updated with rate limiting (#2484 )

fix panic on shutdown or folder deletion (#2467 )
Co-authored-by: codacy-production[bot] <61871480+codacy-production[bot]@users.noreply.github.com>
2026-11-13 12:41:59 -05:00 · 2026-05-22 10:28:19 -05:00 · 2026-05-20 14:20:26 -05:00 · 2026-05-20 14:20:05 -05:00 · 2026-05-19 18:26:41 -05:00 · 2026-05-19 11:47:53 -05:00
795 changed files with 31440 additions and 79940 deletions
@@ -1,15 +1,10 @@
 backend/**.db
-backend/*.sqlite
-backend/*.sqlite.*
-**/*.sqlite
-**/*.sqlite.*
-backend/filebrowser.sqlite*
 **.crt
 **.key
 backend/tmp
 backend/dist
 backend/backend*
-backend/internal/web/dist/**
+backend/http/dist/**
 backend/vendor/**

 frontend/dist/**
@@ -11,7 +11,7 @@ on:
 jobs:
  create-dev-branch:
    name: Create Dev Branch
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-latest

    steps:
      - name: Check out repository
@@ -5,13 +5,10 @@ on:
    branches:
      - "main"

-permissions:
-  contents: write
-
 jobs:
  test_playwright:
    name: Test Playwright
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
@@ -33,44 +30,3 @@ jobs:
          context: .
          file: ./_docker/Dockerfile.playwright-general
          push: false
-
-  create_beta_release:
-    needs: [test_playwright]
-    if: startsWith(github.event.head_commit.message, 'Beta/v')
-    name: Create Beta Release
-    runs-on: ubuntu-24.04-arm
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          token: ${{ secrets.PAT }}
-          fetch-depth: 0
-      - name: Extract version from commit message
-        id: extract_version
-        shell: bash
-        run: |
-          tag_name=$(echo "${{ github.event.head_commit.message }}" | grep -oE 'v[0-9]+\.[0-9]+\.[0-9]+')-beta
-          if [ -z "$tag_name" ] || [ "$tag_name" = "-beta" ]; then
-            echo "Could not extract version from: ${{ github.event.head_commit.message }}"
-            exit 1
-          fi
-          echo "tag_name=$tag_name" >> $GITHUB_OUTPUT
-      - name: Tag release commit on main
-        run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          TAG="${{ steps.extract_version.outputs.tag_name }}"
-          git tag -f "$TAG" "${{ github.sha }}"
-          git push origin "refs/tags/$TAG" --force
-      - name: Create Release
-        uses: softprops/action-gh-release@v2
-        with:
-          target_commitish: ${{ github.sha }}
-          token: ${{ secrets.PAT }}
-          tag_name: ${{ steps.extract_version.outputs.tag_name }}
-          prerelease: false
-          make_latest: false
-          draft: false
-          generate_release_notes: true
-          overwrite_existing: true
-          name: ${{ steps.extract_version.outputs.tag_name }}
@@ -11,7 +11,7 @@ on:
 jobs:
  prime_docker_cache:
    name: Prime docker cache
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
@@ -28,7 +28,7 @@ jobs:
            type=gha,mode=max,scope=${{ github.ref_name }}-playwright-base
  build_frontend:
    name: Build frontend
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
@@ -40,10 +40,10 @@ jobs:
        uses: actions/upload-artifact@v4
        with:
          name: dist
-          path: backend/internal/web/dist
+          path: backend/http/dist
  build_backend:
    name: Build backend
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
@@ -61,7 +61,7 @@ jobs:
  test_playwright:
    needs: [build_backend, build_frontend, prime_docker_cache]
    name: Test Playwright - ${{ matrix.name }}
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
@@ -103,8 +103,8 @@ jobs:
        run: chmod +x backend/filebrowser
      - name: Copy frontend build to backend
        run: |
-          mkdir -p backend/internal/web/embed
-          cp -r frontend/dist/* backend/internal/web/embed
+          mkdir -p backend/http/embed
+          cp -r frontend/dist/* backend/http/embed
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3.0.0
      - name: Set up Docker Buildx
@@ -124,7 +124,7 @@ jobs:
            type=gha,mode=max,scope=${{ github.ref_name }}-playwright-base
  push_pr_to_registry:
    name: Build docker image
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
@@ -11,7 +11,7 @@ on:
 jobs:
  promote-beta-to-stable:
    name: Promote Beta to Stable
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-latest

    steps:
      - name: Check out repository
@@ -11,7 +11,7 @@ on:
 jobs:
  promote-dev-to-beta:
    name: Promote Dev to Beta
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-latest

    steps:
      - name: Check out repository
@@ -7,7 +7,7 @@ on:

 jobs:
  test-backend:
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
@@ -16,16 +16,19 @@ jobs:
