fixed linting and docs

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

.dockerignore

@@ -9,9 +9,10 @@ backend/filebrowser.sqlite*
 backend/tmp
 backend/dist
 backend/backend*
-backend/internal/web/dist/**
 backend/vendor/**
+backend/internal/web/dist/*
+!backend/internal/web/dist/.gitkeep
+
 
-frontend/dist/**
 frontend/node_modules/**
 frontend/pkg/**

.editorconfig

@@ -0,0 +1,15 @@
+root = true
+
+[*]
+charset = utf-8
+indent_size = 2
+indent_style = space
+insert_final_newline = true
+trim_trailing_whitespace = true
+end_of_line = lf
+
+[*.go]
+indent_size = 4
+
+[{Makefile,makefile}]
+indent_style = tab

.github/scripts/docker-release-tags.sh

@@ -0,0 +1,90 @@
+#!/usr/bin/env bash
+# Builds the comma-separated Docker tag list for a release image.
+#
+# Usage: docker-release-tags.sh <metadata.json> <variant> <update_track> <update_major>
+#   metadata.json  JSON output of docker/metadata-action (uses .tags)
+#   variant        default | slim | media
+#                  default and media: floating tags include latest
+#                  slim: every tag gets a -slim suffix and latest is not added
+#   update_track   true when the semver policy allows floating beta/stable/latest tags
+#   update_major   true when the semver policy allows major-only version tags
+#
+# Image repositories are fixed per variant so that each image only gets its own tags.
+set -euo pipefail
+
+if [[ $# -ne 4 ]]; then
+  echo "usage: $0 <metadata.json> <default|slim|media> <true|false> <true|false>" >&2
+  exit 2
+fi
+
+metadata_file=$1
+variant=$2
+update_track=$3
+update_major=$4
+
+case "$variant" in
+default)
+  suffix=""
+  add_latest=true
+  repos=(gtstef/filebrowser ghcr.io/gtsteffaniak/filebrowser)
+  ;;
+slim)
+  suffix="-slim"
+  add_latest=false
+  repos=(gtstef/filebrowser ghcr.io/gtsteffaniak/filebrowser)
+  ;;
+media)
+  suffix=""
+  add_latest=true
+  repos=(gtstef/filebrowser-media ghcr.io/gtsteffaniak/filebrowser-media)
+  ;;
+*)
+  echo "unknown variant: $variant" >&2
+  exit 2
+  ;;
+esac
+
+jq -r \
+  --arg suffix "$suffix" \
+  --argjson addLatest "$add_latest" \
+  --argjson updateTrack "$update_track" \
+  --argjson updateMajor "$update_major" \
+  --arg dh "${repos[0]}" \
+  --arg gh "${repos[1]}" '
+  # Strip the v prefix, drop metadata latest, and append the variant suffix.
+  .tags |= map(
+    sub(":v"; ":")
+    | select(test(":latest") | not)
+    | . + $suffix
+  ) |
+  # Version tags with a prerelease suffix (X.Y.Z-suffix) get major.minor, and major when allowed.
+  .tags += [
+    .tags[]
+    | select(test(":[0-9]+\\.[0-9]+\\.[0-9]+-"))
+    | split(":")
+    | .[-1] as $version
+    | ($version | split("-")) as $version_split
+    | ($version_split[0] | split(".")) as $version_parts
+    | ($version_split[1:] | join("-")) as $tag_suffix
+    | ($version_parts | "\(.[0]).\(.[1])") as $major_minor
+    | ($version_parts[0]) as $major
+    | "\($dh):\($major_minor)-\($tag_suffix)",
+      "\($gh):\($major_minor)-\($tag_suffix)",
+      if $updateMajor then
+        "\($dh):\($major)-\($tag_suffix)",
+        "\($gh):\($major)-\($tag_suffix)"
+      else empty end
+  ] |
+  # Floating beta tag.
+  if $updateTrack and any(.tags[]; split(":")[-1] | endswith("-beta" + $suffix)) then
+    .tags += ["\($dh):beta\($suffix)", "\($gh):beta\($suffix)"]
+  else . end |
+  # Floating stable tag, plus latest for variants that have it.
+  if $updateTrack and any(.tags[]; split(":")[-1] | endswith("-stable" + $suffix)) then
+    .tags += (
+      ["\($dh):stable\($suffix)", "\($gh):stable\($suffix)"]
+      + (if $addLatest then ["\($dh):latest", "\($gh):latest"] else [] end)
+    )
+  else . end |
+  .tags | join(",")
+' "$metadata_file"

.github/workflows/main.yaml

@@ -23,7 +23,7 @@ jobs:
         with:
           node-version-file: frontend/.nvmrc
       - working-directory: frontend
-        run: npm i && npm run build
+        run: npm ci && npm run build
       - uses: actions/setup-go@v5
         with:
           go-version: 'stable'

.github/workflows/pr.yaml

@@ -37,12 +37,12 @@ jobs:
           node-version-file: frontend/.nvmrc
       - name: Build frontend
         working-directory: frontend
-        run: npm i && npm run build
+        run: npm ci && npm run build
       - name: Upload frontend build artifact
         uses: actions/upload-artifact@v4
         with:
           name: dist
-          path: backend/internal/web/dist
+          path: frontend/dist
   build_backend:
     name: Build backend
     runs-on: ubuntu-24.04-arm
@@ -105,10 +105,6 @@ jobs:
           path: backend/
       - name: Make backend executable
         run: chmod +x backend/filebrowser
-      - name: Copy frontend build to backend
-        run: |
-          mkdir -p backend/internal/web/embed
-          cp -r frontend/dist/* backend/internal/web/embed
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3.0.0
       - name: Set up Docker Buildx
@@ -166,3 +162,30 @@ jobs:
             REVISION=${{ steps.meta.outputs.revision }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
+
+  build_media_docker_image:
+    name: Build media docker image
+    runs-on: ubuntu-24.04-arm
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3.0.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3.0.0
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v5
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./_docker/Dockerfile.media
+          push: false # Do not push the image for now
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          build-args: |
+            VERSION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.version'] }}
+            REVISION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }}
+          cache-from: type=gha,scope=pr-media
+          cache-to: type=gha,mode=max,scope=pr-media

.github/workflows/regular-tests.yaml

@@ -8,6 +8,7 @@ on:
 jobs:
   test-backend:
     runs-on: ubuntu-24.04-arm
+    timeout-minutes: 5
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
@@ -17,6 +18,7 @@ jobs:
         run: go test -race -v ./... -timeout 30s
   lint-backend:
     runs-on: ubuntu-24.04-arm
+    timeout-minutes: 5
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
@@ -28,6 +30,7 @@ jobs:
           cd backend && "$GOLANGCI_LINT" run --path-prefix=backend
   format-backend:
     runs-on: ubuntu-24.04-arm
+    timeout-minutes: 5
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
@@ -37,33 +40,47 @@ jobs:
         run: go fmt ./...
   lint-frontend:
     runs-on: ubuntu-24.04-arm
+    timeout-minutes: 5
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
           node-version-file: frontend/.nvmrc
       - working-directory: frontend
-        run: npm i && npm run lint
+        run: npm ci && npm run lint
   test-frontend:
     runs-on: ubuntu-24.04-arm
+    timeout-minutes: 5
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
           node-version-file: frontend/.nvmrc
       - working-directory: frontend
-        run: npm i && npm run test
+        run: npm ci && npm run test
+  typecheck-frontend:
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: frontend/.nvmrc
+      - working-directory: frontend
+        run: npm ci && npm run typecheck
   check-translations:
     runs-on: ubuntu-24.04-arm
+    timeout-minutes: 5
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
           node-version-file: frontend/.nvmrc
       - working-directory: frontend
-        run: npm i && npm run i18n:check
+        run: npm ci && npm run i18n:check
   check-docs:
     runs-on: ubuntu-24.04-arm
+    timeout-minutes: 5
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
@@ -73,10 +90,11 @@ jobs:
       - run: git diff --exit-code
   check-icons:
     runs-on: ubuntu-24.04-arm
+    timeout-minutes: 5
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
           node-version-file: frontend/.nvmrc
       - working-directory: frontend
-        run: npm i && npm run icons:check
+        run: npm ci && npm run icons:check

.github/workflows/tag.yaml

@@ -15,16 +15,20 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: backend/go.mod
+          cache-dependency-path: backend/go.sum
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
           node-version-file: frontend/.nvmrc
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
       - name: Install dependencies and build frontend
-        run: npm i && npm run build
+        run: npm ci && npm run build
         working-directory: frontend
-      - name: Install OS Requirements
-        run: sudo apt update && sudo apt install -y upx build-essential musl-tools
-      - uses: goto-bus-stop/setup-zig@v2
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v6
         with:
@@ -68,50 +72,8 @@ jobs:
         id: modify-json
         run: |
           JSON='${{ steps.meta.outputs.json }}'
-          MODIFIED_JSON=$(echo "$JSON" | jq \
-            --argjson updateTrack '${{ steps.floating.outputs.update_track == 'true' }}' \
-            --argjson updateMajor '${{ steps.floating.outputs.update_major == 'true' }}' '
-            .tags |= map(
-              sub(":v"; ":")      # Strip the 'v'
-              | select(test(":latest") | not)
-            ) |
-            # Find all version tags with suffix (X.Y.Z-suffix) and add major.minor (always) and major tags (when allowed)
-            .tags += [
-              .tags[]
-              | select(test(":[0-9]+\\.[0-9]+\\.[0-9]+-"))
-              | split(":")
-              | .[-1] as $version
-              | ($version | split("-")) as $version_split
-              | ($version_split[0] | split(".")) as $version_parts
-              | ($version_split[1:] | join("-")) as $suffix
-              | ($version_parts | "\(.[0]).\(.[1])") as $major_minor
-              | ($version_parts[0]) as $major
-              | "gtstef/filebrowser:\($major_minor)-\($suffix)",
-                "ghcr.io/gtsteffaniak/filebrowser:\($major_minor)-\($suffix)",
-                if $updateMajor then
-                  "gtstef/filebrowser:\($major)-\($suffix)",
-                  "ghcr.io/gtsteffaniak/filebrowser:\($major)-\($suffix)"
-                else empty end
-            ] |
-            # Add suffix-only tags for beta when semver policy allows
-            if $updateTrack and any(.tags[]; split(":")[-1] | endswith("-beta")) then
-              .tags += [
-                "gtstef/filebrowser:beta",
-                "ghcr.io/gtsteffaniak/filebrowser:beta"
-              ]
-            else . end |
-            # Add suffix-only tags for stable (and latest) when semver policy allows
-            if $updateTrack and any(.tags[]; split(":")[-1] | endswith("-stable")) then
-              .tags += [
-                "gtstef/filebrowser:stable",
-                "ghcr.io/gtsteffaniak/filebrowser:stable",
-                "gtstef/filebrowser:latest",
-                "ghcr.io/gtsteffaniak/filebrowser:latest"
-              ]
-            else . end
-          ')
-          TAGS_CSV=$(echo "$MODIFIED_JSON" | jq -r '.tags | join(",")')
-          echo "$TAGS_CSV" > modified_tags.txt  # Optional debug output
+          printf '%s' "$JSON" > metadata.json
+          TAGS_CSV=$(bash .github/scripts/docker-release-tags.sh metadata.json default '${{ steps.floating.outputs.update_track }}' '${{ steps.floating.outputs.update_major }}')
           echo "cleaned_tag=$TAGS_CSV" >> $GITHUB_OUTPUT
       - name: Build and push
         uses: docker/build-push-action@v6
@@ -125,6 +87,62 @@ jobs:
           push: true
           tags: ${{ steps.modify-json.outputs.cleaned_tag }}
           labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha,scope=release-main
+          cache-to: type=gha,mode=max,scope=release-main
+  push_media_release_to_registry:
+    name: Push media release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3.0.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3.0.0
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{github.actor}}
+          password: ${{ secrets.PAT }}
+      - name: Extract metadata (tags, labels) for Docker and GHCR
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            gtstef/filebrowser-media
+            ghcr.io/gtsteffaniak/filebrowser-media
+      - name: Decide floating Docker tags
+        id: floating
+        env:
+          IMAGE_REPO: gtstef/filebrowser-media
+        run: bash .github/scripts/docker-floating-tag-policy.sh
+      - name: Modify tags (strip 'v' and add version tags)
+        id: modify-json
+        run: |
+          JSON='${{ steps.meta.outputs.json }}'
+          printf '%s' "$JSON" > metadata.json
+          TAGS_CSV=$(bash .github/scripts/docker-release-tags.sh metadata.json media '${{ steps.floating.outputs.update_track }}' '${{ steps.floating.outputs.update_major }}')
+          echo "cleaned_tag=$TAGS_CSV" >> $GITHUB_OUTPUT
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          build-args: |
+            VERSION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.version'] }}
+            REVISION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }}
+          platforms: linux/amd64,linux/arm64
+          file: ./_docker/Dockerfile.media
+          push: true
+          tags: ${{ steps.modify-json.outputs.cleaned_tag }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha,scope=release-media
+          cache-to: type=gha,mode=max,scope=release-media
   push_slim_release_to_registry:
     name: Push slim release
     runs-on: ubuntu-latest
@@ -162,48 +180,8 @@ jobs:
         id: modify-json-slim
         run: |
           JSON='${{ steps.meta.outputs.json }}'
-          MODIFIED_JSON=$(echo "$JSON" | jq \
-            --argjson updateTrack '${{ steps.floating.outputs.update_track == 'true' }}' \
-            --argjson updateMajor '${{ steps.floating.outputs.update_major == 'true' }}' '
-            .tags |= map(
-              sub(":v"; ":")                 # Strip the 'v'
-              | select(test(":latest") | not) # Remove the "latest" tag
-              | . + "-slim"                   # Append "-slim" to the versioned tag
-            ) |
-            # Find all version tags with suffix (X.Y.Z-suffix-slim) and add major.minor (always) and major tags (when allowed)
-            .tags += [
-              .tags[]
-              | select(test(":[0-9]+\\.[0-9]+\\.[0-9]+-"))
-              | split(":")
-              | .[-1] as $version
-              | ($version | split("-")) as $version_split
-              | ($version_split[0] | split(".")) as $version_parts
-              | ($version_split[1:] | join("-")) as $suffix
-              | ($version_parts | "\(.[0]).\(.[1])") as $major_minor
-              | ($version_parts[0]) as $major
-              | "gtstef/filebrowser:\($major_minor)-\($suffix)",
-                "ghcr.io/gtsteffaniak/filebrowser:\($major_minor)-\($suffix)",
-                if $updateMajor then
-                  "gtstef/filebrowser:\($major)-\($suffix)",
-                  "ghcr.io/gtsteffaniak/filebrowser:\($major)-\($suffix)"
-                else empty end
-            ] |
-            # Add suffix-only tags for beta-slim when semver policy allows
-            if $updateTrack and any(.tags[]; split(":")[-1] | endswith("-beta-slim")) then
-              .tags += [
-                "gtstef/filebrowser:beta-slim",
-                "ghcr.io/gtsteffaniak/filebrowser:beta-slim"
-              ]
-            else . end |
-            # Add suffix-only tags for stable-slim when semver policy allows
-            if $updateTrack and any(.tags[]; split(":")[-1] | endswith("-stable-slim")) then
-              .tags += [
-                "gtstef/filebrowser:stable-slim",
-                "ghcr.io/gtsteffaniak/filebrowser:stable-slim"
-              ]
-            else . end
-          ')
-          TAGS_CSV=$(echo "$MODIFIED_JSON" | jq -r '.tags | join(",")')
+          printf '%s' "$JSON" > metadata.json
+          TAGS_CSV=$(bash .github/scripts/docker-release-tags.sh metadata.json slim '${{ steps.floating.outputs.update_track }}' '${{ steps.floating.outputs.update_major }}')
           echo "cleaned_tag=$TAGS_CSV" >> $GITHUB_OUTPUT
       - name: Build and push slim image
         uses: docker/build-push-action@v6
@@ -217,3 +195,5 @@ jobs:
           push: true
           tags: ${{ steps.modify-json-slim.outputs.cleaned_tag }}
           labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha,scope=release-slim
+          cache-to: type=gha,mode=max,scope=release-slim

.gitignore

@@ -43,9 +43,10 @@ frontend/.tmp-icons-*
 /backend/*test_config.yaml
 /backend/generated.yaml
 /backend/srv
-/backend/internal/web/dist
-/backend/internal/web/embed
+/backend/internal/web/dist/*
+!/backend/internal/web/dist/.gitkeep
 /backend/debug
+/backend/http
 
 .DS_Store
 node_modules

CHANGELOG.md

@@ -2,122 +2,237 @@
 
 All notable changes to this project will be documented in this file. For commit guidelines, please refer to [Standard Version](https://github.com/conventional-changelog/standard-version).
 
-## v2.0.0-stable
-
-This version represents the most significant change to date. It **requires** both a database migration and config structural changes. See the [migration guide](https://filebrowserquantum.com/en/docs/getting-started/v2/migration/) for step-by-step upgrade instructions, [About v2.0.0](https://filebrowserquantum.com/en/docs/getting-started/v2/about/) for a full summary.
-
-Also, consider enabling "analytics" in admin settings which will help me populate an anonymous public dashboard for everyone to see. Currently, theres 60 deployments details populated from beta, so after a percentage of you enable this in staging there should be plenty to make the dashboard useful and available. No private information is used, you can see exactly what data is sent in the UI.
-
- **Breaking Changes**:
- - Removed: `GET /api/raw` and `GET /public/api/raw` download routes — use `/api/resources/download` instead.
- - Removed: `/share/…` URL redirect to `/public/share/…` — use `/public/share/…` directly.
- - Removed: singular `source` search api param (use `sources`), bare `scope` paths without `sourceName:` prefix, and `glob` / `useGlob` aliases (use `useWildcard`).
- - Removed `config.conditionals`, source-level `indexingIntervalMinutes` (indexing always uses adaptive scheduling), and deprecated rule fields `fileNames` / `folderNames` / top-level `hidden` — use `config.rules` with `fileName`, `folderName`, and `ignoreHidden` on rules. See [Exclusion rules](https://filebrowserquantum.com/en/docs/user-guides/general-configuration/exclusion-rules/).
- - Removed: deprecated `userDefaults` config formats (nested and flat) — use the [config migration tool](https://filebrowserquantum.com/en/docs/getting-started/v2/config-migration/) to convert before upgrading.
- - Changed: `PUT /api/users` moved to the more appropriate `PATCH` method and requires specifying `which` in the body. Blank or `all` values are rejected.
- - Changed: http related config options in `server` config key moved to `http` config key. See [HTTP settings](https://filebrowserquantum.com/en/docs/configuration/http/).
- - Changed (reverse proxy): `http.trustedHeaders` (v1.5.x list) removed — use `http.trustProxyHeaders: true` when behind nginx, Traefik, or Caddy. When enabled, FileBrowser honors `X-Forwarded-Host`, `X-Forwarded-Proto`, `X-Forwarded-For`, and `X-Real-IP` for client IP, cookies, OIDC callbacks, WebAuthn, share URLs, rate limiting, and activity logs. Default is `false` (direct connection values). The [config migration tool](https://filebrowserquantum.com/en/docs/getting-started/v2/config-migration/) converts v1 `trustedHeaders` lists to `trustProxyHeaders: true`. See [Reverse proxy](https://filebrowserquantum.com/en/docs/getting-started/reverse-proxy/) and [HTTP trustProxyHeaders](https://filebrowserquantum.com/en/docs/configuration/http/#trustproxyheaders).
- - Changed: `FILEBROWSER_DATABASE` environment variable — use `FILEBROWSER_DATABASE_PATH` instead. See [Environment variables](https://filebrowserquantum.com/en/docs/reference/environment-variables/) and [Server settings](https://filebrowserquantum.com/en/docs/configuration/server/).
- - Changed: Moved stream api to `/api/media/stream`. See [API reference](https://filebrowserquantum.com/en/docs/reference/api/).
- - Changed: CLI user management — canonical commands are `user set <username> --password [value]` and `user promote <username>`; `set -u username,password` is deprecated. See [CLI reference](https://filebrowserquantum.com/en/docs/reference/cli/).
-
- **Security**:
-- [Critical] A forged JWT could authenticate as any known `belongsTo`. Auth signing keys are now persisted in the application database and JWT validation fails closed when no key is configured. (GHSA-8f9r-wg7w-pfw) (#2987) Thanks @d3do-23 and @whoamis3c.
-- [High] Restricted custom API tokens can no longer be upgraded to a full-permission session via `POST /api/auth/renew` (GHSA-6gr6-5qpq-888p) -- thanks @tao0845.
-- [High] TOTP re-enrollment no longer allows anonymous callers to replace an existing second factor using only the account password; requires an authenticated self or admin session (GHSA-qx86-4v5r-26g5) -- thanks @tao0845.
-- [Medium] Public upload shares with `allowReplacements=false` now reject overwrites when clients send `override=true`. (GHSA-3846-gh75-gp3m) Thanks @d3do-23
-- [Medium] OnlyOffice callbacks verify the shared `integrations.office.secret` JWT and require the document key to match the cached editor session; document downloads re-validate redirect targets against the configured document-server host (SSRF); public shares with `enableOnlyOffice=false` reject `/office/*` requests server-side.
-- [Low] Public share lyrics and subtitle routes honor the share's file-viewer setting, download disable flag, and download limits (GHSA-p7x3-p5jj-9xfh) -- thanks Yves Soete of Blacksight LLC. @yssoe
-- Fresh installs with default `admin`/`admin` generate a random initial password and log it once (#2977).
-- OIDC login binds OAuth `state` to an HttpOnly cookie and rejects tampered callbacks; login/logout/session-expiry redirects reject open-redirect targets, and signup sends credentials in a JSON body instead of query parameters.
-- Startup fails when the configured auth signing key differs from the persisted one; session/API token registrations record JWT expiry and expired mappings are pruned.
+## v2.2.0
 
  **New Features**:
- - View grant mechanism to distinguish between UI viewing and download. See [Access control overview](https://filebrowserquantum.com/en/docs/access-control/access-control-overview/).
- - granular per-source file permissions (view, download, modify, create, delete) with automatic migration from global permissions
-   - per-source defaults configurable in `settings > access management`
-   - `view` permission is automatically set to true unless explicitly set to false. See [Access control overview](https://filebrowserquantum.com/en/docs/access-control/access-control-overview/).
-   - can be enforced for all users. See [Access control overview](https://filebrowserquantum.com/en/docs/access-control/access-control-overview/).
- - New activity logs for user activity.
-   - charts and historical data
-   - export to csv reports
- - Media player improvements:
-   - Refreshed playback queue UI: Supports thumbnails, stored into session storage, and has a "clear queue" button (#2575) (#2600).
-   - Loop now has 3 states (off/single/all) and neither of them will clear the existing queue (#2600).
-   - New "Audio visualizer" for audio files (desktop-only), you can configure some basic things to your taste (#2575) (#2620).
-   - The current state of the audio panel now is stored into local storage.
-   - More gestures: Swipe up to enter/exit fullscreen, long-press to change playback speed, single tap to pause (#2575).
-   - Videos now will resume fullscreen and PiP when navigating (queue auto-navigation, swipes gestures or next/previous) (#2649).
- - Added `F4` shortcut to refresh the current directory and metadata (#2600).
- - opt-in feature to send deployment analytics to filebrowser quantum developer servers
-   - anonymized with a viewer so users can see what info would be sent.
-   - if opt-in, every month a snapshot of your deployment config would be sent to developer servers
-   - this will help me know what features are being used and what versions everyone is on over time. I will also provide a public dashboard with this information in the future. 
- - WebDAV now supports set modification time via the `X-OC-Mtime` header for clients that support it (#2626). See [WebDAV docs](https://filebrowserquantum.com/en/docs/features/webdav/).
- - Copy operations now preserve their original modification times (#2642) (#2647):
-   - WebUI preserves both, files and directories.
-   - WebDAV `COPY` preserves modification times only for files, is limitation we have with webdav.
- - User default enhancements
-   - Config `userDefaults` seeds SQLite on first run; only fields explicitly set in config stay locked in **Settings → User defaults** (other defaults remain editable)
-   - Added administrator controls for universal user defaults and enforced preferences in `settings > user management > user defaults`.
-   - Added configurable default file permissions per source in `settings > access management`.
-   - Added a User Defaults editor for account, permission, and profile preferences in the edit/create user prompt. See [User management](https://filebrowserquantum.com/en/docs/configuration/users/).
- - Database env var rename: `FILEBROWSER_DATABASE` is removed (startup fails if set). Use `FILEBROWSER_DATABASE_PATH` (default `filebrowser.sqlite`) or `server.database.path` in config. See [Environment variables](https://filebrowserquantum.com/en/docs/reference/environment-variables/) and [Server settings](https://filebrowserquantum.com/en/docs/configuration/server/).
- - CLI: `user set` with `--password` (inline value, interactive prompt on TTY, or piped stdin); `user promote` for admin grant without password reset. See [CLI reference](https://filebrowserquantum.com/en/docs/reference/cli/).
-- Require password change at next login for password-based users: new user setting `requirePasswordChange` (user defaults + per-user admin toggle). Bootstrap admins with a generated initial password get this automatically ([#2977](https://github.com/gtsteffaniak/filebrowser/issues/2977)). Generated bootstrap passwords use a speakable `word-xxxxx-xx` form.
-- PWA improvements for installed mobile apps: dedicated maskable icons (192/512), manifest and splash colors that follow the instance default theme, runtime `theme-color` sync on dark-mode toggle, and edge-to-edge safe-area layout for notched devices (#2625) (#2869) -- thanks @APatenaude
-- Users can set default view mode and thumbnail size from Profile settings (Listing options). Admins can set the same defaults for existing users and edit all profile preference defaults from the user management panel ([#2884](https://github.com/gtsteffaniak/filebrowser/issues/2884)).
-- Added "Upload only what's missing" to the upload conflict prompt (#2985) (#2553)
-- Added `init` CLI command, which creates a minimal commented config.yaml instead of a full config (#2957)
-- Config YAML expands `$VAR` and `${VAR}` so values such as `userPassword: "${FILEBROWSER_LDAP_USER_PASSWORD}"` work (#3042).
-- Sidebar source links can switch between aggregated usage (default) and a root-filesystem-only view via a new "Limit disk usage to source filesystem" toggle.
+  - Core web assets are loaded into memory instead of served from disk.
+  - Media enhancements
+    - All server media settings can be managed in settings by admins.
+    - JXL image preview support (#3334) (#2551)
+    - Transcoding for media playback with quality presets -- requires ffmpeg.
+    - Hardware Acceleration device selector (Software / detected GPU devices)
+    - More operations use native api operations rather than ffmpeg, improving performance in many cases. Added temporary config option to force ffmpeg to be used
+  - Document enhancements
+    - Official Collabora support using WOPI config.
+    - Document previews use a pure-go in-process package (all versions get it now).
+    - Added **Always use office for document previews** option to force OnlyOffice/Collabora.
+    - Office previews can use embedded thumbnail if possible.
+    - Text file previews are more efficient direct creation.
+    - New text preview API (`/api/resources/preview/text`) returns a 16KB text preview for text, Markdown, HTML, CSS, code and RTF files. Markdown and HTML render in the listing as sanitized previews. Previews are not cached on disk. SVG files are served directly as images.
+    - Text previews only render inline on tiles at least 60px wide, so narrower tiles (list, compact, normal) show the file-type icon with a `saved_search` badge instead when popup previews are enabled, and hovering still opens the larger popup preview. Text preview reads are bounded by the preview service's shared image-processor semaphore (`server.numImageProcessors`), and rendered preview HTML is cached in the browser so scrolling and hovering do not re-parse it.
+    - Embedded previews for Krita (`.kra`, [#2431](https://github.com/gtsteffaniak/filebrowser/issues/2431)), OpenRaster (`.ora`), Sketch (`.sketch`), MuseScore (`.mscz`), CBZ (first page), XPS (embedded thumbnail, when present), ODF (`.odt`, `.ods`, `.odp`, `.odg`), and Office Open XML (`.docx`, `.xlsx`, `.pptx`) thumbnails.
+  - Virtual scrolling for large lists: like the main listing, advanced search, file tree, etc. Only render the rows on screen, so very large folders stay responsive, resolving some performance issues (#2879) (#1773) (#3320) (#3326).
+  - Search and navigation improvements:
+    - Next/previous in a preview follows the results of quick search and advanced search, playback queue also uses if there's media (#3275).
+    - Closing a preview opened from quick or advanced search returns to the results and scrolls to the item like the normal listing (#3275).
+    - Advanced search now has almost all the features of the normal listing, including rectangle selection, keyboard navigation, etc (#3299).
+    - Quick search results use natural ordering.
+    - Listings now are cached (with a cap) allowing a more responsive navigation between folders (#3193).
+  - Upload and download prompts list is reversed (#2998) (#3328).
+  - Replaced `indented soft wrap` editor setting by a dropdown with more wrap settings (#3183) (#3282).
 
  **Notes**:
- - v2.x.x uses a new write-through backend state management. Changes go through a fast memory layer and also write changes to database to stay in sync. See [About v2.0.0](https://filebrowserquantum.com/en/docs/getting-started/v2/about/).
- - CLI server start (`./filebrowser`), `setup`, `version`, and `set rule` syntax unchanged; see [CLI docs](https://filebrowserquantum.com/en/docs/reference/cli/)
- - new dropdown and input styles
- - swipe gestures to dismiss notifications (#2672)
- - user updates are more granular, don't include entire user payload.
- - `user.id` has been moved to a backend property and all frontend apis now query users by username. Swagger has been updated. See [API reference](https://filebrowserquantum.com/en/docs/reference/api/).
- - removed legacy and deprecated properties from API responses and generated config output
- - `/api/media/stream` is audio/video only (range-based chunking). Non-media inline viewing uses `GET /api/resources/view`. Both endpoints use the same `viewToken` from file metadata. See [API reference](https://filebrowserquantum.com/en/docs/reference/api/).
- - removed exiftool as an optional helper, always built with the supported libraries (requires 64 bit os)
- - If migration issues arise, see [Migration troubleshooting](https://filebrowserquantum.com/en/docs/getting-started/migration/troubleshooting/).
- - default browser media player option removed, always uses themed plyr
- - [docker] upgraded ffmpeg from 8.1.2 to 9.0
-- Sidebar navigation tree rows are real hyperlinks: middle-click, Ctrl/Cmd+click, and Shift+click use the browser's default new-tab or new-window behavior.
-- Pop-up preview has a 200ms debounce delay so it doesn't flash when moving the cursor across files quickly.
-- Improved UI responsiveness for larger directories and Firefox, with marginal memory improvement (#1773) (#2879)
-- Improvements to document thumbnail generation performance.
-- Changed behavior for typing to select files in listing view; added more actions in advanced search (#2776).
-- Session renew is handled by client keep-alive; per-request `X-Renew-Token` header handling removed.
-- `defaultEnabled` now means the source is always added to users on startup and login.
-- Webdav always shows hidden files, ignores the user preference. (#3004)
-- Share download links no longer embed a token; they link to the UI, which prompts for the password before download. For direct downloads use the documented `/api/share/direct` API. (#2888)
-- Sidebar links follow source changes: renaming a source updates links, disabling/deleting a user source removes them (#2878) (#2942), and adding a source via scopes auto-adds a link.
-- `/api/resources/download` and `/public/api/resources/download` return HTTP 404 for missing files/directories instead of 500 (#2981); `GET /api/resources` returns 400 when `path` is missing or empty (#2801).
-- Added risc-v to official releases.
-- A CLI password reset returns the user to a password-method user.
+ - **Document preview formats:** New in-process support includes **`.azw3`**, **`.chm`**, **`.htm`**, and **`.html`**. However, `.doc` continues to require the office integration for thumbnails. **`.xps`** and **`.cbz`** previews come from embedded images. With **Always use office for document previews** enabled, office files still use the office converter
+ - UPX compression is removed from release builds.
+ - A `filebrowser-media` image is published alongside the main and slim images.
+ - Previews (thumbnails, popup, and text previews) are no longer requested for sources the user does not have view access to.
 
- **Bugfixes**:
-- Long uploads/downloads no longer lose the session mid-transfer; session keep-alive renews before expiry and auto-logout is disabled during active transfers (#2638).
-- GroupMap changes are written through to SQL so JWT/OIDC/LDAP group memberships survive restart (#2742).
-- OIDC: `groupsClaim` is always requested and falls back to UserInfo; the verified ID-token identifier is preserved on fallback; sessions respect `tokenExpirationHours` (#3006).
-- LDAP `userGroups` matching accepts CN-only values against full `memberOf` DNs and is case-insensitive (#3044).
-- Sidebar folder links with custom names/icons/styles persist across restarts, and deleted links stay deleted (#2809) (#2935).
-- Fixed PDF thumbnail process aborts (#2763), PDF preview blocking uploads (#2752), and 401 on the PDF download button (#2978).
-- Fixed ffmpeg unresponsive lock issue (#2996).
-- Fixed multiple embedded subtitles with the same language (#2756).
-- Fixed Fuji `.raf` thumbnail preview; unsupported image preview formats return HTTP 415 instead of 500.
-- Members without download permission could not open text-based files with OnlyOffice enabled (#2777).
-- Fixed iOS 26 / WebKit multi-chunk upload stall by isolating chunk connections (#2734).
-- Mobile/UI fixes: upload options cut off (#2685), uploaded image cut off (#2765), next/previous buttons hiding on photos (#2767), missing gallery download button (#2767), double-tap to zoom, html viewer height, tooltips on mobile, assorted styling inconsistencies (#2908).
-- Public share folder and multi-file ZIP downloads were empty for anonymous visitors on sources with deny-by-default/path rules (#2631) (#2365).
-- Preserve Ctrl-click selection with stale keyboard state (#2958) (#2923); avoid false stalls in parallel transfers (#2950) (#2948) thanks @gudcks0305; hide Replace on conflict prompts when the user lacks modify permission (#2837).
-- Disk usage: fixed overstatement on virtiofs/Docker Desktop (#2894), inflated usage across ZFS datasets/btrfs subvolumes (#3025) (#2997), capped usage bars at 100% and summed nested mounts on Linux (#2761) (#2238).
-- Support non-ASCII share passwords (#2933); fall back to buffered copies when FUSE rejects fast paths (#2938) (#2924); tilde (`~`) source paths expand properly.
-- Fixed slow/broken file listing when `http.baseURL` is a subpath.
-- SQLite: removed shared cache and set `busy_timeout` on every pooled connection; busy errors no longer reported as success or empty cache results.
+ **Bug Fixes**:
+ - Closing a video preview from the header bar now stops playback immediately instead of leaving audio running in the background.
+ - Closing a preview no longer navigates back to the same file when a stale "previous item" was remembered from an earlier navigation.
+ - Transcoding recovers from unreliable hardware decoding without discarding the segments already produced: the retry resumes at the encode head with software decode instead of wiping the generation and re-encoding from the start.
+ - The player no longer aborts a segment request after 10 seconds while the transcode producer is repositioning or restarting, which previously surfaced as a 503 and a skipped segment.
+ - getDirectoryPreview no longer requests metadata, so folder previews skip the per-file probe and subtitle scan.
+ - Media probes are cached by file identity and concurrent reads are coalesced, so opening a file no longer triggers repeated ffprobe runs.
+ - Client-initiated stream cancels (seek/navigation) no longer log spurious write-error responses.
+ - Gzipped `.woff` font files are no longer generated without being served; only `.js` and `.woff2` are precompressed.
+ - Text preview tiles no longer show the bottom truncation fade; truncated content is clipped at the tile edge instead.
+ - Text preview tiles lay out at a minimum width and are clipped, instead of wrapping aggressively on narrow tiles.
+ - Queued text preview requests are canceled when their tiles unmount, so scrolling through a folder of text files and then opening another folder no longer delays the new folder's previews.
+ - Removed the stale, unreferenced `backend/internal/web/embed/` build output that was accidentally re-added; the frontend is embedded from `backend/internal/web/dist/` as before.
+ - Advanced search no longer loses the previously selected sorting (#3275)
+ - Context menu in iOS don't opening in Advanced Search (#2776) (#3299)
+ - Improved mobile layout of inputs in search filters.
+ - Doing actions in the main list/adv search, like move, copy, delete, or create a new file no longer reloads the entire listing, now updates in place and doesn't lost the position you were browsing at (#3193).
+ - Uploading lot of files freezing the UI for a few seconds (#3321).
+ - Directory uploads are prioritized, and files wait until their parent is ready (#3221).
+
+## v2.1.4
+
+ **Security**:
+ - [Low] `GET /api/settings` and `GET /api/settings?property=auth` no longer return cleartext secrets (`auth.key`, `totpSecret`, `adminPassword`, OIDC `clientSecret`, LDAP bind password, recaptcha secret, OnlyOffice secret); secret fields are replaced with `**hidden**` in the response, and the YAML export now redacts the recaptcha and LDAP secrets whose comments lacked the `secret:` marker (GHSA-892f-9h5p-mfc8) reporter @paulmossman
+
+ **New Features**:
+ - feat(search): sidebar File actions and close button in advanced search (#3303) (#2479) (#3303)
+
+ **Bug Fixes**:
+ - Deleting a directory now releases folder quotas rooted inside it instead of leaving them charged for files that no longer exist; applies to API and WebDAV deletes (#3163) (#3235)
+ - Bulk and public share deletes now release accounted quota usage; nested folder quotas reset when an ancestor is removed (#3163) (#3305)
+ - Directory listings skip entries that return permission denied or not-found on per-entry stat instead of failing the whole folder (e.g. unreadable NTFS junctions on CIFS); skipped entries are omitted from the index like `ls -l` (#3184)
+ - Preview generation for webp broken (#3254) (#3259)
+ - Share banner never shows to public visitors, returns bannerUrl but not banner (#3246) (#3250)
+ - fix html/markdown relative file preview support (#3131) (#3129) (#2355)
+ - fix(archive): extract tar hard links instead of dropping them (#3234)
+ - fix(auth): apply stored permission caps for customized API tokens with no global flags enabled (#3255)
+ - Archive extraction writes regular and hard-link entries at the entry path instead of following an existing symlink at that path (tar and zip) (#3265)
+ - fix(move-copy): require choosing a destination source in advanced search when none can be inferred, instead of silently copying to the source root (#3276)
+ - fix(stream): single-file shares can now stream their own media on Windows by using slash-based path handling (#3270) (#3271)
+ - fix(users): `lockPassword` is now enforced on self-service password changes; non-admins get 403 while admin resets still work (#3279) (#3283)
+ - fix(analytics): the FreeBSD release binary now reports `freebsd` in `system.os` instead of `other` (#3244) (#3284)
+ - fix(frontend): share expiration now reads backend Unix-seconds timestamps correctly instead of showing dates decades off (#3247)
+ - fix(frontend): video on iPhone now uses the native fullscreen player instead of the in-page fallback (#3113) (#3288)
+ - fix(frontend): the video loading spinner no longer stays on for the rest of playback when the fetch stalls but the buffer can continue (#3287) (#3289)
+ - fix(frontend): the share banner is now shown to public visitors, using `bannerUrl` instead of the never-set `banner` field (#3246) (#3250)
+ - fix(preview): camera RAW files (Panasonic `.rw2`/`.raw`/`.rwl`, Olympus `.orf`, `.cr2`/`.dng`) extract embedded previews from TIFF strips/SubIFDs and no longer return 415 when EXIF decoding fails (#3219) (#3243)
+ - fix(indexing): restore lazy listing persistence with atomic folder-size deltas and ancestor propagation, and force a full scan for scanners that missed their slot while the process was down (#3260)
+ - fix(indexing): directory listings skip entries that cannot be accessed or have vanished instead of failing the whole listing; remaining errors still fail and fully-vanished nonempty directories return an error (#3292)
+ - fix(frontend): redirects from `/files` stay inside the files area so a source named "Files" no longer leaves an empty view after login (#3167) (#3304)
+
+## v2.1.3
+
+ **Security**:
+ - [Moderate] Passkey registration and deletion now require the account password when a passkey is already configured, and passkeys cannot be altered through generic user profile PATCH (GHSA-r744-4vm3-2px3) reporter @tonghuaroot
+ - [Medium] Storage quota accounting now records upload byte deltas using the pre-replace file size, and upload paths without size metadata or with resumed chunk offsets cannot skip quota checks (GHSA-m57f-66qj-8jxg) reporter @jayhemnani9910
+ - [High] Sources marked `readOnly` are now enforced on WebDAV writes, server-side archive/unarchive, and OnlyOffice save callbacks (GHSA-4v62-884x-2466) reporter @anpryl
+ - [Moderate] Moving or renaming a folder updates only shares whose paths are under the moved prefix, preserving per-file share roots instead of retargeting unrelated substring matches (GHSA-26fh-r34c-qxh6) reporters @jayhemnani9910 @dylanzonix
+ - [Moderate] WebDAV PUT now requires Create permission when the target path does not yet exist, so Modify-only users cannot create new files (GHSA-8655-2ph3-q7q7) reporter @levanduy181
+ - [Low] Failed-login lockout and auth rate limits now use the rightmost `X-Forwarded-For` hop when proxy headers are trusted, so a client cannot spoof the client IP with a leftmost forwarded value (GHSA-wjp8-g49g-xrhx) reporter @LECOQQ
+ - [Low] Duplicate finder results are cached per requesting user so filtered file names from one account are not served to another (GHSA-4fhx-8pf6-5gmr) reporter @Nazarami
+ - [Moderate] Authenticated `GET /api/resources/view` no longer accepts view tokens minted for a public share when the caller lacks view permission on the requested source (GHSA-wxj5-g3qp-g732) reporter @BlueN0r
+ - [Low] SSE source-update and user-targeted delivery hold the client registry lock through nonblocking sends, preventing concurrent map mutation and send-on-closed-channel panics when Realtime clients connect, disconnect, or shut down (GHSA-p9wm-f5jj-75pj) reporter @tao0845
+ - [High] Incomplete symlink-containment remediation: an authenticated non-admin user could create a relative symlink via archive extraction, relocate it with WebDAV MOVE, and write through it to arbitrary host paths with the service account's privileges (GHSA-3j46-5w28-f8p2) reporter @Saku0512
+ - [Moderate] Source-root containment bypass: create, write, delete, and move operations now resolve symlinks uncached and enforce the caller's scope, closing escapes through pre-existing out-of-source symlinks on upload, PUT, PATCH, delete, and WebDAV endpoints (GHSA-j764-qg3m-rhv7) reporter @chaoming0625
+ - [Moderate] Preview reads resolve symlinks within the caller's scope so authenticated preview cannot follow an out-of-scope symlink target (GHSA-g2q5-r6ch-v25f) reporter @tao0845
+ - [Moderate] Archive downloads and extraction no longer read or write through symlinks that resolve outside the caller's share or user scope; escaping archive-walk entries are skipped (GHSA-qqf3-2wvq-q4w9) reporter @SmokinCaterpillar
+ - [Moderate] Share directory-archive downloads now apply the share owner's access rules to every entry, closing a bypass where anonymous share visitors could download admin-denied content (GHSA-9fcr-gm58-p839) reporter @Tan-JunWei
+ - [Moderate] Access rule paths are stored and matched case-insensitively so rules cannot be bypassed via path casing on case-insensitive filesystems; existing rules are migrated at startup (GHSA-4vrc-935w-xxq2) reporter @FrogApprentice
+
+ **New Features**:
+ - chunked uploads for large files like rclone `--owncloud-chunk-size` (#3112)
+
+ **Bug Fixes**:
+ - keep requested permissions when creating a user (#3130)
+ - add missing file modify logging to activity viewer (#3152)
+ - fix(frontend): restore upload prompt close, tab-reload, and in-app navigation guards while uploads are active (including paused uploads)
+ - fix(frontend): load the default source when browsing `/files/` with a single configured source ([#3178](https://github.com/gtsteffaniak/filebrowser/issues/3178)) (related: [#3143](https://github.com/gtsteffaniak/filebrowser/issues/3143), [#3144](https://github.com/gtsteffaniak/filebrowser/issues/3144))
+ - Path picker list and thumbnails not working in shares in the markdown editor (#3223).
+ - perf(indexing): single statx per Linux directory entry (#1890)
+
+## v2.1.2
+
+ **Security**:
+ - [High] New accounts named with ".." breaks out of scoped folder on creation (GHSA-c84q-q5g6-r47f) -- reporter @dylanzonix
+ - [Medium] Fixed session token collision issue when multiple users login simultaneously. (GHSA-c9cr-w724-gqj3) (#3135) Thanks @dl-pt reporters: @Ishtiaque-Ahmed-Risat @AlexWhiplash @tonghuaroot
+
+ **Notes**:
+ - Removed "Editor quick save" setting (`userDefaults.fileViewer.quickSave`), the save button is now always present in the editor toolbar. (#3122)
+ - add Basque (eu) translation and fix Spanish (es) strings (#3118)
+
+ **Bug Fixes**:
+ - fix(webdav): OPTIONS now advertises only methods actually supported and permitted for the user; the DAV header reports class 1 only since LOCK/UNLOCK are not enabled (#3110)
+ - fix(download): revalidate single-file downloads so a changed file is not served stale (#3133)
+ - Language switcher not working (#3114) (#3117)
+ - Viewer showing a stale image after the file changed on disk: single-file downloads are now revalidated by the browser (#3132)
+
+## v2.1.1
+
+Note: this release also contains all changes from v2.0.10-beta changelog
+
+ **New Features**:
+ - User and group picker with partial, case-insensitive search when creating access rules (#3085), assigning groups on user edit, and choosing members on group edit.
+ - New `PUT /api/access/user-groups` endpoint that atomically replaces a user's group memberships.
+ - feat(search): configure the advanced search result limit (#3058) @beemines
+ - feat(listing): add sortable Date added and Type columns (#3052) @dweebzxx
+ - feat(archive): suggest and preview ZIP filename encodings (#3024) @AnaTofuZ
+
+ **Notes**:
+ - Group API breaking changes: `POST /api/access` returns 400 when `ruleCategory=group` names a nonexistent group or `ruleCategory=user` names a nonexistent user, group endpoints return 400/409 instead of 500 for client errors, and `PUT /api/access/group` accepts a `create` flag and returns `unknownMembers`. Existing database records are unaffected; no migration is required.
+ - update halloween theme (#3055)
+ - Add soft wrap option to the editor config (#3063)
+ - add better screenshot view handling (#3059)
+ - Update nl.json (#3089) @Stephan-P
+ - update german translations (#3062) @fehnomenal
+ - Update dev dependencies, add biome, fix types and linting (#3075) @Kurami32
+
+ **Bug Fixes**:
+ - Groups assigned in the user edit prompt now refresh the Groups settings list.
+ - Creating a group with an existing name now returns a conflict instead of silently overwriting its members.
+ - Access rules can no longer create empty groups from typos; group rules must reference an existing group.
+ - Empty group names are rejected and new group names must be 2-128 characters without control characters (existing records are unaffected); deleting or renaming a user now updates group memberships.
+ - fix(auth): use login endpoint for existing TOTP authentication (#3074)
+ - fix: apply theme toggles on anonymous public shares (#3049) @mvanhorn
+ - fix(frontend): keep source named files in extractSourceFromPath (#3099) (#3095)
+ - fix(auth): identify login fields for password autofill (#3077)
+ - fix(backend): skip denied paths in multi-file downloads, 404 when none remain (#3100) @hippi345
+ - fix: persist the user scope path chosen in the edit dialog (#3065) @mvanhorn
+
+## v2.1.0
+
+ **Security**:
+ - [Moderate] Conflicting upload responses no longer synchronously drain the request body before returning HTTP 409; the server now closes the body and marks the connection for closure, preventing denial-of-service from clients that never send EOF (CWE-400).
+ - Share download links no longer create links with token, instead they link to the UI prompting for password before download. If a direct download is required, the `/api/share/direct` api exists and documented by swagger. (#2888)
+
+ **New Features**:
+ - Added Storage Quotas
+   - configurable by folder, source, user, and share.
+   - Administrators can create, edit, view, and delete folder quotas through the interface.
+   - Quota information now appears in source views, share details, sidebar progress bars, and folder prompts.
+ - Enhancements to the editor (#2714):
+   - Added a floating button to open a resizable split view with live editing for markdown files, the scrolling is synced in both sides and scrolling in single-view modes (the viewer and editor in non-split) now also tries to sync with each other so you don't lose context easily.
+   - Added a toolbar: This toolbar is present on all the files.
+     - JSON files have a button to toggle between formatted and minified versions (#2854) (#2566).
+     - Markdown files have a richer toolbar with lots of quick actions, for example you can now browse, navigate and insert images more easily from your current source.
+   - Added a prompt to configure some editor settings in UI, that prompt is accessible via the toolbar in the three-dots menu, there you can configure things like:
+     - Word wrap, keybinds, autocompletion, scrollbar, etc.
+   - The markdown viewer now supports rendering LaTeX Math and Chemistry formulas.
+   - Improved and fixed some styles that weren't following the app light/dark theme (#2949).
+ - Proxy auth group support: `groupsClaim`, `adminGroup`, and `userGroups` now control role-based access when the proxy sends a group/role header (#2755). Admin is determined by `adminGroup` only.
+ - Moved `auth.adminUsername` and `auth.adminPassword` to `auth.methods.password` (legacy top-level keys are migrated automatically on load).
+ - Support for `.elrc` (word-by-word lyrics), `.vtt`, `.srt` sidecar files for lyrics in audio files in the media player. (#2838)
+ - Added setting to configure the placement of the prompts close button in profile settings (#2853) (#2595).
+ - Added "New file templates". You can now add and configure pre-defined filenames + extension for the creation of new files in the context menu on profile settings! (#2881) (#1239).
+ - sidebar links can be bulk edited as yaml (#1963) (settings > user management)
+ - admins can customize more defaults:
+   - share creation defaults and enforcements (#1692) (#2434) (#2279) (#2812) (settings > share management)
+   - sidebar link defaults and enforcements (#2561) (settings > user management)
+   - tool defaults and enforcement (settings > user management)
+ - Add cli init CLI command (#2957)
+ - Sort header in file listings inside prompts like move/copy/quick jump, is now sticky. Also added a button to show a search input and filter the items of the current listing (#3028).
+ - Quick jump now scrolls and highlights the current item you are previewing (#3028).
+ - When hovering `date` and `name` in the listings, will show up the formatted/raw date (the inverse of what you have configured to display) and the full filename (#3028) (#2623).
+ - User groups can now be managed from the WebUI under `User Management` -> `Groups` and when editing a user (#2983) (#3040).
+
+ **Notes**:
+ - An Admin can remove a `defautlEnabled` source for a user and it will remove removed until an admin adds it back.
+ - Enhancements to cross-source copy/move permissions and behavior.
+ - Improved resume upload behavior.
+ - Play/pause on videos in mobile now is toggled by the button in the middle rather than the whole container (#2828).
+ - improved video thumbnail generation speed and efficiency.
+ - Added icons based on extension to the upload prompt and new file/folder/rename prompts (#2881).
+ - Profile settings show minimal options by default. Full advanced profile settings can be shown by default by enabling `account.showAdvancedProfile`.
+ - sidebar links/navigation is button group toggle for clearer visibility
+ - Pop-up preview has 200ms debounce delay so it doesn't flash from moving the cursor across files quickly.
+ - Added risc-v to official releases
+ - Polished a bit some styles across various places of the UI (#3019) (#3028).
+ - Moved `Access Management` under `User Management` in the UI (#3040).
+ - improved developer experience with native vue webhook reloads.
+ - improved ffmpeg handling and concurrency via library upgrades
+
+ **Bug Fixes**:
+ - Undo in a fresh opened file on the editor was setting the file empty (#2714)
+ - Added some missing styles in the markdown viewer (#2714)
+ - Recaptcha not working (#1925) (#2861)
+ - Fix disk-usage overstatement on virtiofs bind mounts (#2894)
+ - Support non-ASCII share passwords (#2933)
+ - Fall back to buffered copies when FUSE rejects fast paths (#2938)
+ - Preserve deleted sidebar links across restarts (#2935)
+ - scope padding to listing view (#2934)
+ - Hide the Replace option on upload/create conflict prompts when the user lacks modify permission (or when a public share disallows replacements), so create-only users are not offered an action that the server rejects (#2837)
+ - Preserve Ctrl-click file selection when keyboard state is stale (#2958) (#2923)
+ - Avoid false stalls during parallel transfers (#2950) (#2948) thanks @gudcks0305
+ - Cap source usage-bar percentage at 100% when indexed size exceeds partition total (#2761) (#2238)
+ - On Linux, source partition totals sum distinct filesystems mounted under the source root (nested mounts) so usage bars match indexed content (#2761)
+ - Context menu stuck when opened from a listing in a prompt like move/copy or search (#3028).
 