      - working-directory: backend
        run: go test -race -v ./... -timeout 30s
  lint-backend:
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: 'stable'
-      - working-directory: backend
-        run: go tool golangci-lint run --path-prefix=backend
+      - uses: golangci/golangci-lint-action@v7
+        with:
+          version: 'v2.1.6'
+          working-directory: backend
+          install-mode: goinstall
  format-backend:
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
@@ -34,39 +37,32 @@ jobs:
      - working-directory: backend
        run: go fmt ./...
  lint-frontend:
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
      - working-directory: frontend
        run: npm i && npm run lint
  test-frontend:
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
      - working-directory: frontend
        run: npm i && npm run test
  check-translations:
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
      - working-directory: frontend
        run: npm i && npm run i18n:check
  check-docs:
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: 'stable'
      - run: make generate-docs
-      - run: git diff --exit-code
-  check-icons:
-    runs-on: ubuntu-24.04-arm
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-      - working-directory: frontend
-        run: npm i && npm run icons:check
+      - run: git diff --exit-code
@@ -0,0 +1,66 @@
+name: beta release
+
+on:
+  push:
+    branches:
+      - "beta/v[0-9]+.[0-9]+.[0-9]+"
+
+permissions:
+  contents: write
+
+jobs:
+  test_playwright:
+    name: Test Playwright - regular
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3.0.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3.0.0
+      - uses: actions/setup-node@v4
+      - working-directory: frontend
+        run: npm i && npm run build
+      - uses: actions/setup-go@v5
+        with:
+          go-version: 'stable'
+      - working-directory: backend
+        run: go build -o filebrowser .
+      - name: Build
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./_docker/Dockerfile.playwright-general
+          push: false
+  create_release_tag:
+    needs: [ test_playwright ]
+    name: Create Release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.PAT }}
+      - name: Extract branch name
+        shell: bash
+        run: |
+          original_branch=${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}
+          echo "branch_name=$transformed_branch" >> $GITHUB_OUTPUT
+          tag_name=$(echo "$original_branch" | grep -oE 'v[0-9]+\.[0-9]+\.[0-9]+')-beta
+          echo "tag_name=$tag_name" >> $GITHUB_OUTPUT
+        id: extract_branch
+      - uses: actions/setup-go@v5
+        with:
+          go-version: 'stable'
+      - name: Create Release
+        uses: softprops/action-gh-release@v2
+        with:
+          target_commitish: ${{ github.sha }}
+          token: ${{ secrets.PAT }}
+          tag_name: ${{ steps.extract_branch.outputs.tag_name }}
+          prerelease: true
+          make_latest: false
+          draft: false
+          generate_release_notes: true
+          name: ${{ steps.extract_branch.outputs.tag_name }}
@@ -11,7 +11,7 @@ permissions:
 jobs:
  test_playwright:
    name: Test Playwright - regular
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
@@ -36,7 +36,7 @@ jobs:
  create_release_tag:
    needs: [ test_playwright ]
    name: Create Release
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
@@ -11,7 +11,7 @@ permissions:
 jobs:
  update_tag:
    name: Update Release tag
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
@@ -7,7 +7,7 @@ on:
 jobs:
  publish_playwright_base:
    name: Publish playwright-base to GHCR
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
@@ -1,8 +1,6 @@
 *.db
 *.db.old
-# Playwright settings migration fixture (BoltDB → SQLite tests + Docker settings image)
-!_docker/src/settings/backend/database.db.old
-*.sqlite**
+*.sqlite
 *.bak
 *.log
 *.mjs
@@ -23,8 +21,6 @@ frontend/tsconfig.tsbuildinfo
 /frontend/playwright-files
 /frontend/screenshots
 /frontend/generated
-frontend/.venv-icons
-frontend/.tmp-icons-*
 /frontend/tests/playwright-files/demo*
 /frontend/loginAuth.json
 /frontend/sharePrepStorage.json
@@ -33,8 +29,8 @@ frontend/.tmp-icons-*
 /backend/*test_config.yaml
 /backend/generated.yaml
 /backend/srv
-/backend/internal/web/dist
-/backend/internal/web/embed
+/backend/http/dist
+/backend/http/embed
 /backend/debug

 .DS_Store
@@ -2,207 +2,6 @@

 All notable changes to this project will be documented in this file. For commit guidelines, please refer to [Standard Version](https://github.com/conventional-changelog/standard-version).