 ## v2.0.10
 
@@ -168,6 +283,7 @@ Also, consider enabling "analytics" in admin settings which will help me populat
  - SQLite index and application databases configure `busy_timeout` on every pooled connection, and busy/locked detection now uses driver result codes; index batch writes and maintenance no longer report success when the DB stays busy, and index cache reads return busy errors instead of empty results so listing can fall back to the filesystem.
 
 ## v2.0.8
+
  **Security**:
  - [Critical] A forged JWT could authenticate as any known `belongsTo`. Auth signing keys are now persisted in the application database and JWT validation fails closed when no key is configured. (GHSA-8f9r-wg7w-pfw) (#2987) Thanks @d3do-23 and @whoamis3c.
  - [Medium] Public upload shares with replacements disabled (`allowReplacements=false`) now reject overwrites when clients send `override=true`. (GHSA-3846-gh75-gp3m) Thanks @d3do-23
@@ -192,7 +308,7 @@ Also, consider enabling "analytics" in admin settings which will help me populat
  - Add cli init CLI command (#2957)
 
  **Notes**:
- - Pop-up preview has 200ms debounce delay so it doesn't flash from moving the cursor across files quickly. 
+ - Pop-up preview has 200ms debounce delay so it doesn't flash from moving the cursor across files quickly.
  - Added risc-v to official releases
 
  **Bugfixes**:
@@ -272,6 +388,7 @@ Also, consider enabling "analytics" in admin settings which will help me populat
  - External subtitles fail to load on public video shares due to authenticated subtitle endpoint (#2822) (#2827)
  - OnlyOffice is inaccessible on password-protected shares (#2811)
  - FFmpeg 9.0 incorrectly detected as below minimum 5.0.0 on Windows (#2820) -- thanks @yzxcj797
+ - Queue buttons not clickable in the desktop panel in audio files.
 
 ## v2.0.1
 
@@ -345,7 +462,7 @@ This version represents the most significant change to date. It **requires** bot
  - opt-in feature to send deployment analytics to filebrowser quantum developer servers
    - anonymized with a viewer so users can see what info would be sent.
    - if opt-in, every month a snapshot of your deployment config would be sent to developer servers
-   - this will help me know what features are being used and what versions everyone is on over time. I will also provide a public dashboard with this information in the future. 
+   - this will help me know what features are being used and what versions everyone is on over time. I will also provide a public dashboard with this information in the future.
  - WebDAV now supports set modification time via the `X-OC-Mtime` header for clients that support it (#2626). See [WebDAV docs](https://filebrowserquantum.com/en/docs/features/webdav/).
  - Copy operations now preserve their original modification times (#2642) (#2647):
    - WebUI preserves both, files and directories.
@@ -525,14 +642,14 @@ This version represents the most significant change to date. It **requires** bot
  - Improved style of drag and drop into listing view (#2407)
  - Edit Sidebar links has new "show tools in sidebar" toggle and all users have this enabled by default. can be disabled via for new users `userDefaults.sidebar.showTools: false`
  - Update user defaults ordering (#1140)
- - Save view modes and sizes into local storage instead of db (#2301) 
+ - Save view modes and sizes into local storage instead of db (#2301)
 
  **BugFixes**:
  - Blue overlay when using gestures in video files on mobile (#2360)
  - Playback queue wasn't updating when changing of folder (#2360)
  - Added missing `UserDefaults.listing.showCopyPath` option to config file (#2364)
  - Delete prompt thumbnail didn't worked when using it with the `delete` shortcut. (#2407)
- - Searching icons in the Icon picker prompt wasn't working properly (#2407) 
+ - Searching icons in the Icon picker prompt wasn't working properly (#2407)
  - Drag and drop style state was stuck until page reload (#2407)
  - Navigate close settings shows "something went wrong" (#2047)
 
@@ -678,7 +795,7 @@ This version represents the most significant change to date. It **requires** bot
  - Cannot edit shared file in OnlyOffice #2143
  - PWA install button disappeared (#2086)
  - Deleting a root folder was possible #2128
- - PUT resource api errors if action against a folder (#2153) 
+ - PUT resource api errors if action against a folder (#2153)
  - LDAP authentication issue if a password caontains @ symbol (#2154)
  - Share banner seems to be not working for custom urls (#2120)
 
@@ -712,7 +829,7 @@ Note: a potentially breaking change for docker users: \the default user is now "
  - New Sidebar Features
    - Sidebar tree navigation (#2006) (#350)
    - Source usage to be customized to show os-reported values rather than calculated. This can be changed per source by editing the source link in the sidebar. (#1266) (#982)
- - Archive/Unarchive actions in UI (#1252) (#335) (#1569) 
+ - Archive/Unarchive actions in UI (#1252) (#335) (#1569)
    - new api to archive/unarchive files on the server
    - requires `create` user permissions
    - archiving actions respect `server.maxArchiveSize`
@@ -875,7 +992,7 @@ Note: a potentially breaking change for docker users: \the default user is now "
 ## v1.2.1-beta
 
  **New Features**:
- - Global disable onlyoffice editor via "*" file option to disable all files for a specific user. (#1533) 
+ - Global disable onlyoffice editor via "*" file option to disable all files for a specific user. (#1533)
 
  **Notes**:
  - upgraded imaging package and improved thumbnail generation performance. (#1797) (#1850)
@@ -978,7 +1095,7 @@ Sorry for the delay -- a lot of effort went into this release, specifically abou
    - warning for low free space below 20GB
    - warning if read/write latency is slow
    - fatal for any errors reading or writing to the directory
-   - links to official docs for more info 
+   - links to official docs for more info
  - access rule changes:
    - denied folders won't show up in parent directory listing view (#1684)
    - tools will respect access rules
@@ -1013,7 +1130,7 @@ Sorry for the delay -- a lot of effort went into this release, specifically abou
 
  **BugFixes**:
  - better index status updates, fixing delays #1649
- - fixed long load times for listings with media info due sequential processing of files. 
+ - fixed long load times for listings with media info due sequential processing of files.
  - downloaded files always included `utf-8` in filename #1671
  - custom sidebar links allow external links like `https://google.com`
  - html title not populated correctly for links #1676

CONTRIBUTING.md

@@ -16,10 +16,7 @@ Thank you for your interest in contributing to FileBrowser Quantum! This guide w
   - macOS: `brew install ffmpeg`
   - Windows: Download from [ffmpeg.org](https://ffmpeg.org/download.html)
 
-- **mupdf-tools**: For PDF preview generation
-  - Ubuntu/Debian: `sudo apt-get install mupdf-tools`
-  - macOS: `brew install mupdf-tools`
-  - Windows: Download from [mupdf.com](https://mupdf.com/downloads/)
+Document thumbnails (PDF, EPUB, Office Open XML, and similar) are generated in-process via [folio](https://github.com/gen2brain/folio). An optional office integration is used as a fallback for formats folio does not handle and for in-browser editing.
 
 ## Quick Start
 

README.md

@@ -18,7 +18,7 @@
 
 :pushpin: [Read The Official Docs](https://filebrowserquantum.com/) (currently english-only)
 
-:pushpin: [v2.0.0 is now in beta!](https://filebrowserquantum.com/en/docs/getting-started/v2/about/)
+:pushpin: [v2.0.0 is now stable!](https://filebrowserquantum.com/en/docs/getting-started/v2/about/) --> See [migration support discussion](https://github.com/gtsteffaniak/filebrowser/discussions/3105)
 
 ## About
 
@@ -86,7 +86,7 @@ See the [Official Docs](https://filebrowserquantum.com/). Contributions are welc
 ## Comparison Chart
 Application Name | <img width="48" alt="" src="https://github.com/user-attachments/assets/c40b22c9-33da-47b7-bc4c-ce69bb5cc174" > Quantum | <img width="48" alt="" src="https://github.com/filebrowser/filebrowser/blob/master/frontend/public/img/logo.svg" > Filebrowser | <img width="48" alt="" src="https://github.com/mickael-kerjean/filestash/blob/master/public/assets/logo/app_icon.png?raw=true" > Filestash | <img width="48" alt="" src="https://avatars.githubusercontent.com/u/19211038?s=200&v=4" >  Nextcloud | <img width="48" alt="" src="https://cdn.iconscout.com/icon/free/png-256/free-google-drive-logo-icon-svg-download-png-2476481.png" > Google_Drive | <img width="48" alt="" src="https://avatars.githubusercontent.com/u/6422152?v=4" > FileRun
 --- | --- | --- | --- | --- | --- | --- |
-Filesystem support            | ✅ | ✅ | ✅ | ❌ | ❌ | ✅ |
+Filesystem support            | ✅ | ✅ | ✅ | ✅ | ❌ | ✅ |
 Linux                         | ✅ | ✅ | ✅ | ✅ | ❌ | ✅ |
 Windows                       | ✅ | ✅ | ✅ | ❌ | ❌ | ✅ |
 Mac                           | ✅ | ✅ | ✅ | ❌ | ❌ | ✅ |
@@ -95,7 +95,7 @@ Has Stable Release?           | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
 S3 support                    | ❌ | ❌ | ✅ | ✅ | ❌ | ❌ |
 webdav support                | ✅ | ❌ | ✅ | ✅ | ❌ | ✅ |
 FTP support                   | ❌ | ❌ | ✅ | ✅ | ❌ | ✅ |
-Dedicated docs site?          | ✅ | ✅ | ✅ | ✅ | ❌ | ✅ |
+Dedicated docs site?          | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
 Multiple sources at once      | ✅ | ❌ | ✅ | ✅ | ❌ | ✅ |
 Docker image size             | 180 MB (with ffmpeg) | 31 MB  | 240 MB (main image) | 250 MB | ❌ | > 2 GB |
 Min. Memory Requirements      | 512 MB | 128 MB | 128 MB (main image) | 512 MB | ❌ | 512 MB   |
@@ -109,25 +109,25 @@ Content-aware search?         | ❌ | ❌ | ✅ | configurable | ✅ | ✅ |
 Custom job support            | :construction: | ✅ | ✅ | ✅ | ❌ | ✅ |
 Multiple users                | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
 Single sign-on support        | ✅ | ❌ | ✅ | ✅ | ✅ | ✅ |
-LDAP sign-on support          | ✅ | ❌ | ✅ | ✅ | ❌ | ✅ |
+LDAP sign-on support          | ✅ | ❌ | ✅ | ✅ | ✅ | ✅ |
 Long-live API key support     | ✅ | ❌ | ✅ | ✅ | ✅ | ✅ |
-API documentation page        | ✅ | ❌ | ✅ | ✅ | ❌ | ✅ |
-Mobile App                    | ❌ | ❌ | ✅ | ✅ | ✅ | ❌ |
+API documentation page        | ✅ | ❌ | ✅ | ✅ | ✅ | ✅ |
+Mobile App                    | ❌ | ❌ | ❌ | ✅ | ✅ | ❌ |
 open source?                  | ✅ | ✅ | ✅ | ✅ | ❌ | ❌ |
 tags support                  | :construction: | ❌ | ✅ | ✅ | ❌ | ✅ |
 shareable web links?          | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
 Event-based notifications     | :construction: | ❌ | ✅ | ❌ | ❌ | ✅ |
-Metrics                       | :construction: | ❌ | ✅ | ❌ | ❌ | ❌ |
-file space quotas             | :construction: | ❌ | ✅ | ❌ | ✅ | ✅ |
+Metrics                       | :construction: | ❌ | ✅ | ✅ | ❌ | ❌ |
+file space quotas             | ✅ | ❌ | ✅ | ❌ | ✅ | ✅ |
 text-based files editor       | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
 Office file support           | ✅ | ❌ | ✅ | ✅ | ✅ | ✅ |
 Office file previews          | ✅ | ❌ | ❌ | ✅ | ✅ | ✅ |
-Themes                        | ✅ | ✅ | ✅ | ❌ | ❌ | ✅ |
+Themes                        | ✅ | ✅ | ✅ | ✅ | ❌ | ✅ |
 Branding support              | ✅ | ✅ | ✅ | ❌ | ❌ | ✅ |
 activity log                  | ✅ | ❌ | ✅ | ✅ | ✅ | ✅
 Comments support              | ❌ | ❌ | ✅ | ✅ | ✅ | ✅ |
 trash support                 | :construction: | ❌ | ✅ | ✅ | ✅ | ✅ |
-Starred/pinned files          | ✅ | ❌ | ✅ | ❌ | ✅ | ✅ |
+Starred/pinned files          | ✅ | ❌ | ✅ | ✅ | ✅ | ✅ |
 Chromecast support            | ❌ | ❌ | ✅ | ❌ | ❌ | ❌ |
 Share collections of files    | :construction: | ❌ | ❌ | ❌ | ❌ | ✅ |
 Can archive selected files    | ✅ | ❌ | ❌ | ❌ | ❌ | ✅ |

_docker/Dockerfile

@@ -1,24 +1,25 @@
-FROM ghcr.io/gtsteffaniak/ffmpeg:9.0.2-decode AS ffmpeg
+# syntax=docker/dockerfile:1.4
+FROM gtstef/ffmpeg:9.0.2 AS ffmpeg
 FROM golang:alpine AS base
 ARG VERSION
 ARG REVISION
 WORKDIR /app
+COPY ./backend/go.mod ./backend/go.sum ./
+RUN --mount=type=cache,target=/go/pkg/mod go mod download
 COPY ./backend ./
-RUN apk update && apk add --no-cache gcc musl-dev
-RUN go mod download && go run ./scripts/setup-gofitz-cgo
-ENV CGO_ENABLED=1
-RUN go build -tags analytics,mupdf,musl -ldflags="-w -s \
+ENV CGO_ENABLED=0
+RUN --mount=type=cache,target=/go/pkg/mod --mount=type=cache,target=/root/.cache/go-build go build -trimpath -tags analytics -ldflags="-w -s \
   -X 'github.com/gtsteffaniak/filebrowser/backend/internal/version.Version=${VERSION}' \
   -X 'github.com/gtsteffaniak/filebrowser/backend/internal/version.CommitSHA=${REVISION}'" \
   -o filebrowser .
 
-FROM node:jod-slim AS nbuild
+FROM --platform=$BUILDPLATFORM node:jod-slim AS nbuild
 WORKDIR /build
 COPY ./frontend/package.json ./frontend/package-lock.json ./frontend/
 RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates \
     && git config --global url."https://github.com/".insteadOf "git@github.com:" \
     && git config --global url."https://github.com/".insteadOf "ssh://git@github.com/"
-RUN cd frontend && npm ci --maxsockets 1
+RUN --mount=type=cache,target=/root/.npm cd frontend && npm ci --maxsockets 1
 COPY ./frontend/ ./frontend/
 WORKDIR /build/frontend
 RUN npm run build:docker
@@ -38,7 +39,7 @@ COPY --from=base --chown=filebrowser:1000 [ "/app/filebrowser", "./" ]
 COPY --from=base --chown=filebrowser:1000 [ "/app/config.yaml", "./data/config.yaml" ]
 COPY --from=base --chown=filebrowser:1000 [ "/app/config.yaml", "./" ]
 COPY --from=base --chown=filebrowser:1000 [ "/app/reduce-rounded-corners.css", "./" ]
-COPY --from=nbuild --chown=filebrowser:1000 [ "/build/backend/internal/web/dist/", "./internal/web/dist/" ]
+COPY --from=nbuild --chown=filebrowser:1000 [ "/build/frontend/dist/", "./internal/web/dist/" ]
 ## sanity checks
 RUN [ "filebrowser", "version" ]
 RUN [ "ffmpeg", "-version" ]

_docker/Dockerfile.beta

@@ -0,0 +1,44 @@
+# syntax=docker/dockerfile:1.4
+FROM golang:alpine AS base
+ARG VERSION
+ARG REVISION
+WORKDIR /app
+COPY ./backend/go.mod ./backend/go.sum ./
+RUN --mount=type=cache,target=/go/pkg/mod go mod download
+COPY ./backend ./
+ENV CGO_ENABLED=0
+RUN --mount=type=cache,target=/go/pkg/mod --mount=type=cache,target=/root/.cache/go-build go build -trimpath -tags analytics -ldflags="-w -s \
+  -X 'github.com/gtsteffaniak/filebrowser/backend/internal/version.Version=${VERSION}' \
+  -X 'github.com/gtsteffaniak/filebrowser/backend/internal/version.CommitSHA=${REVISION}'" \
+  -o filebrowser .
+
+FROM --platform=$BUILDPLATFORM node:jod-slim AS nbuild
+WORKDIR /build
+COPY ./frontend/package.json ./frontend/package-lock.json ./frontend/
+RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates
+RUN --mount=type=cache,target=/root/.npm cd frontend && npm ci --maxsockets 1
+COPY ./frontend/ ./frontend/
+WORKDIR /build/frontend
+RUN npm run build:docker
+
+FROM alpine:latest
+ENV FILEBROWSER_DATABASE_PATH="/home/filebrowser/data/database.sqlite"
+ENV FILEBROWSER_CONFIG="/home/filebrowser/data/config.yaml"
+ENV PATH="$PATH:/home/filebrowser"
+RUN apk --no-cache add ca-certificates mailcap tzdata curl
+RUN adduser -D -s /bin/true -u 1000 filebrowser
+USER filebrowser
+WORKDIR /home/filebrowser
+# copy config to two locations for compatibility
+COPY --from=base --chown=filebrowser:1000 [ "/app/filebrowser", "./" ]
+COPY --from=base --chown=filebrowser:1000 [ "/app/config.yaml", "./data/config.yaml" ]
+COPY --from=base --chown=filebrowser:1000 [ "/app/config.yaml", "./" ]
+COPY --from=base --chown=filebrowser:1000 [ "/app/reduce-rounded-corners.css", "./" ]
+COPY --from=nbuild --chown=filebrowser:1000 [ "/build/frontend/dist/", "./internal/web/dist/" ]
+## sanity checks
+RUN [ "filebrowser", "version" ]
+# exposing default port for auto discovery.
+EXPOSE 80
+HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
+  CMD curl -f http://localhost:80/health || exit 1
+ENTRYPOINT [ "./filebrowser" ]

_docker/Dockerfile.media

@@ -0,0 +1,78 @@
+# syntax=docker/dockerfile:1.4
+# GPU-capable media image: mostly-static glibc FFmpeg + dynamic VA/Vulkan/OpenCL drivers (amd64).
+# Codecs/TLS are linked into gtstef/ffmpeg:<ver> (full track, not *-static).
+#
+# amd64: libva/Mesa/Vulkan/OpenCL userspace below; NVIDIA libs come from the host toolkit.
+# arm64 (e.g. Raspberry Pi): h264_v4l2m2m uses kernel V4L2 only — no extra GPU .debs; pass
+#   /dev/video10 or /dev/video11 (and group video). Pi 5 VAAPI via /dev/dri is optional (mesa on arm64).
+FROM gtstef/ffmpeg:9.0.2 AS ffmpeg
+
+FROM golang:bookworm AS base
+ARG VERSION
+ARG REVISION
+WORKDIR /app
+COPY ./backend/go.mod ./backend/go.sum ./
+RUN --mount=type=cache,target=/go/pkg/mod go mod download
+COPY ./backend ./
+ENV CGO_ENABLED=0
+RUN --mount=type=cache,target=/go/pkg/mod --mount=type=cache,target=/root/.cache/go-build go build -trimpath -tags analytics -ldflags="-w -s \
+  -X 'github.com/gtsteffaniak/filebrowser/backend/internal/version.Version=${VERSION}' \
+  -X 'github.com/gtsteffaniak/filebrowser/backend/internal/version.CommitSHA=${REVISION}'" \
+  -o filebrowser .
+
+FROM --platform=$BUILDPLATFORM node:jod-slim AS nbuild
+WORKDIR /build
+COPY ./frontend/package.json ./frontend/package-lock.json ./frontend/
+RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates
+RUN --mount=type=cache,target=/root/.npm cd frontend && npm ci --maxsockets 1
+COPY ./frontend/ ./frontend/
+WORKDIR /build/frontend
+RUN npm run build:docker
+
+FROM debian:bookworm-slim AS runtime
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+  ca-certificates \
+  curl \
+  mailcap \
+  tzdata \
+  && rm -rf /var/lib/apt/lists/* \
+  && (dpkg --print-architecture | grep -q amd64 \
+    && apt-get update \
+    && apt-get install -y --no-install-recommends \
+      libva2 \
+      libva-drm2 \
+      libdrm2 \
+      libvulkan1 \
+      mesa-va-drivers \
+      mesa-vulkan-drivers \
+      ocl-icd-libopencl1 \
+      intel-media-va-driver \
+      libmfx1 \
+    && rm -rf /var/lib/apt/lists/* \
+    || true)
+COPY --from=ffmpeg [ "/ffmpeg", "/ffprobe", "/usr/local/bin/" ]
+ENV FILEBROWSER_FFMPEG_PATH="/usr/local/bin/"
+ENV FILEBROWSER_DATABASE_PATH="/home/filebrowser/data/database.sqlite"
+ENV FILEBROWSER_CONFIG="/home/filebrowser/data/config.yaml"
+ENV PATH="$PATH:/home/filebrowser"
+ENV NVIDIA_VISIBLE_DEVICES=all
+ENV NVIDIA_DRIVER_CAPABILITIES=compute,video,utility,graphics
+
+RUN useradd -m -u 1000 -s /usr/sbin/nologin filebrowser
+USER filebrowser
+WORKDIR /home/filebrowser
+
+COPY --from=base --chown=filebrowser:1000 [ "/app/filebrowser", "./" ]
+COPY --from=base --chown=filebrowser:1000 [ "/app/config.yaml", "./data/config.yaml" ]
+COPY --from=base --chown=filebrowser:1000 [ "/app/config.yaml", "./" ]
+COPY --from=base --chown=filebrowser:1000 [ "/app/reduce-rounded-corners.css", "./" ]
+COPY --from=nbuild --chown=filebrowser:1000 [ "/build/frontend/dist/", "./internal/web/dist/" ]
+
+RUN filebrowser version && ffmpeg -version && ffprobe -version
+
+EXPOSE 80
+HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
+  CMD curl -f http://localhost:80/health || exit 1
+ENTRYPOINT [ "./filebrowser" ]

_docker/Dockerfile.playwright-base

@@ -4,4 +4,4 @@ WORKDIR /app/frontend
 COPY frontend/package-lock.json /tmp/package-lock.json
 RUN PW_VERSION=$(node -p "require('/tmp/package-lock.json').packages['node_modules/@playwright/test'].version") \
   && npm i "@playwright/test@${PW_VERSION}" oauth2-mock-server @types/node
-RUN npx playwright install --with-deps chromium
+RUN npx playwright install --with-deps chromium-headless-shell

_docker/Dockerfile.playwright-general

@@ -12,7 +12,7 @@ WORKDIR /app/backend/
 COPY [ "./backend/filebrowser", "./"]
 COPY [ "./backend/reduce-rounded-corners.css", "./no-rounded.css" ]
 RUN mkdir -p ./internal/web/dist
-COPY [ "./backend/internal/web/embed/", "./internal/web/dist/"]
+COPY [ "./frontend/dist/", "./internal/web/dist/"]
 
 # generate duplicate 1.1MB files
 RUN dd if=/dev/zero of=/app/frontend/tests/playwright-files/1.1MB.bin bs=1024 count=1126 && dd if=/dev/zero of=/app/frontend/tests/playwright-files/1.1mb.bin bs=1024 count=1126

_docker/Dockerfile.playwright-jwt

@@ -6,7 +6,7 @@ COPY [ "./frontend/tests", "./tests" ]
 WORKDIR /app/backend/
 COPY [ "./backend/filebrowser", "./"]
 RUN mkdir -p ./internal/web/dist
-COPY [ "./backend/internal/web/embed/", "./internal/web/dist/"]
+COPY [ "./frontend/dist/", "./internal/web/dist/"]
 RUN apt update && apt install nginx -y
 RUN mv default.conf /etc/nginx/conf.d/default.conf
 RUN sed -i 's/filebrowser/localhost/g' /etc/nginx/conf.d/default.conf

_docker/Dockerfile.playwright-local

@@ -11,7 +11,7 @@ COPY [ "./_docker/src/settings/backend/config.yaml", "./"]
 COPY [ "./_docker/src/settings/backend/database.db.old", "./"]
 COPY [ "./backend/reduce-rounded-corners.css", "./no-rounded.css"]
 RUN mkdir -p ./internal/web/dist
-COPY [ "./backend/internal/web/embed/", "./internal/web/dist/"]
+COPY [ "./frontend/dist/", "./internal/web/dist/"]
 
 ENV FILEBROWSER_PLAYWRIGHT_TEST=true
 RUN ./filebrowser user set testuser1 --password testuser1

_docker/Dockerfile.playwright-no-config

@@ -11,7 +11,7 @@ COPY [ "./frontend/tests/", "./tests" ]
 WORKDIR /app/backend/
 COPY [ "./backend/filebrowser", "./"]
 RUN mkdir -p ./internal/web/dist
-COPY [ "./backend/internal/web/embed/", "./internal/web/dist/"]
+COPY [ "./frontend/dist/", "./internal/web/dist/"]
 
 # Run tests
 ENV FILEBROWSER_PLAYWRIGHT_TEST=true

_docker/Dockerfile.playwright-noauth

@@ -11,7 +11,7 @@ COPY [ "./frontend/tests/playwright-files", "./tests/playwright-files2" ]
 WORKDIR /app/backend/
 COPY [ "./backend/filebrowser", "./"]
 RUN mkdir -p ./internal/web/dist
-COPY [ "./backend/internal/web/embed/", "./internal/web/dist/"]
+COPY [ "./frontend/dist/", "./internal/web/dist/"]
 
 # Run tests
 ENV FILEBROWSER_PLAYWRIGHT_TEST=true

_docker/Dockerfile.playwright-oidc

@@ -7,7 +7,7 @@ WORKDIR /app/backend/
 RUN mkdir -p ./internal/web/dist
 COPY [ "./_docker/src/oidc/backend/", "./"]
 COPY ["./backend/filebrowser", "./"]
-COPY [ "./backend/internal/web/embed/", "./internal/web/dist/"]
+COPY [ "./frontend/dist/", "./internal/web/dist/"]
 
 # Run tests
 WORKDIR /app/frontend

_docker/Dockerfile.playwright-performance

@@ -23,7 +23,7 @@ WORKDIR /app/backend/
 COPY [ "./backend/filebrowser", "./"]
 COPY [ "./backend/reduce-rounded-corners.css", "./no-rounded.css" ]
 RUN mkdir -p ./internal/web/dist
-COPY [ "./backend/internal/web/embed/", "./internal/web/dist/"]
+COPY [ "./frontend/dist/", "./internal/web/dist/"]
 
 ENV FILEBROWSER_PLAYWRIGHT_TEST=true
 ENV CI=true

_docker/Dockerfile.playwright-previews

@@ -1,5 +1,8 @@
+FROM gtstef/ffmpeg:9.0.2 AS ffmpeg
+
 FROM ghcr.io/gtsteffaniak/playwright-base:chromium
 WORKDIR /app
+COPY --from=ffmpeg [ "/ffmpeg", "/ffprobe", "/usr/local/bin/" ]
 
 # Copy setup scripts first to leverage caching
 COPY [ "./_docker/src/previews/", "./" ]
@@ -10,8 +13,7 @@ COPY [ "./frontend/tests", "./tests" ]
 WORKDIR /app/backend/
 COPY [ "./backend/filebrowser", "./"]
 RUN mkdir -p ./internal/web/dist
-COPY [ "./backend/internal/web/embed/", "./internal/web/dist/"]
+COPY [ "./frontend/dist/", "./internal/web/dist/"]
 
-# Run tests
 ENV FILEBROWSER_PLAYWRIGHT_TEST=true
 RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test

_docker/Dockerfile.playwright-proxy

@@ -6,7 +6,7 @@ COPY [ "./frontend/tests", "./tests" ]
 WORKDIR /app/backend/
 COPY [ "./backend/filebrowser", "./"]
 RUN mkdir -p ./internal/web/dist
-COPY [ "./backend/internal/web/embed/", "./internal/web/dist/"]
+COPY [ "./frontend/dist/", "./internal/web/dist/"]
 RUN apt update && apt install nginx -y
 RUN mv default.conf /etc/nginx/conf.d/default.conf
 RUN mv .htpasswd /etc/nginx/conf.d/.htpasswd

_docker/Dockerfile.playwright-screenshots

@@ -10,7 +10,7 @@ COPY [ "./backend/filebrowser", "./"]
 COPY [ "./_docker/src/screenshots/backend/*", "./"]
 
 RUN mkdir -p ./internal/web/dist
-COPY [ "./backend/internal/web/embed/", "./internal/web/dist/"]
+COPY [ "./frontend/dist/", "./internal/web/dist/"]
 
 ENV FILEBROWSER_PLAYWRIGHT_TEST=true
 RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test --project dark-screenshots

_docker/Dockerfile.playwright-settings

@@ -13,7 +13,7 @@ WORKDIR /app/backend/
 COPY [ "./backend/filebrowser", "./"]
 COPY [ "./backend/reduce-rounded-corners.css", "./no-rounded.css"]
 RUN mkdir -p ./internal/web/dist
-COPY [ "./backend/internal/web/embed/", "./internal/web/dist/"]
+COPY [ "./frontend/dist/", "./internal/web/dist/"]
 
 # Run tests
 ENV FILEBROWSER_PLAYWRIGHT_TEST=true

_docker/Dockerfile.playwright-sharing

@@ -11,7 +11,7 @@ COPY [ "./frontend/tests/", "./tests" ]
 WORKDIR /app/backend/
 COPY [ "./backend/filebrowser", "./"]
 RUN mkdir -p ./internal/web/dist
-COPY [ "./backend/internal/web/embed/", "./internal/web/dist/"]
+COPY [ "./frontend/dist/", "./internal/web/dist/"]
 
 # Run tests
 ENV FILEBROWSER_PLAYWRIGHT_TEST=true

_docker/Dockerfile.purego

@@ -0,0 +1,43 @@
+# syntax=docker/dockerfile:1.4
+FROM golang:alpine AS base
+ARG VERSION
+ARG REVISION
+WORKDIR /app
+COPY ./backend/go.mod ./backend/go.sum ./
+RUN --mount=type=cache,target=/go/pkg/mod go mod download
+COPY ./backend ./
+RUN --mount=type=cache,target=/go/pkg/mod --mount=type=cache,target=/root/.cache/go-build go build -trimpath -tags analytics -ldflags="-w -s \
+  -X 'github.com/gtsteffaniak/filebrowser/backend/internal/version.Version=${VERSION}' \
+  -X 'github.com/gtsteffaniak/filebrowser/backend/internal/version.CommitSHA=${REVISION}'" \
+  -o filebrowser .
+
+FROM --platform=$BUILDPLATFORM node:jod-slim AS nbuild
+WORKDIR /build
+COPY ./frontend/package.json ./frontend/package-lock.json ./frontend/
+RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates
+RUN --mount=type=cache,target=/root/.npm cd frontend && npm ci --maxsockets 1
+COPY ./frontend/ ./frontend/
+WORKDIR /build/frontend
+RUN npm run build:docker
+
+FROM alpine:latest
+ENV FILEBROWSER_DATABASE_PATH="/home/filebrowser/data/database.sqlite"
+ENV FILEBROWSER_CONFIG="/home/filebrowser/data/config.yaml"
+ENV PATH="$PATH:/home/filebrowser"
+RUN apk --no-cache add ca-certificates mailcap tzdata curl
+RUN adduser -D -s /bin/true -u 1000 filebrowser
+USER filebrowser
+WORKDIR /home/filebrowser
+# copy config to two locations for compatibility
+COPY --from=base --chown=filebrowser:1000 [ "/app/filebrowser", "./" ]
+COPY --from=base --chown=filebrowser:1000 [ "/app/config.yaml", "./data/config.yaml" ]
+COPY --from=base --chown=filebrowser:1000 [ "/app/config.yaml", "./" ]
+COPY --from=base --chown=filebrowser:1000 [ "/app/reduce-rounded-corners.css", "./" ]
+COPY --from=nbuild --chown=filebrowser:1000 [ "/build/frontend/dist/", "./internal/web/dist/" ]
+## sanity checks
+RUN [ "filebrowser", "version" ]
+# exposing default port for auto discovery.
+EXPOSE 80
+HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
+  CMD curl -f http://localhost:80/health || exit 1
+ENTRYPOINT [ "./filebrowser" ]

_docker/Dockerfile.slim

@@ -32,7 +32,7 @@ COPY --from=base --chown=filebrowser:1000 [ "/app/filebrowser", "./" ]
 COPY --from=base --chown=filebrowser:1000 [ "/app/config.yaml", "./data/config.yaml" ]
 COPY --from=base --chown=filebrowser:1000 [ "/app/config.yaml", "./" ]
 COPY --from=base --chown=filebrowser:1000 [ "/app/reduce-rounded-corners.css", "./" ]
-COPY --from=nbuild --chown=filebrowser:1000 [ "/build/backend/internal/web/dist/", "./internal/web/dist/" ]
+COPY --from=nbuild --chown=filebrowser:1000 [ "/build/frontend/dist/", "./internal/web/dist/" ]
 ## sanity checks
 RUN [ "filebrowser", "version" ]
 # exposing default port for auto discovery.

_docker/src/general/backend/config.yaml

@@ -20,3 +20,7 @@ userDefaults:
   account:
     permissions:
       share: true
+
+integrations:
+  media:
+    skipHwCheck: true

_docker/src/jwt/backend/config.yaml

@@ -51,3 +51,7 @@ userDefaults:
     video: true
     office: true
     highQuality: true
+
+integrations:
+  media:
+    skipHwCheck: true

_docker/src/noauth/backend/config.yaml

@@ -64,4 +64,7 @@ userDefaults:
     popup: true
     video: true
     office: true
-    highQuality: true
+    highQuality: true
+integrations:
+  media:
+    skipHwCheck: true

_docker/src/oidc/backend/config.yaml

@@ -50,4 +50,7 @@ userDefaults:
     permissions:
       admin: false
       share: false
-      api: false
+      api: false
+integrations:
+  media:
+    skipHwCheck: true

_docker/src/performance/backend/config.yaml

@@ -4,10 +4,8 @@ http:
   <<: *http-main
 frontend:
   <<: *frontend-main
-
 auth:
   <<: *auth-main
-
 userDefaults:
   preview:
     image: true
@@ -20,3 +18,7 @@ userDefaults:
   account:
     permissions:
       share: true
+
+integrations:
+  media:
+    skipHwCheck: true

_docker/src/previews/backend/config.yaml

@@ -39,3 +39,10 @@ userDefaults:
     office: true
     models: true
     highQuality: true
+
+integrations:
+  media:
+    skipHwCheck: true
+    # Real HLS transcoding for the preview specs (requires ffmpeg in the image).
+    transcode:
+      enabled: true

_docker/src/previews/frontend/playwright.config.ts

@@ -13,23 +13,20 @@ export default defineConfig({
   globalSetup: "./tests/playwright/previews-setup",
   timeout: 10000,
   testDir: "./tests/playwright/previews",
-  /* Run tests in files in parallel */
-  fullyParallel: true,
-  /* Fail the build on CI if you accidentally left test.only in the source code. */
+  fullyParallel: false,
   forbidOnly: false,
-  /* Retry on CI only */
   retries: 2,
   workers: 10,
   reporter: "line",
-  /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
   use: {
     launchOptions: {
       args: [
-        '--disable-gpu',
-        '--use-gl=swiftshader',  // CPU-based WebGL renderer built into Chromium
-        '--enable-webgl',
-        '--disable-dev-shm-usage',  // Overcome limited resource problems in Docker
-        '--no-sandbox',  // Required for Docker
+        "--autoplay-policy=no-user-gesture-required",
+        "--disable-gpu",
+        "--use-gl=swiftshader",
+        "--enable-webgl",
+        "--disable-dev-shm-usage",
+        "--no-sandbox",
       ],
     },
     storageState: "previews.json",

_docker/src/proxy/backend/config.yaml

@@ -40,3 +40,7 @@ userDefaults:
   account:
     permissions:
       share: true
+
+integrations:
+  media:
+    skipHwCheck: true

_docker/src/screenshots/backend/config.yaml

@@ -1,9 +1,6 @@
 http:
   port: 8080
   baseURL:  "/files/"
-frontend:
-  styling:
-    disableEventThemes: true
 auth:
   adminPassword: "playwright-password"
 
@@ -16,3 +13,13 @@ server:
       name: "playwright"
       config:
         defaultEnabled: true
+userDefaults:
+  listing:
+    viewMode: "normal"
+    # Size 4: switch-view "gallery" family resolves to icons (not gallery); list family → list.
+    gallerySize: 3
+  account:
+    showAdvancedProfile: true
+integrations:
+  media:
+    skipHwCheck: true

_docker/src/screenshots/frontend/playwright.config.ts

@@ -12,7 +12,7 @@ import type { PlaywrightFixtureOptions } from "./tests/playwright/test-setup";
  */
 export default defineConfig<PlaywrightFixtureOptions>({
   globalSetup: "./tests/playwright/screenshots-setup.ts",
-  timeout: 5000,
+  timeout: 60_000,
   testDir: "./tests/playwright/screenshots",
   /* Run tests in files in parallel */
   fullyParallel: false,

_docker/src/settings/backend/config.yaml

@@ -48,4 +48,7 @@ auth:
 
 userDefaults:
   listing:
-    showHidden: true
+    showHidden: true
+integrations:
+  media:
+    skipHwCheck: true

_docker/src/sharing/backend/config.yaml

@@ -27,4 +27,7 @@ frontend:
       url: "https://playwright.dev/"
       title: "Playwright"
   styling:
-    disableEventThemes: true
+    disableEventThemes: true
+integrations:
+  media:
+    skipHwCheck: true

backend/.air.env

@@ -0,0 +1 @@
+FILEBROWSER_DEVMODE=true

backend/.air.toml

@@ -1,16 +1,22 @@
 root = "."
 tmp_dir = "tmp"
+env_files = [".air.env"]
 
 [build]
-  pre_cmd = ["go run ./scripts/setup-gofitz-cgo"]
-  cmd = "go build -o ./tmp/filebrowser --tags=mupdf --ldflags=\"-w -s -X 'github.com/gtsteffaniak/filebrowser/backend/internal/version.CommitSHA=commitSHA' -X 'github.com/gtsteffaniak/filebrowser/backend/internal/version.Version=version'\" ."
+  cmd = "bash ./scripts/air-build.sh"
   entrypoint = "./tmp/filebrowser"
-  full_bin = "FILEBROWSER_DEVMODE=true CGO_ENABLED=1 ./tmp/filebrowser -c test_config.yaml"
+  args_bin = ["-c", "test_config.yaml"]
   include_ext = ["go", "tpl", "tmpl", "html"]
-  exclude_dir = ["tmp", "vendor", "internal/web/dist", "internal/web/embed", "internal/preview/testdata", "internal/preview/thumbnails", "internal/preview/heic", "swagger/docs"]
+  exclude_dir = ["tmp", "vendor", "internal/web/dist", "internal/preview/testdata", "internal/preview/thumbnails", "internal/preview/heic", "swagger/docs"]
+  poll = true
+  poll_interval = 1000
   log = "air.log"
   delay = 1000 # ms
 
+[build.windows]
+  cmd = "bash ./scripts/air-build.sh"
+  entrypoint = "./tmp/filebrowser.exe"
+
 [log]
   time = true
 

backend/.air.windows.toml

@@ -1,22 +0,0 @@
-root = "."
-tmp_dir = "tmp"
-
-[build]
-  pre_cmd = ["go run ./scripts/setup-gofitz-cgo"]
-  cmd = "go build -o ./tmp/filebrowser.exe --tags=mupdf --ldflags=\"-w -s -X 'github.com/gtsteffaniak/filebrowser/backend/internal/version.CommitSHA=commitSHA' -X 'github.com/gtsteffaniak/filebrowser/backend/internal/version.Version=version'\" ."
-  entrypoint = "./tmp/filebrowser.exe"
-  full_bin = "FILEBROWSER_DEVMODE=true CGO_ENABLED=1 ./tmp/filebrowser.exe -c test_config.yaml"
-  include_ext = ["go", "tpl", "tmpl", "html"]
-  exclude_dir = ["tmp", "vendor", "internal\\web\\dist", "internal\\web\\embed", "internal\\preview\\testdata", "internal\\preview\\thumbnails", "internal\\preview\\heic", "swagger\\docs"]
-  exclude_unchanged = true
-  follow_symlink = false
-  poll = true
-  poll_interval = 1000
-  log = "air.log"
-  delay = 1000 # ms
-
-[log]
-  time = true
-
-[misc]
-  clean_on_exit = false

backend/.golangci.yml

@@ -17,7 +17,7 @@ linters:
     exhaustive:
       check:
         - switch
-        - map
+        - mapliteral
     exhaustruct:
       exclude:
         - ^net/http.Client$

backend/.goreleaser.yaml

@@ -5,137 +5,61 @@ version: 2
 before:
   hooks:
     - go mod download
-    - go run ./scripts/setup-gofitz-cgo
 
 builds:
-  # Build configuration for linux amd64
-  - id: linux-amd64
+  - id: filebrowser
+    main: main.go
+    # Flat dist layout without GOAMD64/GOARM64/GORISCV64 suffix folders (e.g. _v1, _v8.0).
+    no_unique_dist_dir: true
+    binary: >-
+      {{ .Os }}-{{ .Arch }}{{ if eq .Arch "arm" }}-{{ .Arm }}{{ end }}/filebrowser
     env:
-      - CGO_ENABLED=1
-      - CC=zig cc -target x86_64-linux-musl
+      - CGO_ENABLED=0
+    flags:
+      - -trimpath
     tags:
       - analytics
-      - mupdf
-      - musl
-    ldflags: &ldflags
+    ldflags:
       - -s -w -X github.com/gtsteffaniak/filebrowser/backend/internal/version.Version=v{{ .Version }} -X github.com/gtsteffaniak/filebrowser/backend/internal/version.CommitSHA={{ .ShortCommit }}
-    main: main.go
-    binary: filebrowser
     goos:
       - linux
-    goarch:
-      - amd64
-    hooks:
-      post:
-        - upx {{ .Path }}
-
-  # Build configuration for linux arm64
-  - id: linux-arm64
-    ldflags: *ldflags
-    main: main.go
-    binary: filebrowser
-    env:
-      - CGO_ENABLED=1
-      - CC=zig cc -target aarch64-linux-musl
-    tags:
-      - analytics
-      - mupdf
-      - musl
-    goos:
-      - linux
-    goarch:
-      - arm64
-    hooks:
-      post:
-        - upx {{ .Path }}
-
-  # Build configuration for linux riscv64
-  - id: linux-riscv64
-    ldflags: *ldflags
-    main: main.go
-    binary: filebrowser
-    env:
-      - CC=zig cc -target riscv64-linux-musl
-    # go-fitz does not provide riscv64 MuPDF libraries yet: https://github.com/gen2brain/go-fitz/tree/master/libs
-    tags:
-      - analytics
-      - musl
-    goos:
-      - linux
-    goarch:
-      - riscv64
-
-  # Build configuration for linux
-  - id: linux-arm32
-    ldflags: *ldflags
-    main: main.go
-    binary: filebrowser
-    tags:
-      - analytics
-    goos:
-      - linux
-    goarch:
-      - arm
-    goarm:
-      - "6"
-      - "7"
-    hooks:
-      post:
-        - upx {{ .Path }}  # Compress the binary with UPX
-
-  # Build configuration for windows without arm
-  - id: windows
-    env:
-      - CGO_ENABLED=1
-      # windows-gnu avoids zig rejecting Go's -tsaware when cross-compiling from macOS
-      - CC=zig cc -target x86_64-windows-gnu -lc
-    tags:
-      - analytics
-      - mupdf
-    ldflags: *ldflags
-    main: main.go
-    binary: filebrowser
-    goos:
       - windows
-    goarch:
-      - amd64
-    hooks:
-      post:
-        - upx {{ .Path }}  # Compress the binary with UPX
-
-  # Build configuration for freebsd without arm & upx
-  - id: freeBSD and freebsd-arm
-    ldflags: *ldflags
-    main: main.go
-    binary: filebrowser
-    tags:
-      - analytics
-    goos:
+      - darwin
       - freebsd
     goarch:
       - amd64
-
-  # Build configuration for macos without upx (no mupdf: CGO cross-compile from Linux CI is unsupported)
-  - id: macos
-    ldflags: *ldflags
-    main: main.go
-    binary: filebrowser
-    tags:
-      - analytics
-    goos:
-      - darwin
-    goarch:
       - arm64
-      - amd64
+      - arm
+      - riscv64
+    goarm:
+      - "6"
+      - "7"
+    ignore:
+      - goos: windows
+        goarch: arm
+      - goos: windows
+        goarch: riscv64
+      - goos: darwin
+        goarch: arm
+      - goos: darwin
+        goarch: riscv64
+      - goos: freebsd
+        goarch: arm
+      - goos: freebsd
+        goarch: arm64
+      - goos: freebsd
+        goarch: riscv64
 
 archives:
   - name_template: >
       {{- if eq .Os "windows" -}}
-      {{.ProjectName}}
+      {{.ProjectName}}{{ if ne .Arch "amd64" }}-{{ .Arch }}{{ end }}
+      {{- else if eq .Arch "arm" -}}
+      {{.Os}}-arm-{{ .Arm }}-{{.ProjectName}}
       {{- else -}}
-      {{.Os}}-{{.Arch}}{{if .Arm}}v{{.Arm}}{{end}}-{{.ProjectName}}
+      {{.Os}}-{{.Arch}}-{{.ProjectName}}
       {{- end -}}
-    formats: [ 'binary' ]
-
-checksum:
-  disable: true
+    formats: ["tar.gz"]
+    format_overrides:
+      - goos: windows
+        formats: ["zip"]

backend/build/go.mod

@@ -45,7 +45,7 @@ require (
 	github.com/blizzy78/varnamelen v0.8.0 // indirect
 	github.com/bombsimon/wsl/v4 v4.7.0 // indirect
 	github.com/bombsimon/wsl/v5 v5.9.0 // indirect
-	github.com/breml/bidichk v0.3.3 // indirect
+	github.com/breml/bidichk v0.3.4 // indirect
 	github.com/breml/errchkjson v0.4.1 // indirect
 	github.com/butuzov/ireturn v0.4.1 // indirect
 	github.com/butuzov/mirror v1.3.3 // indirect
@@ -101,16 +101,16 @@ require (
 	github.com/gohugoio/hashstructure v1.1.0 // indirect
 	github.com/gohugoio/hugo v0.165.0 // indirect
 	github.com/golangci/asciicheck v0.5.0 // indirect
-	github.com/golangci/canonicalheader v0.0.0-20260827115959-a25c71c521f6 // indirect
+	github.com/golangci/canonicalheader v0.0.0-20260928145534-e18e5c5a078f // indirect
 	github.com/golangci/dupl v0.0.0-20260401084720-c99c5cf5c202 // indirect
 	github.com/golangci/go-printf-func-name v0.1.1 // indirect
 	github.com/golangci/gofmt v0.0.0-20260820135601-e84e05053792 // indirect
-	github.com/golangci/golangci-lint/v2 v2.14.0 // indirect
-	github.com/golangci/golines v0.15.0 // indirect
+	github.com/golangci/golangci-lint/v2 v2.15.0 // indirect
+	github.com/golangci/golines v0.16.0 // indirect
 	github.com/golangci/misspell v0.8.0 // indirect
 	github.com/golangci/plugin-module-register v0.1.2 // indirect
 	github.com/golangci/revgrep v0.8.0 // indirect
-	github.com/golangci/rowserrcheck v0.0.0-20260901154044-241134db7241 // indirect
+	github.com/golangci/rowserrcheck v0.0.0-20261005233414-e0740d52dee8 // indirect
 	github.com/golangci/swaggoswag v0.0.0-20250504205917-77f2aca3143e // indirect
 	github.com/golangci/unconvert v0.0.0-20250410112200-a129a6e6413e // indirect
 	github.com/google/go-cmp v0.7.0 // indirect
@@ -129,10 +129,10 @@ require (
 	github.com/joho/godotenv v1.5.1 // indirect
 	github.com/julz/importas v0.2.0 // indirect
 	github.com/karamaru-alpha/copyloopvar v1.2.2 // indirect
-	github.com/kisielk/errcheck v1.20.0 // indirect
+	github.com/kisielk/errcheck v1.30.0 // indirect
 	github.com/kkHAIKE/contextcheck v1.1.6 // indirect
 	github.com/kulti/thelper v0.7.1 // indirect
-	github.com/kunwardeep/paralleltest v1.0.15 // indirect
+	github.com/kunwardeep/paralleltest v1.0.16 // indirect
 	github.com/ldez/exptostd v0.4.5 // indirect
 	github.com/ldez/gomoddirectives v0.10.0 // indirect
 	github.com/ldez/grignotin v0.10.1 // indirect
@@ -147,17 +147,17 @@ require (
 	github.com/maratori/testableexamples v1.0.1 // indirect
 	github.com/maratori/testpackage v1.1.2 // indirect
 	github.com/matoous/godox v1.1.0 // indirect
-	github.com/mattn/go-colorable v0.1.15 // indirect
+	github.com/mattn/go-colorable v0.1.16 // indirect
 	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/mattn/go-runewidth v0.0.30 // indirect
-	github.com/mgechev/revive v1.17.0 // indirect
+	github.com/mgechev/revive v1.17.1 // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/moricho/tparallel v0.3.2 // indirect
 	github.com/muesli/cancelreader v0.2.2 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/nakabonne/nestif v0.3.1 // indirect
-	github.com/nishanths/exhaustive v0.13.0 // indirect
-	github.com/nishanths/predeclared v0.2.2 // indirect
+	github.com/nishanths/exhaustive v0.15.0 // indirect
+	github.com/nishanths/predeclared v0.3.0 // indirect
 	github.com/nunnatsa/ginkgolinter v0.24.0 // indirect
 	github.com/pelletier/go-toml v1.9.5 // indirect
 	github.com/pelletier/go-toml/v2 v2.4.3 // indirect
@@ -201,14 +201,14 @@ require (
 	github.com/tdewolff/parse/v2 v2.8.16 // indirect
 	github.com/tetafro/godot v1.5.6 // indirect
 	github.com/timakin/bodyclose v0.0.0-20260923065923-98ded9ab4ef2 // indirect
-	github.com/timonwong/loggercheck v0.12.0 // indirect
-	github.com/tomarrell/wrapcheck/v2 v2.12.0 // indirect
+	github.com/timonwong/loggercheck v0.13.0 // indirect
+	github.com/tomarrell/wrapcheck/v2 v2.13.0 // indirect
 	github.com/tommy-muehle/go-mnd/v2 v2.5.1 // indirect
 	github.com/ultraware/funlen v0.2.0 // indirect
 	github.com/ultraware/whitespace v0.2.0 // indirect
 	github.com/urfave/cli/v2 v2.27.7 // indirect
-	github.com/uudashr/gocognit v1.2.1 // indirect
-	github.com/uudashr/iface v1.5.1 // indirect
+	github.com/uudashr/gocognit v1.3.0 // indirect
+	github.com/uudashr/iface v1.5.3 // indirect
 	github.com/xen0n/gosmopolitan v1.3.0 // indirect
 	github.com/xo/terminfo v1.2.0 // indirect
 	github.com/xrash/smetrics v0.0.0-20250705151800-55b8f293f342 // indirect
@@ -225,14 +225,14 @@ require (
 	go.yaml.in/yaml/v2 v2.4.4 // indirect
 	go.yaml.in/yaml/v3 v3.0.5 // indirect
 	golang.org/x/exp/typeparams v0.0.0-20260908205506-85c1c2202aba // indirect
-	golang.org/x/mod v0.41.0 // indirect
-	golang.org/x/sync v0.23.0 // indirect
-	golang.org/x/sys v0.48.0 // indirect
+	golang.org/x/mod v0.42.0 // indirect
+	golang.org/x/sync v0.24.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
 	golang.org/x/text v0.42.0 // indirect
-	golang.org/x/tools v0.50.0 // indirect
+	golang.org/x/tools v0.52.0 // indirect
 	google.golang.org/protobuf v1.36.12 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	honnef.co/go/tools v0.8.1 // indirect
+	honnef.co/go/tools v0.8.2 // indirect
 	mvdan.cc/gofumpt v0.12.0 // indirect
 	mvdan.cc/unparam v0.0.0-20260823230713-2fa3d841b0c8 // indirect
 	sigs.k8s.io/yaml v1.6.0 // indirect

backend/build/go.sum

@@ -120,8 +120,8 @@ github.com/bombsimon/wsl/v4 v4.7.0 h1:1Ilm9JBPRczjyUs6hvOPKvd7VL1Q++PL8M0SXBDf+j
 github.com/bombsimon/wsl/v4 v4.7.0/go.mod h1:uV/+6BkffuzSAVYD+yGyld1AChO7/EuLrCF/8xTiapg=
 github.com/bombsimon/wsl/v5 v5.9.0 h1:WCrgZ7RQnZO5oEwbVTlYgBdU3wL294kR1BSWV8vTfsU=
 github.com/bombsimon/wsl/v5 v5.9.0/go.mod h1:kjo4HiAV5FDkHC8/uzJq9mBffEEd6WT/nvN7DoMovDM=
-github.com/breml/bidichk v0.3.3 h1:WSM67ztRusf1sMoqH6/c4OBCUlRVTKq+CbSeo0R17sE=
-github.com/breml/bidichk v0.3.3/go.mod h1:ISbsut8OnjB367j5NseXEGGgO/th206dVa427kR8YTE=
+github.com/breml/bidichk v0.3.4 h1:70G6w80G6GDZTUURHTC5gBKVjMLMw2736CzXquSf5Ek=
+github.com/breml/bidichk v0.3.4/go.mod h1:GOHprnh4i0V7HrvWjtbvbpicTUcqoYt9zYESKcJkk4M=
 github.com/breml/errchkjson v0.4.1 h1:keFSS8D7A2T0haP9kzZTi7o26r7kE3vymjZNeNDRDwg=
 github.com/breml/errchkjson v0.4.1/go.mod h1:a23OvR6Qvcl7DG/Z4o0el6BRAjKnaReoPQFciAl9U3s=
 github.com/butuzov/ireturn v0.4.1 h1:vWb3NO4t77iku/sjCQ/2pHTQeOmxEhjIriJqRLg1Y+I=
@@ -282,26 +282,26 @@ github.com/gohugoio/hugo-goldmark-extensions/passthrough v0.5.0 h1:p13Q0DBCrBRpJ
 github.com/gohugoio/hugo-goldmark-extensions/passthrough v0.5.0/go.mod h1:ob9PCHy/ocsQhTz68uxhyInaYCbbVNpOOrJkIoSeD+8=
 github.com/golangci/asciicheck v0.5.0 h1:jczN/BorERZwK8oiFBOGvlGPknhvq0bjnysTj4nUfo0=
 github.com/golangci/asciicheck v0.5.0/go.mod h1:5RMNAInbNFw2krqN6ibBxN/zfRFa9S6tA1nPdM0l8qQ=
-github.com/golangci/canonicalheader v0.0.0-20260827115959-a25c71c521f6 h1:fVLolA3dG6s0brGetsiDAtcnpMSwVa2LqXJEw/9RJG4=
-github.com/golangci/canonicalheader v0.0.0-20260827115959-a25c71c521f6/go.mod h1:1xo+NFW5S+bEf2DKXhaxuzvcDN5AR6o/KMwvqC5Mkpo=
+github.com/golangci/canonicalheader v0.0.0-20260928145534-e18e5c5a078f h1:pOnwRNeWLPkADfkgqKcCP7RPQAS9OIzffaBaktRsKnk=
+github.com/golangci/canonicalheader v0.0.0-20260928145534-e18e5c5a078f/go.mod h1:aXo+AVSX0pC3TRo2wAfR92YwBKfG6C2eal+omjKXwYw=
 github.com/golangci/dupl v0.0.0-20260401084720-c99c5cf5c202 h1:CbTB8KpqnViI6lIXxp03Oclc4VFHi3K4BWC1TacsZ+A=
 github.com/golangci/dupl v0.0.0-20260401084720-c99c5cf5c202/go.mod h1:NUw9Zr2Sy7+HxzdjIULge71wI6yEg1lWQr7Evcu8K0E=
 github.com/golangci/go-printf-func-name v0.1.1 h1:hIYTFJqAGp1iwoIfsNTpoq1xZAarogrvjO9AfiW3B4U=
 github.com/golangci/go-printf-func-name v0.1.1/go.mod h1:Es64MpWEZbh0UBtTAICOZiB+miW53w/K9Or/4QogJss=
 github.com/golangci/gofmt v0.0.0-20260820135601-e84e05053792 h1:WL8YKrt3UbOBqSRU7GpP5BTtQTMWtVtj+mfPijgZeIg=
 github.com/golangci/gofmt v0.0.0-20260820135601-e84e05053792/go.mod h1:te5hX0dW4C5r6YbXs+6ysNr8Q5UTmdIqGbb+mlFiYmA=
-github.com/golangci/golangci-lint/v2 v2.14.0 h1:ot8QffRa4LzAAEgtvNYrVs9esxQ7xoTwoAv6uhp4ngA=
-github.com/golangci/golangci-lint/v2 v2.14.0/go.mod h1:amHimCzNDP1GfVno3hIiNssjvqXmuW+CPZAHOdR4cIc=
-github.com/golangci/golines v0.15.0 h1:Qnph25g8Y1c5fdo1X7GaRDGgnMHgnxh4Gk4VfPTtRx0=
-github.com/golangci/golines v0.15.0/go.mod h1:AZjXd23tbHMpowhtnGlj9KCNsysj72aeZVVHnVcZx10=
+github.com/golangci/golangci-lint/v2 v2.15.0 h1:w94zf8HAYI7hm3164kwKsvZRuqXvY+YxeFoTbu1OLg8=
+github.com/golangci/golangci-lint/v2 v2.15.0/go.mod h1:/FRI304IxqDVhX2o3ZZ0qp8Vvz8egJdzCY5A4GjvmTU=
+github.com/golangci/golines v0.16.0 h1:xKdwzRvwzLd7V131B/dv90vUiEoTA0vQybdeqperPOg=
+github.com/golangci/golines v0.16.0/go.mod h1:mCMgRQHiCvuALJOeaNtylu09zbzvS9Ka01dfvLLJios=
 github.com/golangci/misspell v0.8.0 h1:qvxQhiE2/5z+BVRo1kwYA8yGz+lOlu5Jfvtx2b04Jbg=
 github.com/golangci/misspell v0.8.0/go.mod h1:WZyyI2P3hxPY2UVHs3cS8YcllAeyfquQcKfdeE9AFVg=
 github.com/golangci/plugin-module-register v0.1.2 h1:e5WM6PO6NIAEcij3B053CohVp3HIYbzSuP53UAYgOpg=
 github.com/golangci/plugin-module-register v0.1.2/go.mod h1:1+QGTsKBvAIvPvoY/os+G5eoqxWn70HYDm2uvUyGuVw=
 github.com/golangci/revgrep v0.8.0 h1:EZBctwbVd0aMeRnNUsFogoyayvKHyxlV3CdUA46FX2s=
 github.com/golangci/revgrep v0.8.0/go.mod h1:U4R/s9dlXZsg8uJmaR1GrloUr14D7qDl8gi2iPXJH8k=
-github.com/golangci/rowserrcheck v0.0.0-20260901154044-241134db7241 h1:0kPqfqytQizeQ9WBk487NcsGcRdS8YhHeUhXxkfEAhA=
-github.com/golangci/rowserrcheck v0.0.0-20260901154044-241134db7241/go.mod h1:lczq5oJ8PxpMESQG6dO3iFYTQPhpqoMOYw//n2FEnHA=
+github.com/golangci/rowserrcheck v0.0.0-20261005233414-e0740d52dee8 h1:oN042y1yEcpldrqY81puyNA4ZjQZJzt0U/t7HyYrMic=
+github.com/golangci/rowserrcheck v0.0.0-20261005233414-e0740d52dee8/go.mod h1:T1Bg58Sk3N352aBbPLJPpHykFWxEEwV3o4/Enn+PPU8=
 github.com/golangci/swaggoswag v0.0.0-20250504205917-77f2aca3143e h1:ai0EfmVYE2bRA5htgAG9r7s3tHsfjIhN98WshBTJ9jM=
 github.com/golangci/swaggoswag v0.0.0-20250504205917-77f2aca3143e/go.mod h1:Vrn4B5oR9qRwM+f54koyeH3yzphlecwERs0el27Fr/s=
 github.com/golangci/unconvert v0.0.0-20250410112200-a129a6e6413e h1:gD6P7NEo7Eqtt0ssnqSJNNndxe69DOQ24A5h7+i3KpM=
@@ -357,8 +357,8 @@ github.com/julz/importas v0.2.0 h1:y+MJN/UdL63QbFJHws9BVC5RpA2iq0kpjrFajTGivjQ=
 github.com/julz/importas v0.2.0/go.mod h1:pThlt589EnCYtMnmhmRYY/qn9lCf/frPOK+WMx3xiJY=
 github.com/karamaru-alpha/copyloopvar v1.2.2 h1:yfNQvP9YaGQR7VaWLYcfZUlRP2eo2vhExWKxD/fP6q0=
 github.com/karamaru-alpha/copyloopvar v1.2.2/go.mod h1:oY4rGZqZ879JkJMtX3RRkcXRkmUvH0x35ykgaKgsgJY=
-github.com/kisielk/errcheck v1.20.0 h1:9rwHBNKzd4wkDWcROy3DvFGNqEPlkxBg305rvk7HabI=
-github.com/kisielk/errcheck v1.20.0/go.mod h1:O+f80MKNwX8Oor2jwgpeQ9An7uJm+hRSgT+h22knRJU=
+github.com/kisielk/errcheck v1.30.0 h1:ZIxNDAfAd4larXHTceoZP/dYPAB90dHg1OYhA2sVh5k=
+github.com/kisielk/errcheck v1.30.0/go.mod h1:uiCAInmFuyOje4VDdbQSP9mgqf5gORYSXrDf19XilsI=
 github.com/kkHAIKE/contextcheck v1.1.6 h1:7HIyRcnyzxL9Lz06NGhiKvenXq7Zw6Q0UQu/ttjfJCE=
 github.com/kkHAIKE/contextcheck v1.1.6/go.mod h1:3dDbMRNBFaq8HFXWC1JyvDSPm43CmE6IuHam8Wr0rkg=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
@@ -370,8 +370,8 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/kulti/thelper v0.7.1 h1:fI8QITAoFVLx+y+vSyuLBP+rcVIB8jKooNSCT2EiI98=
 github.com/kulti/thelper v0.7.1/go.mod h1:NsMjfQEy6sd+9Kfw8kCP61W1I0nerGSYSFnGaxQkcbs=
-github.com/kunwardeep/paralleltest v1.0.15 h1:ZMk4Qt306tHIgKISHWFJAO1IDQJLc6uDyJMLyncOb6w=
-github.com/kunwardeep/paralleltest v1.0.15/go.mod h1:di4moFqtfz3ToSKxhNjhOZL+696QtJGCFe132CbBLGk=
+github.com/kunwardeep/paralleltest v1.0.16 h1:I0gQkLNgfigjpxWAGhx7PYj3VpswzfGrSV/715t6g+o=
+github.com/kunwardeep/paralleltest v1.0.16/go.mod h1:di4moFqtfz3ToSKxhNjhOZL+696QtJGCFe132CbBLGk=
 github.com/kyokomi/emoji/v2 v2.2.14 h1:YOF6VL52613M0Qr9v4puJDD9QQPmyyjXedDDlrGzH80=
 github.com/kyokomi/emoji/v2 v2.2.14/go.mod h1:1AnYl9IgmJZXKd5m1PEijyyUw85SqYsuAr8lpU/s+9s=
 github.com/ldez/exptostd v0.4.5 h1:kv2ZGUVI6VwRfp/+bcQ6Nbx0ghFWcGIKInkG/oFn1aQ=
@@ -408,14 +408,14 @@ github.com/matoous/godox v1.1.0 h1:W5mqwbyWrwZv6OQ5Z1a/DHGMOvXYCBP3+Ht7KMoJhq4=
 github.com/matoous/godox v1.1.0/go.mod h1:jgE/3fUXiTurkdHOLT5WEkThTSuE7yxHv5iWPa80afs=
 github.com/matryer/is v1.4.0 h1:sosSmIWwkYITGrxZ25ULNDeKiMNzFSr4V/eqBQP0PeE=
 github.com/matryer/is v1.4.0/go.mod h1:8I/i5uYgLzgsgEloJE1U6xx5HkBQpAZvepWuujKwMRU=
-github.com/mattn/go-colorable v0.1.15 h1:+u9SLTRGnXv73cEsnsmoZBom+dMU88B2M0aDcWy0/jY=
-github.com/mattn/go-colorable v0.1.15/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
+github.com/mattn/go-colorable v0.1.16 h1:+2YjeAe7xP1OQbZW1jERPWWCDLlNqFNCvjiqGiAt84A=
+github.com/mattn/go-colorable v0.1.16/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
 github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
 github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/mattn/go-runewidth v0.0.30 h1:+KUuiDA4fF0R1p5FeueHefjDm+GIM+kWfFnDjybOPgk=
 github.com/mattn/go-runewidth v0.0.30/go.mod h1:3qAiGCV4Koz/yuveO58qUefmUTRm8r0IGEXZ9jeHp/8=
-github.com/mgechev/revive v1.17.0 h1:hwTTVC3svSv9X2FA2hiYT17Uws+lfxDWhPxzBZZCREg=
-github.com/mgechev/revive v1.17.0/go.mod h1:uiVNUF8ruVh4WHm/aPs7kKEeuo+m6oO3tuOfniyzP/g=
+github.com/mgechev/revive v1.17.1 h1:z8hV0L3uJ6yrwOMnJbkc5qBJpxXa2AxYKFKERGJyA4s=
+github.com/mgechev/revive v1.17.1/go.mod h1:FRd64pJwWSEE6j8ESoaX0PixPzjh2rpNSfckbEu3rIE=
 github.com/microcosm-cc/bluemonday v1.0.27 h1:MpEUotklkwCSLeH+Qdx1VJgNqLlpY2KXwXFM08ygZfk=
 github.com/microcosm-cc/bluemonday v1.0.27/go.mod h1:jFi9vgW+H7c3V0lb6nR74Ib/DIB5OBs92Dimizgw2cA=
 github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
@@ -434,10 +434,10 @@ github.com/nakabonne/nestif v0.3.1 h1:wm28nZjhQY5HyYPx+weN3Q65k6ilSBxDb8v5S81B81
 github.com/nakabonne/nestif v0.3.1/go.mod h1:9EtoZochLn5iUprVDmDjqGKPofoUEBL8U4Ngq6aY7OE=
 github.com/niklasfasching/go-org v1.9.1 h1:/3s4uTPOF06pImGa2Yvlp24yKXZoTYM+nsIlMzfpg/0=
 github.com/niklasfasching/go-org v1.9.1/go.mod h1:ZAGFFkWvUQcpazmi/8nHqwvARpr1xpb+Es67oUGX/48=
-github.com/nishanths/exhaustive v0.13.0 h1:Rof0axOSNQaaPaPmLK5RxcRrJV2Vcv+vfUmuRy+2EAM=
-github.com/nishanths/exhaustive v0.13.0/go.mod h1:3/adQjJgvD/UFHHSYBjpK9Wbz8DOvf0FBtzx+zI0Rlo=
-github.com/nishanths/predeclared v0.2.2 h1:V2EPdZPliZymNAn79T8RkNApBjMmVKh5XRpLm/w98Vk=
-github.com/nishanths/predeclared v0.2.2/go.mod h1:RROzoN6TnGQupbC+lqggsOlcgysk3LMK/HI84Mp280c=
+github.com/nishanths/exhaustive v0.15.0 h1:uFjiO/WvrwQG+ojSZ+vtl/jAFbqA2oAtfpUWK/iKQ8M=
+github.com/nishanths/exhaustive v0.15.0/go.mod h1:2by9rYmg9FnsnLQC4Ixig4fQaWxRsY7RluxJuAu9sa0=
+github.com/nishanths/predeclared v0.3.0 h1:W3i3JK/DZS5h7QwsEIyU8ler4Z2vwEwQSxNrZzhnlfk=
+github.com/nishanths/predeclared v0.3.0/go.mod h1:gN4uryPExDME/zmZdqkKIPSAqcfprj316ZDI6UTqz70=
 github.com/nunnatsa/ginkgolinter v0.24.0 h1:Mp0EagluLFP98JatP6nqp/gGEoljNG97uf9AcxcBVy8=
 github.com/nunnatsa/ginkgolinter v0.24.0/go.mod h1:2ZMRuzX6+3XXyY6UZOwb6n+MCocVGbkIsDBC4vuWz5c=
 github.com/oasdiff/yaml v0.1.1 h1:6nHx+pn9gBRM6YpBlFZFQGCCd1nuvqOBtTD3KKTgGxY=
@@ -569,10 +569,10 @@ github.com/tetratelabs/wazero v1.12.0 h1:DuWcpNu/FzgEXgGBDp8J1Spc+CWOvvtvVyjKlaZ
 github.com/tetratelabs/wazero v1.12.0/go.mod h1:LvKtzl2RqO4gyF27BiXU+nKAjcV8f38U+kP/q2vgxh0=
 github.com/timakin/bodyclose v0.0.0-20260923065923-98ded9ab4ef2 h1:HECVafB2AKntWWRfsiQ4gdunLx5WOYQzFdCsxqOrzp8=
 github.com/timakin/bodyclose v0.0.0-20260923065923-98ded9ab4ef2/go.mod h1:JLoPVtROtNgJ99yXTIxuGNttvmJa85tkJAO6lr05qBA=
-github.com/timonwong/loggercheck v0.12.0 h1:7Cb9XGLJZSWYNjgL459DIhpSiEHupD+MLQ6vaN2Pl3g=
-github.com/timonwong/loggercheck v0.12.0/go.mod h1:Wa6Y+SJHQR01mViZlLLY5GAZVOWOLNMbkXddMjFWQCs=
-github.com/tomarrell/wrapcheck/v2 v2.12.0 h1:H/qQ1aNWz/eeIhxKAFvkfIA+N7YDvq6TWVFL27Of9is=
-github.com/tomarrell/wrapcheck/v2 v2.12.0/go.mod h1:AQhQuZd0p7b6rfW+vUwHm5OMCGgp63moQ9Qr/0BpIWo=
+github.com/timonwong/loggercheck v0.13.0 h1:6amIOmLLPFYt24rXUbNWzcJeNGuJc+3c31tZtO85VHs=
+github.com/timonwong/loggercheck v0.13.0/go.mod h1:thn3allpox0fI5JeUWTCwiwp45peQxCZZHkHuA1Oc6I=
+github.com/tomarrell/wrapcheck/v2 v2.13.0 h1:jYbLNs8PDkzGCY6d5LUzJdY7Bq//CTlb2HxZGV5z0JY=
+github.com/tomarrell/wrapcheck/v2 v2.13.0/go.mod h1:AQhQuZd0p7b6rfW+vUwHm5OMCGgp63moQ9Qr/0BpIWo=
 github.com/tommy-muehle/go-mnd/v2 v2.5.1 h1:NowYhSdyE/1zwK9QCLeRb6USWdoif80Ie+v+yU8u1Zw=
 github.com/tommy-muehle/go-mnd/v2 v2.5.1/go.mod h1:WsUAkMJMYww6l/ufffCD3m+P7LEvr8TnZn9lwVDlgzw=
 github.com/ultraware/funlen v0.2.0 h1:gCHmCn+d2/1SemTdYMiKLAHFYxTYz7z9VIDRaTGyLkI=
@@ -581,10 +581,10 @@ github.com/ultraware/whitespace v0.2.0 h1:TYowo2m9Nfj1baEQBjuHzvMRbp19i+RCcRYrSW
 github.com/ultraware/whitespace v0.2.0/go.mod h1:XcP1RLD81eV4BW8UhQlpaR+SDc2givTvyI8a586WjW8=
 github.com/urfave/cli/v2 v2.27.7 h1:bH59vdhbjLv3LAvIu6gd0usJHgoTTPhCFib8qqOwXYU=
 github.com/urfave/cli/v2 v2.27.7/go.mod h1:CyNAG/xg+iAOg0N4MPGZqVmv2rCoP267496AOXUZjA4=
-github.com/uudashr/gocognit v1.2.1 h1:CSJynt5txTnORn/DkhiB4mZjwPuifyASC8/6Q0I/QS4=
-github.com/uudashr/gocognit v1.2.1/go.mod h1:acaubQc6xYlXFEMb9nWX2dYBzJ/bIjEkc1zzvyIZg5Q=
-github.com/uudashr/iface v1.5.1 h1:BS3yrgaT55s3dAtJoxuTnsZNbsejq/mVuzp49YDyfBA=
-github.com/uudashr/iface v1.5.1/go.mod h1:5UWoT6SvTdTww/KToRj6clO+n4Kg3/NrAQvgOB+5Ggw=
+github.com/uudashr/gocognit v1.3.0 h1:Xdw5JwAoYmX3WAB+wsXY3nxEwdw7+MWAnM0wCAAv7A4=
+github.com/uudashr/gocognit v1.3.0/go.mod h1:acaubQc6xYlXFEMb9nWX2dYBzJ/bIjEkc1zzvyIZg5Q=
+github.com/uudashr/iface v1.5.3 h1:N61bzr11L7BHP6Rct+C6zQePHjSTMeyVBq+s03uB/Ds=
+github.com/uudashr/iface v1.5.3/go.mod h1:5UWoT6SvTdTww/KToRj6clO+n4Kg3/NrAQvgOB+5Ggw=
 github.com/xen0n/gosmopolitan v1.3.0 h1:zAZI1zefvo7gcpbCOrPSHJZJYA9ZgLfJqtKzZ5pHqQM=
 github.com/xen0n/gosmopolitan v1.3.0/go.mod h1:rckfr5T6o4lBtM1ga7mLGKZmLxswUoH1zxHgNXOsEt4=
 github.com/xo/terminfo v1.2.0 h1:d0ZTOCpuGE0lwSAOs0zcJjwz3jWQyqcRt9XbGJpCOl4=
@@ -649,8 +649,8 @@ golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.6.0-dev.0.20220106191415-9b9b3d81d5e3/go.mod h1:3p9vT2HGsQu2K1YbXdKPJLVgG5VJdoTa1poYQBtP1AY=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c=
-golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o=
+golang.org/x/mod v0.42.0 h1:ICeL3t2L30ljSPHHxDnR4fqVcBt/zR2zJAb9juavmQg=
+golang.org/x/mod v0.42.0/go.mod h1:u5fzIrRInkL8MaO1cbRkUHT64v303YIT5KEqpNr7jRs=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
@@ -660,8 +660,8 @@ golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v
 golang.org/x/net v0.0.0-20211015210444-4f30a5c0130f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues=
-golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/net v0.61.0 h1:RR+6j/BTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw=
+golang.org/x/net v0.61.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -669,8 +669,8 @@ golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk=
-golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
+golang.org/x/sync v0.24.0 h1:iqiDrGoDgyuvAKrhLQthUEzU/R378N78gXbBjxed7oA=
+golang.org/x/sync v0.24.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -684,8 +684,8 @@ golang.org/x/sys v0.0.0-20211105183446-c75c47738b0c/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
-golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
@@ -706,8 +706,8 @@ golang.org/x/tools v0.1.1-0.20210302220138-2ac05c832e1a/go.mod h1:9bzcO0MWcOuT0t
 golang.org/x/tools v0.1.10/go.mod h1:Uh6Zz+xoGYZom868N8YTex3t7RhtHDBrE8Gzo9bV56E=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/tools v0.50.0 h1:c2ifzfcuY7L90lZ2aKd8S4K2NpASF08SZx9ZuJkHmSU=
-golang.org/x/tools v0.50.0/go.mod h1:7ulVMw3831Mwi5EZD6RomGyffr4VFjuNYXf2BbCEAV0=
+golang.org/x/tools v0.52.0 h1:ryxg4U63oaUYk7uOLTF37n43f4qgtGvqV4Ioit1BaEs=
+golang.org/x/tools v0.52.0/go.mod h1:ItcP5UNaVGG+Yc4eIYmaFLNJ4soEopkx5Y2d4lcEurs=
 golang.org/x/tools/go/expect v0.1.1-deprecated h1:jpBZDwmgPhXsKZC6WhL20P4b/wmnpsEAGHaNy0n/rJM=
 golang.org/x/tools/go/expect v0.1.1-deprecated/go.mod h1:eihoPOH+FgIqa3FpoTwguz/bVUSGBlGQU67vpBeOrBY=
 golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated h1:1h2MnaIAIXISqTFKdENegdpAgUXz6NrPEsbIeWaBRvM=
@@ -724,8 +724,8 @@ gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EV
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-honnef.co/go/tools v0.8.1 h1:+JKf3xJ1ni4CwrhVg4/pqsfPGP6vNAXcKbMXJodYx3w=
-honnef.co/go/tools v0.8.1/go.mod h1:XA+OnlRA9EDh/ukGvXMNSZNKGwFQJ+5dER0ioUkOxks=
+honnef.co/go/tools v0.8.2 h1:+jPbCzuYxYrcoOvCecYUFDj+XJQRmzIhJmlbpps21Zk=
+honnef.co/go/tools v0.8.2/go.mod h1:xG1Q4n+mg3bKZrO6RWFA9jFlkqplflmDRHGeuexiLDs=
 mvdan.cc/gofumpt v0.12.0 h1:1Lbudkz2kpM9Cjz2pL4M19u7q+GaEhCTNf7N9mfpcho=
 mvdan.cc/gofumpt v0.12.0/go.mod h1:SmBHHrljiZu/uoypeKup3rFzP6eoC9UwCp2iH5E3jZA=
 mvdan.cc/unparam v0.0.0-20260823230713-2fa3d841b0c8 h1:Re1NRyLpiAt9kB+ImaaoapwWiQXrKwER4tY8fLOkDew=

backend/cmd/cli.go

@@ -248,12 +248,12 @@ func createConfig(configpath string, noInput bool) error {
 	}
 	adminUsername := askQuestion(reader, "What should the default admin username be?", "admin")
 	if adminUsername != "admin" {
-		config.Auth.AdminUsername = adminUsername
+		config.Auth.Methods.PasswordAuth.AdminUsername = adminUsername
 	}
 	const adminPasswordGenerateDefault = "generate on startup"
 	adminPassword := askQuestion(reader, "What should the default admin password be?", adminPasswordGenerateDefault)
 	if adminPassword != "" && !strings.EqualFold(adminPassword, adminPasswordGenerateDefault) {
-		config.Auth.AdminPassword = adminPassword
+		config.Auth.Methods.PasswordAuth.AdminPassword = adminPassword
 	}
 
 	modifyDefault := askYesNoQuestion(reader, "Should a new user be able to modify content by default?", "no")
@@ -293,18 +293,23 @@ func createConfig(configpath string, noInput bool) error {
 	return nil
 }
 