-## v2.0.2
-
- **Bugfixes**:
- - OIDC: `groupsClaim` value is always included in requested scopes and falls back to the UserInfo endpoint when the ID token omits the groups claim.
- - Windows: fix backslash duplication in navigation URLs, folder sizes showing 4 KB, and download/preview failures (#2815, #2816)
- - Wrong extension in the 'new database was created popup (#2817) (#2824)
- - External subtitles fail to load on public video shares due to authenticated subtitle endpoint (#2822) (#2827)
- - OnlyOffice is inaccessible on password-protected shares (#2811)
- - FFmpeg 9.0 incorrectly detected as below minimum 5.0.0 on Windows (#2820) -- thanks @yzxcj797
-
-## v2.0.1
-
- **Security**:
- - [High] Symlink following on read paths no longer escapes source or user/share scope (GHSA-mgqf-5mf5-prfj) -- thanks @je-lv @KasperBuilds
- - [Moderate] Absolute paths in API path/file parameters could bypass user scope and read files outside the source mount (GHSA-rqqq-wv83-rp74) -- thanks @Wei-Leo
- - [Moderate] Logout did not invalidate session JWTs with equivalent Base64URL spellings (GHSA-8m35-wcjh-95q7) -- thanks @corbanvilla @soh3e @dderpym (This vulnerability was discovered as part of a U.C. Berkeley security research project by: Corban Villa, Sohee Kim, and Austin Chu)
- - [Moderate] Stored XSS via unsanitized DOCX hyperlink in DocViewer (GHSA-9wm6-jcjh-3m8c) -- thanks @karen93shieh @je-lv @EclipsSec
- - [Moderate] Revoked JWTs could still authenticate on public-share and withOrWithoutUser routes until natural expiry, bypassing logout and Api-permission revocation on that surface (GHSA-4wmj-rq3c-m65v) -- thanks @hypnguyen1209
-
- **Notes**:
- - GroupMap `SyncUserGroups` fix so JWT/OIDC/LDAP group memberships survive restart (#2742).
- - Session renew is handled by client keep-alive. removed per-request `X-Renew-Token` header handling.
- - Improvements to document thumbnail generation performance.
- - behavior changes for typing to select files in listing view.
- - next/previous buttons don't hide automatically on photos (#2767)
- - added more actions available in advanced search (#2776)
-
- **Bugfixes**:
- - GroupMap mutations (`SyncUserGroups`, add/remove group members) are write-through to SQL so JWT/OIDC/LDAP group memberships survive restart (#2742).
- - `defaultEnabled` behavior change/fix so defaultEnabled means its always added to users on startup and login. (updated docs too)
- - Long uploads/downloads no longer lose the session mid-transfer: proactive session JWT keep-alive renews before expiry (#2638).
- - Disable auto logout/session expiry if there are active file transfers going (#2638)
- - upload options get cut off on mobile (#2685)
- - Uploading image: image gets cut-off (#2765)
- - Process aborts (not just 500) during PDF thumbnail generation (#2763)
- - PDF preview generation prevents file uploads from completing (#2752)
- - Brings back double-tap to zoom images that was mistakenly removed.