+// setupConfigYAMLCandidates lists on-disk setup templates for config.generated.yaml.
+var setupConfigYAMLCandidates = []string{
+	"frontend/public/config.generated.yaml",
+	"../frontend/public/config.generated.yaml",
+	"internal/web/dist/config.generated.yaml",
+	"../internal/web/dist/config.generated.yaml",
+	"backend/internal/web/dist/config.generated.yaml",
+}
+
+func readSetupConfigTemplateYAML() (string, error) {
+	return settings.ReadFirstExistingFile(setupConfigYAMLCandidates)
+}
+
 func generateSetupConfigYAML(config *settings.Settings) (string, error) {
-	embeddedPaths := []string{
-		"frontend/public/config.generated.yaml",
-		"../frontend/public/config.generated.yaml",
-		"internal/web/dist/config.generated.yaml",
-		"../internal/web/dist/config.generated.yaml",
-	}
-	for _, path := range embeddedPaths {
-		embeddedYaml, err := os.ReadFile(path)
-		if err == nil && len(embeddedYaml) > 0 {
-			return settings.GenerateConfigYamlWithEmbedded(config, true, false, false, string(embeddedYaml))
-		}
+	embeddedYaml, err := readSetupConfigTemplateYAML()
+	if err == nil {
+		return settings.GenerateConfigYamlWithEmbedded(config, true, false, false, embeddedYaml)
 	}
 	return settings.GenerateConfigYaml(config, true, false, false)
 }

backend/cmd/cli_setup_yaml_test.go

@@ -0,0 +1,47 @@
+package cmd
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func writeSetupConfigYAML(t *testing.T, root, relPath, content string) {
+	t.Helper()
+	path := filepath.Join(root, filepath.FromSlash(relPath))
+	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(path, []byte(content), 0o644); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestReadSetupConfigTemplateYAML_fromDist(t *testing.T) {
+	root := t.TempDir()
+	writeSetupConfigYAML(t, root, "internal/web/dist/config.generated.yaml", "dist-content")
+	t.Chdir(root)
+
+	got, err := readSetupConfigTemplateYAML()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got != "dist-content" {
+		t.Fatalf("readSetupConfigTemplateYAML() = %q, want dist-content", got)
+	}
+}
+
+func TestReadSetupConfigTemplateYAML_prefersFrontendPublic(t *testing.T) {
+	root := t.TempDir()
+	writeSetupConfigYAML(t, root, "frontend/public/config.generated.yaml", "from-public")
+	writeSetupConfigYAML(t, root, "internal/web/dist/config.generated.yaml", "from-dist")
+	t.Chdir(root)
+
+	got, err := readSetupConfigTemplateYAML()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got != "from-public" {
+		t.Fatalf("readSetupConfigTemplateYAML() = %q, want from-public", got)
+	}
+}

backend/cmd/main_test.go

@@ -0,0 +1,12 @@
+package cmd
+
+import (
+	"os"
+	"testing"
+
+	"github.com/gtsteffaniak/filebrowser/backend/internal/testutil"
+)
+
+func TestMain(m *testing.M) {
+	os.Exit(testutil.Main(m))
+}

backend/cmd/migrate.go

@@ -289,6 +289,9 @@ func migrateUsers(oldDB *storm.DB, sqlStore *sqldb.SQLStore) error {
 		prevVersion := user.Version
 		if len(user.BackendScopes) == 0 {
 			settings.ApplyUserDefaults(user)
+			if !user.Permissions.Admin {
+				settings.ExpandBackendScopesForCreateUserDir(user)
+			}
 		}
 		if prevVersion < users.SourcePermissionsMigrationVersion {
 			// ApplyUserDefaults bumps Version; restore pre-defaults version so legacy global file ops migrate to scopes.

backend/cmd/migrate_users_defaults_test.go

@@ -27,6 +27,9 @@ func TestMigrateUsersFlow_appliesConfigDefaultsAndSourcePermissions(t *testing.T
 	prevVersion := user.Version
 	if len(user.BackendScopes) == 0 {
 		settings.ApplyUserDefaults(user)
+		if !user.Permissions.Admin {
+			settings.ExpandBackendScopesForCreateUserDir(user)
+		}
 	}
 	if prevVersion < users.SourcePermissionsMigrationVersion {
 		user.Version = prevVersion
@@ -50,7 +53,7 @@ func TestMigrateUsersFlow_appliesConfigDefaultsAndSourcePermissions(t *testing.T
 		t.Fatalf("scope permissions after migration: %+v", perms)
 	}
 	if user.BackendScopes[0].Scope != "/legacy-bolt-user" {
-		t.Fatalf("createUserDir scope=%q", user.BackendScopes[0].Scope)
+		t.Fatalf("scope after applying migration defaults=%q", user.BackendScopes[0].Scope)
 	}
 }
 

backend/cmd/root.go

@@ -9,14 +9,13 @@ import (
 	"syscall"
 	"time"
 
-	_ "net/http/pprof"
-
 	"github.com/gtsteffaniak/filebrowser/backend/internal/adapters/fs/fileutils"
 	"github.com/gtsteffaniak/filebrowser/backend/internal/analytics"
 	"github.com/gtsteffaniak/filebrowser/backend/internal/app"
 	"github.com/gtsteffaniak/filebrowser/backend/internal/icons"
 	"github.com/gtsteffaniak/filebrowser/backend/internal/preview"
 	"github.com/gtsteffaniak/filebrowser/backend/internal/state"
+	"github.com/gtsteffaniak/filebrowser/backend/internal/transcoding"
 	"github.com/gtsteffaniak/filebrowser/backend/internal/utils"
 	"github.com/gtsteffaniak/filebrowser/backend/internal/version"
 	"github.com/gtsteffaniak/filebrowser/backend/internal/web"
@@ -52,6 +51,12 @@ func initializeDatabase(configFile string, cliMode bool) bool {
 	if err != nil {
 		logger.Fatalf("could not initialize state: %v", err)
 	}
+	// state.Open applies persisted media settings, so initialize ffmpeg once here
+	// (before wiring, which reads Env.FFmpegAvailable) instead of during config
+	// load, which would run the multi-second hardware codec probe twice.
+	if !cliMode {
+		settings.InitFFmpeg()
+	}
 	runtimeApp, err = app.WireServices(store)
 	if err != nil {
 		logger.Fatalf("could not wire services: %v", err)
@@ -87,14 +92,7 @@ func StartFilebrowser() {
 	done := make(chan struct{})             // Signals server has stopped
 	shutdownComplete := make(chan struct{}) // Signals shutdown process is complete
 
-	// Dev mode enables development features like template hot-reloading
-	_, err := os.Stat("internal/web/dist")
-	// In dev mode, always use filesystem assets. Otherwise, check if internal/web/dist exists
-	if !settings.Env.IsDevMode {
-		settings.Env.EmbeddedFs = os.IsNotExist(err)
-	}
-
-	err = utils.SetInvalidPasswordHash()
+	err := utils.SetInvalidPasswordHash()
 	if err != nil {
 		logger.Fatalf("Failed to set security hash: %v", err)
 	}
@@ -180,6 +178,13 @@ func StartFilebrowser() {
 		fileutils.ClearCacheDir(settings.Config.Server.CacheDir)
 	}
 	<-shutdownComplete
+	if transcodeMgr := transcoding.Default(); transcodeMgr != nil {
+		shutdownCtx, shutdownCancel := context.WithTimeout(context.Background(), 30*time.Second)
+		if err := transcodeMgr.Close(shutdownCtx); err != nil {
+			logger.Warningf("transcode shutdown: %v", err)
+		}
+		shutdownCancel()
+	}
 	if err := fileutils.ClearDirectoryContents(settings.DownloadCacheDir()); err != nil {
 		logger.Warningf("failed to clear download spool on shutdown: %v", err)
 	}
@@ -194,15 +199,17 @@ func rootCMD(ctx context.Context, serverConfig *settings.Server, a *app.App, shu
 	numWorkers := settings.Config.Server.NumImageProcessors
 
 	// Initialize asset filesystem before starting services
-	if settings.Env.EmbeddedFs {
+	if !settings.Env.IsDevMode && web.EmbeddedFrontendAvailable() {
 		embeddedAssets := web.GetEmbeddedAssets()
-		subAssets, err := fs.Sub(embeddedAssets, "embed")
+		subAssets, err := fs.Sub(embeddedAssets, "dist")
 		if err != nil {
 			logger.Fatalf("Failed to create sub filesystem: %v", err)
 		}
-		fileutils.InitAssetFS(subAssets, true)
+		settings.Env.EmbeddedFs = true
+		fileutils.InitAssetFS(subAssets, true, false)
 	} else {
-		fileutils.InitAssetFS(nil, false)
+		settings.Env.EmbeddedFs = false
+		fileutils.InitAssetFS(nil, false, settings.Env.IsDevMode)
 	}
 
 	// Start preview service
@@ -210,8 +217,6 @@ func rootCMD(ctx context.Context, serverConfig *settings.Server, a *app.App, shu
 	if err != nil {
 		logger.Fatalf("Error starting preview service: %v", err)
 	}
-	logger.Debugf("MuPDF Enabled            : %v", settings.Env.MuPdfAvailable)
-
 	// Generate PWA icons after preview service is initialized
 	if err := icons.GeneratePWAIcons(); err != nil {
 		logger.Warningf("Failed to generate PWA icons: %v", err)

backend/cmd/user.go

@@ -74,10 +74,7 @@ func validateUserInfo(newDB bool) {
 		if bumpToNewestVersion(user, tokenBackfillFailed) {
 			changedFields = append(changedFields, "version")
 		}
-		adminUser := settings.Config.Auth.AdminUsername
-		if adminUser == "" {
-			adminUser = "admin"
-		}
+		adminUser := settings.PasswordAdminUsername()
 		if user.Username == adminUser && user.Permissions.Admin {
 			adminPerms := settings.AdminPerms()
 			if user.Permissions.Share != adminPerms.Share || user.Permissions.Api != adminPerms.Api {
@@ -90,7 +87,7 @@ func validateUserInfo(newDB bool) {
 		if user.Username == adminUser && settings.ConfigTriggersAdminPasswordReset() && user.LoginMethod == users.LoginMethodPassword {
 			logger.Info("Resetting admin user to default username and password.")
 			user.Permissions = settings.AdminPerms()
-			user.Password = settings.Config.Auth.AdminPassword
+			user.Password = settings.PasswordAdminPassword()
 			user.LoginMethod = users.LoginMethodPassword
 			changedFields = append(changedFields, "permissions", "password", "loginMethod")
 			changePass = true
@@ -138,7 +135,7 @@ func dedupeFields(fields []string) []string {
 }
 
 func updateUserScopes(user *users.User) bool {
-	newScopes := settings.MergeDefaultEnabledBackendScopes(user.BackendScopes)
+	newScopes := settings.MergeDefaultEnabledBackendScopes(user.BackendScopes, user.DeclinedDefaultSources)
 	changed := !reflect.DeepEqual(user.BackendScopes, newScopes)
 	user.BackendScopes = newScopes
 	return changed

backend/config.playwright-performance.yaml

@@ -1,9 +1,6 @@
 http:
   port: 8080
   baseURL: "/"
-frontend:
-  styling:
-    disableEventThemes: true
 server:
   logging:
     - levels: "info|warning|error"

backend/config.playwright.yaml

@@ -18,7 +18,6 @@ server:
 
 userDefaults:
   fileViewer:
-    editorQuickSave: false
     disableOnlyOfficeExt: ".md .txt .pdf"
     disableViewingExt: ""
   sidebar:
@@ -53,6 +52,7 @@ userDefaults:
     lockPassword: false
     disableSettings: false
     disableUpdateNotifications: false
+    showAdvancedProfile: false
     permissions:
       api: false
       admin: false
@@ -62,3 +62,7 @@ userDefaults:
 #office:
 #  url: "http://localhost:9052"
 #  secret: "6H1H7GzUk2alRkNxAPav0W02g8JS5oUd"
+
+integrations:
+  media:
+    skipHwCheck: true

backend/default.pgo.provenance.json

@@ -0,0 +1,23 @@
+{
+  "generatedAt": "2026-10-27T14:46:52Z",
+  "gitHead": "880900c18dc7655899398cfb7327ab4e191fc3f0",
+  "profileSha256": "371d012d4ed5bc3907667f6d35876c998af98a6cc3c71f6ea4ddf57ab4ed4bbd",
+  "workloads": [
+    "internal/thumb BenchmarkMJPEGSmall/Large",
+    "internal/thumb BenchmarkMP4H264Large",
+    "internal/thumb BenchmarkMP4H264Small (full pipeline)",
+    "internal/thumb BenchmarkMP4H264Baseline1080Small (CAVLC + thumb)",
+    "internal/thumb BenchmarkMP4H264Main1080Large",
+    "internal/thumb BenchmarkMP4H264High1080Large",
+    "internal/thumb BenchmarkThumbnailLargeWebM",
+    "internal/h264 BenchmarkBaselineThumbnailDecode (CAVLC IDR)"
+  ],
+  "hotPathGlobs": [
+    "internal/thumb/**/*.go",
+    "internal/h264/**/*.go",
+    "internal/kernels/**/*.go",
+    "internal/isobmff/**/*.go",
+    "internal/matroska/**/*.go",
+    "internal/jpegfast/**/*.go"
+  ]
+}

backend/go.mod

@@ -1,6 +1,6 @@
 module github.com/gtsteffaniak/filebrowser/backend
 
-go 1.27.0
+go 1.27.1
 
 require (
 	github.com/alecthomas/kong v1.16.1
@@ -10,8 +10,8 @@ require (
 	github.com/dhowden/tag v0.0.0-20240417053706-3d75831295e8
 	github.com/dsoprea/go-exif/v3 v3.0.1
 	github.com/evanoberholster/imagemeta v1.1.0
-	github.com/gen2brain/go-fitz v1.28.2
-	github.com/go-ldap/ldap/v3 v3.4.14
+	github.com/gen2brain/folio v0.2.8
+	github.com/go-ldap/ldap/v3 v3.4.15
 	github.com/go-playground/validator/v10 v10.30.5
 	github.com/go-webauthn/webauthn v0.18.2
 	github.com/goccy/go-yaml v1.19.2
@@ -19,43 +19,50 @@ require (
 	github.com/google/go-cmp v0.7.0
 	github.com/google/uuid v1.6.0
 	github.com/gtsteffaniak/go-cache v1.1.0
-	github.com/gtsteffaniak/go-ffmpeg v0.5.2
+	github.com/gtsteffaniak/go-ffmpeg v1.6.2
 	github.com/gtsteffaniak/go-logger v1.1.0
-	github.com/kovidgoyal/imaging v1.8.23
-	github.com/mattn/go-sqlite3 v1.14.52
+	github.com/gtsteffaniak/go-media v1.2.1
+	github.com/kovidgoyal/imaging v1.9.0
 	github.com/pquerna/otp v1.5.0
 	github.com/spf13/afero v1.15.0
 	github.com/stretchr/testify v1.12.1
-	github.com/swaggo/http-swagger v1.3.4
 	github.com/swaggo/swag v1.16.6
-	golang.org/x/crypto v0.57.0
-	golang.org/x/image v0.46.0
-	golang.org/x/mod v0.41.0
-	golang.org/x/net v0.59.0
+	golang.org/x/crypto v0.58.0
+	golang.org/x/image v0.47.0
+	golang.org/x/mod v0.42.0
+	golang.org/x/net v0.61.0
 	golang.org/x/oauth2 v0.37.0
-	golang.org/x/sys v0.48.0
-	golang.org/x/term v0.46.0
+	golang.org/x/sync v0.24.0
+	golang.org/x/sys v0.49.0
+	golang.org/x/term v0.47.0
+	golang.org/x/text v0.43.0
 	golang.org/x/time v0.16.0
-	golang.org/x/tools v0.50.0
+	golang.org/x/tools v0.52.0
 	gopkg.in/yaml.v3 v3.0.1
-	modernc.org/sqlite v1.59.0
+	modernc.org/sqlite v1.60.1
 )
 
 require (
 	github.com/Azure/go-ntlmssp v0.1.1 // indirect
+	github.com/Eyevinn/mp4ff v0.61.0 // indirect
 	github.com/KyleBanks/depth v1.2.1 // indirect
+	github.com/abema/go-mp4 v1.7.4 // indirect
+	github.com/at-wat/ebml-go v0.19.4 // indirect
 	github.com/boombuler/barcode v1.1.0 // indirect
 	github.com/dsoprea/go-logging v0.0.0-20200710184922-b02d349568dd // indirect
 	github.com/dsoprea/go-utility/v2 v2.0.0-20221003172846-a3e1774ef349 // indirect
 	github.com/dustin/go-humanize v1.1.0 // indirect
-	github.com/ebitengine/purego v0.11.1 // indirect
-	github.com/fxamacker/cbor/v2 v2.9.4 // indirect
-	github.com/gabriel-vasile/mimetype v1.4.15 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.6 // indirect
+	github.com/gabriel-vasile/mimetype v1.4.16 // indirect
+	github.com/gen2brain/gav1d v0.2.6 // indirect
+	github.com/gen2brain/h265 v0.2.4 // indirect
+	github.com/gen2brain/jxl v0.2.0 // indirect
+	github.com/gen2brain/vpx v0.2.1 // indirect
 	github.com/go-asn1-ber/asn1-ber v1.5.8 // indirect
 	github.com/go-errors/errors v1.5.1 // indirect
-	github.com/go-jose/go-jose/v4 v4.1.5 // indirect
-	github.com/go-openapi/jsonpointer v1.0.1 // indirect
-	github.com/go-openapi/jsonreference v1.0.2 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.6 // indirect
+	github.com/go-openapi/jsonpointer v1.0.2 // indirect
+	github.com/go-openapi/jsonreference v1.0.3 // indirect
 	github.com/go-openapi/spec v1.0.1 // indirect
 	github.com/go-openapi/swag/conv v0.29.2 // indirect
 	github.com/go-openapi/swag/jsonutils v0.29.2 // indirect
@@ -64,44 +71,37 @@ require (
 	github.com/go-openapi/swag/stringutils v0.29.2 // indirect
 	github.com/go-openapi/swag/typeutils v0.29.2 // indirect
 	github.com/go-openapi/swag/yamlutils v0.29.2 // indirect
-	github.com/go-playground/locales v0.14.1 // indirect
+	github.com/go-playground/locales v0.14.2 // indirect
 	github.com/go-playground/universal-translator v0.18.2 // indirect
 	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
 	github.com/go-webauthn/x v0.3.1 // indirect
 	github.com/golang-jwt/jwt/v5 v5.3.1 // indirect
-	github.com/golang/geo v0.0.0-20260818125358-b200a1149890 // indirect
+	github.com/golang/geo v0.0.0-20260928092222-7d12f68cfadb // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/golang/snappy v0.0.4 // indirect
 	github.com/google/go-tpm v0.9.8 // indirect
+	github.com/gtsteffaniak/go-av1 v1.0.0 // indirect
+	github.com/gtsteffaniak/go-vpx v1.0.1 // indirect
 	github.com/kovidgoyal/go-parallel v1.1.1 // indirect
 	github.com/kovidgoyal/go-shm v1.0.0 // indirect
 	github.com/kr/pretty v0.3.1 // indirect
 	github.com/leodido/go-urn v1.5.0 // indirect
 	github.com/mattn/go-isatty v0.0.24 // indirect
-	github.com/ncruces/go-strftime v1.0.0 // indirect
-	github.com/philhofer/fwd v1.2.0 // indirect
+	github.com/ncruces/go-strftime v1.1.0 // indirect
+	github.com/philhofer/fwd v1.2.1 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/rogpeppe/go-internal v1.16.0 // indirect
 	github.com/rwcarlsen/goexif v0.0.0-20190401172101-9e8deecbddbd // indirect
-	github.com/swaggo/files v1.0.1 // indirect
-	github.com/tinylib/msgp v1.6.4 // indirect
+	github.com/tinylib/msgp v1.6.5 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	go.etcd.io/bbolt v1.5.0 // indirect
 	go.yaml.in/yaml/v3 v3.0.5 // indirect
-	golang.org/x/sync v0.23.0 // indirect
-	golang.org/x/text v0.42.0 // indirect
 	google.golang.org/appengine v1.6.8 // indirect
 	google.golang.org/protobuf v1.36.12 // indirect
 	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
-	modernc.org/libc v1.77.1 // indirect
+	modernc.org/libc v1.79.0 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
 	modernc.org/memory v1.12.1 // indirect
 )
-
-exclude (
-	github.com/alecthomas/go-check-sumtype v0.5.0
-	github.com/gtsteffaniak/go-ffmpeg v1.1.0
-	github.com/gtsteffaniak/go-ffmpeg v1.2.0
-)

backend/go.sum

@@ -2,10 +2,14 @@ github.com/Azure/go-ntlmssp v0.1.1 h1:l+FM/EEMb0U9QZE7mKNEDw5Mu3mFiaa2GKOoTSsNDP
 github.com/Azure/go-ntlmssp v0.1.1/go.mod h1:NYqdhxd/8aAct/s4qSYZEerdPuH1liG2/X9DiVTbhpk=
 github.com/DataDog/zstd v1.4.1 h1:3oxKN3wbHibqx897utPC2LTQU4J+IHWWJO+glkAkpFM=
 github.com/DataDog/zstd v1.4.1/go.mod h1:1jcaCB/ufaK+sKp1NBhlGmpz41jOoPQ35bpF36t7BBo=
+github.com/Eyevinn/mp4ff v0.61.0 h1:uX3GBauEouxuGepRbv15JB7X2RyVyE2EZEfLpgimL6o=
+github.com/Eyevinn/mp4ff v0.61.0/go.mod h1:97zsDIJUiDTYqKpqq/b1K9foamxXmvsgE4GdPrPK3ks=
 github.com/KyleBanks/depth v1.2.1 h1:5h8fQADFrWtarTdtDudMmGsC7GPbOAu6RVB3ffsVFHc=
 github.com/KyleBanks/depth v1.2.1/go.mod h1:jzSb9d0L43HxTQfT+oSA1EEp2q+ne2uh6XgeJcm8brE=
 github.com/Sereal/Sereal v0.0.0-20190618215532-0b8ac451a863 h1:BRrxwOZBolJN4gIwvZMJY1tzqBvQgpaZiQRuIDD40jM=
 github.com/Sereal/Sereal v0.0.0-20190618215532-0b8ac451a863/go.mod h1:D0JMgToj/WdxCgd30Kc1UcA9E+WdZoJqeVOuYW7iTBM=
+github.com/abema/go-mp4 v1.7.4 h1:MztDjMx3nac+Lktig9wrUa962Mnyi4+ZtDtpbHuckww=
+github.com/abema/go-mp4 v1.7.4/go.mod h1:vPl9t5ZK7K0x68jh12/+ECWBCXoWuIDtNgPtU2f04ws=
 github.com/alecthomas/assert/v2 v2.11.0 h1:2Q9r3ki8+JYXvGsDyBXwH3LcJ+WK5D0gc5E8vS6K3D0=
 github.com/alecthomas/assert/v2 v2.11.0/go.mod h1:Bze95FyfUr7x34QZrjL+XP+0qgp/zg8yS+TtBj1WA3k=
 github.com/alecthomas/kong v1.16.1 h1:ixhCt93XkJ98kGposQ54+bl0IK6XwqB40AsMynU7Z8E=
@@ -16,6 +20,8 @@ github.com/alexbrainman/sspi v0.0.0-20250919150558-7d374ff0d59e h1:4dAU9FXIyQktp
 github.com/alexbrainman/sspi v0.0.0-20250919150558-7d374ff0d59e/go.mod h1:cEWa1LVoE5KvSD9ONXsZrj0z6KqySlCCNKHlLzbqAt4=
 github.com/asdine/storm/v3 v3.2.1 h1:I5AqhkPK6nBZ/qJXySdI7ot5BlXSZ7qvDY1zAn5ZJac=
 github.com/asdine/storm/v3 v3.2.1/go.mod h1:LEpXwGt4pIqrE/XcTvCnZHT5MgZCV6Ub9q7yQzOFWr0=
+github.com/at-wat/ebml-go v0.19.4 h1:6F767ThzH/JqNUsF79PwRFP0pwUF5ALXWJ6pXuiolI8=
+github.com/at-wat/ebml-go v0.19.4/go.mod h1:wu3fQj+DWo6SOOl9c4yDi+gFs9Oa96Z2B5qxo1OxFYY=
 github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
 github.com/boombuler/barcode v1.1.0 h1:ChaYjBR63fr4LFyGn8E8nt7dBSt3MiU3zMOZqFvVkHo=
 github.com/boombuler/barcode v1.1.0/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
@@ -23,6 +29,7 @@ github.com/coreos/go-oidc/v3 v3.21.0 h1:wZo4Q9Pum8dYEj0eMUPrqR+kvuGkeUplbLpNCkBq
 github.com/coreos/go-oidc/v3 v3.21.0/go.mod h1:DYCf24+ncYi+XkIH97GY1+dqoRlbaSI26KVTCI9SrY4=
 github.com/coreos/go-systemd/v22 v22.7.0 h1:LAEzFkke61DFROc7zNLX/WA2i5J8gYqe0rSj9KI28KA=
 github.com/coreos/go-systemd/v22 v22.7.0/go.mod h1:xNUYtjHu2EDXbsxz1i41wouACIwT7Ybq9o0BQhMwD0w=
+github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7DoTY=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -47,16 +54,22 @@ github.com/dsoprea/go-utility/v2 v2.0.0-20221003172846-a3e1774ef349 h1:DilThiXje
 github.com/dsoprea/go-utility/v2 v2.0.0-20221003172846-a3e1774ef349/go.mod h1:4GC5sXji84i/p+irqghpPFZBF8tRN/Q7+700G0/DLe8=
 github.com/dustin/go-humanize v1.1.0 h1:dbKTrvD0klcbBV/h4AWJdMuZogJACoMlvWIWZ5b2xWg=
 github.com/dustin/go-humanize v1.1.0/go.mod h1:hc1CvRkJMsgxqjmjMQF3QNRAZBwY8AXBAzKYoSX9sFI=
-github.com/ebitengine/purego v0.11.1 h1:2zpWRSQNVKN4eKsKO9eM1ILDgWfYMY9GwqRmK6XeQ/0=
-github.com/ebitengine/purego v0.11.1/go.mod h1:DCHPP08djqhNSoTfImcnHYQRZmd0qhakvrozqaEYhGQ=
 github.com/evanoberholster/imagemeta v1.1.0 h1:0iBtgVxLORZTZAlKxRcNodBmjMfHCSFwUh8Asmi83oI=
 github.com/evanoberholster/imagemeta v1.1.0/go.mod h1:nmf6le+qSyoRAXgp2psPbtfkxcEgf/AZGgai9pnN8d0=
-github.com/fxamacker/cbor/v2 v2.9.4 h1:xwjVlxEMR3S605oUlgBjKLTTeGFciYPGYCtF/35LKGo=
-github.com/fxamacker/cbor/v2 v2.9.4/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
-github.com/gabriel-vasile/mimetype v1.4.15 h1:05iP/CYtZ/w455R/KZM6rZ5ieAdh99UPtd+d3YzLmaI=
-github.com/gabriel-vasile/mimetype v1.4.15/go.mod h1:azpTcoLcDZRNgFou5j+APrqQx9HqVPWa6ijYQIIVswQ=
-github.com/gen2brain/go-fitz v1.28.2 h1:845G85N5TUgnq5oDqyYrW0JvehAkeo35UkkK2dJtW1M=
-github.com/gen2brain/go-fitz v1.28.2/go.mod h1:pY2hqAjp9Zy7qfPI2gwbJMHBFAdZpVXOLrRxD82l3Bs=
+github.com/fxamacker/cbor/v2 v2.9.6 h1:NHZPxuUjJXQjX9itA785y/5NKSlI4HQ+S7noZsmI7hs=
+github.com/fxamacker/cbor/v2 v2.9.6/go.mod h1:4EaZp6ClVunETjQ4GHmGNzysDK91Lr+r6Yz6tJqzVCw=
+github.com/gabriel-vasile/mimetype v1.4.16 h1:5izNFuvA37st1dDRAcA7TtmngBmRgiIPDmTtiEvjx1E=
+github.com/gabriel-vasile/mimetype v1.4.16/go.mod h1:3oFFwxX8kTklZwzIl2aQEDZT0lKY8xH92ST88bAwba4=
+github.com/gen2brain/folio v0.2.8 h1:9iDI7h+zt4mjwEnzm1x8Pl9BrWqLwUwB74X/fnc1PZs=
+github.com/gen2brain/folio v0.2.8/go.mod h1:4/PcXfaXIYmW1nwQ4bJeE+aG5ybG58Aw9xrwODXaXII=
+github.com/gen2brain/gav1d v0.2.6 h1:7TSkrWTdE22k5Ul7vYZML7Nu80gNW6OovV7FSCITSE0=
+github.com/gen2brain/gav1d v0.2.6/go.mod h1:ReFKjHq7pvRhEk+pgRPAo9gOlcrf51sdzVcAbbX7e0E=
+github.com/gen2brain/h265 v0.2.4 h1:JUSbGkRAYZpd7ucCL192yx4ViEo75ZO6OEdm1TQt9qM=
+github.com/gen2brain/h265 v0.2.4/go.mod h1:kefpLxLhGpNCUG/q/aabJcD6GqB9Nhet3fNi9xX9Wzw=
+github.com/gen2brain/jxl v0.2.0 h1:cXSQnfbcC0JGFzaI344VzPMbe7mh6rYc0tjPcBUsE4U=
+github.com/gen2brain/jxl v0.2.0/go.mod h1:VjJHRai/8I8Es01mULqyiOihRBOjJr1Zo+NoN/MyIwo=
+github.com/gen2brain/vpx v0.2.1 h1:UD6tibcs/zlaIOKNFXeVyZuHBEaW9GYfxKSxvAN9cc8=
+github.com/gen2brain/vpx v0.2.1/go.mod h1:EVIdqguMSiapbtjDm4AWgFgYYJ4d+k8trXqjxYZ/4XE=
 github.com/go-asn1-ber/asn1-ber v1.5.8 h1:H9AZkK22UOmfX8J84ubyaZxKJZ3FMHVwn8swoMML7iQ=
 github.com/go-asn1-ber/asn1-ber v1.5.8/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
 github.com/go-errors/errors v1.0.1/go.mod h1:f4zRHt4oKfwPJE5k8C9vpYG+aDHdBFUsgrm6/TyX73Q=
@@ -65,14 +78,14 @@ github.com/go-errors/errors v1.1.1/go.mod h1:psDX2osz5VnTOnFWbDeWwS7yejl+uV3FEWE
 github.com/go-errors/errors v1.4.2/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
 github.com/go-errors/errors v1.5.1 h1:ZwEMSLRCapFLflTpT7NKaAc7ukJ8ZPEjzlxt8rPN8bk=
 github.com/go-errors/errors v1.5.1/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
-github.com/go-jose/go-jose/v4 v4.1.5 h1:RjgjO2LOtWOJKUC5wpwY9LR3B3vwVAz6JS2YHfYU6eA=
-github.com/go-jose/go-jose/v4 v4.1.5/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
-github.com/go-ldap/ldap/v3 v3.4.14 h1:D6PYdEgsaVzsXyr6w/yDC06Ria4uUhWm+Rb+er8lfAs=
-github.com/go-ldap/ldap/v3 v3.4.14/go.mod h1:S4eJUMUNjDkE0ZJtIZdybwyb03sGGLW6gxXT1Hs8VKA=
-github.com/go-openapi/jsonpointer v1.0.1 h1:2KxywRmNwJkT/FMBa3iRNHEaAxSJvjqoufQZy3au1Mg=
-github.com/go-openapi/jsonpointer v1.0.1/go.mod h1:wI7ZYsFmbIi9nBXOZqgDaS/bqOchRGZjqxFli7FBYxY=
-github.com/go-openapi/jsonreference v1.0.2 h1:oS4et8FOf3p3UQxEo4Xt0esijmBUM+F259Xl72OSZsc=
-github.com/go-openapi/jsonreference v1.0.2/go.mod h1:TbUNSOo+fcorZjFaNoiSDSoaNnnZtqJtLGR1PuvE/Cs=
+github.com/go-jose/go-jose/v4 v4.1.6 h1:sNRkftxFJxwsILiQukqp5z83QBSmntVwmgRY7AqBDO4=
+github.com/go-jose/go-jose/v4 v4.1.6/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
+github.com/go-ldap/ldap/v3 v3.4.15 h1:eRB4f4Ecn1POL1mO86+uUDlecmyWsdiJwh60bAUS4UY=
+github.com/go-ldap/ldap/v3 v3.4.15/go.mod h1:jeD0c98EdZQCKKKKe4kTWs5aCf6y+j8KuYsYLznZSQk=
+github.com/go-openapi/jsonpointer v1.0.2 h1:NbW7xT2b+l7x+JefiPGDsZWsrLk1ogrz4AHK1TTzMt8=
+github.com/go-openapi/jsonpointer v1.0.2/go.mod h1:N0rI4MbNKD7xAFTiHtB+5Nhrg2j/wwYg7m7Fmb4/jk8=
+github.com/go-openapi/jsonreference v1.0.3 h1:5rDbq+JsjCv6/nUDDJt83nLZoADI4w03uvHXer+4aYQ=
+github.com/go-openapi/jsonreference v1.0.3/go.mod h1:OJSlMXHysgH272D9z2tiy2MGe5A9vQLHaCPb6KbYdE4=
 github.com/go-openapi/spec v1.0.1 h1:lj2vdGpNDcVgwRc6qXdw6qt/KQpCtSa9tnUH6vpDPDk=
 github.com/go-openapi/spec v1.0.1/go.mod h1:M//GWQGtDUAjnP37gE6fInLgaczB+FatoipV3H1fYw8=
 github.com/go-openapi/swag v0.19.15 h1:D2NRCBzS9/pEY3gP9Nl8aDqGUcPFrwG2p+CNFrLyrCM=
@@ -94,16 +107,18 @@ github.com/go-openapi/swag/yamlutils v0.29.2 h1:IFKFFeDnuIwzfsuWRQU+rI8iL3g4XyAY
 github.com/go-openapi/swag/yamlutils v0.29.2/go.mod h1:7MGqtcrK73sxQ4ceiyIf8qiXS/s09JLMdR5esK5euYQ=
 github.com/go-openapi/testify/enable/yaml/v2 v2.7.0 h1:wPW6YRgx3+SID1yUy/Xwa17L8kFEaEKod2VRbJDZNUs=
 github.com/go-openapi/testify/enable/yaml/v2 v2.7.0/go.mod h1:mI1M88etYbc3PhgHsWQK2kwvNwW5aGFqMPbmib+SGIs=
-github.com/go-openapi/testify/v2 v2.7.0 h1:bycOreEj6wfBvijg3YFogZ/sFjTCDmQnwSodSzHa3X8=
-github.com/go-openapi/testify/v2 v2.7.0/go.mod h1:SgsVHtfooshd0tublTtJ50FPKhujf47YRqauXXOUxfw=
+github.com/go-openapi/testify/v2 v2.8.0 h1:19QDx5b57p8KjO2E4sgs/woL4Akp+FGLRlVm2xn0Rho=
+github.com/go-openapi/testify/v2 v2.8.0/go.mod h1:4gUN8jC+RqOE2qjW/vDmfyTvl5BCht4qL7oca0odrak=
 github.com/go-playground/assert/v2 v2.2.0 h1:JvknZsQTYeFEAhQwI4qEt9cyV5ONwRHC+lYKSsYSR8s=
 github.com/go-playground/assert/v2 v2.2.0/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
-github.com/go-playground/locales v0.14.1 h1:EWaQ/wswjilfKLTECiXz7Rh+3BjFhfDFKv/oXslEjJA=
-github.com/go-playground/locales v0.14.1/go.mod h1:hxrqLVvrK65+Rwrd5Fc6F2O76J/NuW9t0sjnWqG1slY=
+github.com/go-playground/locales v0.14.2 h1:d8UmcrM6Nip0hfGZKLGpAvZH37XB4TS0xzK9B56YNCY=
+github.com/go-playground/locales v0.14.2/go.mod h1:hxrqLVvrK65+Rwrd5Fc6F2O76J/NuW9t0sjnWqG1slY=
 github.com/go-playground/universal-translator v0.18.2 h1:LCsMLC9RzmbUMNUPVYD15dmcjwYAJhmX8mPZRW4rAVU=
 github.com/go-playground/universal-translator v0.18.2/go.mod h1:67VZIMp5lQpDWlnStOct22q1bkdJGJqHghbOtmkawxk=
 github.com/go-playground/validator/v10 v10.30.5 h1:YyCXvVShZbs2Sm3Mb53eNOlhRXctSOzW5QJAouCTZL4=
 github.com/go-playground/validator/v10 v10.30.5/go.mod h1:wEqiaov48pXX1kjhc3Da8y0M0Dtg/BK7gurFBLgwFrQ=
+github.com/go-test/deep v1.1.0 h1:WOcxcdHcvdgThNXjw0t76K42FXTU7HpNQWHpA2HHNlg=
+github.com/go-test/deep v1.1.0/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
 github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=
 github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
 github.com/go-webauthn/webauthn v0.18.2 h1:0BeftmEHU7i3Dv0VFwBtidy/ba37Vcdjvqst9EYu8Sk=
@@ -119,8 +134,8 @@ github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArs
 github.com/golang/geo v0.0.0-20190916061304-5b978397cfec/go.mod h1:QZ0nwyI2jOfgRAoBvP+ab5aRr7c9x7lhGEJrKvBwjWI=
 github.com/golang/geo v0.0.0-20200319012246-673a6f80352d/go.mod h1:QZ0nwyI2jOfgRAoBvP+ab5aRr7c9x7lhGEJrKvBwjWI=
 github.com/golang/geo v0.0.0-20210211234256-740aa86cb551/go.mod h1:QZ0nwyI2jOfgRAoBvP+ab5aRr7c9x7lhGEJrKvBwjWI=
-github.com/golang/geo v0.0.0-20260818125358-b200a1149890 h1:m+G0ip1+N4CF0ex34SeojAon6htIIBwvzsyXNx1fGWg=
-github.com/golang/geo v0.0.0-20260818125358-b200a1149890/go.mod h1:Mymr9kRGDc64JPr03TSZmuIBODZ3KyswLzm1xL0HFA8=
+github.com/golang/geo v0.0.0-20260928092222-7d12f68cfadb h1:z//sB+BhCYNvUrk19E8aWqNx+BBom8p/uD/nh95N/5U=
+github.com/golang/geo v0.0.0-20260928092222-7d12f68cfadb/go.mod h1:Mymr9kRGDc64JPr03TSZmuIBODZ3KyswLzm1xL0HFA8=
 github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
@@ -139,16 +154,23 @@ github.com/google/go-tpm-tools v0.3.13-0.20230620182252-4639ecce2aba h1:qJEJcuLz
 github.com/google/go-tpm-tools v0.3.13-0.20230620182252-4639ecce2aba/go.mod h1:EFYHy8/1y2KfgTAsx7Luu7NGhoxtuVHnNo8jE7FikKc=
 github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3 h1:LMLX+LgTNWpfvCBdFebv6EsYotImrt/Ppc5cXIriCSo=
 github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3/go.mod h1:jl5iWTm0/hd5PjEYEOuwAJ57L/CibdZfrqZ5XA5GrCk=
+github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/gtsteffaniak/go-av1 v1.0.0 h1:CILp67bcOtiDXvnrQubnH9ctub0OSKnUNA2JJuoIP+c=
+github.com/gtsteffaniak/go-av1 v1.0.0/go.mod h1:C/dIrjfdUcHgdyChr2YXwLY3pIVjENI9npSd98PU4lE=
 github.com/gtsteffaniak/go-cache v1.1.0 h1:ni/2cJpCxpGmaMZd92iTDIGOy+yUcMcxQuW7bSKhkCE=
 github.com/gtsteffaniak/go-cache v1.1.0/go.mod h1:rHUZvf4huhMX/bnNK4/oQ3sNAE2fYC2jFpAWZiBPWac=
-github.com/gtsteffaniak/go-ffmpeg v0.5.2 h1:KVnKM3zewY9yeZVd59Hb0/10gSbhYf01yRM5RftXGEU=
-github.com/gtsteffaniak/go-ffmpeg v0.5.2/go.mod h1:FefhoD+KZzHWqBaUpntcKp6lXtUzdFW00F74axnENUQ=
-github.com/gtsteffaniak/go-ffmpeg v1.0.0 h1:dUWvlZmWnkiujDtIMLGwrpfSAOnM+IOtk93HXF6HR0U=
-github.com/gtsteffaniak/go-ffmpeg v1.0.0/go.mod h1:FefhoD+KZzHWqBaUpntcKp6lXtUzdFW00F74axnENUQ=
+github.com/gtsteffaniak/go-ffmpeg v1.6.2 h1:gtvBg3G4PHO1Z/ZIPEK/XP4XT/g+l9S0Rpmmq6v5tnA=
+github.com/gtsteffaniak/go-ffmpeg v1.6.2/go.mod h1:FefhoD+KZzHWqBaUpntcKp6lXtUzdFW00F74axnENUQ=
 github.com/gtsteffaniak/go-logger v1.1.0 h1:baFds+iibuLLNpNLwygz32bDqdsunI6dGWcdxwMIVKI=
 github.com/gtsteffaniak/go-logger v1.1.0/go.mod h1:rapapTju4D7bwt6h4JOdZNUXDjnp0WkTBd6TN5yWglI=
+github.com/gtsteffaniak/go-media v1.2.0 h1:lbNL/G86uzzH8NaT45DBHKm1r0P7yndIo9pNC7gdqQs=
+github.com/gtsteffaniak/go-media v1.2.0/go.mod h1:EH+5KAVLWfFl0g4W0Xni0qJJH8MUDIhAw4wPcC0mhxY=
+github.com/gtsteffaniak/go-media v1.2.1 h1:SjrPqgQTHnenAFuVh8fTRxk8+qXFEaCxiADx3zkM1OI=
+github.com/gtsteffaniak/go-media v1.2.1/go.mod h1:EH+5KAVLWfFl0g4W0Xni0qJJH8MUDIhAw4wPcC0mhxY=
+github.com/gtsteffaniak/go-vpx v1.0.1 h1:9lSI8yoz6omDChaeV0AJrhdfe2YTrWvJrDENI/bnkAM=
+github.com/gtsteffaniak/go-vpx v1.0.1/go.mod h1:tRCdDZ15oZZTsiwmQAwyH56PTt1jn1C1O0P03oOkoJ8=
 github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=
 github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
@@ -173,13 +195,14 @@ github.com/kovidgoyal/go-parallel v1.1.1 h1:1OzpNjtrUkBPq3UaqrnvOoB2F9RttSt811ui
 github.com/kovidgoyal/go-parallel v1.1.1/go.mod h1:BJNIbe6+hxyFWv7n6oEDPj3PA5qSw5OCtf0hcVxWJiw=
 github.com/kovidgoyal/go-shm v1.0.0 h1:HJEel9D1F9YhULvClEHJLawoRSj/1u/EDV7MJbBPgQo=
 github.com/kovidgoyal/go-shm v1.0.0/go.mod h1:Yzb80Xf9L3kaoB2RGok9hHwMIt7Oif61kT6t3+VnZds=
-github.com/kovidgoyal/imaging v1.8.23 h1:4WsboyQ/E8tic2kX49P93Rvscg33SPsCwTBG5EZZF54=
-github.com/kovidgoyal/imaging v1.8.23/go.mod h1:k3Iot3H0v2rSWXIxQISfT3e9wIryqzAHLHCuhG7z9lM=
+github.com/kovidgoyal/imaging v1.9.0 h1:TxHvhClPANvDW7eLm7PYDTZU1KE15xbqlFv95DA6DmY=
+github.com/kovidgoyal/imaging v1.9.0/go.mod h1:t2vWMc3uISm/jMP87nBCcZUcAK6EDUdgumwaXSuz0Jc=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/pty v1.1.8/go.mod h1:O1sed60cT9XZ5uDucP5qwvh+TE3NnUj51EiZO/lmSfw=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
@@ -187,12 +210,12 @@ github.com/leodido/go-urn v1.5.0 h1:pLqT2kq1zpHW/1D18QMjMpdtX7cekxqtJJjg5ANyWw0=
 github.com/leodido/go-urn v1.5.0/go.mod h1:9BORnCDhdPBJNDEX+w1bJisa8yOKYi116VeO96s4ifE=
 github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
 github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
-github.com/mattn/go-sqlite3 v1.14.52 h1:wVbm2Qnf4OXkqhBTSPuCRZDRnxfbVrrmiCEroVdog8U=
-github.com/mattn/go-sqlite3 v1.14.52/go.mod h1:6JTjA44L93a0QCyJef5YvlPoKXntQPjzWv5gtm9sB6w=
-github.com/ncruces/go-strftime v1.0.0 h1:HMFp8mLCTPp341M/ZnA4qaf7ZlsbTc+miZjCLOFAw7w=
-github.com/ncruces/go-strftime v1.0.0/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
-github.com/philhofer/fwd v1.2.0 h1:e6DnBTl7vGY+Gz322/ASL4Gyp1FspeMvx1RNDoToZuM=
-github.com/philhofer/fwd v1.2.0/go.mod h1:RqIHx9QI14HlwKwm98g9Re5prTQ6LdeRQn+gXJFxsJM=
+github.com/ncruces/go-strftime v1.1.0 h1:vtPmPWMkb539RGV9WpWT9EwJGvrOCKvMNI4obWL47Hk=
+github.com/ncruces/go-strftime v1.1.0/go.mod h1:yVaq7iwCN09vHRrKBrrflXT0M9tTMG2KmZ9Fj7xeG/g=
+github.com/orcaman/writerseeker v0.0.0-20200621085525-1d3f536ff85e h1:s2RNOM/IGdY0Y6qfTeUKhDawdHDpK9RGBdx80qN4Ttw=
+github.com/orcaman/writerseeker v0.0.0-20200621085525-1d3f536ff85e/go.mod h1:nBdnFKj15wFbf94Rwfq4m30eAcyY9V/IyKAGQFtqkW0=
+github.com/philhofer/fwd v1.2.1 h1:UtpS73q8bFgy/yH3gCq8LSNvj5gv/FowNOiWZa7uKwQ=
+github.com/philhofer/fwd v1.2.1/go.mod h1:RqIHx9QI14HlwKwm98g9Re5prTQ6LdeRQn+gXJFxsJM=
 github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
@@ -211,16 +234,14 @@ github.com/spf13/afero v1.15.0/go.mod h1:NC2ByUVxtQs4b3sIUphxK0NioZnmxgyCrfzeuq8
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
 github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
-github.com/swaggo/files v1.0.1 h1:J1bVJ4XHZNq0I46UU90611i9/YzdrF7x92oX1ig5IdE=
-github.com/swaggo/files v1.0.1/go.mod h1:0qXmMNH6sXNf+73t65aKeB+ApmgxdnkQzVTAj2uaMUg=
-github.com/swaggo/http-swagger v1.3.4 h1:q7t/XLx0n15H1Q9/tk3Y9L4n210XzJF5WtnDX64a5ww=
-github.com/swaggo/http-swagger v1.3.4/go.mod h1:9dAh0unqMBAlbp1uE2Uc2mQTxNMU/ha4UbucIg1MFkQ=
+github.com/sunfish-shogi/bufseekio v0.0.0-20210207115823-a4185644b365/go.mod h1:dEzdXgvImkQ3WLI+0KQpmEx8T/C/ma9KeS3AfmU899I=
 github.com/swaggo/swag v1.16.6 h1:qBNcx53ZaX+M5dxVyTrgQ0PJ/ACK+NzhwcbieTt+9yI=
 github.com/swaggo/swag v1.16.6/go.mod h1:ngP2etMK5a0P3QBizic5MEwpRmluJZPHjXcMoj4Xesg=
-github.com/tinylib/msgp v1.6.4 h1:mOwYbyYDLPj35mkA2BjjYejgJk9BuHxDdvRnb6v2ZcQ=
-github.com/tinylib/msgp v1.6.4/go.mod h1:RSp0LW9oSxFut3KzESt5Voq4GVWyS+PSulT77roAqEA=
+github.com/tinylib/msgp v1.6.5 h1:iAH6XTP7BpzErjBZlujJQXxA+GmRi2YWs6M4KdLtNbE=
+github.com/tinylib/msgp v1.6.5/go.mod h1:RSp0LW9oSxFut3KzESt5Voq4GVWyS+PSulT77roAqEA=
 github.com/vmihailenco/msgpack v4.0.4+incompatible h1:dSLoQfGFAo3F6OoNhwUmLwVgaUXK79GlxNBwueZn0xI=
 github.com/vmihailenco/msgpack v4.0.4+incompatible/go.mod h1:fy3FlTQTDXWkZ7Bh6AcGMlsjHatGryHQYUTf1ShIgkk=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
@@ -235,13 +256,13 @@ go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
 go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
-golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
-golang.org/x/image v0.46.0 h1:b1+oYj0Jbp6K5MDT4i4/eZpYlk3V8SJhhDKh6LBHAyQ=
-golang.org/x/image v0.46.0/go.mod h1:3B3W05VGVQyuXucLINLjXKrqISASfi4Xj+iCVkLMwew=
+golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
+golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
+golang.org/x/image v0.47.0 h1:za/8gVz++PPZqmZJBNSISICN5Rrj5zixP/8K++fgmqo=
+golang.org/x/image v0.47.0/go.mod h1:IkN5o4A7vq55vXN8FWjjnhg9Rs2GOtffqsSi9mWAKYE=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c=
-golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o=
+golang.org/x/mod v0.42.0 h1:ICeL3t2L30ljSPHHxDnR4fqVcBt/zR2zJAb9juavmQg=
+golang.org/x/mod v0.42.0/go.mod h1:u5fzIrRInkL8MaO1cbRkUHT64v303YIT5KEqpNr7jRs=
 golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20191105084925-a882066a44e0/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
@@ -252,16 +273,16 @@ golang.org/x/net v0.0.0-20200513185701-a91f0712d120/go.mod h1:qpuaurCH72eLCgpAm/
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.0.0-20221002022538-bcab6841153b/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk=
-golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues=
-golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/net v0.61.0 h1:RR+6j/BTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw=
+golang.org/x/net v0.61.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI=
 golang.org/x/oauth2 v0.37.0 h1:JUlcxA8oAtauLfiH8FX2/FkAWHAdi0QtGCGc+hofE98=
 golang.org/x/oauth2 v0.37.0/go.mod h1:IxwZNxUULJmpBFf9K/9NTMSIfZZuvuTy1gGxhigP/58=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk=
-golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
+golang.org/x/sync v0.24.0 h1:iqiDrGoDgyuvAKrhLQthUEzU/R378N78gXbBjxed7oA=
+golang.org/x/sync v0.24.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190726091711-fc99dfbffb4e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -271,29 +292,26 @@ golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220928140112-f11e5e49a4ec/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
-golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
-golang.org/x/term v0.46.0 h1:3+OXuTbaKDgwk8jTi3aSLHRlmWqHEUDUtxnbFigO4YE=
-golang.org/x/term v0.46.0/go.mod h1:+K02xbkittuwc0Am4abfA3Fc+XRGXkvBXNO88NCXPoc=
+golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
+golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
-golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
-golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
+golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
+golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
 golang.org/x/time v0.16.0 h1:vMb6ptszcQMkcwiRTAuNNU50gom6++Q/6gY2hDM6VDE=
 golang.org/x/time v0.16.0/go.mod h1:rVKOqvZeKvrDKTQiAHJ7wmwP0RzleSphoEA9RcdLA0s=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.50.0 h1:c2ifzfcuY7L90lZ2aKd8S4K2NpASF08SZx9ZuJkHmSU=
-golang.org/x/tools v0.50.0/go.mod h1:7ulVMw3831Mwi5EZD6RomGyffr4VFjuNYXf2BbCEAV0=
+golang.org/x/tools v0.52.0 h1:ryxg4U63oaUYk7uOLTF37n43f4qgtGvqV4Ioit1BaEs=
+golang.org/x/tools v0.52.0/go.mod h1:ItcP5UNaVGG+Yc4eIYmaFLNJ4soEopkx5Y2d4lcEurs=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
@@ -304,29 +322,34 @@ google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQ
 google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=
 google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/src-d/go-billy.v4 v4.3.2 h1:0SQA1pRztfTFx2miS8sA97XvooFeNOmvUenF4o0EcVg=
+gopkg.in/src-d/go-billy.v4 v4.3.2/go.mod h1:nDjArDMp+XMs1aFAESLRjfGSgfvoYN0hDfzEk0GjC98=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.7/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-modernc.org/cc/v4 v4.29.7 h1:q+NXGJ0bK3b4TXFYQQVr9pYETGnmwFWkrUzJnMya/Tg=
-modernc.org/cc/v4 v4.29.7/go.mod h1:OnovgIhbbMXMu1aISnJ0wvVD1KnW+cAUJkIrAWh+kVI=
-modernc.org/ccgo/v4 v4.36.1 h1:ZNIUZAryN0UgnJwtyxrdEzcFc3yD4Cu4AzjfPXsLsIE=
-modernc.org/ccgo/v4 v4.36.1/go.mod h1:rrtGc2QkS239nYb/mQNuBMyjq3/y3ZXWbBjPoV3wqzA=
+modernc.org/cc/v4 v4.30.3 h1:aDq8gIX1X7+VFgO/JYYji6pLWL2H4tv3g8WatT3KCys=
+modernc.org/cc/v4 v4.30.3/go.mod h1:OnovgIhbbMXMu1aISnJ0wvVD1KnW+cAUJkIrAWh+kVI=
+modernc.org/ccgo/v4 v4.37.0 h1:BAuJCUtIHIxFIYaFhqXIw5YaoMBlNCUlFovejHfMip4=
+modernc.org/ccgo/v4 v4.37.0/go.mod h1:/8627VhwWtAbqUXmPORxFQU5SgLrAx2jl9seLw9GBhY=
 modernc.org/fileutil v1.4.0 h1:j6ZzNTftVS054gi281TyLjHPp6CPHr2KCxEXjEbD6SM=
 modernc.org/fileutil v1.4.0/go.mod h1:EqdKFDxiByqxLk8ozOxObDSfcVOv/54xDs/DUHdvCUU=
 modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI=
 modernc.org/gc/v2 v2.6.5/go.mod h1:YgIahr1ypgfe7chRuJi2gD7DBQiKSLMPgBQe9oIiito=
-modernc.org/gc/v3 v3.1.5 h1:21ldfPfRYE31Tb7B3mwAK8gy1AxP4+dKjrOQPfqakoc=
-modernc.org/gc/v3 v3.1.5/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
+modernc.org/gc/v3 v3.2.0 h1:/Y3LGDMQaoYf55PebP1qsZ5FDGgAZyG1RYKEHeQzh1o=
+modernc.org/gc/v3 v3.2.0/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
 modernc.org/goabi0 v0.2.0 h1:HvEowk7LxcPd0eq6mVOAEMai46V+i7Jrj13t4AzuNks=
 modernc.org/goabi0 v0.2.0/go.mod h1:CEFRnnJhKvWT1c1JTI3Avm+tgOWbkOu5oPA8eH8LnMI=
-modernc.org/libc v1.77.1 h1:Ct8j47QtiZ1Enj2DtFXQtUqrPCAjdCmPjtCuvrYQ0Hs=
-modernc.org/libc v1.77.1/go.mod h1:87/pZ4L6nD1zqW4nItuS12YO7hN1igAah34xjnQo/W0=
+modernc.org/libc v1.79.0 h1:9Dvvv++bAMSkSuBzuOFAatbTV5OIoq6Y6FohmD3e7q8=
+modernc.org/libc v1.79.0/go.mod h1:uT3kR61NsbeKJSLqq83GJwSnZMVLlSjyAz4DfTaBy1M=
 modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
 modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
 modernc.org/memory v1.12.1 h1:nFMiWrpStgZczNl6XI9GnIk/rWhYIyHGUaR04pGbp9g=
@@ -335,8 +358,8 @@ modernc.org/opt v0.2.0 h1:tGyef5ApycA7FSEOMraay9SaTk5zmbx7Tu+cJs4QKZg=
 modernc.org/opt v0.2.0/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
 modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
 modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
-modernc.org/sqlite v1.59.0 h1:X1es1GpqBlS/5T+vbM4HLUdaa8OtQx468DF2vrx+38A=
-modernc.org/sqlite v1.59.0/go.mod h1:+paeT2A3iPRHkQDwG7oA6Tk0zQd5woMEI8q7orfry8k=
+modernc.org/sqlite v1.60.1 h1:/blz53O951KWFOso4QQvEs/Fq6cDBKLtMVrYNSeJVKw=
+modernc.org/sqlite v1.60.1/go.mod h1:1dIoEagfDE72QytD5scH1lxARtaUgKgHC/NuApA27r0=
 modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
 modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
 modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=

backend/internal/activity/diff_test.go

@@ -141,6 +141,14 @@ func TestUserUpdateChangesExpandsNestedStructFields(t *testing.T) {
 	}
 }
 
+// Mock source paths used only as lookup keys in tests. They never touch the
+// filesystem. They are relative (and not equal to the source names) so the
+// tests are portable across machines.
+const (
+	testDownloadsPath = "./testdata/Downloads"
+	testAccessPath    = "./testdata/playwright-files"
+)
+
 type activityChangePair struct {
 	from string
 	to   string
@@ -150,9 +158,9 @@ func testDownloadsSourceConfig() *users.SourceConfigProvider {
 	return &users.SourceConfigProvider{
 		GetSourceByPath: func(path string) (users.SourceInfo, bool) {
 			switch path {
-			case "/Users/steffag/Downloads":
+			case testDownloadsPath:
 				return users.SourceInfo{Path: path, Name: "Downloads"}, true
-			case "/Users/steffag/git/personal/filebrowser/frontend/tests/playwright-files":
+			case testAccessPath:
 				return users.SourceInfo{Path: path, Name: "access"}, true
 			default:
 				return users.SourceInfo{}, false
@@ -229,8 +237,8 @@ func TestUserUpdateChangesExpandsPreviewBulkToggle(t *testing.T) {
 func TestUserUpdateChangesExpandsBackendSourcePermissions(t *testing.T) {
 	withTestSourceConfig(t, testDownloadsSourceConfig())
 
-	downloadsPath := "/Users/steffag/Downloads"
-	accessPath := "/Users/steffag/git/personal/filebrowser/frontend/tests/playwright-files"
+	downloadsPath := testDownloadsPath
+	accessPath := testAccessPath
 	beforePerms := users.MarkSourceFilePermissionsConfigured(users.SourceFilePermissions{
 		View: true, Download: true,
 	})
@@ -274,8 +282,8 @@ func TestUserUpdateChangesExpandsBackendSourcePermissions(t *testing.T) {
 func TestUserUpdateChangesExpandsScopePermissions(t *testing.T) {
 	withTestSourceConfig(t, testDownloadsSourceConfig())
 
-	downloadsPath := "/Users/steffag/Downloads"
-	accessPath := "/Users/steffag/git/personal/filebrowser/frontend/tests/playwright-files"
+	downloadsPath := testDownloadsPath
+	accessPath := testAccessPath
 	basePerms := users.MarkSourceFilePermissionsConfigured(users.SourceFilePermissions{
 		View: true, Download: true,
 	})
@@ -353,9 +361,9 @@ func TestSidebarLinksFieldChangeIgnoresPathVsName(t *testing.T) {
 	withTestSourceConfig(t, &users.SourceConfigProvider{
 		GetSourceByPath: func(path string) (users.SourceInfo, bool) {
 			switch path {
-			case "/Users/steffag/Downloads":
+			case testDownloadsPath:
 				return users.SourceInfo{Path: path, Name: "Downloads"}, true
-			case "/Users/steffag/git/personal/filebrowser/frontend/tests/playwright-files":
+			case testAccessPath:
 				return users.SourceInfo{Path: path, Name: "access"}, true
 			default:
 				return users.SourceInfo{}, false
@@ -364,9 +372,9 @@ func TestSidebarLinksFieldChangeIgnoresPathVsName(t *testing.T) {
 		GetSourceByName: func(name string) (users.SourceInfo, bool) {
 			switch name {
 			case "Downloads":
-				return users.SourceInfo{Path: "/Users/steffag/Downloads", Name: "Downloads"}, true
+				return users.SourceInfo{Path: testDownloadsPath, Name: "Downloads"}, true
 			case "access":
-				return users.SourceInfo{Path: "/Users/steffag/git/personal/filebrowser/frontend/tests/playwright-files", Name: "access"}, true
+				return users.SourceInfo{Path: testAccessPath, Name: "access"}, true
 			default:
 				return users.SourceInfo{}, false
 			}
@@ -380,8 +388,8 @@ func TestSidebarLinksFieldChangeIgnoresPathVsName(t *testing.T) {
 				ShowToolsInSidebar: true,
 				SidebarLinks: []users.SidebarLink{
 					toolsLink,
-					{Name: "Downloads", Category: "source", Target: "/", SourceName: "/Users/steffag/Downloads"},
-					{Name: "access", Category: "source", Target: "/", SourceName: "/Users/steffag/git/personal/filebrowser/frontend/tests/playwright-files"},
+					{Name: "Downloads", Category: "source", Target: "/", SourceName: testDownloadsPath},
+					{Name: "access", Category: "source", Target: "/", SourceName: testAccessPath},
 				},
 			},
 		},

backend/internal/activity/record.go

@@ -7,6 +7,7 @@ import (
 	"time"
 
 	activitydb "github.com/gtsteffaniak/filebrowser/backend/internal/database/activity"
+	"github.com/gtsteffaniak/filebrowser/backend/internal/database/quota"
 	"github.com/gtsteffaniak/filebrowser/backend/internal/database/users"
 )
 
@@ -162,8 +163,18 @@ func RecordPatchItem(r *http.Request, actor *Actor, action string, item MoveCopy
 	RecordUser(r, actor, entry)
 }
 
+// recordFileEvent records a file operation. Anonymous share visitors have no user ID,
+// so their uploads and deletes are attributed to the share owner.
+func recordFileEvent(r *http.Request, actor *Actor, entry activitydb.Entry) {
+	if actor != nil && actor.Share.Hash != "" && (actor.User == nil || actor.User.ID == 0) {
+		RecordShareOwner(r, actor, entry)
+		return
+	}
+	RecordUser(r, actor, entry)
+}
+
 func RecordDelete(r *http.Request, actor *Actor, source, path string) {
-	RecordUser(r, actor, activitydb.Entry{
+	recordFileEvent(r, actor, activitydb.Entry{
 		EventType: activitydb.EventDelete,
 		Source:    source,
 		Path:      path,
@@ -197,7 +208,7 @@ func RecordBulkDelete(r *http.Request, actor *Actor, succeeded []BulkDeleteItem)
 		entry.Details.Source = succeeded[0].Source
 		entry.Details.Path = succeeded[0].Path
 	}
-	RecordUser(r, actor, entry)
+	recordFileEvent(r, actor, entry)
 }
 
 func RecordUpload(r *http.Request, actor *Actor, source, path string, isDir bool) {
@@ -209,7 +220,7 @@ func RecordUpload(r *http.Request, actor *Actor, source, path string, isDir bool
 		Source: source,
 		Path:   pathLabel,
 	}
-	RecordUser(r, actor, activitydb.Entry{
+	recordFileEvent(r, actor, activitydb.Entry{
 		EventType: activitydb.EventUpload,
 		Source:    source,
 		Path:      pathLabel,
@@ -217,6 +228,20 @@ func RecordUpload(r *http.Request, actor *Actor, source, path string, isDir bool
 	})
 }
 
+// RecordFileModify appends an audit row for an in-place file content update (PUT).
+func RecordFileModify(r *http.Request, actor *Actor, source, path string) {
+	entry := activitydb.Entry{
+		EventType: activitydb.EventFileModify,
+		Source:    source,
+		Path:      path,
+		Details: activitydb.Details{
+			Source: source,
+			Path:   path,
+		},
+	}
+	recordFileEvent(r, actor, entry)
+}
+
 func RecordShareMutation(r *http.Request, actor *Actor, eventType activitydb.EventType, hash, sourceName, path string, changes []activitydb.FieldChange) {
 	details := activitydb.Details{
 		Source:    sourceName,
@@ -287,6 +312,79 @@ func RecordAccessDelete(r *http.Request, actor *Actor, source, path string, chan
 	})
 }
 
+func RecordQuotaCreate(r *http.Request, actor *Actor, source, path string, changes []activitydb.FieldChange) {
+	RecordQuotaMutation(r, actor, activitydb.EventQuotaCreate, source, path, changes)
+}
+
+func RecordQuotaUpdate(r *http.Request, actor *Actor, source, path string, changes []activitydb.FieldChange) {
+	RecordQuotaMutation(r, actor, activitydb.EventQuotaUpdate, source, path, changes)
+}
+
+func RecordQuotaDelete(r *http.Request, actor *Actor, source, path string, changes []activitydb.FieldChange) {
+	RecordQuotaMutation(r, actor, activitydb.EventQuotaDelete, source, path, changes)
+}
+
+func RecordQuotaMutation(r *http.Request, actor *Actor, eventType activitydb.EventType, source, path string, changes []activitydb.FieldChange) {
+	RecordUser(r, actor, activitydb.Entry{
+		EventType: eventType,
+		Source:    source,
+		Path:      path,
+		Details: activitydb.Details{
+			Source:  source,
+			Path:    path,
+			Changes: changes,
+		},
+	})
+}
+
+func quotaFolderChanges(q quota.FolderQuota) []activitydb.FieldChange {
+	changes := []activitydb.FieldChange{
+		{Field: "limitBytes", To: strconv.FormatInt(q.LimitBytes, 10)},
+		{Field: "meter", To: q.Meter},
+	}
+	if q.UserID > 0 {
+		changes = append(changes, activitydb.FieldChange{
+			Field: "userId",
+			To:    strconv.FormatUint(q.UserID, 10),
+		})
+	}
+	return changes
+}
+
+func QuotaFolderCreateChanges(q quota.FolderQuota) []activitydb.FieldChange {
+	return quotaFolderChanges(q)
+}
+
+func QuotaFolderDeleteChanges(q quota.FolderQuota) []activitydb.FieldChange {
+	return quotaFolderChanges(q)
+}
+
+func QuotaFolderUpdateChanges(before, after quota.FolderQuota) []activitydb.FieldChange {
+	var changes []activitydb.FieldChange
+	if before.LimitBytes != after.LimitBytes {
+		changes = append(changes, activitydb.FieldChange{
+			Field: "limitBytes",
+			From:  strconv.FormatInt(before.LimitBytes, 10),
+			To:    strconv.FormatInt(after.LimitBytes, 10),
+		})
+	}
+	if before.Meter != after.Meter {
+		changes = append(changes, activitydb.FieldChange{
+			Field: "meter",
+			From:  before.Meter,
+			To:    after.Meter,
+		})
+	}
+	if before.UserID != after.UserID {
+		changes = append(changes, activitydb.FieldChange{
+			Field: "userId",
+			From:  strconv.FormatUint(before.UserID, 10),
+			To:    strconv.FormatUint(after.UserID, 10),
+		})
+	}
+	return changes
+}
+
 func AccessRuleCreateChanges(allow bool, ruleCategory, value string) []activitydb.FieldChange {
 	ruleType := "deny"
 	if allow {

backend/internal/activity/record_test.go

@@ -1,9 +1,13 @@
 package activity
 
 import (
+	"net/http/httptest"
 	"testing"
+	"time"
 
 	activitydb "github.com/gtsteffaniak/filebrowser/backend/internal/database/activity"
+	"github.com/gtsteffaniak/filebrowser/backend/internal/database/share"
+	"github.com/gtsteffaniak/filebrowser/backend/internal/database/users"
 )
 
 func TestAccessRuleCreateChanges(t *testing.T) {
@@ -28,6 +32,86 @@ func TestAccessRuleDeleteChanges(t *testing.T) {
 	assertFieldChange(t, changes[4], "count", "", "3")
 }
 
+func TestShareFileEventsRecordedForShareOwner(t *testing.T) {
+	store := &mockActivityStore{}
+	globalMu.Lock()
+	old := globalRecorder
+	globalMu.Unlock()
+	defer func() {
+		globalMu.Lock()
+		globalRecorder = old
+		globalMu.Unlock()
+	}()
+
+	rec := &Recorder{
+		store:         store,
+		buffer:        make([]activitydb.Entry, 0, 4),
+		flushCh:       make(chan struct{}, 1),
+		stopCh:        make(chan struct{}),
+		doneCh:        make(chan struct{}),
+		maxBuffer:     10000,
+		flushInterval: time.Hour,
+		enabled:       true,
+	}
+	globalMu.Lock()
+	globalRecorder = rec
+	globalMu.Unlock()
+	go rec.loop()
+
+	actor := &Actor{
+		User:  &users.User{FrontendUser: users.FrontendUser{Username: "anonymous"}},
+		Share: share.Share{Hash: "share-hash", UserID: 7},
+	}
+	r := httptest.NewRequest("POST", "/public/api/resources", nil)
+	RecordUpload(r, actor, "main", "/pub/new.txt", false)
+	RecordDelete(r, actor, "main", "/pub/old.txt")
+	RecordBulkDelete(r, actor, []BulkDeleteItem{{Source: "main", Path: "/pub/a.txt"}})
+	loggedIn := &Actor{
+		User:  &users.User{ID: 5, FrontendUser: users.FrontendUser{Username: "bob"}},
+		Share: share.Share{Hash: "share-hash", UserID: 7},
+	}
+	RecordUpload(r, loggedIn, "main", "/pub/bob.txt", false)
+	RecordFileModify(r, loggedIn, "main", "/pub/edited.txt")
+	RecordFileModify(r, actor, "main", "/pub/anon-edit.txt")
+	rec.Stop()
+
+	var got []activitydb.Entry
+	for _, batch := range store.inserts {
+		got = append(got, batch...)
+	}
+	want := []activitydb.EventType{
+		activitydb.EventUpload,
+		activitydb.EventDelete,
+		activitydb.EventBulkDelete,
+		activitydb.EventUpload,
+		activitydb.EventFileModify,
+		activitydb.EventFileModify,
+	}
+	if len(got) != len(want) {
+		t.Fatalf("expected %d entries, got %d: %+v", len(want), len(got), got)
+	}
+	for i, e := range got {
+		if e.EventType != want[i] {
+			t.Fatalf("entry %d: event type %q, want %q", i, e.EventType, want[i])
+		}
+	}
+	for i := 0; i < 3; i++ {
+		e := got[i]
+		if e.UserID != 7 || e.Details.ShareHash != "share-hash" {
+			t.Fatalf("anonymous share entry %d: userID=%d shareHash=%q", i, e.UserID, e.Details.ShareHash)
+		}
+	}
+	if got[3].UserID != 5 {
+		t.Fatalf("logged-in share visitor upload: userID=%d, want 5", got[3].UserID)
+	}
+	if got[4].UserID != 5 {
+		t.Fatalf("logged-in share visitor modify: userID=%d, want 5", got[4].UserID)
+	}
+	if got[5].UserID != 7 || got[5].Details.ShareHash != "share-hash" {
+		t.Fatalf("anonymous share modify: userID=%d shareHash=%q", got[5].UserID, got[5].Details.ShareHash)
+	}
+}
+
 func assertFieldChange(t *testing.T, change activitydb.FieldChange, field, from, to string) {
 	t.Helper()
 	if change.Field != field || change.From != from || change.To != to {

backend/internal/activity/remote.go

@@ -3,7 +3,6 @@ package activity
 import (
 	"net"
 	"net/http"
-	"strings"
 
 	"github.com/gtsteffaniak/filebrowser/backend/pkg/settings"
 )
@@ -11,14 +10,19 @@ import (
 func remoteIP(r *http.Request) string {
 	cfg := &settings.Config
 
+	// Forwarded client headers are only honored when the socket peer is a
+	// configured trusted proxy; otherwise a direct client could spoof its IP.
+	trustedPeer := cfg.Http.TrustProxyHeaders && settings.IsTrustedProxyPeer(r)
+
 	xff := r.Header.Get("X-Forwarded-For")
-	if cfg.Http.TrustProxyHeaders && xff != "" {
-		ips := strings.Split(xff, ",")
-		return strings.TrimSpace(ips[0])
+	if trustedPeer && xff != "" {
+		if ip := settings.TrustedProxyClientIP(xff); ip != "" {
+			return ip
+		}
 	}
 
 	xri := r.Header.Get("X-Real-IP")
-	if cfg.Http.TrustProxyHeaders && xri != "" {
+	if trustedPeer && xri != "" {
 		return xri
 	}
 

backend/internal/adapters/fs/files/file_test.go

@@ -12,11 +12,11 @@ import (
 	"time"
 
 	"github.com/gtsteffaniak/filebrowser/backend/internal/adapters/fs/fileutils"
-	liberrors "github.com/gtsteffaniak/filebrowser/backend/internal/errors"
-	"github.com/gtsteffaniak/filebrowser/backend/pkg/settings"
 	dbsql "github.com/gtsteffaniak/filebrowser/backend/internal/database/sql"
+	liberrors "github.com/gtsteffaniak/filebrowser/backend/internal/errors"
 	"github.com/gtsteffaniak/filebrowser/backend/pkg/indexing"
 	"github.com/gtsteffaniak/filebrowser/backend/pkg/indexing/iteminfo"
+	"github.com/gtsteffaniak/filebrowser/backend/pkg/settings"
 )
 
 func Test_GetRealPath(t *testing.T) {
@@ -129,7 +129,7 @@ func TestWriteFilePreservesExecutableBit(t *testing.T) {
 	waitForScannerReady(t, idx)
 
 	indexPath := "/" + scriptName
-	if err := WriteFile(sourceName, indexPath, strings.NewReader("#!/bin/sh\necho bye\n")); err != nil {
+	if err := WriteFile(sourceName, "", indexPath, strings.NewReader("#!/bin/sh\necho bye\n")); err != nil {
 		t.Fatalf("WriteFile: %v", err)
 	}
 
@@ -182,7 +182,7 @@ func TestWriteFileRejectsExistingDirectory(t *testing.T) {
 	defer stopPoll()
 	waitForScannerReady(t, idx)
 
-	err := WriteFile(sourceName, "/"+dirName, strings.NewReader("file content"))
+	err := WriteFile(sourceName, "", "/"+dirName, strings.NewReader("file content"))
 	if err == nil {
 		t.Fatal("expected error when path is an existing directory")
 	}
@@ -571,7 +571,7 @@ func TestDeleteFilesRootProtection(t *testing.T) {
 	}
 
 	// Test: Attempting to delete the root directory should return an error
-	err := DeleteFiles("test_root_protection", realTmpDir, true)
+	err := DeleteFiles("test_root_protection", "", "/", true)
 	if err == nil {
 		t.Error("DeleteFiles should return an error when trying to delete root directory")
 	}
@@ -583,13 +583,13 @@ func TestDeleteFilesRootProtection(t *testing.T) {
 	}
 
 	// Test with trailing slash - should still be blocked
-	err = DeleteFiles("test_root_protection", realTmpDir+"/", true)
+	err = DeleteFiles("test_root_protection", "", "/", true)
 	if err == nil {
 		t.Error("DeleteFiles should return an error for root directory with trailing slash")
 	}
 
 	// Test with cleaned path variations
-	err = DeleteFiles("test_root_protection", realTmpDir+"/.", true)
+	err = DeleteFiles("test_root_protection", "", "/", true)
 	if err == nil {
 		t.Error("DeleteFiles should return an error for root directory with /. suffix")
 	}
@@ -670,7 +670,7 @@ func runDeleteFilesSubfolderWithRaceStress(t *testing.T, iter int) {
 
 	waitForScannerReady(t, idx)
 
-	err := DeleteFiles(sourceName, subfolderPath, true)
+	err := DeleteFiles(sourceName, "", "/"+subfolderName, true)
 	stopPolling()
 
 	t.Logf("iteration %d: DeleteFiles finished in %s (err=%v)", iter, time.Since(start), err)
@@ -694,13 +694,130 @@ func runDeleteFilesSubfolderWithRaceStress(t *testing.T, iter int) {
 	t.Logf("iteration %d: cleaned scanners and indices", iter)
 }
 
+// TestDeleteFiles_RemovesSymlinkNotTarget verifies that deleting a symlink leaf
+// removes the link itself and never follows it to the target.
+func TestDeleteFiles_RemovesSymlinkNotTarget(t *testing.T) {
+	root := t.TempDir()
+	outside := filepath.Join(filepath.Dir(root), "outside-victim.txt")
+	if err := os.WriteFile(outside, []byte("keep me"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Symlink(outside, filepath.Join(root, "link")); err != nil {
+		t.Fatal(err)
+	}
+
+	sourceName := "test_delete_symlink"
+	indexing.SetTestIndex(sourceName, root)
+	t.Cleanup(indexing.ClearTestIndices)
+	idx := indexing.GetIndex(sourceName)
+	idx.Config.ResolvedRules.IndexingDisabled = true
+
+	if err := DeleteFiles(sourceName, "", "/link", false); err != nil {
+		t.Fatalf("DeleteFiles: %v", err)
+	}
+	if _, err := os.Lstat(filepath.Join(root, "link")); !os.IsNotExist(err) {
+		t.Fatal("symlink should have been removed")
+	}
+	got, err := os.ReadFile(outside)
+	if err != nil || string(got) != "keep me" {
+		t.Fatalf("delete followed the symlink and removed the target: %v %q", err, got)
+	}
+}
+
+// TestDeleteFiles_RejectsEscapingIntermediate verifies a delete under an
+// intermediate symlink escaping the source is refused.
+func TestDeleteFiles_RejectsEscapingIntermediate(t *testing.T) {
+	root := t.TempDir()
+	outsideDir := filepath.Join(filepath.Dir(root), "outside-dir")
+	if err := os.MkdirAll(outsideDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Symlink(outsideDir, filepath.Join(root, "evil")); err != nil {
+		t.Fatal(err)
+	}
+	victim := filepath.Join(outsideDir, "victim.txt")
+	if err := os.WriteFile(victim, []byte("keep"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	sourceName := "test_delete_escape"
+	indexing.SetTestIndex(sourceName, root)
+	t.Cleanup(indexing.ClearTestIndices)
+	idx := indexing.GetIndex(sourceName)
+	idx.Config.ResolvedRules.IndexingDisabled = true
+
+	err := DeleteFiles(sourceName, "", "/evil/victim.txt", false)
+	if !errors.Is(err, liberrors.ErrPathEscapesScope) {
+		t.Fatalf("expected ErrPathEscapesScope, got %v", err)
+	}
+	if _, err := os.Stat(victim); err != nil {
+		t.Fatal("delete escaped the bound and removed the outside file")
+	}
+}
+
+// TestWriteFile_RejectsSymlinkEscape verifies a write through a symlink leaf
+// resolving outside the source is refused before any bytes are written.
+func TestWriteFile_RejectsSymlinkEscape(t *testing.T) {
+	root := t.TempDir()
+	outside := filepath.Join(filepath.Dir(root), "outside.txt")
+	if err := os.WriteFile(outside, []byte("original"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Symlink(outside, filepath.Join(root, "evil")); err != nil {
+		t.Fatal(err)
+	}
+
+	sourceName := "test_write_symlink"
+	indexing.SetTestIndex(sourceName, root)
+	t.Cleanup(indexing.ClearTestIndices)
+	idx := indexing.GetIndex(sourceName)
+	idx.Config.ResolvedRules.IndexingDisabled = true
+
+	err := WriteFile(sourceName, "", "/evil", strings.NewReader("pwned"))
+	if !errors.Is(err, liberrors.ErrPathEscapesScope) {
+		t.Fatalf("expected ErrPathEscapesScope, got %v", err)
+	}
+	got, _ := os.ReadFile(outside)
+	if string(got) != "original" {
+		t.Fatal("write went through the symlink")
+	}
+}
+
+// TestWriteFile_RejectsMissingLeafUnderEscapingParent verifies the j764/3j46
+// primitive: writing a new file under a symlinked directory that escapes the
+// source is refused even though the leaf does not exist yet.
+func TestWriteFile_RejectsMissingLeafUnderEscapingParent(t *testing.T) {
+	root := t.TempDir()
+	outsideDir := filepath.Join(filepath.Dir(root), "outside-parent")
+	if err := os.MkdirAll(outsideDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Symlink(outsideDir, filepath.Join(root, "evil_dir")); err != nil {
+		t.Fatal(err)
+	}
+
+	sourceName := "test_write_escape_parent"
+	indexing.SetTestIndex(sourceName, root)
+	t.Cleanup(indexing.ClearTestIndices)
+	idx := indexing.GetIndex(sourceName)
+	idx.Config.ResolvedRules.IndexingDisabled = true
+
+	err := WriteFile(sourceName, "", "/evil_dir/hack.txt", strings.NewReader("pwned"))
+	if !errors.Is(err, liberrors.ErrPathEscapesScope) {
+		t.Fatalf("expected ErrPathEscapesScope, got %v", err)
+	}
+	if _, err := os.Lstat(filepath.Join(outsideDir, "hack.txt")); !os.IsNotExist(err) {
+		t.Fatal("write landed outside the source through the symlinked parent")
+	}
+}
+
 func waitForScannerReady(t *testing.T, idx *indexing.Index) {
 	t.Helper()
 	// Give the scanners a moment to initialize, but don't wait for full "ready" status
 	// The initial scan can take longer than the test timeout, but DeleteFiles will work
 	// as long as the scanners are initialized and running
 	time.Sleep(500 * time.Millisecond)
-	
+
 	// Verify scanners exist
 	status := idx.GetScannerStatus()
 	if totalScanners, ok := status["totalScanners"].(int); !ok || totalScanners == 0 {

backend/internal/adapters/fs/files/files.go

@@ -1,13 +1,11 @@
 package files
 
 import (
-	"bufio"
 	"context"
 	"fmt"
 	"io"
 	"os"
 	"path/filepath"
-	"regexp"
 	"strconv"
 	"strings"
 	"sync"
@@ -18,15 +16,15 @@ import (
 	"github.com/gtsteffaniak/filebrowser/backend/internal/database/users"
 	"github.com/gtsteffaniak/filebrowser/backend/internal/errors"
 	"github.com/gtsteffaniak/filebrowser/backend/internal/ffmpeg"
+	"github.com/gtsteffaniak/filebrowser/backend/internal/gomedia"
 	"github.com/gtsteffaniak/filebrowser/backend/internal/utils"
 	"github.com/gtsteffaniak/filebrowser/backend/pkg/indexing"
 	"github.com/gtsteffaniak/filebrowser/backend/pkg/indexing/iteminfo"
 	"github.com/gtsteffaniak/filebrowser/backend/pkg/settings"
 	"github.com/gtsteffaniak/go-logger/logger"
+	"github.com/gtsteffaniak/go-media/pkg/media"
 )
 
-var reDuration = regexp.MustCompile(`^\[(?:(\d{1,2}):)?(\d{1,2}):(\d{1,2})\.(\d+)\](.*)`)
-
 // CheckPermissionsFunc allows tests to override CheckPermissions behavior
 var CheckPermissionsFunc = func(opts utils.FileOptions, user *users.User) (string, string, error) {
 	return checkPermissionsImpl(opts, user, svc())
@@ -50,7 +48,7 @@ func addMetadataToChildren(response *iteminfo.ExtendedFileInfo, opts utils.FileO
 		wg.Go(func() {
 			fullPath := response.RealPath + "/" + fileItem.Name
 			if isAudio {
-				if err := extractAudioMetadata(context.Background(), fileItem, fullPath, opts.AlbumArt, opts.Metadata, false, sharedFFmpegService); err != nil {
+				if err := extractAudioMetadata(context.Background(), fileItem, fullPath, opts.AlbumArt, opts.Metadata, sharedFFmpegService); err != nil {
 					logger.Debugf("failed to extract metadata for file: %s, error: %v", fileItem.Name, err)
 				}
 			} else {
@@ -75,13 +73,18 @@ func processDirectoryMetadata(response *iteminfo.ExtendedFileInfo, idx *indexing
 	}
 	var wg sync.WaitGroup
 