- - multiple embedded subtitles with same language bug (#2756)
- - gallery view download button missing (#2767)
- - fixed HEIC rotation regression from v1.5.x
- - fixed raw image preview regression from v1.5.x
- - html viewer takes full height
- - Members without download permission receive 403 when opening text-based files despite OnlyOffice preview being enabled (#2777)
-
-## v2.0.0
-
-This version represents the most significant change to date. It **requires** both a database migration and config structural changes. See the [migration guide](https://filebrowserquantum.com/en/docs/getting-started/v2/migration/) for step-by-step upgrade instructions, [About v2.0.0](https://filebrowserquantum.com/en/docs/getting-started/v2/about/) for a full summary, and the [config migration tool](https://filebrowserquantum.com/en/docs/getting-started/v2/config-migration/) to convert legacy config.
-
- **Breaking Changes**:
- - Removed: `GET /api/raw` and `GET /public/api/raw` download routes — use `/api/resources/download` instead.
- - Removed: `/share/…` URL redirect to `/public/share/…` — use `/public/share/…` directly.
- - Removed: singular `source` search api param (use `sources`), bare `scope` paths without `sourceName:` prefix, and `glob` / `useGlob` aliases (use `useWildcard`).
- - Removed `config.conditionals`, source-level `indexingIntervalMinutes` (indexing always uses adaptive scheduling), and deprecated rule fields `fileNames` / `folderNames` / top-level `hidden` — use `config.rules` with `fileName`, `folderName`, and `ignoreHidden` on rules. See [Exclusion rules](https://filebrowserquantum.com/en/docs/user-guides/general-configuration/exclusion-rules/).
- - Removed: deprecated `userDefaults` config formats (nested and flat) — use the [config migration tool](https://filebrowserquantum.com/en/docs/getting-started/v2/config-migration/) to convert before upgrading.
- - Changed: `PUT /api/users` moved to the more appropriate `PATCH` method and requires specifying `which` in the body. Blank or `all` values are rejected.
- - Changed: http related config options in `server` config key moved to `http` config key. See [HTTP settings](https://filebrowserquantum.com/en/docs/configuration/http/).
- - Changed (reverse proxy): `http.trustedHeaders` (v1.5.x list) removed — use `http.trustProxyHeaders: true` when behind nginx, Traefik, or Caddy. When enabled, FileBrowser honors `X-Forwarded-Host`, `X-Forwarded-Proto`, `X-Forwarded-For`, and `X-Real-IP` for client IP, cookies, OIDC callbacks, WebAuthn, share URLs, rate limiting, and activity logs. Default is `false` (direct connection values). The [config migration tool](https://filebrowserquantum.com/en/docs/getting-started/v2/config-migration/) converts v1 `trustedHeaders` lists to `trustProxyHeaders: true`. See [Reverse proxy](https://filebrowserquantum.com/en/docs/getting-started/reverse-proxy/) and [HTTP trustProxyHeaders](https://filebrowserquantum.com/en/docs/configuration/http/#trustproxyheaders).
- - Changed: `FILEBROWSER_DATABASE` environment variable — use `FILEBROWSER_DATABASE_PATH` instead. See [Environment variables](https://filebrowserquantum.com/en/docs/reference/environment-variables/) and [Server settings](https://filebrowserquantum.com/en/docs/configuration/server/).
- - Changed: Moved stream api to `/api/media/stream`. See [API reference](https://filebrowserquantum.com/en/docs/reference/api/).
- - Changed: CLI user management — canonical commands are `user set <username> --password [value]` and `user promote <username>`; `set -u username,password` is deprecated. See [CLI reference](https://filebrowserquantum.com/en/docs/reference/cli/).
-
-
- **New Features**:
- - View grant mechanism to distinguish between UI viewing and download. See [Access control overview](https://filebrowserquantum.com/en/docs/access-control/access-control-overview/).
- - granular per-source file permissions (view, download, modify, create, delete) with automatic migration from global permissions
-   - per-source defaults configurable in `settings > access management`
-   - `view` permission is automatically set to true unless explicitly set to false. See [Access control overview](https://filebrowserquantum.com/en/docs/access-control/access-control-overview/).
-   - can be enforced for all users. See [Access control overview](https://filebrowserquantum.com/en/docs/access-control/access-control-overview/).
- - New activity logs for user activity.
-   - charts and historical data
-   - export to csv reports
- - Media player improvements:
-   - Refreshed playback queue UI: Supports thumbnails, stored into session storage, and has a "clear queue" button (#2575) (#2600).
-   - Loop now has 3 states (off/single/all) and neither of them will clear the existing queue (#2600).
-   - New "Audio visualizer" for audio files (desktop-only), you can configure some basic things to your taste (#2575) (#2620).
-   - The current state of the audio panel now is stored into local storage.
-   - More gestures: Swipe up to enter/exit fullscreen, long-press to change playback speed, single tap to pause (#2575).
-   - Videos now will resume fullscreen and PiP when navigating (queue auto-navigation, swipes gestures or next/previous) (#2649).
- - Added `F4` shortcut to refresh the current directory and metadata (#2600).
- - opt-in feature to send deployment analytics to filebrowser quantum developer servers
-   - anonymized with a viewer so users can see what info would be sent.
-   - if opt-in, every month a snapshot of your deployment config would be sent to developer servers
-   - this will help me know what features are being used and what versions everyone is on over time. I will also provide a public dashboard with this information in the future. 
- - WebDAV now supports set modification time via the `X-OC-Mtime` header for clients that support it (#2626). See [WebDAV docs](https://filebrowserquantum.com/en/docs/features/webdav/).
- - Copy operations now preserve their original modification times (#2642) (#2647):
-   - WebUI preserves both, files and directories.
-   - WebDAV `COPY` preserves modification times only for files, is limitation we have with webdav.
- - User default enhancements
-   - Config `userDefaults` seeds SQLite on first run; only fields explicitly set in config stay locked in **Settings → User defaults** (other defaults remain editable)
-   - Added administrator controls for universal user defaults and enforced preferences in `settings > user management > user defaults`.
-   - Added configurable default file permissions per source in `settings > access management`.
-   - Added a User Defaults editor for account, permission, and profile preferences in the edit/create user prompt. See [User management](https://filebrowserquantum.com/en/docs/configuration/users/).
- - Database env var rename: `FILEBROWSER_DATABASE` is removed (startup fails if set). Use `FILEBROWSER_DATABASE_PATH` (default `filebrowser.sqlite`) or `server.database.path` in config. See [Environment variables](https://filebrowserquantum.com/en/docs/reference/environment-variables/) and [Server settings](https://filebrowserquantum.com/en/docs/configuration/server/).
- - CLI: `user set` with `--password` (inline value, interactive prompt on TTY, or piped stdin); `user promote` for admin grant without password reset. See [CLI reference](https://filebrowserquantum.com/en/docs/reference/cli/).
-
- **Notes**:
- - v2.x.x uses a new write-through backend state management. Changes go through a fast memory layer and also write changes to database to stay in sync. See [About v2.0.0](https://filebrowserquantum.com/en/docs/getting-started/v2/about/).
- - CLI server start (`./filebrowser`), `setup`, `version`, and `set rule` syntax unchanged; see [CLI docs](https://filebrowserquantum.com/en/docs/reference/cli/)
- - new dropdown and input styles
- - swipe gestures to dismiss notifications (#2672)
- - user updates are more granular, don't include entire user payload.
- - `user.id` has been moved to a backend property and all frontend apis now query users by username. Swagger has been updated. See [API reference](https://filebrowserquantum.com/en/docs/reference/api/).
- - removed legacy and deprecated properties from API responses and generated config output
- - `/api/media/stream` is audio/video only (range-based chunking). Non-media inline viewing uses `GET /api/resources/view`. Both endpoints use the same `viewToken` from file metadata. See [API reference](https://filebrowserquantum.com/en/docs/reference/api/).