-	wg.Go(func() {
-		indexPath := idx.MakeIndexPath(response.Path, true).String()
-		err := idx.RefreshDirectory(indexPath, false)
-		if err != nil {
-			logger.Debugf("Failed to refresh directory for folder size update: %v", err)
-		}
-	})
+	// Expanded listings already persisted index rows and the folder size from
+	// the freshly read directory (persistDirectoryListing); only unexpanded
+	// directory requests still need a refresh walk.
+	if !opts.Expand {
+		wg.Go(func() {
+			indexPath := idx.MakeIndexPath(response.Path, true).String()
+			err := idx.RefreshDirectory(indexPath, false)
+			if err != nil {
+				logger.Debugf("Failed to refresh directory for folder size update: %v", err)
+			}
+		})
+	}
 
 	if opts.Metadata && metadataCount > 0 {
 		addMetadataToChildren(response, opts, &wg)
@@ -92,7 +95,7 @@ func processDirectoryMetadata(response *iteminfo.ExtendedFileInfo, idx *indexing
 // finalizeResponse handles final response adjustments (OnlyOffice ID, scope stripping).
 func finalizeResponse(response *iteminfo.ExtendedFileInfo, info *iteminfo.FileInfo, realPath string, user *users.User, userScope string) {
 	// Add OnlyOffice ID if applicable
-	if settings.Config.Integrations.OnlyOffice.Secret != "" && info.Type != "directory" && iteminfo.IsOnlyOffice(info.Name) {
+	if settings.Config.Integrations.OnlyOffice.Secret != "" && !settings.Config.Integrations.OnlyOffice.IsCollabora() && info.Type != "directory" && iteminfo.IsOnlyOffice(info.Name) {
 		response.OnlyOfficeId = generateOfficeId(realPath)
 	}
 
@@ -334,6 +337,15 @@ func fileInfoFasterImpl(opts utils.FileOptions, user *users.User, s *Service) (*
 		if info.Type == "directory" && opts.HideFileExt != "" {
 			response.Files = filterFilesByExt(response.Files, opts.HideFileExt)
 		}
+		if info.Type == "directory" && opts.Expand {
+			// Expanded listings without extended attrs skip persistDirectoryListing
+			// (their placeholder preview values must not overwrite index rows), so
+			// refresh the index lazily — otherwise folder sizes here never update.
+			// Capture indexPath now: the deferred finalizeResponse strips the user
+			// scope from response.Path before returning.
+			// Coalesced per path so repeated listings do not run parallel refreshes.
+			idx.RefreshDirectoryAsync(idx.MakeIndexPath(response.Path, true).String())
+		}
 		return response, nil
 	}
 	// Process directory metadata if requested
@@ -370,7 +382,7 @@ func processContent(info *iteminfo.ExtendedFileInfo, idx *indexing.Index, opts u
 		}
 		err := extractVideoMetadata(context.Background(), extItem, info.RealPath, nil)
 		if err != nil {
-			logger.Debugf("failed to extract video metadata for file: "+info.RealPath, info.Name, err)
+			logger.Debugf("failed to extract video metadata for file: %s (%s): %v", info.RealPath, info.Name, err)
 		} else {
 			info.Metadata = extItem.Metadata
 		}
@@ -380,10 +392,13 @@ func processContent(info *iteminfo.ExtendedFileInfo, idx *indexing.Index, opts u
 		if exists {
 			info.GetSubtitles(parentInfo)
 		}
-		if opts.ExtractEmbeddedSubtitles {
-			subtitles := ffmpeg.DetectEmbeddedSubtitles(info.RealPath, info.ModTime)
-			info.Subtitles = append(info.Subtitles, subtitles...)
+		subtitles, ok := gomedia.EmbeddedSubtitles(info.RealPath, info.ModTime, func() ([]utils.SubtitleTrack, bool) {
+			return ffmpeg.DetectEmbeddedSubtitles(info.RealPath, info.ModTime), true
+		})
+		if !ok {
+			subtitles = ffmpeg.DetectEmbeddedSubtitles(info.RealPath, info.ModTime)
 		}
+		info.Subtitles = append(info.Subtitles, subtitles...)
 		return
 	}
 
@@ -393,7 +408,7 @@ func processContent(info *iteminfo.ExtendedFileInfo, idx *indexing.Index, opts u
 		extItem := &iteminfo.ExtendedItemInfo{
 			ItemInfo: info.ItemInfo,
 		}
-		err := extractAudioMetadata(context.Background(), extItem, info.RealPath, opts.AlbumArt || opts.Content, opts.Metadata || opts.Content, false, nil)
+		err := extractAudioMetadata(context.Background(), extItem, info.RealPath, opts.AlbumArt || opts.Content, opts.Metadata || opts.Content, nil)
 		if err != nil {
 			logger.Debugf("failed to extract audio metadata for file: "+info.RealPath, info.Name, err)
 		} else {
@@ -431,57 +446,10 @@ func generateOfficeId(realPath string) string {
 	return key
 }
 
-// Parses raw LRC text into a slice of Lyric.
-// Lines with [hh:mm:ss.xx] (timestamps) will be parsed to ms for synced lyrics
-// The ones without timestamp are kept as unsynced (timestamp 0).
-func parseLRC(raw string) []iteminfo.Lyric {
-	var lines []iteminfo.Lyric
-	scanner := bufio.NewScanner(strings.NewReader(raw))
-	for scanner.Scan() {
-		line := strings.TrimSpace(scanner.Text())
-		if line == "" {
-			continue
-		}
-		matches := reDuration.FindStringSubmatch(line)
-		if len(matches) == 6 {
-			// Hours default to 0 (if not present in the timestamps)
-			h := 0
-			if matches[1] != "" {
-				h, _ = strconv.Atoi(matches[1])
-			}
-			min, _ := strconv.Atoi(matches[2])
-			sec, _ := strconv.Atoi(matches[3])
-
-			msStr := matches[4]
-			// Normalise to 3 digits, some songs have more than 3 digits in the milliseconds
-			switch {
-			case len(msStr) < 3:
-				msStr += strings.Repeat("0", 3-len(msStr))
-			case len(msStr) > 3:
-				msStr = msStr[:3]
-			}
-			ms, _ := strconv.Atoi(msStr)
-			timestamp := int64((h*3600+min*60+sec)*1000 + ms)
-			text := strings.TrimSpace(matches[5])
-			lines = append(lines, iteminfo.Lyric{
-				Text:      text,
-				Timestamp: timestamp,
-			})
-		} else {
-			// Line without a valid timestamp – treat as unsynced (timestamp 0)
-			lines = append(lines, iteminfo.Lyric{
-				Text:      line,
-				Timestamp: 0,
-			})
-		}
-	}
-	return lines
-}
-
 // extractAudioMetadata extracts metadata from an audio file using dhowden/tag
 // and optionally extracts duration using the ffmpeg service with concurrency control
 // If ffmpegService is nil, a new service will be created (for backward compatibility)
-func extractAudioMetadata(ctx context.Context, item *iteminfo.ExtendedItemInfo, realPath string, getArt bool, getDuration bool, getLyrics bool, ffmpegService *ffmpeg.FFmpegService) error {
+func extractAudioMetadata(ctx context.Context, item *iteminfo.ExtendedItemInfo, realPath string, getArt bool, getDuration bool, ffmpegService *ffmpeg.FFmpegService) error {
 	file, err := os.Open(realPath)
 	if err != nil {
 		return err
@@ -500,6 +468,29 @@ func extractAudioMetadata(ctx context.Context, item *iteminfo.ExtendedItemInfo,
 		return fmt.Errorf("file with size %d MB exceeds metadata check limit: %d MB", fileInfo.Size()/1024/1024, maxSize)
 	}
 
+	// go-media fast path: tags, lyrics availability, and artwork. Unsupported or
+	// failed reads fall through to the existing dhowden/tag code below.
+	if info, ok := gomedia.Audio(realPath, getArt, func() (gomedia.AudioInfo, bool) { return legacyAudioInfo(realPath, getArt) }); ok {
+		item.Metadata = &iteminfo.MediaMetadata{
+			Title:     info.Tags.Title,
+			Artist:    info.Tags.Artist,
+			Album:     info.Tags.Album,
+			Year:      info.Tags.Year,
+			Genre:     info.Tags.Genre,
+			Track:     info.Tags.Track,
+			HasLyrics: info.HasLyrics,
+		}
+		if getDuration {
+			audioDuration(ctx, item, realPath, ffmpegService)
+		}
+		if n := len(info.Artwork); n > 0 && n <= 5*1024*1024 {
+			item.Metadata.AlbumArt = info.Artwork
+		} else if n > 5*1024*1024 {
+			logger.Debugf("Skipping album art for %s: too large (%d bytes)", realPath, n)
+		}
+		return nil
+	}
+
 	m, err := tag.ReadFrom(file)
 	if err != nil {
 		return err
@@ -518,41 +509,12 @@ func extractAudioMetadata(ctx context.Context, item *iteminfo.ExtendedItemInfo,
 	item.Metadata.Track = track
 
 	// Check if lyrics are available without extract them
-	if rawLyrics := m.Lyrics(); rawLyrics != "" {
-		item.Metadata.HasLyrics = true
-	} else {
-		// Check for sidecar .lrc file
-		dir := filepath.Dir(realPath)
-		base := filepath.Base(realPath)
-		ext := filepath.Ext(base)
-		nameWithoutExt := strings.TrimSuffix(base, ext)
-		lrcPath := filepath.Join(dir, nameWithoutExt+".lrc")
-		if _, err := os.Stat(lrcPath); err == nil {
-			item.Metadata.HasLyrics = true
-		}
-	}
-
-	if getLyrics {
-		lyrics, err := ExtractLyrics(realPath)
-		if err != nil {
-			logger.Debugf("failed to extract lyrics for %s: %v", realPath, err)
-		} else if len(lyrics) > 0 {
-			item.Metadata.Lyrics = lyrics
-		}
-	}
+	item.Metadata.HasLyrics = hasLyricsSidecar(realPath) || m.Lyrics() != ""
 
 	// Extract duration ONLY if explicitly requested using the ffmpeg VideoService
 	// This respects concurrency limits and gracefully handles missing ffmpeg
 	if getDuration {
-		service := ffmpegService
-		if service == nil {
-			service = ffmpeg.Get()
-		}
-		if service != nil {
-			if duration, err := service.GetMediaDuration(ctx, realPath); err == nil {
-				item.Metadata.Duration = int(duration)
-			}
-		}
+		audioDuration(ctx, item, realPath, ffmpegService)
 	}
 
 	if !getArt {
@@ -572,58 +534,216 @@ func extractAudioMetadata(ctx context.Context, item *iteminfo.ExtendedItemInfo,
 	return nil
 }
 
-// Returns lyrics from an audio file (from embedded tags or from a .lrc file with the same name).
-func ExtractLyrics(realPath string) ([]iteminfo.Lyric, error) {
-	file, err := os.Open(realPath)
-	if err != nil {
-		return nil, err
+// audioDuration sets the duration on item.Metadata. go-media reads it from the
+// container header first, then ffmpeg is used.
+func audioDuration(ctx context.Context, item *iteminfo.ExtendedItemInfo, realPath string, ffmpegService *ffmpeg.FFmpegService) {
+	service := ffmpegService
+	if service == nil {
+		service = ffmpeg.Get()
 	}
-	defer file.Close()
-
-	m, err := tag.ReadFrom(file)
-	if err != nil {
-		return nil, err
+	// The shadow run can outlive the request, so it uses a context that is not cancelled with it.
+	shadowCtx := context.WithoutCancel(ctx)
+	legacy := func() (float64, bool) {
+		d, err := service.GetMediaDuration(shadowCtx, realPath)
+		return d, err == nil
 	}
-
-	var lyrics []iteminfo.Lyric
-	if raw := m.Lyrics(); raw != "" {
-		lyrics = parseLRC(raw)
+	if duration, ok := gomedia.Duration(realPath, legacy); ok {
+		item.Metadata.Duration = int(duration)
+		return
 	}
-	if len(lyrics) == 0 {
-		// Check for sidecar .lrc file
-		dir := filepath.Dir(realPath)
-		base := filepath.Base(realPath)
-		ext := filepath.Ext(base)
-		nameWithoutExt := strings.TrimSuffix(base, ext)
-		lrcPath := filepath.Join(dir, nameWithoutExt+".lrc")
-		if data, err := os.ReadFile(lrcPath); err == nil {
-			lyrics = parseLRC(string(data))
+	if service != nil {
+		if duration, err := service.GetMediaDuration(ctx, realPath); err == nil {
+			item.Metadata.Duration = int(duration)
 		}
 	}
-	return lyrics, nil
+}
+
+var lyricsSidecarExts = []string{".elrc", ".lrc", ".srt", ".vtt"}
+
+func lyricsSidecar(dir, nameWithoutExt, ext string) (path string, ok bool) {
+	sidecarPath := filepath.Join(dir, nameWithoutExt+ext)
+	info, err := os.Lstat(sidecarPath)
+	if err != nil {
+		return "", false
+	}
+	if !info.Mode().IsRegular() {
+		return "", false
+	}
+	if info.Size() > 15*1024*1024 { // 15MB
+		return "", false
+	}
+	return sidecarPath, true
+}
+
+func findLyricsSidecar(realPath string) (data []byte, ext string, ok bool) {
+	dir := filepath.Dir(realPath)
+	base := filepath.Base(realPath)
+	nameWithoutExt := strings.TrimSuffix(base, filepath.Ext(base))
+	for _, ext = range lyricsSidecarExts {
+		sidecarPath, candOk := lyricsSidecar(dir, nameWithoutExt, ext)
+		if !candOk {
+			continue
+		}
+		data, err := os.ReadFile(sidecarPath)
+		if err != nil {
+			continue
+		}
+		if strings.TrimSpace(string(data)) == "" {
+			continue
+		}
+		return data, strings.TrimPrefix(ext, "."), true
+	}
+	return nil, "", false
+}
+
+func hasLyricsSidecar(realPath string) bool {
+	dir := filepath.Dir(realPath)
+	base := filepath.Base(realPath)
+	nameWithoutExt := strings.TrimSuffix(base, filepath.Ext(base))
+	for _, ext := range lyricsSidecarExts {
+		sidecarPath, ok := lyricsSidecar(dir, nameWithoutExt, ext)
+		if !ok {
+			continue
+		}
+		f, err := os.Open(sidecarPath)
+		if err != nil {
+			continue
+		}
+		buf := make([]byte, 4096)
+		for {
+			n, readErr := f.Read(buf)
+			if n > 0 && strings.TrimSpace(string(buf[:n])) != "" {
+				f.Close()
+				return true
+			}
+			if readErr != nil {
+				break
+			}
+		}
+		f.Close()
+	}
+	return false
+}
+
+// Returns raw lyrics from an audio file (from embedded tags or from sidecar files with the same name).
+func ExtractLyrics(realPath string) (string, string, error) {
+	// go-media fast path: sidecar first, then embedded tags. Falls through to the
+	// existing code below when unsupported or failed.
+	if text, format, ok := gomedia.Lyrics(realPath, func() (gomedia.LyricsResult, bool) { return legacyLyrics(realPath) }); ok {
+		return text, format, nil
+	}
+	if data, ext, ok := findLyricsSidecar(realPath); ok {
+		return string(data), ext, nil
+	}
+	file, err := os.Open(realPath)
+	if err != nil {
+		return "", "", err
+	}
+	defer file.Close()
+	m, err := tag.ReadFrom(file)
+	if err != nil {
+		return "", "", err
+	}
+	if raw := m.Lyrics(); raw != "" {
+		return raw, "embedded", nil
+	}
+	return "", "", nil
+}
+
+// legacyAudioInfo is the dhowden tag read used as the shadow-mode comparison
+// for gomedia.Audio. It returns the same fields go-media returns, so the two
+// can be compared. Cover bytes are read only when withArt is true.
+func legacyAudioInfo(realPath string, withArt bool) (gomedia.AudioInfo, bool) {
+	f, err := os.Open(realPath)
+	if err != nil {
+		return gomedia.AudioInfo{}, false
+	}
+	defer f.Close()
+	m, err := tag.ReadFrom(f)
+	if err != nil {
+		return gomedia.AudioInfo{}, false
+	}
+	track, _ := m.Track()
+	info := gomedia.AudioInfo{
+		Tags: media.Tags{
+			Title:  m.Title(),
+			Artist: m.Artist(),
+			Album:  m.Album(),
+			Year:   m.Year(),
+			Genre:  m.Genre(),
+			Track:  track,
+		},
+		HasLyrics: strings.TrimSpace(m.Lyrics()) != "" || hasLyricsSidecar(realPath),
+	}
+	if withArt {
+		if pic := m.Picture(); pic != nil {
+			info.Artwork = pic.Data
+		}
+	}
+	return info, true
+}
+
+// legacyLyrics is the sidecar and dhowden lyrics read used as the shadow-mode
+// comparison for gomedia.Lyrics. Sidecar first, then embedded, as in go-media.
+func legacyLyrics(realPath string) (gomedia.LyricsResult, bool) {
+	if data, ext, ok := findLyricsSidecar(realPath); ok {
+		return gomedia.LyricsResult{Text: strings.TrimSpace(string(data)), Format: ext}, true
+	}
+	f, err := os.Open(realPath)
+	if err != nil {
+		return gomedia.LyricsResult{}, false
+	}
+	defer f.Close()
+	m, err := tag.ReadFrom(f)
+	if err != nil {
+		return gomedia.LyricsResult{}, false
+	}
+	text := strings.TrimSpace(m.Lyrics())
+	if text == "" {
+		return gomedia.LyricsResult{}, false
+	}
+	return gomedia.LyricsResult{Text: text, Format: "embedded"}, true
 }
 
 // extractVideoMetadata extracts duration and codec info from video files using ffprobe.
 // If ffmpegService is nil, a new service will be created (for backward compatibility)
 func extractVideoMetadata(ctx context.Context, item *iteminfo.ExtendedItemInfo, realPath string, ffmpegService *ffmpeg.FFmpegService) error {
-	service := ffmpegService
-	if service == nil {
-		service = ffmpeg.Get()
+	// go-media fast path. Works without ffmpeg installed.
+	probeService := ffmpegService
+	if probeService == nil {
+		probeService = ffmpeg.Get()
 	}
-	if service == nil {
-		return nil
+	// The shadow run can outlive the request, so it uses a context that is not cancelled with it.
+	shadowCtx := context.WithoutCancel(ctx)
+	legacyProbe := func() (gomedia.ProbeResult, bool) {
+		info, err := probeService.ProbeFile(shadowCtx, realPath)
+		if err != nil || info == nil {
+			return gomedia.ProbeResult{}, false
+		}
+		return *info, true
 	}
+	info, ok := gomedia.Probe(realPath, legacyProbe)
+	if !ok {
+		service := ffmpegService
+		if service == nil {
+			service = ffmpeg.Get()
+		}
+		if service == nil {
+			return nil
+		}
 
-	info, err := service.ProbeFile(ctx, realPath)
-	if err != nil {
-		duration, durErr := service.GetMediaDuration(ctx, realPath)
-		if durErr != nil {
-			return err
+		probed, err := service.ProbeFile(ctx, realPath)
+		if err != nil {
+			duration, durErr := service.GetMediaDuration(ctx, realPath)
+			if durErr != nil {
+				return err
+			}
+			if duration > 0 {
+				item.Metadata = &iteminfo.MediaMetadata{Duration: int(duration)}
+			}
+			return nil
 		}
-		if duration > 0 {
-			item.Metadata = &iteminfo.MediaMetadata{Duration: int(duration)}
-		}
-		return nil
+		info = *probed
 	}
 
 	meta := &iteminfo.MediaMetadata{}
@@ -645,47 +765,53 @@ func extractVideoMetadata(ctx context.Context, item *iteminfo.ExtendedItemInfo,
 	return nil
 }
 
-func DeleteFiles(source, absPath string, isDir bool) error {
+// DeleteFiles deletes the file or directory at indexPath. boundIndexPath limits
+// symlink resolution to the caller's scope ("" or "/" = source root only). The
+// entry itself is removed: a symlink leaf is deleted, never followed, and an
+// intermediate symlinked component cannot carry the delete outside the bound.
+func DeleteFiles(source, boundIndexPath, indexPath string, isDir bool) error {
 	index := indexing.GetIndex(source)
 	if index == nil {
 		return fmt.Errorf("could not get index: %v ", source)
 	}
-	// Safety guard: never allow deletion of the source root directory itself
-	cleanAbs := filepath.Clean(absPath)
-	if cleanAbs == filepath.Clean(index.Path) {
-		return fmt.Errorf("refusing to delete source root directory: %s", absPath)
+	if utils.CleanIndexPathSegment(indexPath) == "" {
+		return fmt.Errorf("refusing to delete source root directory: %s", indexPath)
 	}
-
-	if !index.Config.ResolvedRules.IndexingDisabled {
-		indexPath := index.MakeIndexPath(absPath, isDir).String()
-
-		// Perform the physical deletion
-		err := os.RemoveAll(absPath)
-		if err != nil {
-			return err
-		}
-
-		// Clear cache entries
-		indexing.RealPathCache.Delete(absPath)
-		indexing.IsDirCache.Delete(absPath + ":isdir")
-
-		// Remove metadata from index
-		deleteSuccess := index.DeleteMetadata(indexPath, isDir, isDir)
-		if !deleteSuccess {
-			logger.Errorf("Failed to delete metadata from index for %s, but filesystem deletion succeeded", indexPath)
-		}
-
-		// Refresh the parent directory to recalculate sizes and update counts
-		refreshConfig := utils.FileOptions{
-			Path:  index.MakeIndexPath(filepath.Dir(absPath), true).String(),
-			IsDir: true,
-		}
-		err = index.RefreshFileInfo(refreshConfig)
+	realPath, err := index.GetRealPathForRemoval(boundIndexPath, indexPath)
+	if err != nil {
 		return err
 	}
 
-	// Indexing disabled, just delete the file
-	return os.RemoveAll(absPath)
+	if index.Config.ResolvedRules.IndexingDisabled {
+		// Indexing disabled, just delete the file
+		return os.RemoveAll(realPath)
+	}
+
+	indexPath = index.MakeIndexPath(indexPath, isDir).String()
+
+	// Perform the physical deletion
+	err = os.RemoveAll(realPath)
+	if err != nil {
+		return err
+	}
+
+	// Clear cache entries
+	indexing.RealPathCache.Delete(realPath)
+	indexing.IsDirCache.Delete(realPath + ":isdir")
+
+	// Remove metadata from index
+	deleteSuccess := index.DeleteMetadata(indexPath, isDir, isDir)
+	if !deleteSuccess {
+		logger.Errorf("Failed to delete metadata from index for %s, but filesystem deletion succeeded", indexPath)
+	}
+
+	// Refresh the parent directory to recalculate sizes and update counts
+	refreshConfig := utils.FileOptions{
+		Path:  index.MakeIndexPath(filepath.Dir(strings.TrimSuffix(indexPath, "/")), true).String(),
+		IsDir: true,
+	}
+	err = index.RefreshFileInfo(refreshConfig)
+	return err
 }
 
 func RefreshIndex(source string, path string, isDir bool, recursive bool) error {
@@ -912,15 +1038,19 @@ func CopyResource(isSrcDir bool, sourceIndex, destIndex, realsrc, realdst string
 	return nil
 }
 
-func WriteDirectory(opts utils.FileOptions) error {
+// WriteDirectory creates a directory at opts.Path. boundIndexPath limits symlink
+// resolution to the caller's scope ("" or "/" = source root only).
+func WriteDirectory(boundIndexPath string, opts utils.FileOptions) error {
 	idx := indexing.GetIndex(opts.Source)
 	if idx == nil {
 		return fmt.Errorf("could not get index: %v ", opts.Source)
 	}
-	realPath, _, _ := idx.GetRealPath(opts.Path)
+	realPath, err := idx.GetRealPathForMutation(boundIndexPath, opts.Path)
+	if err != nil {
+		return err
+	}
 
 	var stat os.FileInfo
-	var err error
 	// Check if the destination exists and is a file
 	if stat, err = os.Stat(realPath); err == nil && !stat.IsDir() {
 		// If it's a file and we're trying to create a directory, remove the file first
@@ -964,21 +1094,24 @@ func WriteDirectory(opts utils.FileOptions) error {
 // WriteFileFunc is a variable that can be mocked in tests
 var WriteFileFunc = writeFile
 
-func WriteFile(source, path string, in io.Reader) error {
-	return WriteFileFunc(source, path, in)
+// WriteFile writes stream contents to the file at index path path. boundIndexPath
+// limits symlink resolution to the caller's scope ("" or "/" = source root only).
+func WriteFile(source, boundIndexPath, path string, in io.Reader) error {
+	return WriteFileFunc(source, boundIndexPath, path, in)
 }
 
-func writeFile(source, path string, in io.Reader) error {
+func writeFile(source, boundIndexPath, path string, in io.Reader) error {
 	idx := indexing.GetIndex(source)
 	if idx == nil {
 		return fmt.Errorf("could not get index: %v ", source)
 	}
-	realPath, _, _ := idx.GetRealPath(path)
-	// Strip trailing slash from realPath if it's meant to be a file
-	realPath = strings.TrimRight(realPath, "/")
+	realPath, err := idx.GetRealPathForMutation(boundIndexPath, path)
+	if err != nil {
+		return err
+	}
 	// Ensure the parent directories exist
 	parentDir := filepath.Dir(realPath)
-	err := os.MkdirAll(parentDir, fileutils.PermDir)
+	err = os.MkdirAll(parentDir, fileutils.PermDir)
 	if err != nil {
 		return err
 	}

backend/internal/adapters/fs/files/mime.go

@@ -55,6 +55,8 @@ const (
 var types = map[string]string{
 	".3dm":       "x-world/x-3dmf",
 	".3dmf":      "x-world/x-3dmf",
+	".3g2":       "video/3gpp2",
+	".3gp":       "video/3gpp",
 	".7z":        "application/x-7z-compressed",
 	".a":         "application/octet-stream",
 	".aab":       "application/x-authorware-bin",
@@ -447,6 +449,7 @@ var types = map[string]string{
 	".vtt":       "text/subtitle-vtt",
 	".ssa":       "text/subtitle-ssa",
 	".lrc":       "text/lyrics",
+	".elrc":      "text/lyrics",
 	".sbv":       "text/plain",
 	".ssi":       "text/x-server-parsed-html",
 	".ssm":       "application/streamingmedia",
@@ -524,6 +527,7 @@ var types = map[string]string{
 	".wmlc":      "application/vnd.wap.wmlc",
 	".wmls":      "text/vnd.wap.wmlscript",
 	".wmlsc":     "application/vnd.wap.wmlscriptc",
+	".wmv":       "video/x-ms-wmv",
 	".word":      "application/msword",
 	".wp5":       "application/wordperfect",
 	".wp6":       "application/wordperfect",
@@ -649,55 +653,55 @@ var types = map[string]string{
 	".tmp":       "text/tmp",
 	".temp":      "text/tmp",
 	// the ones below are some from: https://svn.apache.org/repos/asf/httpd/httpd/trunk/docs/conf/mime.types
-	".adp":       "audio/adpcm",
-	".mp4a":      "audio/mp4",
-	".mp2a":      "audio/mpeg",
-	".m3a":       "audio/mpeg",
-	".sil":       "audio/silk",
-	".uva":       "audio/vnd.dece.audio",
-	".uvva":      "audio/vnd.dece.audio",
-	".eol":       "audio/vnd.digital-winds",
-	".dra":       "audio/vnd.dra",
-	".dts":       "audio/vnd.dts",
-	".dtshd":     "audio/vnd.dts.hd",
-	".lvp":       "audio/vnd.lucent.voice",
-	".pya":       "audio/vnd.ms-playready.media.pya",
-	".rip":       "audio/vnd.rip",
-	".mka":       "audio/x-matroska",
-	".h261":      "video/h261",
-	".h263":      "video/h263",
-	".h264":      "video/h264",
-	".jpgv":      "video/jpeg",
-	".jpm":       "video/jpm",
-	".jpgm":      "video/jpm",
-	".mj2":       "video/mj2",
-	".mjp2":      "video/mj2",
-	".m2t":       "video/mp2t",
-	".m2ts":      "video/mp2t",
-	".mts":       "video/mp2t",
-	".mp4v":      "video/mp4",
-	".mpg4":      "video/mp4",
-	".uvh":       "video/vnd.dece.hd",
-	".uvvh":      "video/vnd.dece.hd",
-	".uvm":       "video/vnd.dece.mobile",
-	".uvvm":      "video/vnd.dece.mobile",
-	".uvp":       "video/vnd.dece.pd",
-	".uvvp":      "video/vnd.dece.pd",
-	".uvs":       "video/vnd.dece.sd",
-	".uvvs":      "video/vnd.dece.sd",
-	".uvv":       "video/vnd.dece.video",
-	".uvvv":      "video/vnd.dece.video",
-	".dvb":       "video/vnd.dvb.file",
-	".fvt":       "video/vnd.fvt",
-	".mxu":       "video/vnd.mpegurl",
-	".pyv":       "video/vnd.ms-playready.media.pyv",
-	".uvu":       "video/vnd.uvvu.mp4",
-	".uvvu":      "video/vnd.uvvu.mp4",
-	".f4v":       "video/x-f4v",
-	".mk3d":      "video/x-matroska",
-	".mks":       "video/x-matroska",
-	".vob":       "video/x-ms-vob",
-	".smv":       "video/x-smv",
+	".adp":   "audio/adpcm",
+	".mp4a":  "audio/mp4",
+	".mp2a":  "audio/mpeg",
+	".m3a":   "audio/mpeg",
+	".sil":   "audio/silk",
+	".uva":   "audio/vnd.dece.audio",
+	".uvva":  "audio/vnd.dece.audio",
+	".eol":   "audio/vnd.digital-winds",
+	".dra":   "audio/vnd.dra",
+	".dts":   "audio/vnd.dts",
+	".dtshd": "audio/vnd.dts.hd",
+	".lvp":   "audio/vnd.lucent.voice",
+	".pya":   "audio/vnd.ms-playready.media.pya",
+	".rip":   "audio/vnd.rip",
+	".mka":   "audio/x-matroska",
+	".h261":  "video/h261",
+	".h263":  "video/h263",
+	".h264":  "video/h264",
+	".jpgv":  "video/jpeg",
+	".jpm":   "video/jpm",
+	".jpgm":  "video/jpm",
+	".mj2":   "video/mj2",
+	".mjp2":  "video/mj2",
+	".m2t":   "video/mp2t",
+	".m2ts":  "video/mp2t",
+	".mts":   "video/mp2t",
+	".mp4v":  "video/mp4",
+	".mpg4":  "video/mp4",
+	".uvh":   "video/vnd.dece.hd",
+	".uvvh":  "video/vnd.dece.hd",
+	".uvm":   "video/vnd.dece.mobile",
+	".uvvm":  "video/vnd.dece.mobile",
+	".uvp":   "video/vnd.dece.pd",
+	".uvvp":  "video/vnd.dece.pd",
+	".uvs":   "video/vnd.dece.sd",
+	".uvvs":  "video/vnd.dece.sd",
+	".uvv":   "video/vnd.dece.video",
+	".uvvv":  "video/vnd.dece.video",
+	".dvb":   "video/vnd.dvb.file",
+	".fvt":   "video/vnd.fvt",
+	".mxu":   "video/vnd.mpegurl",
+	".pyv":   "video/vnd.ms-playready.media.pyv",
+	".uvu":   "video/vnd.uvvu.mp4",
+	".uvvu":  "video/vnd.uvvu.mp4",
+	".f4v":   "video/x-f4v",
+	".mk3d":  "video/x-matroska",
+	".mks":   "video/x-matroska",
+	".vob":   "video/x-ms-vob",
+	".smv":   "video/x-smv",
 }
 
 //nolint:gochecknoinits

backend/internal/adapters/fs/files/mime_test.go

@@ -0,0 +1,25 @@
+package files
+
+import (
+	"mime"
+	"testing"
+)
+
+// Video containers that browsers cannot play must still be detected as video so
+// the preview routes to the transcode UI instead of showing "no preview".
+func TestVideoContainerExtensionsAreRegisteredAsVideo(t *testing.T) {
+	tests := map[string]string{
+		".wmv": "video/x-ms-wmv",
+		".3gp": "video/3gpp",
+		".3g2": "video/3gpp2",
+		".mp4": "video/mp4",
+		".avi": "video/x-msvideo",
+		".mkv": "video/x-matroska",
+	}
+	for ext, want := range tests {
+		got := mime.TypeByExtension(ext)
+		if got != want {
+			t.Errorf("mime.TypeByExtension(%q) = %q, want %q", ext, got, want)
+		}
+	}
+}

backend/internal/adapters/fs/files/user.go

@@ -5,8 +5,8 @@ import (
 	"os"
 	"path/filepath"
 
-	"github.com/gtsteffaniak/filebrowser/backend/pkg/settings"
 	"github.com/gtsteffaniak/filebrowser/backend/internal/database/users"
+	"github.com/gtsteffaniak/filebrowser/backend/pkg/settings"
 	"github.com/gtsteffaniak/go-logger/logger"
 )
 
@@ -19,11 +19,13 @@ func MakeUserDir(fullPath string) error {
 }
 
 func MakeUserDirs(u *users.User, createDir bool) error {
+	if u.Permissions.Admin {
+		return nil
+	}
 	cleanedUserName := users.CleanUsername(u.Username)
 	if cleanedUserName == "" || cleanedUserName == "-" || cleanedUserName == "." {
 		return fmt.Errorf("MakeUserDirs: invalid user for home dir creation: [%s]", u.Username)
 	}
-	settings.ExpandBackendScopesForCreateUserDir(u)
 	for i, scope := range u.BackendScopes {
 		source, ok := settings.Config.Server.SourceMap[scope.Path]
 		if !ok {

backend/internal/adapters/fs/files/user_test.go

@@ -0,0 +1,54 @@
+package files
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/gtsteffaniak/filebrowser/backend/internal/database/users"
+	"github.com/gtsteffaniak/filebrowser/backend/pkg/settings"
+)
+
+func TestMakeUserDirsSkipsAdmins(t *testing.T) {
+	root := t.TempDir()
+	saved := settings.Config
+	t.Cleanup(func() { settings.Config = saved })
+	settings.Config = settings.Settings{
+		Server: settings.Server{
+			Sources: []*settings.Source{{
+				Path: root,
+				Config: settings.SourceConfig{
+					CreateUserDir: true,
+				},
+			}},
+			SourceMap: map[string]*settings.Source{
+				root: {
+					Path: root,
+					Config: settings.SourceConfig{
+						CreateUserDir: true,
+					},
+				},
+			},
+		},
+	}
+
+	u := &users.User{
+		FrontendUser: users.FrontendUser{
+			Username: "admin",
+			Permissions: users.Permissions{
+				Admin: true,
+			},
+		},
+		BackendScopes: []users.BackendScope{{Path: root, Scope: "/"}},
+	}
+
+	if err := MakeUserDirs(u, true); err != nil {
+		t.Fatalf("MakeUserDirs: %v", err)
+	}
+	if got := u.BackendScopes[0].Scope; got != "/" {
+		t.Fatalf("scope=%q want /", got)
+	}
+	if _, err := os.Stat(filepath.Join(root, "admin")); !os.IsNotExist(err) {
+		t.Fatalf("admin directory stat error=%v, want not-exist", err)
+	}
+}

backend/internal/adapters/fs/fileutils/assets.go

@@ -3,6 +3,8 @@ package fileutils
 import (
 	"io/fs"
 	"net/http"
+
+	"github.com/gtsteffaniak/go-logger/logger"
 )
 
 var (
@@ -21,12 +23,24 @@ func (d dirFS) Open(name string) (fs.File, error) {
 
 // InitAssetFS initializes the asset filesystem for the application
 // This should be called once during startup before http or preview services start
-func InitAssetFS(embeddedAssets fs.FS, useEmbedded bool) {
+func InitAssetFS(embeddedAssets fs.FS, useEmbedded bool, devMode bool) {
 	if useEmbedded {
 		assetFs = embeddedAssets
+	} else if devMode {
+		// Dev mode: serve frontend source assets (templates, fonts, icons)
+		assetFs = dirFS{Dir: http.Dir("../frontend/public")}
 	} else {
-		// Dev mode: Serve files from internal/web/dist directory
-		assetFs = dirFS{Dir: http.Dir("internal/web/dist")}
+		// Non-dev disk build (e.g. Docker): dist is shipped beside the binary. Preload it
+		// into memory when possible; otherwise serve from disk.
+		diskAssets := dirFS{Dir: http.Dir("internal/web/dist")}
+		cached, err := loadMemFS(diskAssets)
+		if err != nil {
+			logger.Warningf("could not preload frontend assets into memory, serving from disk: %v", err)
+			assetFs = diskAssets
+		} else {
+			logger.Debugf("preloaded %d frontend assets (%d bytes) into memory", cached.Len(), cached.Size())
+			assetFs = cached
+		}
 	}
 }
 

backend/internal/adapters/fs/fileutils/file.go

@@ -55,49 +55,79 @@ func unixModeToFileMode(u uint32) os.FileMode {
 	return m
 }
 
-// MoveFile moves a file from src to dst.
-// By default, the rename system call is used. If src and dst point to different volumes,
-// the file copy is used as a fallback.
-func MoveFile(src, dst string) error {
-	err := os.Rename(src, dst)
-	if err == nil {
-		return nil
-	}
-
-	// fallback
-	err = CopyFile(src, dst)
+// removeDestinationSymlinkIfPresent deletes dest when it is a symlink so a copy or
+// cross-device move replaces the link entry instead of writing through it.
+func removeDestinationSymlinkIfPresent(dest string) error {
+	info, err := os.Lstat(dest)
 	if err != nil {
-		logger.Errorf("CopyFile failed %v", err)
+		if os.IsNotExist(err) {
+			return nil
+		}
 		return err
 	}
-
-	go func() {
-		err = os.RemoveAll(src)
-		if err != nil {
-			logger.Errorf("os.Remove failed %v", err)
-		}
-	}()
-
+	if info.Mode()&os.ModeSymlink != 0 {
+		return os.Remove(dest)
+	}
 	return nil
 }
 
+// MoveFile moves a file from src to dst.
+// By default, the rename system call is used. If src and dst are on different volumes,
+// CopyFile is used as a fallback and the source is removed synchronously on success.
+func MoveFile(src, dst string) error {
+	if err := os.Rename(src, dst); err != nil {
+		if !isCrossDeviceRenameError(err) {
+			return err
+		}
+		if err := CopyFile(src, dst); err != nil {
+			return err
+		}
+		return os.RemoveAll(src)
+	}
+	return nil
+}
+
+func preserveFileMode(path string, mode os.FileMode) error {
+	return os.Chmod(path, mode.Perm())
+}
+
 // CopyFile copies a file or directory from source to dest and returns an error if any.
 func CopyFile(source, dest string) error {
-	// Check if the source exists and whether it's a file or directory.
-	info, err := os.Stat(source)
+	info, err := os.Lstat(source)
 	if err != nil {
 		return err
 	}
-
+	if info.Mode()&os.ModeSymlink != 0 {
+		return copySymlink(source, dest)
+	}
 	if info.IsDir() {
-		// If the source is a directory, copy it recursively.
 		return copyDirectory(source, dest)
 	}
-
-	// If the source is a file, copy the file.
 	return copySingleFile(source, dest)
 }
 
+func copySymlink(source, dest string) error {
+	target, err := os.Readlink(source)
+	if err != nil {
+		return err
+	}
+	destDir := filepath.Dir(dest)
+	if err = os.MkdirAll(destDir, EffectiveDirPerm()); err != nil {
+		return err
+	}
+	tmpDir, err := os.MkdirTemp(destDir, ".fb-link-*")
+	if err != nil {
+		return err
+	}
+	defer func() { _ = os.RemoveAll(tmpDir) }()
+
+	tmpPath := filepath.Join(tmpDir, "link")
+	if err := os.Symlink(target, tmpPath); err != nil {
+		return err
+	}
+	return os.Rename(tmpPath, dest)
+}
+
 // copySingleFile handles copying a single file.
 func copySingleFile(source, dest string) error {
 	// Get source file info to preserve permissions
@@ -120,6 +150,10 @@ func copySingleFile(source, dest string) error {
 		return err
 	}
 
+	if err = removeDestinationSymlinkIfPresent(dest); err != nil {
+		return err
+	}
+
 	// Create the destination file with source permissions
 	dst, err := os.OpenFile(dest, os.O_RDWR|os.O_CREATE|os.O_TRUNC, sourcePerms)
 	if err != nil {
@@ -161,7 +195,7 @@ func copyFileContents(dst io.Writer, src io.Reader) error {
 
 // copyDirectory handles copying directories recursively.
 func copyDirectory(source, dest string) error {
-	srcInfo, err := os.Stat(source)
+	srcInfo, err := os.Lstat(source)
 	if err != nil {
 		return err
 	}
@@ -170,6 +204,9 @@ func copyDirectory(source, dest string) error {
 	if err != nil {
 		return err
 	}
+	if err = preserveFileMode(dest, srcInfo.Mode()); err != nil {
+		logger.Debugf("Could not set directory permissions for %s: %v", dest, err)
+	}
 
 	// Read the contents of the source directory.
 	entries, err := os.ReadDir(source)
@@ -182,6 +219,17 @@ func copyDirectory(source, dest string) error {
 		srcPath := filepath.Join(source, entry.Name())
 		destPath := filepath.Join(dest, entry.Name())
 
+		if entry.Type()&os.ModeSymlink != 0 {
+			linkTarget := ""
+			linkTarget, err = os.Readlink(srcPath)
+			if err != nil {
+				return err
+			}
+			if err = os.Symlink(linkTarget, destPath); err != nil {
+				return err
+			}
+			continue
+		}
 		if entry.IsDir() {
 			// Recursively copy subdirectories.
 			err = copyDirectory(srcPath, destPath)

backend/internal/adapters/fs/fileutils/file_test.go

@@ -139,6 +139,291 @@ func TestCopyFilePreservesModTime(t *testing.T) {
 	}
 }
 
+// moveViaCrossDeviceFallback mirrors MoveFile's EXDEV fallback (CopyFile + RemoveAll).
+func moveViaCrossDeviceFallback(t *testing.T, src, dst string) {
+	t.Helper()
+	if err := CopyFile(src, dst); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.RemoveAll(src); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestMoveFileDoesNotFallbackOnNonCrossDeviceError(t *testing.T) {
+	srcDir := t.TempDir()
+	src := filepath.Join(srcDir, "file.txt")
+	if err := os.WriteFile(src, []byte("data"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	dst := filepath.Join(srcDir, "existing-dir")
+	if err := os.Mkdir(dst, 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	err := MoveFile(src, dst)
+	if err == nil {
+		t.Fatal("expected rename error")
+	}
+	if _, statErr := os.Stat(src); statErr != nil {
+		t.Fatalf("source file should remain after rename failure: %v", statErr)
+	}
+	entries, err := os.ReadDir(dst)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(entries) != 0 {
+		t.Fatalf("destination directory should be unchanged, got %d entries", len(entries))
+	}
+}
+
+func TestMoveFileCrossDevicePreservesFilePermissions(t *testing.T) {
+	srcDir := t.TempDir()
+	dstDir := t.TempDir()
+	src := filepath.Join(srcDir, "secret.txt")
+	if err := os.WriteFile(src, []byte("data"), 0o640); err != nil {
+		t.Fatal(err)
+	}
+	dst := filepath.Join(dstDir, "secret.txt")
+
+	moveViaCrossDeviceFallback(t, src, dst)
+	got, err := os.Stat(dst)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.Mode().Perm() != 0o640 {
+		t.Fatalf("dst perm = %#o, want 0640", got.Mode().Perm())
+	}
+	if _, err := os.Stat(src); !os.IsNotExist(err) {
+		t.Fatalf("src should be removed, stat err = %v", err)
+	}
+}
+
+func TestMoveFileCrossDeviceMovesDirectory(t *testing.T) {
+	srcDir := t.TempDir()
+	dstParent := t.TempDir()
+	nested := filepath.Join(srcDir, "nested.txt")
+	if err := os.WriteFile(nested, []byte("nested"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Chmod(srcDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	dst := filepath.Join(dstParent, "moved-dir")
+
+	moveViaCrossDeviceFallback(t, srcDir, dst)
+	movedNested := filepath.Join(dst, "nested.txt")
+	if _, err := os.Stat(movedNested); err != nil {
+		t.Fatalf("expected nested file at destination: %v", err)
+	}
+	got, err := os.Stat(dst)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.Mode().Perm() != 0o755 {
+		t.Fatalf("dst dir perm = %#o, want 0755", got.Mode().Perm())
+	}
+	if _, err := os.Stat(srcDir); !os.IsNotExist(err) {
+		t.Fatalf("source directory should be removed, stat err = %v", err)
+	}
+}
+
+func TestMoveFileCrossDevicePreservesSymlinkToFile(t *testing.T) {
+	targetDir := t.TempDir()
+	target := filepath.Join(targetDir, "target.txt")
+	if err := os.WriteFile(target, []byte("data"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	srcDir := t.TempDir()
+	dstDir := t.TempDir()
+	link := filepath.Join(srcDir, "link")
+	if err := os.Symlink(target, link); err != nil {
+		t.Fatal(err)
+	}
+	dst := filepath.Join(dstDir, "link")
+
+	moveViaCrossDeviceFallback(t, link, dst)
+	gotTarget, err := os.Readlink(dst)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if gotTarget != target {
+		t.Fatalf("link target = %q, want %q", gotTarget, target)
+	}
+	info, err := os.Lstat(dst)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if info.Mode()&os.ModeSymlink == 0 {
+		t.Fatal("expected destination to remain a symlink")
+	}
+	if _, err := os.Stat(link); !os.IsNotExist(err) {
+		t.Fatalf("source symlink should be removed, stat err = %v", err)
+	}
+}
+
+func TestMoveFileCrossDevicePreservesSymlinkToDirectory(t *testing.T) {
+	targetDir := t.TempDir()
+	if err := os.Mkdir(filepath.Join(targetDir, "inside"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	srcDir := t.TempDir()
+	dstDir := t.TempDir()
+	link := filepath.Join(srcDir, "dirlink")
+	if err := os.Symlink(targetDir, link); err != nil {
+		t.Fatal(err)
+	}
+	dst := filepath.Join(dstDir, "dirlink")
+
+	moveViaCrossDeviceFallback(t, link, dst)
+	gotTarget, err := os.Readlink(dst)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if gotTarget != targetDir {
+		t.Fatalf("link target = %q, want %q", gotTarget, targetDir)
+	}
+	info, err := os.Lstat(dst)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if info.Mode()&os.ModeSymlink == 0 {
+		t.Fatal("expected destination to remain a symlink")
+	}
+}
+
+func TestMoveFileCrossDeviceMovesDirectoryWithNestedSymlink(t *testing.T) {
+	target := filepath.Join(t.TempDir(), "target.txt")
+	if err := os.WriteFile(target, []byte("linked"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	srcDir := t.TempDir()
+	if err := os.Symlink(target, filepath.Join(srcDir, "nested-link")); err != nil {
+		t.Fatal(err)
+	}
+	dstParent := t.TempDir()
+	dst := filepath.Join(dstParent, "moved-dir")
+
+	moveViaCrossDeviceFallback(t, srcDir, dst)
+	movedLink := filepath.Join(dst, "nested-link")
+	gotTarget, err := os.Readlink(movedLink)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if gotTarget != target {
+		t.Fatalf("nested link target = %q, want %q", gotTarget, target)
+	}
+	info, err := os.Lstat(movedLink)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if info.Mode()&os.ModeSymlink == 0 {
+		t.Fatal("expected nested entry to remain a symlink")
+	}
+}
+
+func TestCopySymlinkReplacesExistingDestination(t *testing.T) {
+	target := filepath.Join(t.TempDir(), "target.txt")
+	if err := os.WriteFile(target, []byte("data"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	workDir := t.TempDir()
+	src := filepath.Join(workDir, "link")
+	if err := os.Symlink(target, src); err != nil {
+		t.Fatal(err)
+	}
+	dst := filepath.Join(workDir, "existing")
+	if err := os.WriteFile(dst, []byte("old"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	if err := copySymlink(src, dst); err != nil {
+		t.Fatal(err)
+	}
+	gotTarget, err := os.Readlink(dst)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if gotTarget != target {
+		t.Fatalf("link target = %q, want %q", gotTarget, target)
+	}
+	info, err := os.Lstat(dst)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if info.Mode()&os.ModeSymlink == 0 {
+		t.Fatal("expected destination to be a symlink")
+	}
+}
+
+func TestCopyFile_ReplacesDestinationSymlinkWithoutFollowingTarget(t *testing.T) {
+	dir := t.TempDir()
+	outside := filepath.Join(filepath.Dir(dir), "outside-victim.txt")
+	if err := os.WriteFile(outside, []byte("keep me"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	link := filepath.Join(dir, "link")
+	if err := os.Symlink(outside, link); err != nil {
+		t.Fatal(err)
+	}
+	src := filepath.Join(dir, "src.txt")
+	if err := os.WriteFile(src, []byte("copied"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	if err := CopyFile(src, link); err != nil {
+		t.Fatalf("CopyFile: %v", err)
+	}
+	info, err := os.Lstat(link)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if info.Mode()&os.ModeSymlink != 0 {
+		t.Fatal("destination should be a regular file replacing the symlink entry")
+	}
+	got, err := os.ReadFile(outside)
+	if err != nil || string(got) != "keep me" {
+		t.Fatalf("copy followed the symlink target: %v %q", err, got)
+	}
+	if body, err := os.ReadFile(link); err != nil || string(body) != "copied" {
+		t.Fatalf("link path content = %q, err=%v", body, err)
+	}
+}
+
+func TestMoveFile_ReplacesDestinationSymlinkWithoutFollowingTarget(t *testing.T) {
+	dir := t.TempDir()
+	outside := filepath.Join(filepath.Dir(dir), "outside-victim.txt")
+	if err := os.WriteFile(outside, []byte("keep me"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	link := filepath.Join(dir, "link")
+	if err := os.Symlink(outside, link); err != nil {
+		t.Fatal(err)
+	}
+	src := filepath.Join(dir, "src.txt")
+	if err := os.WriteFile(src, []byte("moved"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	if err := MoveFile(src, link); err != nil {
+		t.Fatalf("MoveFile: %v", err)
+	}
+	if _, err := os.Lstat(src); !os.IsNotExist(err) {
+		t.Fatal("source should be gone after move")
+	}
+	info, err := os.Lstat(link)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if info.Mode()&os.ModeSymlink != 0 {
+		t.Fatal("destination should be a regular file replacing the symlink entry")
+	}
+	got, err := os.ReadFile(outside)
+	if err != nil || string(got) != "keep me" {
+		t.Fatalf("move followed the symlink target: %v %q", err, got)
+	}
+}
+
 func TestCopyFileContentsFallsBackAfterCopyFileRangeBadFileDescriptor(t *testing.T) {
 	const content = "complete file contents"
 	src := struct{ io.Reader }{bytes.NewBufferString(content)}

backend/internal/adapters/fs/fileutils/memfs.go

@@ -0,0 +1,110 @@
+package fileutils
+
+import (
+	"bytes"
+	"io/fs"
+	"time"
+)
+
+// memFS is a read-only fs.FS that holds every file's contents in memory.
+// It is built once at startup from a disk-backed filesystem so that asset
+// requests never touch the disk.
+type memFS struct {
+	files map[string]memFile
+}
+
+type memFile struct {
+	data    []byte
+	modTime time.Time
+}
+
+// loadMemFS reads every regular file under src into memory.
+func loadMemFS(src fs.FS) (*memFS, error) {
+	m := &memFS{files: make(map[string]memFile)}
+	err := fs.WalkDir(src, ".", func(name string, d fs.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+		if d.IsDir() {
+			return nil
+		}
+		data, err := fs.ReadFile(src, name)
+		if err != nil {
+			return err
+		}
+		info, err := d.Info()
+		if err != nil {
+			return err
+		}
+		m.files[name] = memFile{data: data, modTime: info.ModTime()}
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+	return m, nil
+}
+
+// Size returns the total number of bytes held in memory.
+func (m *memFS) Size() int {
+	total := 0
+	for _, f := range m.files {
+		total += len(f.data)
+	}
+	return total
+}
+
+// Len returns the number of files held in memory.
+func (m *memFS) Len() int {
+	return len(m.files)
+}
+
+// Open implements fs.FS. Only regular files are supported, which is all the
+// asset callers need (ReadFile, Stat and template parsing).
+func (m *memFS) Open(name string) (fs.File, error) {
+	if !fs.ValidPath(name) {
+		return nil, &fs.PathError{Op: "open", Path: name, Err: fs.ErrInvalid}
+	}
+	f, ok := m.files[name]
+	if !ok {
+		return nil, &fs.PathError{Op: "open", Path: name, Err: fs.ErrNotExist}
+	}
+	return &memOpenFile{
+		Reader: bytes.NewReader(f.data),
+		info: memFileInfo{
+			name:    baseName(name),
+			size:    int64(len(f.data)),
+			modTime: f.modTime,
+		},
+	}, nil
+}
+
+type memOpenFile struct {
+	*bytes.Reader
+	info memFileInfo
+}
+
+func (f *memOpenFile) Stat() (fs.FileInfo, error) { return f.info, nil }
+func (f *memOpenFile) Close() error               { return nil }
+
+type memFileInfo struct {
+	name    string
+	size    int64
+	modTime time.Time
+}
+
+func (i memFileInfo) Name() string       { return i.name }
+func (i memFileInfo) Size() int64        { return i.size }
+func (i memFileInfo) Mode() fs.FileMode  { return 0o444 }
+func (i memFileInfo) ModTime() time.Time { return i.modTime }
+func (i memFileInfo) IsDir() bool        { return false }
+func (i memFileInfo) Sys() any           { return nil }
+
+func baseName(name string) string {
+	for i := len(name) - 1; i >= 0; i-- {
+		if name[i] == '/' {
+			return name[i+1:]
+		}
+	}
+	return name
+}

backend/internal/adapters/fs/fileutils/memfs_test.go

@@ -0,0 +1,69 @@
+package fileutils
+
+import (
+	"io/fs"
+	"net/http"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestLoadMemFSServesFromMemory(t *testing.T) {
+	dir := t.TempDir()
+	files := map[string]string{
+		"index.html":        "<html>index</html>",
+		"assets/app.js.gz":  "gzip-bytes",
+		"fonts/icons.woff2": "font-bytes",
+	}
+	for name, content := range files {
+		path := filepath.Join(dir, filepath.FromSlash(name))
+		if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(path, []byte(content), 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	m, err := loadMemFS(dirFS{Dir: http.Dir(dir)})
+	if err != nil {
+		t.Fatalf("loadMemFS: %v", err)
+	}
+	if m.Len() != len(files) {
+		t.Fatalf("loaded %d files, want %d", m.Len(), len(files))
+	}
+
+	// Remove everything from disk: the cache must still serve every file.
+	if removeErr := os.RemoveAll(dir); removeErr != nil {
+		t.Fatal(removeErr)
+	}
+	for name, want := range files {
+		got, readErr := fs.ReadFile(m, name)
+		if readErr != nil {
+			t.Fatalf("ReadFile(%s) after disk removal: %v", name, readErr)
+		}
+		if string(got) != want {
+			t.Errorf("ReadFile(%s) = %q, want %q", name, got, want)
+		}
+		info, statErr := fs.Stat(m, name)
+		if statErr != nil {
+			t.Fatalf("Stat(%s): %v", name, statErr)
+		}
+		if info.IsDir() || info.Size() != int64(len(want)) || info.Name() != filepath.Base(name) {
+			t.Errorf("Stat(%s) = %+v, unexpected", name, info)
+		}
+	}
+
+	// Template-style glob on a plain name must resolve via Stat.
+	matches, globErr := fs.Glob(m, "index.html")
+	if globErr != nil || len(matches) != 1 {
+		t.Fatalf("Glob(index.html) = %v, %v", matches, globErr)
+	}
+
+	if _, readErr := fs.ReadFile(m, "missing.css"); readErr == nil {
+		t.Error("ReadFile(missing.css) should fail")
+	}
+	if _, readErr := fs.ReadFile(m, "../escape"); readErr == nil {
+		t.Error("invalid path should be rejected")
+	}
+}

backend/internal/adapters/fs/fileutils/rename_error_unix.go

@@ -0,0 +1,17 @@
+//go:build !windows
+
+package fileutils
+
+import (
+	"errors"
+	"os"
+	"syscall"
+)
+
+func isCrossDeviceRenameError(err error) bool {
+	if errors.Is(err, syscall.EXDEV) {
+		return true
+	}
+	var linkErr *os.LinkError
+	return errors.As(err, &linkErr) && errors.Is(linkErr.Err, syscall.EXDEV)
+}

backend/internal/adapters/fs/fileutils/rename_error_windows.go

@@ -0,0 +1,18 @@
+//go:build windows
+
+package fileutils
+
+import (
+	"errors"
+	"os"
+	"syscall"
+)
+
+func isCrossDeviceRenameError(err error) bool {
+	const errNotSameDevice = syscall.Errno(17)
+	if errors.Is(err, errNotSameDevice) {
+		return true
+	}
+	var linkErr *os.LinkError
+	return errors.As(err, &linkErr) && errors.Is(linkErr.Err, errNotSameDevice)
+}

backend/internal/analytics/main_test.go

@@ -0,0 +1,12 @@
+package analytics
+
+import (
+	"os"
+	"testing"
+
+	"github.com/gtsteffaniak/filebrowser/backend/internal/testutil"
+)
+
+func TestMain(m *testing.M) {
+	os.Exit(testutil.Main(m))
+}

backend/internal/analytics/snapshot.go

@@ -205,8 +205,8 @@ func collectPayload(versionLabel string) (snapshotPayload, error) {
 		Integrations: integrationsPayload{
 			OnlyOfficeConfigured: strings.TrimSpace(settings.Config.Integrations.OnlyOffice.Url) != "",
 			OnlyOfficeViewOnly:   settings.Config.Integrations.OnlyOffice.ViewOnly,
-			MediaEnabled:         settings.MediaEnabled(),
-			HardwareAcceleration: settings.Config.Integrations.Media.HardwareAcceleration,
+			MediaEnabled:         settings.FFmpegEnabled(),
+			HardwareAcceleration: settings.HardwareAccelerationEnabled(),
 		},
 		Features: featuresPayload{
 			DisablePreviews:        settings.Config.Server.DisablePreviews,
@@ -301,7 +301,7 @@ func detectRuntime() string {
 
 func mapSystemOS(goos string) string {
 	switch goos {
-	case "linux", "windows", "darwin":
+	case "linux", "windows", "darwin", "freebsd":
 		return goos
 	default:
 		return "other"

backend/internal/analytics/snapshot_test.go

@@ -0,0 +1,25 @@
+package analytics
+
+import "testing"
+
+func TestMapSystemOS(t *testing.T) {
+	tests := []struct {
+		name string
+		goos string
+		want string
+	}{
+		{name: "linux", goos: "linux", want: "linux"},
+		{name: "windows", goos: "windows", want: "windows"},
+		{name: "darwin", goos: "darwin", want: "darwin"},
+		{name: "freebsd release build", goos: "freebsd", want: "freebsd"},
+		{name: "unsupported goos", goos: "plan9", want: "other"},
+		{name: "empty", goos: "", want: "other"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := mapSystemOS(tt.goos); got != tt.want {
+				t.Errorf("mapSystemOS(%q) = %q, want %q", tt.goos, got, tt.want)
+			}
+		})
+	}
+}

backend/internal/app/wire.go

@@ -1,11 +1,16 @@
 package app
 
 import (
+	"context"
+	"strings"
+
 	"github.com/gtsteffaniak/filebrowser/backend/internal/activity"
 	"github.com/gtsteffaniak/filebrowser/backend/internal/adapters/fs/files"
 	"github.com/gtsteffaniak/filebrowser/backend/internal/auth"
 	"github.com/gtsteffaniak/filebrowser/backend/internal/state"
+	"github.com/gtsteffaniak/filebrowser/backend/internal/transcoding"
 	"github.com/gtsteffaniak/filebrowser/backend/pkg/indexing"
+	"github.com/gtsteffaniak/filebrowser/backend/pkg/settings"
 )
 
 // App holds wired dependencies for the running process.
@@ -17,6 +22,11 @@ type App struct {
 
 // WireServices connects domain packages to the state store after Open.
 func WireServices(store *state.Store) (*App, error) {
+	return WireServicesWithContext(context.Background(), store)
+}
+
+// WireServicesWithContext wires services using ctx for background workers.
+func WireServicesWithContext(ctx context.Context, store *state.Store) (*App, error) {
 	filesSvc := files.New(store, store, store)
 	authSvc := auth.New(store)
 	files.SetDefault(filesSvc)
@@ -26,6 +36,24 @@ func WireServices(store *state.Store) (*App, error) {
 	if err := auth.InitWebAuthn(store); err != nil {
 		return nil, err
 	}
+
+	// Always create the manager: the engine re-checks ffmpeg availability per
+	// request, so a runtime admin settings change takes effect without restart.
+	storeDir, err := transcoding.NewStore(settings.TranscodeCacheDir())
+	if err != nil {
+		return nil, err
+	}
+	// Delivery URLs stay root-relative so a subpath deployment or alternate
+	// hostname still resolves and the session cookie is sent.
+	transcodeMgr, err := transcoding.NewManager(ctx, transcoding.NewMediaEngine(), storeDir,
+		strings.TrimRight(settings.Config.Http.BaseURL, "/"))
+	if err != nil {
+		return nil, err
+	}
+	// Exported so the web layer (and shutdown) can reach it without threading
+	// it through StartHttp's Deps.
+	transcoding.SetDefault(transcodeMgr)
+
 	return &App{
 		Store: store,
 		Files: filesSvc,

backend/internal/archiveencoding/zip.go

@@ -0,0 +1,213 @@
+// Package archiveencoding decodes ZIP entry names before path normalization.
+package archiveencoding
+
+import (
+	"archive/zip"
+	"encoding/binary"
+	"errors"
+	"fmt"
+	"hash/crc32"
+	"strings"
+	"unicode"
+	"unicode/utf8"
+
+	"golang.org/x/text/encoding"
+	"golang.org/x/text/encoding/charmap"
+	"golang.org/x/text/encoding/japanese"
+	"golang.org/x/text/encoding/korean"
+	"golang.org/x/text/encoding/simplifiedchinese"
+	"golang.org/x/text/encoding/traditionalchinese"
+)
+
+// ErrEncoding indicates a filename encoding that needs a different user selection.
+var ErrEncoding = errors.New("invalid ZIP filename encoding")
+
+type codec struct {
+	name     string
+	encoding encoding.Encoding
+}
+
+var codecs = []codec{
+	{"utf-8", nil},
+	{"cp932", japanese.ShiftJIS},
+	{"gb18030", simplifiedchinese.GB18030},
+	{"big5", traditionalchinese.Big5},
+	{"euc-kr", korean.EUCKR},
+	{"cp437", charmap.CodePage437},
+	{"windows-1252", charmap.Windows1252},
+}
+
+// Candidate contains a bounded preview, decoded exactly as during extraction.
+type Candidate struct {
+	Encoding string   `json:"encoding"`
+	Names    []string `json:"names"`
+}
+
+// Preview describes compatible encodings. An empty suggestion requires a choice;
+// a heuristic suggestion is never a guarantee that the names are correct.
+type Preview struct {
+	Suggested  string      `json:"suggested"`
+	Candidates []Candidate `json:"candidates"`
+}
+
+// unicodeName prefers the UTF-8 flag, then a verified Info-ZIP Unicode Path field.
+// A Unicode Path field is usable only when its version and original-name CRC match.
+func unicodeName(f *zip.File) (string, bool) {
+	if f.Flags&0x800 != 0 {
+		return f.Name, true
+	}
+	extra := f.Extra
+	for len(extra) >= 4 {
+		tag := binary.LittleEndian.Uint16(extra)
+		size := int(binary.LittleEndian.Uint16(extra[2:]))
+		extra = extra[4:]
+		if size > len(extra) {
+			break
+		}
+		field := extra[:size]
+		extra = extra[size:]
+		if tag == 0x7075 && len(field) > 5 && field[0] == 1 &&
+			binary.LittleEndian.Uint32(field[1:5]) == crc32.ChecksumIEEE([]byte(f.Name)) && utf8.Valid(field[5:]) {
+			return string(field[5:]), true
+		}
+	}
+	return "", false
+}
+
+func decode(f *zip.File, c codec) (string, error) {
+	name, declared := unicodeName(f)
+	if !declared {
+		name = f.Name
+		if c.encoding != nil {
+			var err error
+			name, err = c.encoding.NewDecoder().String(name)
+			if err != nil || strings.ContainsRune(name, utf8.RuneError) {
+				return "", fmt.Errorf("%w: cannot decode filename as %s", ErrEncoding, c.name)
+			}
+		}
+	}
+	if !utf8.ValidString(name) || strings.ContainsRune(name, 0) {
+		return "", fmt.Errorf("%w: invalid filename for %s", ErrEncoding, c.name)
+	}
+	return name, nil
+}
+
+// Inspect considers all entry names without decompressing file contents. Candidate
+// previews prefer names lacking Unicode metadata so that users can compare them.
+func Inspect(files []*zip.File) Preview {
+	result := Preview{Candidates: []Candidate{}}
+	bestScore, tied := 0, false
+	for _, c := range codecs {
+		candidate := Candidate{Encoding: c.name, Names: []string{}}
+		fallback := []string{}
+		score, valid := 0, true
+		for _, f := range files {
+			name, err := decode(f, c)
+			if err != nil {
+				valid = false
+				break
+			}
+			if len(fallback) < 5 {
+				fallback = append(fallback, name)
+			}
+			if _, declared := unicodeName(f); !declared && !isASCII(f.Name) {
+				if len(candidate.Names) < 5 {
+					candidate.Names = append(candidate.Names, name)
+				}
+				// The EUC-KR decoder also accepts CP949 extension bytes, including
+				// CP932 kana pairs. Do not use those bytes as Korean evidence.
+				if c.name != "euc-kr" || isEUCKR(f.Name) {
+					score += scriptEvidence(name, c.name)
+				}
+			}
+		}
+		if !valid {
+			continue
+		}
+		if len(candidate.Names) == 0 {
+			candidate.Names = fallback
+		}
+		result.Candidates = append(result.Candidates, candidate)
+		// Valid UTF-8 (including metadata-backed names) needs no legacy guess.
+		if c.name == "utf-8" {
+			result.Suggested = c.name
+		}
+		if score > bestScore {
+			bestScore, tied = score, false
+			if result.Suggested != "utf-8" {
+				result.Suggested = c.name
+			}
+		} else if score == bestScore && score > 0 {
+			tied = true
+		}
+	}
+	if result.Suggested != "utf-8" && (bestScore < 3 || tied) {
+		result.Suggested = ""
+	}
+	return result
+}
+
+func isASCII(s string) bool {
+	for i := 0; i < len(s); i++ {
+		if s[i] >= utf8.RuneSelf {
+			return false
+		}
+	}
+	return true
+}
+
+// isEUCKR excludes CP949 extension sequences from automatic Korean suggestions.
+func isEUCKR(raw string) bool {
+	for i := 0; i < len(raw); i++ {
+		if raw[i] < utf8.RuneSelf {
+			continue
+		}
+		if raw[i] < 0xa1 || raw[i] > 0xfe || i+1 >= len(raw) || raw[i+1] < 0xa1 || raw[i+1] > 0xfe {
+			return false
+		}
+		i++
+	}
+	return true
+}
+
+// Kana and Hangul give useful script evidence; Han alone does not distinguish
+// Japanese, simplified Chinese and traditional Chinese. Half-width kana are not
+// evidence: unrelated legacy bytes frequently decode to half-width kana.
+func scriptEvidence(name, charset string) int {
+	score := 0
+	for _, r := range name {
+		if charset == "cp932" && r < 0xff00 && (unicode.Is(unicode.Hiragana, r) || unicode.Is(unicode.Katakana, r)) {
+			score++
+		}
+		if charset == "euc-kr" && unicode.Is(unicode.Hangul, r) {
+			score++
+		}
+	}
+	return score
+}
+
+// DecodeNames resolves the selection once for the entire archive. Explicit
+// Unicode metadata always wins over the selected fallback encoding.
+func DecodeNames(files []*zip.File, charset string) ([]string, error) {
+	if charset == "" {
+		charset = Inspect(files).Suggested
+		if charset == "" {
+			return nil, fmt.Errorf("%w: choose an encoding before extracting", ErrEncoding)
+		}
+	}
+	for _, c := range codecs {
+		if c.name != charset {
+			continue
+		}
+		names := make([]string, 0, len(files))
+		for _, f := range files {
+			name, err := decode(f, c)
+			if err != nil {
+				return nil, err
+			}
+			names = append(names, name)
+		}
+		return names, nil
+	}
+	return nil, fmt.Errorf("%w: unsupported encoding %s", ErrEncoding, charset)
+}

backend/internal/archiveencoding/zip_test.go

@@ -0,0 +1,119 @@
+package archiveencoding
+
+import (
+	"archive/zip"
+	"encoding/binary"
+	"golang.org/x/text/encoding/japanese"
+	"hash/crc32"
+	"reflect"
+	"testing"
+)
+
+func entry(name string) *zip.File { return &zip.File{FileHeader: zip.FileHeader{Name: name}} }
+func cp932(t *testing.T, name string) string {
+	t.Helper()
+	s, err := japanese.ShiftJIS.NewEncoder().String(name)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return s
+}
+func TestJapaneseSuggestionMatchesDecoding(t *testing.T) {
+	t.Parallel()
+	want := []string{"日本語/テストソ001.txt", "日本語/テストソ002.txt"}
+	files := []*zip.File{entry(cp932(t, want[0])), entry(cp932(t, want[1]))}
+	preview := Inspect(files)
+	if preview.Suggested != "cp932" {
+		t.Fatalf("suggestion: %+v", preview)
+	}
+	names, err := DecodeNames(files, preview.Suggested)
+	if err != nil || !reflect.DeepEqual(names, want) {
+		t.Fatalf("names=%q err=%v", names, err)
+	}
+	for _, c := range preview.Candidates {
+		if c.Encoding == preview.Suggested && !reflect.DeepEqual(c.Names, names) {
+			t.Fatalf("preview mismatch: %q", c.Names)
+		}
+	}
+}
+func TestAmbiguousNamesRequireSelection(t *testing.T) {
+	t.Parallel()
+	files := []*zip.File{entry("caf\x82.txt")}
+	if p := Inspect(files); p.Suggested != "" {
+		t.Fatalf("ambiguous name was guessed: %+v", p)
+	}
+	if _, err := DecodeNames(files, ""); err == nil {
+		t.Fatal("expected explicit choice")
+	}
+	names, err := DecodeNames(files, "cp437")
+	if err != nil || names[0] != "café.txt" {
+		t.Fatalf("names=%q err=%v", names, err)
+	}
+	for _, c := range []string{"utf-8", "unknown"} {
+		if _, err = DecodeNames(files, c); err == nil {
+			t.Fatalf("invalid encoding accepted: %s", c)
+		}
+	}
+}
+func unicodeExtra(raw, name string) []byte {
+	payload := append([]byte{1, 0, 0, 0, 0}, []byte(name)...)
+	binary.LittleEndian.PutUint32(payload[1:], crc32.ChecksumIEEE([]byte(raw)))
+	extra := []byte{0x75, 0x70, 0, 0}
+	binary.LittleEndian.PutUint16(extra[2:], uint16(len(payload)))
+	return append(extra, payload...)
+}
+func TestUnicodeMetadataTakesPrecedence(t *testing.T) {
+	t.Parallel()
+	flagged := entry("日本語.txt")
+	flagged.Flags = 0x800
+	extra := entry("legacy.txt")
+	extra.Extra = unicodeExtra(extra.Name, "別の名前.txt")
+	names, err := DecodeNames([]*zip.File{flagged, extra}, "cp437")
+	if err != nil || !reflect.DeepEqual(names, []string{"日本語.txt", "別の名前.txt"}) {
+		t.Fatalf("names=%q err=%v", names, err)
+	}
+	extra.Extra[5] ^= 1
+	names, err = DecodeNames([]*zip.File{extra}, "cp437")
+	if err != nil || names[0] != "legacy.txt" {
+		t.Fatalf("names=%q err=%v", names, err)
+	}
+}
+func TestInvalidUnicodeMetadata(t *testing.T) {
+	t.Parallel()
+	for _, raw := range []string{"bad\xff.txt", "bad\x00.txt"} {
+		f := entry(raw)
+		f.Flags = 0x800
+		if _, err := DecodeNames([]*zip.File{f}, "cp932"); err == nil {
+			t.Fatalf("invalid declared UTF-8 accepted: %q", raw)
+		}
+	}
+	f := entry("ok.txt")
+	f.Extra = []byte{0x75, 0x70, 0xff, 0xff}
+	if _, err := DecodeNames([]*zip.File{f}, "utf-8"); err != nil {
+		t.Fatal(err)
+	}
+}
+func TestUTF8AndASCIIArchives(t *testing.T) {
+	t.Parallel()
+	for _, files := range [][]*zip.File{nil, {entry("readme.txt")}, {entry("日本語.txt")}} {
+		if p := Inspect(files); p.Suggested != "utf-8" {
+			t.Fatalf("expected UTF-8: %+v", p)
+		}
+	}
+}
+func TestPreviewBoundAndAllNamesValidated(t *testing.T) {
+	t.Parallel()
+	files := make([]*zip.File, 20)
+	for i := range files {
+		files[i] = entry("readme.txt")
+	}
+	files = append(files, entry("invalid\xff.txt"))
+	for _, c := range Inspect(files).Candidates {
+		if len(c.Names) > 5 {
+			t.Fatal("unbounded preview")
+		}
+		if c.Encoding == "utf-8" {
+			t.Fatal("entry beyond preview was not validated")
+		}
+	}
+}

backend/internal/auth/auth.go

@@ -6,9 +6,10 @@ import (
 	"time"
 
 	"github.com/golang-jwt/jwt/v4"
-	"github.com/gtsteffaniak/filebrowser/backend/pkg/settings"
 	"github.com/gtsteffaniak/filebrowser/backend/internal/database/access"
 	"github.com/gtsteffaniak/filebrowser/backend/internal/database/users"
+	"github.com/gtsteffaniak/filebrowser/backend/internal/utils"
+	"github.com/gtsteffaniak/filebrowser/backend/pkg/settings"
 )
 
 // Auther is the authentication interface.
@@ -39,18 +40,24 @@ func MakeSignedTokenAPI(user *users.User, name string, duration time.Duration, p
 	if _, ok := user.Tokens[name]; ok {
 		return "", users.AuthToken{}, fmt.Errorf("key already exists with same name %v ", name)
 	}
+	id, err := utils.RandomHex(16)
+	if err != nil {
+		return "", users.AuthToken{}, fmt.Errorf("generate token id: %w", err)
+	}
 	now := time.Now()
 	expires := now.Add(duration)
 	// Create minimal token with only JWT standard claims
 	claim := users.AuthToken{
 		MinimalAuthToken: users.MinimalAuthToken{
 			RegisteredClaims: jwt.RegisteredClaims{
+				ID:        id,
 				IssuedAt:  jwt.NewNumericDate(now),
 				ExpiresAt: jwt.NewNumericDate(expires),
 				Issuer:    FB_ISSUER,
 			},
 		},
 	}
+	claim.Minimal = &minimal
 	if !minimal {
 		claim.Permissions = users.SanitizeTokenPermissions(perms)
 	}

backend/internal/auth/main_test.go

@@ -0,0 +1,12 @@
+package auth
+
+import (
+	"os"
+	"testing"
+
+	"github.com/gtsteffaniak/filebrowser/backend/internal/testutil"
+)
+
+func TestMain(m *testing.M) {
+	os.Exit(testutil.Main(m))
+}

backend/internal/auth/none.go

@@ -15,10 +15,7 @@ type NoAuth struct{}
 
 // AuthenticateNoAuth authenticates as the configured admin user with no credentials required.
 func AuthenticateNoAuth(r *http.Request, user *users.Storage) (*users.User, error) {
-	admin := settings.Config.Auth.AdminUsername
-	if admin == "" {
-		admin = "admin"
-	}
+	admin := settings.PasswordAdminUsername()
 	id, err := users.ResolveUsernameToID(admin)
 	if err != nil {
 		return nil, err

backend/internal/auth/proxy.go

@@ -1,8 +1,10 @@
 package auth
 
 import (
+	"encoding/json"
 	"net/http"
 	"os"
+	"strings"
 
 	"github.com/gtsteffaniak/filebrowser/backend/internal/errors"
 	"github.com/gtsteffaniak/filebrowser/backend/internal/database/users"
@@ -38,3 +40,32 @@ func AuthenticateProxy(r *http.Request, usr *users.Storage, headerName string) (
 func (a ProxyAuth) Auth(r *http.Request, usr *users.Storage) (*users.User, error) {
 	return AuthenticateProxy(r, usr, a.Header)
 }
+
+// ExtractGroupsFromHeader reads group/role values from a proxy header named by groupsClaim.
+// Returns present=false when the header name is empty or the header is missing/blank.
+func ExtractGroupsFromHeader(r *http.Request, headerName string) ([]string, bool) {
+	if headerName == "" {
+		return nil, false
+	}
+	headerVal := strings.TrimSpace(r.Header.Get(headerName))
+	if headerVal == "" {
+		return nil, false
+	}
+	if strings.HasPrefix(headerVal, "[") {
+		var groups []string
+		if err := json.Unmarshal([]byte(headerVal), &groups); err == nil {
+			return groups, true
+		}
+	}
+	groups := ExtractGroupsFromClaims(map[string]interface{}{headerName: headerVal}, headerName)
+	if len(groups) == 1 && strings.Contains(groups[0], ",") {
+		parts := strings.Split(groups[0], ",")
+		groups = make([]string, 0, len(parts))
+		for _, part := range parts {
+			if part = strings.TrimSpace(part); part != "" {
+				groups = append(groups, part)
+			}
+		}
+	}
+	return groups, true
+}

backend/internal/auth/proxy_groups_test.go

@@ -0,0 +1,81 @@
+package auth_test
+
+import (
+	"net/http"
+	"testing"
+
+	"github.com/gtsteffaniak/filebrowser/backend/internal/auth"
+)
+
+func TestExtractGroupsFromHeader_SingleValue(t *testing.T) {
+	req, err := http.NewRequest(http.MethodGet, "/", http.NoBody)
+	if err != nil {
+		t.Fatal(err)
+	}
+	req.Header.Set("X-Cosmos-Role", "2")
+
+	groups, present := auth.ExtractGroupsFromHeader(req, "x-cosmos-role")
+	if !present {
+		t.Fatal("expected groups to be present")
+	}
+	if len(groups) != 1 || groups[0] != "2" {
+		t.Fatalf("groups = %#v, want [\"2\"]", groups)
+	}
+}
+
+func TestExtractGroupsFromHeader_CommaSeparated(t *testing.T) {
+	req, err := http.NewRequest(http.MethodGet, "/", http.NoBody)
+	if err != nil {
+		t.Fatal(err)
+	}
+	req.Header.Set("X-Groups", "1, 2")
+
+	groups, present := auth.ExtractGroupsFromHeader(req, "X-Groups")
+	if !present {
+		t.Fatal("expected groups to be present")
+	}
+	if len(groups) != 2 || groups[0] != "1" || groups[1] != "2" {
+		t.Fatalf("groups = %#v, want [\"1\", \"2\"]", groups)
+	}
+}
+
+func TestExtractGroupsFromHeader_JSONArray(t *testing.T) {
+	req, err := http.NewRequest(http.MethodGet, "/", http.NoBody)
+	if err != nil {
+		t.Fatal(err)
+	}
+	req.Header.Set("X-Groups", `["admin","users"]`)
+
+	groups, present := auth.ExtractGroupsFromHeader(req, "X-Groups")
+	if !present {
+		t.Fatal("expected groups to be present")
+	}
+	if len(groups) != 2 || groups[0] != "admin" || groups[1] != "users" {
+		t.Fatalf("groups = %#v, want [\"admin\", \"users\"]", groups)
+	}
+}
+
+func TestExtractGroupsFromHeader_Missing(t *testing.T) {
+	req, err := http.NewRequest(http.MethodGet, "/", http.NoBody)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	groups, present := auth.ExtractGroupsFromHeader(req, "X-Groups")
+	if present {
+		t.Fatalf("expected groups to be absent, got %#v", groups)
+	}
+}
+
+func TestExtractGroupsFromHeader_EmptyHeaderName(t *testing.T) {
+	req, err := http.NewRequest(http.MethodGet, "/", http.NoBody)
+	if err != nil {
+		t.Fatal(err)
+	}
+	req.Header.Set("X-Groups", "admin")
+
+	groups, present := auth.ExtractGroupsFromHeader(req, "")
+	if present {
+		t.Fatalf("expected groups to be absent, got %#v", groups)
+	}
+}

backend/internal/auth/token_uniqueness_test.go

@@ -0,0 +1,56 @@
+package auth
+
+import (
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"github.com/golang-jwt/jwt/v4"
+	"github.com/gtsteffaniak/filebrowser/backend/internal/database/users"
+	"github.com/gtsteffaniak/filebrowser/backend/pkg/settings"
+)
+
+func TestSignedTokensAreUniqueAtSameTime(t *testing.T) {
+	origKey := settings.Config.Auth.Key
+	settings.Config.Auth.Key = "test-signing-key-for-token-uniqueness"
+	t.Cleanup(func() { settings.Config.Auth.Key = origKey })
+
+	// Freeze the clock so every token has identical issue and expiry times.
+	synctest.Test(t, func(t *testing.T) {
+		now := time.Now()
+		tokens := make(map[string]users.AuthToken)
+		for _, userID := range []uint64{1, 2} {
+			user := &users.User{ID: userID}
+			for _, minimal := range []bool{true, false} {
+				for range 2 {
+					tokenString, claim, err := MakeSignedTokenAPI(user, "test-token", time.Hour, users.Permissions{Api: true}, minimal)
+					if err != nil {
+						t.Fatal(err)
+					}
+					if _, exists := tokens[tokenString]; exists {
+						t.Fatalf("token collision for user %d with minimal=%v", userID, minimal)
+					}
+					tokens[tokenString] = claim
+				}
+			}
+		}
+		ids := make(map[string]bool)
+		for tokenString, claim := range tokens {
+			var parsed users.MinimalAuthToken
+			if _, err := jwt.ParseWithClaims(tokenString, &parsed, JWTSigningKeyFunc()); err != nil {
+				t.Fatalf("parse signed token: %v", err)
+			}
+			if parsed.ID == "" || ids[parsed.ID] {
+				t.Fatal("each signed token must have a unique nonempty id")
+			}
+			ids[parsed.ID] = true
+			if parsed.ID != claim.ID {
+				t.Fatal("signed token id must match returned metadata")
+			}
+			if parsed.IssuedAt == nil || !parsed.IssuedAt.Equal(now) || parsed.ExpiresAt == nil || !parsed.ExpiresAt.Equal(now.Add(time.Hour)) {
+				t.Fatal("token uniqueness must not depend on changing timestamps")
+			}
+			assertMinimalJWTClaims(t, tokenString)
+		}
+	})
+}

backend/internal/database/access/access_test.go

@@ -1,6 +1,7 @@
 package access_test
 
 import (
+	stderrors "errors"
 	"os"
 	"path/filepath"
 	"strings"
@@ -1851,3 +1852,200 @@ func TestAddUserToGroup_WriteThrough(t *testing.T) {
 		t.Fatal("bob should be removed from editors in SQL")
 	}
 }
+
+func TestSetGroupMembers_ReplacesMembership(t *testing.T) {
+	setupTestSources()
+	s, _, sqlStore := createTestStorageWithSQL(t)
+
+	if err := s.SetGroupMembers("editors", []string{"alice", "bob", ""}); err != nil {
+		t.Fatalf("SetGroupMembers: %v", err)
+	}
+	if err := s.SetGroupMembers("editors", []string{"bob", "carol"}); err != nil {
+		t.Fatalf("SetGroupMembers replace: %v", err)
+	}
+	got := s.GetGroupMembers()["editors"]
+	if len(got) != 2 || got[0] != "bob" || got[1] != "carol" {
+		t.Fatalf("unexpected members: %v", got)
+	}
+	sqlGroups, err := sqlStore.GetAllGroups()
+	if err != nil {
+		t.Fatalf("GetAllGroups: %v", err)
+	}
+	if _, ok := sqlGroups["editors"]["alice"]; ok {
+		t.Fatal("alice should have been removed in SQL")
+	}
+	if _, ok := sqlGroups["editors"]["carol"]; !ok {
+		t.Fatal("carol should be persisted in SQL")
+	}
+}
+
+func TestDeleteGroup_RemovesGroupAndRules(t *testing.T) {
+	setupTestSources()
+	s, _, sqlStore := createTestStorageWithSQL(t)
+
+	if err := s.SetGroupMembers("acme", []string{"alice"}); err != nil {
+		t.Fatalf("SetGroupMembers: %v", err)
+	}
+	if err := s.AllowGroup("mnt/storage", idxPath("/tenant"), "acme"); err != nil {
+		t.Fatalf("AllowGroup: %v", err)
+	}
+	if err := s.DeleteGroup("acme"); err != nil {
+		t.Fatalf("DeleteGroup: %v", err)
+	}
+	if _, ok := s.GetGroupMembers()["acme"]; ok {
+		t.Fatal("acme should be gone from memory")
+	}
+	sqlGroups, err := sqlStore.GetAllGroups()
+	if err != nil {
+		t.Fatalf("GetAllGroups: %v", err)
+	}
+	if _, ok := sqlGroups["acme"]; ok {
+		t.Fatal("acme should be gone from SQL")
+	}
+	if rules := s.GetRulesForGroup("mnt/storage", "acme"); len(rules) != 0 {
+		t.Fatalf("expected no rules for deleted group, got %v", rules)
+	}
+	// Deleting a missing group is a no-op.
+	if err := s.DeleteGroup("acme"); err != nil {
+		t.Fatalf("DeleteGroup missing: %v", err)
+	}
+}
+
+// failingGroupDeletePersister wraps a real store but fails the transactional group delete.
+type failingGroupDeletePersister struct {
+	access.SQLPersister
+}
+
+func (failingGroupDeletePersister) DeleteGroupWithRules(string, []access.RuleUpsert, []access.RuleKey) error {
+	return stderrors.New("simulated sql failure")
+}
+
+func TestDeleteGroup_FailureLeavesGroupAndRulesIntact(t *testing.T) {
+	setupTestSources()
+	s, _, sqlStore := createTestStorageWithSQL(t)
+
+	if err := s.SetGroupMembers("acme", []string{"alice"}); err != nil {
+		t.Fatalf("SetGroupMembers: %v", err)
+	}
+	if err := s.AllowGroup("mnt/storage", idxPath("/tenant"), "acme"); err != nil {
+		t.Fatalf("AllowGroup: %v", err)
+	}
+	if err := s.DenyGroup("mnt/storage", idxPath("/private"), "acme"); err != nil {
+		t.Fatalf("DenyGroup: %v", err)
+	}
+	rulesBefore := len(s.GetRulesForGroup("mnt/storage", "acme"))
+	if rulesBefore != 2 {
+		t.Fatalf("expected 2 rules before delete, got %d", rulesBefore)
+	}
+
+	s.SetSQLStore(failingGroupDeletePersister{sqlStore})
+	if err := s.DeleteGroup("acme"); err == nil {
+		t.Fatal("expected DeleteGroup to return the SQL error")
+	}
+
+	if got := s.GetGroupMembers()["acme"]; len(got) != 1 || got[0] != "alice" {
+		t.Fatalf("group should be restored after a failed delete, got %v", got)
+	}
+	if got := len(s.GetRulesForGroup("mnt/storage", "acme")); got != rulesBefore {
+		t.Fatalf("rules should be restored after a failed delete: want %d, got %d", rulesBefore, got)
+	}
+	// SQL was never changed.
+	sqlGroups, err := sqlStore.GetAllGroups()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, ok := sqlGroups["acme"]; !ok {
+		t.Fatal("group row should still be in SQL")
+	}
+	sqlRules, err := sqlStore.GetAllAccessRules()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(sqlRules["mnt/storage"]) != 2 {
+		t.Fatalf("rule rows should still be in SQL, got %v", sqlRules["mnt/storage"])
+	}
+}
+
+func TestDeleteGroup_RemovesGroupAndRuleRowsFromSQL(t *testing.T) {
+	setupTestSources()
+	s, _, sqlStore := createTestStorageWithSQL(t)
+
+	if err := s.SetGroupMembers("acme", []string{"alice"}); err != nil {
+		t.Fatalf("SetGroupMembers: %v", err)
+	}
+	if err := s.AllowGroup("mnt/storage", idxPath("/tenant"), "acme"); err != nil {
+		t.Fatalf("AllowGroup: %v", err)
+	}
+	if err := s.AllowUser("mnt/storage", idxPath("/tenant"), "alice"); err != nil {
+		t.Fatalf("AllowUser: %v", err)
+	}
+	if err := s.DeleteGroup("acme"); err != nil {
+		t.Fatalf("DeleteGroup: %v", err)
+	}
+
+	sqlGroups, err := sqlStore.GetAllGroups()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, ok := sqlGroups["acme"]; ok {
+		t.Fatal("group row should be gone from SQL")
+	}
+	sqlRules, err := sqlStore.GetAllAccessRules()
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, rule := range sqlRules["mnt/storage"] {
+		if _, has := rule.Allow.Groups["acme"]; has {
+			t.Fatal("no stored rule should still reference the deleted group")
+		}
+	}
+	// The rule that also allowed a user must survive with only the group removed.
+	if len(sqlRules["mnt/storage"]) != 1 {
+		t.Fatalf("expected the user rule to remain, got %v", sqlRules["mnt/storage"])
+	}
+}
+
+func TestDeleteGroup_KeepsDenyAllRule(t *testing.T) {
+	setupTestSources()
+	s, _, sqlStore := createTestStorageWithSQL(t)
+
+	// "Deny everyone except group acme": a DenyAll rule whose only allow entry is the group.
+	if err := s.SetGroupMembers("acme", []string{"alice"}); err != nil {
+		t.Fatalf("SetGroupMembers: %v", err)
+	}
+	if err := s.DenyAll("mnt/storage", idxPath("/tenant")); err != nil {
+		t.Fatalf("DenyAll: %v", err)
+	}
+	if err := s.AllowGroup("mnt/storage", idxPath("/tenant"), "acme"); err != nil {
+		t.Fatalf("AllowGroup: %v", err)
+	}
+	if !s.Permitted("mnt/storage", idxPath("/tenant"), "alice") {
+		t.Fatal("alice should be permitted through the group before it is deleted")
+	}
+
+	if err := s.DeleteGroup("acme"); err != nil {
+		t.Fatalf("DeleteGroup: %v", err)
+	}
+
+	// Deleting the group must not remove the deny-all rule and open the path to everyone.
+	if s.Permitted("mnt/storage", idxPath("/tenant"), "alice") || s.Permitted("mnt/storage", idxPath("/tenant"), "bob") {
+		t.Fatal("path must stay denied for everyone after the allowed group is deleted")
+	}
+	rules := s.GetRulesForGroup("mnt/storage", "acme")
+	if len(rules) != 0 {
+		t.Fatalf("no rule should reference the deleted group, got %v", rules)
+	}
+	sqlRules, err := sqlStore.GetAllAccessRules()
+	if err != nil {
+		t.Fatal(err)
+	}
+	stored := 0
+	for _, r := range sqlRules["mnt/storage"] {
+		if r.DenyAll {
+			stored++
+		}
+	}
+	if stored != 1 {
+		t.Fatalf("expected the deny-all rule to remain stored in SQL, found %d", stored)
+	}
+}

backend/internal/database/access/group_persist_test.go

@@ -0,0 +1,184 @@
+package access_test
+
+import (
+	"errors"
+	"maps"
+	"testing"
+
+	"github.com/gtsteffaniak/filebrowser/backend/internal/database/access"
+	"github.com/gtsteffaniak/filebrowser/backend/internal/database/users"
+)
+
+type stubGroupSQL struct {
+	saveErr   error
+	deleteErr error
+}
+
+func (s *stubGroupSQL) SaveAccessRule(string, string, *access.AccessRule) error { return nil }
+func (s *stubGroupSQL) DeleteAccessRule(string, string) error                  { return nil }
+func (s *stubGroupSQL) AccessRulesLowercaseMigrated() (bool, error) { return false, nil }
+func (s *stubGroupSQL) SetAccessRulesLowercaseMigrated() error      { return nil }
+func (s *stubGroupSQL) MigrateAccessRulePathsLowercase(string, []string, access.RuleMap) error {
+	return nil
+}
+func (s *stubGroupSQL) SaveGroup(string, access.StringSet) error {
+	return s.saveErr
+}
+func (s *stubGroupSQL) DeleteGroup(string) error { return s.deleteErr }
+func (s *stubGroupSQL) DeleteGroupWithRules(string, []access.RuleUpsert, []access.RuleKey) error {
+	return s.deleteErr
+}
+func (s *stubGroupSQL) SaveRevokedToken(string, int64) error {
+	return nil
+}
+func (s *stubGroupSQL) PersistImmediateTokenRevocation(string) error          { return nil }
+func (s *stubGroupSQL) PersistTokenRetirement(string, int64, []string) error  { return nil }
+func (s *stubGroupSQL) DeleteRevokedToken(string) error                       { return nil }
+func (s *stubGroupSQL) SaveHashedToken(string, uint64, bool, int64) error            { return nil }
+func (s *stubGroupSQL) DeleteHashedToken(string) error                        { return nil }
+func (s *stubGroupSQL) DeleteHashedTokensByUserID(uint64) error {
+	return nil
+}
+
+type recordingGroupSQL struct {
+	groups    map[string]access.StringSet
+	saveCalls int
+	failOn    int
+}
+
+func (s *recordingGroupSQL) SaveAccessRule(string, string, *access.AccessRule) error { return nil }
+func (s *recordingGroupSQL) DeleteAccessRule(string, string) error                  { return nil }
+func (s *recordingGroupSQL) AccessRulesLowercaseMigrated() (bool, error) { return false, nil }
+func (s *recordingGroupSQL) SetAccessRulesLowercaseMigrated() error      { return nil }
+func (s *recordingGroupSQL) MigrateAccessRulePathsLowercase(string, []string, access.RuleMap) error {
+	return nil
+}
+func (s *recordingGroupSQL) SaveGroup(name string, members access.StringSet) error {
+	if s.groups == nil {
+		s.groups = make(map[string]access.StringSet)
+	}
+	s.saveCalls++
+	if s.failOn > 0 && s.saveCalls == s.failOn {
+		return errors.New("save failed")
+	}
+	s.groups[name] = cloneStringSet(members)
+	return nil
+}
+func (s *recordingGroupSQL) DeleteGroup(name string) error {
+	if s.groups == nil {
+		s.groups = make(map[string]access.StringSet)
+	}
+	delete(s.groups, name)
+	return nil
+}
+func (s *recordingGroupSQL) DeleteGroupWithRules(name string, _ []access.RuleUpsert, _ []access.RuleKey) error {
+	return s.DeleteGroup(name)
+}
+func (s *recordingGroupSQL) SaveRevokedToken(string, int64) error                   { return nil }
+func (s *recordingGroupSQL) PersistImmediateTokenRevocation(string) error          { return nil }
+func (s *recordingGroupSQL) PersistTokenRetirement(string, int64, []string) error  { return nil }
+func (s *recordingGroupSQL) DeleteRevokedToken(string) error                       { return nil }
+func (s *recordingGroupSQL) SaveHashedToken(string, uint64, bool, int64) error            { return nil }
+func (s *recordingGroupSQL) DeleteHashedToken(string) error                        { return nil }
+func (s *recordingGroupSQL) DeleteHashedTokensByUserID(uint64) error               { return nil }
+
+func cloneStringSet(src access.StringSet) access.StringSet {
+	if len(src) == 0 {
+		return nil
+	}
+	dst := make(access.StringSet, len(src))
+	maps.Copy(dst, src)
+	return dst
+}
+
+func TestAddUserToGroup_RollsBackOnSQLFailure(t *testing.T) {
+	userStore := users.NewStorage(nil)
+	store := access.NewStorage(userStore)
+	store.SetSQLStore(&stubGroupSQL{saveErr: errors.New("save failed")})
+
+	err := store.AddUserToGroup("editors", "alice")
+	if err == nil {
+		t.Fatal("expected SQL save error")
+	}
+	groups := store.GetUserGroups("alice")
+	if len(groups) != 0 {
+		t.Fatalf("expected in-memory rollback, alice groups = %#v", groups)
+	}
+}
+
+func TestRemoveUserFromGroup_RollsBackOnSQLFailure(t *testing.T) {
+	userStore := users.NewStorage(nil)
+	store := access.NewStorage(userStore)
+	if err := store.AddUserToGroup("editors", "alice"); err != nil {
+		t.Fatalf("seed group: %v", err)
+	}
+
+	store.SetSQLStore(&stubGroupSQL{saveErr: errors.New("save failed")})
+	err := store.RemoveUserFromGroup("editors", "alice")
+	if err == nil {
+		t.Fatal("expected SQL save error")
+	}
+	groups := store.GetUserGroups("alice")
+	if len(groups) != 1 || groups[0] != "editors" {
+		t.Fatalf("expected in-memory rollback, alice groups = %#v", groups)
+	}
+}
+
+func TestAllowGroup_ReturnsSQLSaveError(t *testing.T) {
+	setupTestSources()
+	store := access.NewStorage(users.NewStorage(nil))
+	store.SetSQLStore(&stubGroupSQL{saveErr: errors.New("save failed")})
+
+	err := store.AllowGroup("mnt/storage", idxPath("/tenant"), "acme")
+	if err == nil {
+		t.Fatal("expected SQL save error from AllowGroup")
+	}
+}
+
+func TestEnsureGroupExistsNL_RollsBackOnSQLFailure(t *testing.T) {
+	setupTestSources()
+	store := access.NewStorage(users.NewStorage(nil))
+	store.SetSQLStore(&stubGroupSQL{saveErr: errors.New("save failed")})
+
+	err := store.AllowGroup("mnt/storage", idxPath("/tenant"), "newgroup")
+	if err == nil {
+		t.Fatal("expected SQL save error")
+	}
+	if groups := store.GetAllGroups(); len(groups) != 0 {
+		t.Fatalf("expected no in-memory group after failed ensure, got %#v", groups)
+	}
+}
+
+func TestSyncUserGroups_RollsBackOnPartialPersistFailure(t *testing.T) {
+	userStore := users.NewStorage(nil)
+	store := access.NewStorage(userStore)
+	store.Groups["groupA"] = access.StringSet{"alice": {}}
+	rec := &recordingGroupSQL{
+		failOn: 2,
+		groups: map[string]access.StringSet{
+			"groupA": {"alice": {}},
+		},
+	}
+	store.SetSQLStore(rec)
+
+	err := store.SyncUserGroups("alice", []string{"groupB"})
+	if err == nil {
+		t.Fatal("expected partial persist failure")
+	}
+	groups := store.GetUserGroups("alice")
+	if len(groups) != 1 || groups[0] != "groupA" {
+		t.Fatalf("expected in-memory rollback to groupA only, got %#v", groups)
+	}
+	if _, ok := store.Groups["groupB"]; ok {
+		t.Fatal("groupB should not remain in memory after rollback")
+	}
+	if rec.saveCalls != 3 {
+		t.Fatalf("saveCalls = %d, want 3 (groupA persist, groupB fail, groupA restore)", rec.saveCalls)
+	}
+	if _, ok := rec.groups["groupA"]["alice"]; !ok {
+		t.Fatalf("expected SQL rollback for groupA, got %#v", rec.groups["groupA"])
+	}
+	if _, ok := rec.groups["groupB"]; ok {
+		t.Fatalf("expected SQL groupB to be absent after rollback, got %#v", rec.groups["groupB"])
+	}
+}

backend/internal/database/access/groupnames.go

@@ -0,0 +1,79 @@
+package access
+
+import (
+	"fmt"
+	"strings"
+	"unicode"
+	"unicode/utf8"
+)
+
+// MaxGroupNameLength bounds names for manually created groups. Existing names
+// (e.g. LDAP DNs synced from an IdP) may exceed it and are never rejected on read.
+const MaxGroupNameLength = 128
+
+// MinGroupNameLength bounds manually created group names. Existing records are
+// never rejected so legacy single-character names stay usable.
+const MinGroupNameLength = 2
+
+// NormalizeGroupName trims and validates a group name supplied by an admin API.
+// It is only used when manually creating or referencing a group; names that
+// already exist in the database are always accepted on read, list, edit and
+// delete paths so legacy records stay usable.
+func NormalizeGroupName(name string) (string, error) {
+	name = strings.TrimSpace(name)
+	if name == "" {
+		return "", fmt.Errorf("group name is required")
+	}
+	if utf8.RuneCountInString(name) < MinGroupNameLength && !isSingleLetterName(name) {
+		return "", fmt.Errorf("group name must be at least %d characters", MinGroupNameLength)
+	}
+	if utf8.RuneCountInString(name) > MaxGroupNameLength {
+		return "", fmt.Errorf("group name exceeds %d characters", MaxGroupNameLength)
+	}
+	for _, r := range name {
+		if unicode.IsControl(r) {
+			return "", fmt.Errorf("group name must not contain control characters")
+		}
+	}
+	return name, nil
+}
+
+// isSingleLetterName reports whether name is one non-ASCII letter (e.g. a CJK ideograph),
+// which is a meaningful group name on its own.
+func isSingleLetterName(name string) bool {
+	r, size := utf8.DecodeRuneInString(name)
+	return size == len(name) && r > unicode.MaxASCII && unicode.IsLetter(r)
+}
+
+// NormalizeMembers trims, dedupes and drops empty usernames while preserving order.
+func NormalizeMembers(usernames []string) []string {
+	seen := make(map[string]struct{}, len(usernames))
+	out := make([]string, 0, len(usernames))
+	for _, name := range usernames {
+		name = strings.TrimSpace(name)
+		if name == "" {
+			continue
+		}
+		if _, ok := seen[name]; ok {
+			continue
+		}
+		seen[name] = struct{}{}
+		out = append(out, name)
+	}
+	return out
+}
+
+// IsUsableSyncedGroupName reports whether a group name coming from an identity
+// provider can be stored. Only the minimum needed to keep rows usable is
+// rejected; everything else is kept so IdP naming conventions keep working.
+func IsUsableSyncedGroupName(name string) bool {
+	if strings.TrimSpace(name) == "" {
+		return false
+	}
+	for _, r := range name {
+		if unicode.IsControl(r) {
+			return false
+		}
+	}
+	return true
+}

backend/internal/database/access/groupnames_test.go

@@ -0,0 +1,115 @@
+package access_test
+
+import (
+	"testing"
+
+	"github.com/gtsteffaniak/filebrowser/backend/internal/database/access"
+)
+
+func TestNormalizeGroupName(t *testing.T) {
+	for _, tc := range []struct {
+		name    string
+		in      string
+		want    string
+		wantErr bool
+	}{
+		{"trims", "  editors  ", "editors", false},
+		{"spaces inside", "cn=admins with spaces,ou=x", "cn=admins with spaces,ou=x", false},
+		{"empty", "", "", true},
+		{"blank", "   ", "", true},
+		{"newline", "a\nb", "", true},
+		{"too short", "a", "", true},
+		{"single wide char", "界", "界", false},
+		{"two chars", "ab", "ab", false},
+		{"single CJK char", "组", "组", false},
+		{"single non-letter non-ascii", "€", "", true},
+		{"too long", string(make([]byte, access.MaxGroupNameLength+1)), "", true},
+	} {
+		got, err := access.NormalizeGroupName(tc.in)
+		if tc.wantErr {
+			if err == nil {
+				t.Fatalf("%s: expected error, got %q", tc.name, got)
+			}
+			continue
+		}
+		if err != nil || got != tc.want {
+			t.Fatalf("%s: got %q, err=%v", tc.name, got, err)
+		}
+	}
+	// Long names of valid characters fail on length, not on content.
+	if _, err := access.NormalizeGroupName(string(make([]byte, access.MaxGroupNameLength+1))); err == nil {
+		t.Fatal("expected too-long name to fail")
+	}
+	if got := access.NormalizeMembers([]string{" a ", "b", "", "a", "  "}); len(got) != 2 || got[0] != "a" || got[1] != "b" {
+		t.Fatalf("unexpected members: %v", got)
+	}
+}
+
+func TestRemoveUserFromAllGroups(t *testing.T) {
+	setupTestSources()
+	s, _, sqlStore := createTestStorageWithSQL(t)
+
+	if err := s.SetGroupMembers("editors", []string{"alice", "bob"}); err != nil {
+		t.Fatal(err)
+	}
+	if err := s.SetGroupMembers("staff", []string{"alice"}); err != nil {
+		t.Fatal(err)
+	}
+	if err := s.RemoveUserFromAllGroups("alice"); err != nil {
+		t.Fatal(err)
+	}
+	if groups := s.GetUserGroups("alice"); len(groups) != 0 {
+		t.Fatalf("alice should be in no groups, got %v", groups)
+	}
+	if got := s.GetGroupMembers()["editors"]; len(got) != 1 || got[0] != "bob" {
+		t.Fatalf("expected [bob], got %v", got)
+	}
+	// The emptied group row still exists.
+	if _, ok := s.GetGroupMembers()["staff"]; !ok {
+		t.Fatal("empty group should remain")
+	}
+	sqlGroups, err := sqlStore.GetAllGroups()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, ok := sqlGroups["staff"]["alice"]; ok {
+		t.Fatal("alice should be removed from staff in SQL")
+	}
+	// Removing a user who is in no group is a no-op.
+	if err := s.RemoveUserFromAllGroups("nobody"); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestRenameUserInGroups(t *testing.T) {
+	setupTestSources()
+	s, _, sqlStore := createTestStorageWithSQL(t)
+
+	if err := s.SetGroupMembers("editors", []string{"alice", "bob"}); err != nil {
+		t.Fatal(err)
+	}
+	if err := s.RenameUserInGroups("alice", "alicia"); err != nil {
+		t.Fatal(err)
+	}
+	got := s.GetGroupMembers()["editors"]
+	if len(got) != 2 || got[0] != "alicia" || got[1] != "bob" {
+		t.Fatalf("unexpected members: %v", got)
+	}
+	sqlGroups, err := sqlStore.GetAllGroups()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, ok := sqlGroups["editors"]["alicia"]; !ok {
+		t.Fatal("alicia should be persisted in SQL")
+	}
+	if _, ok := sqlGroups["editors"]["alice"]; ok {
+		t.Fatal("alice should be removed in SQL")
+	}
+	// Renaming a non-member or same name is a no-op.
+	if err := s.RenameUserInGroups("nobody", "other"); err != nil {
+		t.Fatal(err)
+	}
+	if err := s.RenameUserInGroups("alicia", "alicia"); err != nil {
+		t.Fatal(err)
+	}
+}

backend/internal/database/access/main_test.go

@@ -0,0 +1,12 @@
+package access
+
+import (
+	"os"
+	"testing"
+
+	"github.com/gtsteffaniak/filebrowser/backend/internal/testutil"
+)
+
+func TestMain(m *testing.M) {
+	os.Exit(testutil.Main(m))
+}

backend/internal/database/access/rule_keys.go

@@ -0,0 +1,192 @@
+package access
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/gtsteffaniak/filebrowser/backend/internal/utils"
+	"github.com/gtsteffaniak/go-logger/logger"
+)
+
+// Access rules are stored and matched using lowercase path keys (strings.ToLower).
+
+// checkRulePathExists reports whether rulePath exists under sourcePath, matching
+// path segments case-insensitively when the exact path is not found on case-sensitive filesystems.
+func checkRulePathExists(sourcePath, rulePath string) bool {
+	if utils.CheckPathExists(filepath.Join(sourcePath, rulePath)) {
+		return true
+	}
+	rel := strings.Trim(strings.TrimSpace(rulePath), "/")
+	if rel == "" {
+		return utils.CheckPathExists(sourcePath)
+	}
+	current := sourcePath
+	for _, part := range strings.Split(rel, "/") {
+		if part == "" {
+			continue
+		}
+		candidate := filepath.Join(current, part)
+		if utils.CheckPathExists(candidate) {
+			current = candidate
+			continue
+		}
+		entries, err := os.ReadDir(current)
+		if err != nil {
+			return false
+		}
+		partLower := strings.ToLower(part)
+		matched := ""
+		for _, e := range entries {
+			if strings.ToLower(e.Name()) == partLower {
+				matched = e.Name()
+				break
+			}
+		}
+		if matched == "" {
+			return false
+		}
+		current = filepath.Join(current, matched)
+	}
+	return true
+}
+
+// ruleKeyForNL returns the storage key; caller must hold s.mux.
+func (s *Storage) ruleKeyForNL(_ string, indexPath utils.IndexPath) string {
+	return strings.ToLower(ruleKey(indexPath))
+}
+
+// ruleKeyFor returns the storage/lookup key for a rule path on this source.
+func (s *Storage) ruleKeyFor(sourcePath string, indexPath utils.IndexPath) string {
+	s.mux.RLock()
+	defer s.mux.RUnlock()
+	return s.ruleKeyForNL(sourcePath, indexPath)
+}
+
+func (s *Storage) checkPathForSourceNL(_ string, indexPath utils.IndexPath) utils.IndexPath {
+	p := checkPath(indexPath)
+	return utils.IndexPathFromNormalized(strings.ToLower(p.String()), p.IsDir)
+}
+
+// checkPathForSource normalizes an index path for permission checks on a source.
+func (s *Storage) checkPathForSource(sourcePath string, indexPath utils.IndexPath) utils.IndexPath {
+	s.mux.RLock()
+	defer s.mux.RUnlock()
+	return s.checkPathForSourceNL(sourcePath, indexPath)
+}
+
+// StartupMigrateAccessRuleKeys lowercases existing rule keys in memory and SQL,
+// merging colliding paths. Idempotent when keys are already lowercase.
+func (s *Storage) StartupMigrateAccessRuleKeys() error {
+	s.mux.Lock()
+	defer s.mux.Unlock()
+
+	for sourcePath := range s.AllRules {
+		if err := s.migrateSourceRulesLowercaseNL(sourcePath); err != nil {
+			return err
+		}
+	}
+	if s.sqlStore == nil {
+		return nil
+	}
+	migrated, err := s.sqlStore.AccessRulesLowercaseMigrated()
+	if err != nil {
+		return err
+	}
+	if migrated {
+		return nil
+	}
+	return s.sqlStore.SetAccessRulesLowercaseMigrated()
+}
+
+func (s *Storage) migrateSourceRulesLowercaseNL(sourcePath string) error {
+	rulesBySource, ok := s.AllRules[sourcePath]
+	if !ok || len(rulesBySource) == 0 {
+		return nil
+	}
+
+	if !rulesNeedLowercaseMigration(rulesBySource) {
+		return nil
+	}
+
+	oldPaths := make([]string, 0, len(rulesBySource))
+	newRules := make(RuleMap)
+
+	for path, rule := range rulesBySource {
+		oldPaths = append(oldPaths, path)
+		lower := strings.ToLower(path)
+		if existing, exists := newRules[lower]; exists {
+			logger.Infof("access rules: merging colliding paths %q into %q on source %s", path, lower, sourcePath)
+			mergeAccessRulesInPlace(existing, rule)
+			continue
+		}
+		fresh := &AccessRule{}
+		mergeAccessRulesInPlace(fresh, rule)
+		newRules[lower] = fresh
+		if lower != path {
+			logger.Infof("access rules: migrated rule path %q -> %q on source %s", path, lower, sourcePath)
+		}
+	}
+
+	s.AllRules[sourcePath] = newRules
+
+	if s.sqlStore == nil {
+		return nil
+	}
+	return s.sqlStore.MigrateAccessRulePathsLowercase(sourcePath, oldPaths, newRules)
+}
+
+func rulesNeedLowercaseMigration(rules RuleMap) bool {
+	byLower := make(map[string]string)
+	for path := range rules {
+		lower := strings.ToLower(path)
+		if path != lower {
+			return true
+		}
+		if other, ok := byLower[lower]; ok && other != path {
+			return true
+		}
+		byLower[lower] = path
+	}
+	return false
+}
+
+func mergeAccessRulesInPlace(dst, src *AccessRule) {
+	if src == nil || dst == nil {
+		return
+	}
+	if src.DenyAll {
+		dst.DenyAll = true
+	}
+	if dst.Deny.Users == nil {
+		dst.Deny.Users = StringSet{}
+	}
+	if dst.Deny.Groups == nil {
+		dst.Deny.Groups = StringSet{}
+	}
+	if dst.Allow.Users == nil {
+		dst.Allow.Users = StringSet{}
+	}
+	if dst.Allow.Groups == nil {
+		dst.Allow.Groups = StringSet{}
+	}
+	for u := range src.Deny.Users {
+		dst.Deny.Users[u] = struct{}{}
+	}
+	for g := range src.Deny.Groups {
+		dst.Deny.Groups[g] = struct{}{}
+	}
+	for u := range src.Allow.Users {
+		dst.Allow.Users[u] = struct{}{}
+	}
+	for g := range src.Allow.Groups {
+		dst.Allow.Groups[g] = struct{}{}
+	}
+}
+
+func (s *Storage) deleteStoredRuleNL(sourcePath, rulePath string) {
+	delete(s.AllRules[sourcePath], rulePath)
+	if len(s.AllRules[sourcePath]) == 0 {
+		delete(s.AllRules, sourcePath)
+	}
+}

backend/internal/database/access/rule_keys_integration_test.go

@@ -0,0 +1,67 @@
+package access_test
+
+import (
+	"testing"
+
+	"github.com/gtsteffaniak/filebrowser/backend/internal/database/access"
+)
+
+func TestStartupMigrationMergesCollidingRules(t *testing.T) {
+	store, userStore, sqlStore := createTestStorageWithSQL(t)
+	_ = store
+	_ = userStore
+
+	ruleA := &access.AccessRule{
+		Deny: access.RuleSet{Users: map[string]struct{}{"alice": {}}},
+	}
+	ruleB := &access.AccessRule{
+		Deny: access.RuleSet{Users: map[string]struct{}{"bob": {}}},
+	}
+	if err := sqlStore.SaveAccessRule("/src", "/Private/", ruleA); err != nil {
+		t.Fatal(err)
+	}
+	if err := sqlStore.SaveAccessRule("/src", "/private/", ruleB); err != nil {
+		t.Fatal(err)
+	}
+
+	s := access.NewStorage(nil)
+	rules, err := sqlStore.GetAllAccessRules()
+	if err != nil {
+		t.Fatal(err)
+	}
+	s.AllRules = rules
+	s.SetSQLStore(sqlStore)
+
+	if startErr := s.StartupMigrateAccessRuleKeys(); startErr != nil {
+		t.Fatal(startErr)
+	}
+	byPath, err := sqlStore.GetAccessRulesBySource("/src")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(byPath) != 1 {
+		t.Fatalf("expected one merged rule row, got %d", len(byPath))
+	}
+	merged := byPath["/private/"]
+	if merged == nil {
+		t.Fatal("expected merged rule at lowercase key")
+	}
+	if _, ok := merged.Deny.Users["alice"]; !ok {
+		t.Fatal("missing alice from merge")
+	}
+	if _, ok := merged.Deny.Users["bob"]; !ok {
+		t.Fatal("missing bob from merge")
+	}
+
+	migrated, err := sqlStore.AccessRulesLowercaseMigrated()
+	if err != nil || !migrated {
+		t.Fatal("marker should be set after first migration")
+	}
+	byPath2, err := sqlStore.GetAccessRulesBySource("/src")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(byPath2) != 1 {
+		t.Fatal("rules should remain after marker is set without re-running migration")
+	}
+}

backend/internal/database/access/rule_keys_marker_test.go

@@ -0,0 +1,152 @@
+package access_test
+
+import (
+	"errors"
+	"testing"
+
+	"github.com/gtsteffaniak/filebrowser/backend/internal/database/access"
+)
+
+type migrateCallCounter struct {
+	access.SQLPersister
+	calls int
+}
+
+func (m *migrateCallCounter) MigrateAccessRulePathsLowercase(source string, oldPaths []string, newRules access.RuleMap) error {
+	m.calls++
+	return m.SQLPersister.MigrateAccessRulePathsLowercase(source, oldPaths, newRules)
+}
+
+type failAccessRuleMigratePersister struct {
+	access.SQLPersister
+}
+
+func (failAccessRuleMigratePersister) MigrateAccessRulePathsLowercase(string, []string, access.RuleMap) error {
+	return errors.New("simulated migration failure")
+}
+
+func TestFreshDBSetsAccessRulesLowercaseMarker(t *testing.T) {
+	s, _, sqlStore := createTestStorageWithSQL(t)
+	s.SetSQLStore(sqlStore)
+
+	if err := s.StartupMigrateAccessRuleKeys(); err != nil {
+		t.Fatal(err)
+	}
+	ok, err := sqlStore.AccessRulesLowercaseMigrated()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !ok {
+		t.Fatal("expected migration marker on empty database")
+	}
+}
+
+func TestUpgradeMigratesAndSetsMarker(t *testing.T) {
+	_, _, sqlStore := createTestStorageWithSQL(t)
+
+	rule := &access.AccessRule{
+		Deny: access.RuleSet{Users: map[string]struct{}{"alice": {}}},
+	}
+	if err := sqlStore.SaveAccessRule("/src", "/Private/", rule); err != nil {
+		t.Fatal(err)
+	}
+
+	s := access.NewStorage(nil)
+	rules, err := sqlStore.GetAllAccessRules()
+	if err != nil {
+		t.Fatal(err)
+	}
+	s.AllRules = rules
+	counter := &migrateCallCounter{SQLPersister: sqlStore}
+	s.SetSQLStore(counter)
+
+	if err = s.StartupMigrateAccessRuleKeys(); err != nil {
+		t.Fatal(err)
+	}
+	if counter.calls != 1 {
+		t.Fatalf("expected one SQL migration, got %d", counter.calls)
+	}
+	ok, err := sqlStore.AccessRulesLowercaseMigrated()
+	if err != nil || !ok {
+		t.Fatalf("marker should be set after upgrade, ok=%v err=%v", ok, err)
+	}
+	byPath, err := sqlStore.GetAccessRulesBySource("/src")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if byPath["/private/"] == nil {
+		t.Fatal("expected lowercased rule row")
+	}
+}
+
+func TestSecondStartupSkipsAccessRulesMigration(t *testing.T) {
+	_, _, sqlStore := createTestStorageWithSQL(t)
+	if err := sqlStore.SaveAccessRule("/src", "/Private/", &access.AccessRule{
+		Deny: access.RuleSet{Users: map[string]struct{}{"u": {}}},
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	s := access.NewStorage(nil)
+	rules, err := sqlStore.GetAllAccessRules()
+	if err != nil {
+		t.Fatal(err)
+	}
+	s.AllRules = rules
+	counter := &migrateCallCounter{SQLPersister: sqlStore}
+	s.SetSQLStore(counter)
+
+	if err = s.StartupMigrateAccessRuleKeys(); err != nil {
+		t.Fatal(err)
+	}
+	if counter.calls != 1 {
+		t.Fatalf("first startup: expected 1 migrate call, got %d", counter.calls)
+	}
+
+	already, err := sqlStore.AccessRulesLowercaseMigrated()
+	if err != nil || !already {
+		t.Fatal("marker should be set after first startup")
+	}
+
+	s2 := access.NewStorage(nil)
+	rules2, err := sqlStore.GetAllAccessRules()
+	if err != nil {
+		t.Fatal(err)
+	}
+	s2.AllRules = rules2
+	s2.SetSQLStore(counter)
+	if err = s2.StartupMigrateAccessRuleKeys(); err != nil {
+		t.Fatal(err)
+	}
+	if counter.calls != 1 {
+		t.Fatalf("second startup must not invoke SQL migration, got %d calls", counter.calls)
+	}
+}
+
+func TestMigrationFailureDoesNotSetMarker(t *testing.T) {
+	_, _, sqlStore := createTestStorageWithSQL(t)
+	if err := sqlStore.SaveAccessRule("/src", "/Private/", &access.AccessRule{
+		Deny: access.RuleSet{Users: map[string]struct{}{"u": {}}},
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	s := access.NewStorage(nil)
+	rules, err := sqlStore.GetAllAccessRules()
+	if err != nil {
+		t.Fatal(err)
+	}
+	s.AllRules = rules
+	s.SetSQLStore(failAccessRuleMigratePersister{SQLPersister: sqlStore})
+
+	if err = s.StartupMigrateAccessRuleKeys(); err == nil {
+		t.Fatal("expected migration failure")
+	}
+	ok, err := sqlStore.AccessRulesLowercaseMigrated()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if ok {
+		t.Fatal("marker must not be set when migration fails")
+	}
+}

backend/internal/database/access/rule_keys_test.go

@@ -0,0 +1,211 @@
+package access
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/gtsteffaniak/filebrowser/backend/internal/utils"
+	"github.com/gtsteffaniak/filebrowser/backend/pkg/settings"
+)
+
+func TestPermittedDenyCaseVariant(t *testing.T) {
+	settings.Config = settings.Settings{
+		Server: settings.Server{
+			SourceMap: map[string]*settings.Source{
+				"/data": {Path: "/data", Config: settings.SourceConfig{DenyByDefault: false}},
+			},
+		},
+	}
+	s := NewStorage(nil)
+	if err := s.DenyUser("/data", utils.IndexPathFromNormalized("/private/secret.txt", false), "alice"); err != nil {
+		t.Fatal(err)
+	}
+	key := s.ruleKeyFor("/data", utils.IndexPathFromNormalized("/private/secret.txt", false))
+	if key != "/private/secret.txt/" {
+		t.Fatalf("stored key %q", key)
+	}
+	if s.Permitted("/data", utils.IndexPathFromNormalized("/PRIVATE/secret.txt", false), "alice") {
+		t.Fatal("case variant must hit deny rule")
+	}
+}
+
+func TestRemoveRuleByPathKeyCaseVariant(t *testing.T) {
+	settings.Config = settings.Settings{
+		Server: settings.Server{
+			SourceMap: map[string]*settings.Source{
+				"/data": {Path: "/data", Config: settings.SourceConfig{DenyByDefault: false}},
+			},
+		},
+	}
+	s := NewStorage(nil)
+	if err := s.DenyUser("/data", utils.IndexPathFromNormalized("/private/x", false), "alice"); err != nil {
+		t.Fatal(err)
+	}
+	s.RemoveRuleByPathKey("/data", "/PRIVATE/x/")
+	if !s.Permitted("/data", utils.IndexPathFromNormalized("/private/x", false), "alice") {
+		t.Fatal("rule should be removed when key casing differs")
+	}
+}
+
+func TestPermittedHotPathNoFilesystemAccess(t *testing.T) {
+	settings.Config = settings.Settings{
+		Server: settings.Server{
+			SourceMap: map[string]*settings.Source{
+				"/data": {Path: "/data", Config: settings.SourceConfig{DenyByDefault: false}},
+			},
+		},
+	}
+	s := NewStorage(nil)
+	_ = s.DenyUser("/data", utils.IndexPathFromNormalized("/a/b", false), "u")
+	if !s.Permitted("/data", utils.IndexPathFromNormalized("/A/B", false), "other") {
+		t.Fatal("expected permitted for non-denied user")
+	}
+}
+
+func BenchmarkPermittedLowercaseNoFS(b *testing.B) {
+	settings.Config = settings.Settings{
+		Server: settings.Server{
+			SourceMap: map[string]*settings.Source{
+				"/data": {Path: "/data", Config: settings.SourceConfig{DenyByDefault: false}},
+			},
+		},
+	}
+	s := NewStorage(nil)
+	_ = s.DenyUser("/data", utils.IndexPathFromNormalized("/x/y", false), "u")
+	path := utils.IndexPathFromNormalized("/X/Y", false)
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		s.Permitted("/data", path, "bob")
+	}
+}
+
+func TestRulesNeedLowercaseMigration(t *testing.T) {
+	if rulesNeedLowercaseMigration(RuleMap{"/ok/": {}}) {
+		t.Fatal("already lowercase")
+	}
+	if !rulesNeedLowercaseMigration(RuleMap{"/Private/": {}}) {
+		t.Fatal("uppercase segment should need migration")
+	}
+	if !rulesNeedLowercaseMigration(RuleMap{"/Private/": {}, "/private/": {}}) {
+		t.Fatal("case collision should need migration")
+	}
+}
+
+func TestCheckRulePathExistsMixedCase(t *testing.T) {
+	root := t.TempDir()
+	mixedDir := filepath.Join(root, "MyFolder", "SubDir")
+	if err := os.MkdirAll(mixedDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	mixedFile := filepath.Join(mixedDir, "Readme.MD")
+	if err := os.WriteFile(mixedFile, []byte("ok"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	settings.Config = settings.Settings{
+		Server: settings.Server{
+			SourceMap: map[string]*settings.Source{
+				root: {Path: root, Config: settings.SourceConfig{DenyByDefault: false}},
+			},
+		},
+	}
+	s := NewStorage(nil)
+	if err := s.DenyUser(root, utils.IndexPathFromNormalized("/MyFolder/SubDir/Readme.MD", false), "alice"); err != nil {
+		t.Fatal(err)
+	}
+
+	all, err := s.GetAllRules(root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	rule, ok := all["/myfolder/subdir/readme.md/"]
+	if !ok {
+		t.Fatalf("expected lowercased rule key in GetAllRules, got %v", all)
+	}
+	if !rule.PathExists {
+		t.Fatal("expected PathExists=true for mixed-case path on disk")
+	}
+
+	feRule, ok := s.GetFrontendRules(root, utils.IndexPathFromNormalized("/myfolder/subdir/readme.md", false))
+	if !ok {
+		t.Fatal("expected rule from GetFrontendRules with lowercase query")
+	}
+	if !feRule.PathExists {
+		t.Fatal("expected PathExists=true in GetFrontendRules")
+	}
+
+	if checkRulePathExists(root, "/myfolder/subdir/nonexistent.txt/") {
+		t.Fatal("expected false for missing path")
+	}
+}
+
+func TestUpdateRulesAndUpdateRulePathCaseOnlyAndCollision(t *testing.T) {
+	settings.Config = settings.Settings{
+		Server: settings.Server{
+			SourceMap: map[string]*settings.Source{
+				"/data": {Path: "/data", Config: settings.SourceConfig{DenyByDefault: false}},
+			},
+		},
+	}
+	s := NewStorage(nil)
+	if err := s.DenyUser("/data", utils.IndexPathFromNormalized("/MyFolder", true), "alice"); err != nil {
+		t.Fatal(err)
+	}
+
+	// Case-only rename is a no-op and preserves the rule.
+	updated, err := s.UpdateRules("/data", utils.IndexPathFromNormalized("/MyFolder", true), utils.IndexPathFromNormalized("/myfolder", true))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if updated != 0 {
+		t.Fatalf("expected 0 updated for case-only rename, got %d", updated)
+	}
+	if s.Permitted("/data", utils.IndexPathFromNormalized("/MyFolder", true), "alice") {
+		t.Fatal("rule should still deny alice after case-only rename")
+	}
+
+	if err := s.UpdateRulePath("/data", utils.IndexPathFromNormalized("/MyFolder", true), utils.IndexPathFromNormalized("/myfolder", true)); err != nil {
+		t.Fatal(err)
+	}
+	if s.Permitted("/data", utils.IndexPathFromNormalized("/myfolder", true), "alice") {
+		t.Fatal("rule should still deny alice after case-only UpdateRulePath")
+	}
+
+	// Colliding target rule merges entries instead of overwriting.
+	if err := s.DenyUser("/data", utils.IndexPathFromNormalized("/Archive", true), "bob"); err != nil {
+		t.Fatal(err)
+	}
+	if err := s.UpdateRulePath("/data", utils.IndexPathFromNormalized("/MyFolder", true), utils.IndexPathFromNormalized("/archive", true)); err != nil {
+		t.Fatal(err)
+	}
+	if s.Permitted("/data", utils.IndexPathFromNormalized("/archive", true), "alice") ||
+		s.Permitted("/data", utils.IndexPathFromNormalized("/archive", true), "bob") {
+		t.Fatal("expected merged rule at /archive/ to deny both alice and bob")
+	}
+}
+
+func TestRemoveAllowUserPreservesDenyAll(t *testing.T) {
+	settings.Config = settings.Settings{
+		Server: settings.Server{
+			SourceMap: map[string]*settings.Source{
+				"/data": {Path: "/data", Config: settings.SourceConfig{DenyByDefault: false}},
+			},
+		},
+	}
+	s := NewStorage(nil)
+	p := utils.IndexPathFromNormalized("/Secret", true)
+	if err := s.DenyAll("/data", p); err != nil {
+		t.Fatal(err)
+	}
+	if err := s.AllowUser("/data", p, "alice"); err != nil {
+		t.Fatal(err)
+	}
+	removed, err := s.RemoveAllowUser("/data", p, "alice")
+	if err != nil || !removed {
+		t.Fatalf("RemoveAllowUser failed: removed=%v err=%v", removed, err)
+	}
+	if s.Permitted("/data", p, "bob") {
+		t.Fatal("DenyAll must remain active after removing the last allowed user")
+	}
+}