- - removed exiftool as an optional helper, always built with the supported libraries (requires 64 bit os)
- - If migration issues arise, see [Migration troubleshooting](https://filebrowserquantum.com/en/docs/getting-started/migration/troubleshooting/).
- - default browser media player option removed, always uses themed plyr
- - [docker] upgraded ffmpeg from 8.1.2 to 9.0
-
-## v1.5.5
-
- **BugFixes**:
- - fix uncustomized (minimal) API tokens creation needed by webdav clients (#2503)
-
-## v1.5.4
-
- **Notes**:
- - PWA installation name now capped at 30 characters instead of 12 (#2699)
-
- **BugFixes**:
- - fix forward slash blocked in text fields when the search shortcut listener intercepts `/` (#2696)
-
-## v1.5.3
-
- **BugFixes**:
- - fix probe canShare with the real file, not a fixed text/plain stand-in (#2664)
- - When the logout button is pressed, the user is redirected to an invalid URL that does not honor baseURL / externalUrl (#2657)
- - fix redirect to login when an authenticated request returns 401 (expired session)
-
-## v1.5.2
-
- **Notes**:
- - [docker] upgraded ffmpeg version 8.1.1 to 8.1.2
-
- **BugFixes**:
- - Fixed OnlyOffice reopening an older editor state after a document is modified (#2633) (#2578).
- - Cannot "Reset and generate new two-factor code" to reset the TOTP for a user (#2399) (#2641).
-
-## v1.5.1
-
- **BugFixes**:
- - fix http config section being dropped so trustedHeaders and disableRateLimit apply (#2602) (#2560)
- - fix upload shares with password (#2589) (#2573)
- - fix token when returning from preview on shares with pass (#2588) (#2465)
- - fix share undefined url after editing (#2567) (#2523)
-## v1.5.0
-
- **New Features**:
- - Added basic html viewer with relative reference support (#2522)
- - Shares can have pinned files, requires a user to have edit access to share (#2522)
- - Enhanced search
-   - now uses "lazy" match by default. (#2509)
-   - added missing `case sensitive` option in the UI
- - Progressive Web App (PWA) improvements
-   - restored install prompt with sidebar install button (#2086)
-   - camera and video capture buttons on upload (mobile-friendly `capture` inputs)
-   - send files to other apps via the Web Share API (`Send to app` in the context menu)
- - App notifications for file operations (#2478)
-   - optional browser notifications when uploads, chunked downloads, move/copy, or failures finish while the tab is in the background
-   - single on/off toggle in Notifications settings, stored in browser local storage
-
- **Notes**:
- - [docker] upgraded ffmpeg version 8.1 to 8.1.1
-
- **BugFixes**:
- - fixed PWA manifest `scope` and `id` so install works when the app is served under a base URL
- - installing a public share as a PWA now opens the share URL instead of the site root (#2302)
-
-## v1.4.4
-
- **BugFixes**:
- - Pinning/Unpinning file resets users' scope permission (#2532)
-
-## v1.4.3
-
- **Security**:
- - [High] Path traversal in subtitle handler allows any authenticated user to read arbitrary files (GHSA-vvp7-h4fj-m28w)
-
- **New Features**:
- - pinned files/folders (#2396) (#2510)
- - Markdown Image relative reference support (#2355)
- - Add an option to create a new folder for unarchiving (#2338)
-
- **Notes**:
- - added fallback to show text in notification if copy fails (#2517)
- - added `alt`+`arrow up` shortcut as alias of `backspace` to go into parent directory (#2501) (#2521)
- - added `alt`+`arrow down` shortcut as alias of `enter` to open files in Listing View (#2501) (#2521)
- - updated help menu with better translations
- - migrate i18n to v11 (#2472) (#2504)
- - migrate eslint (#2459)
- - improved preview cancellation to improve performance when navigating UI.
-
- **BugFixes**:
- - fix lyrics regex parsing (#2505)
- - fix folder previews issue (#2487) (#2492)
- - fix accidental exit on images while using gestures (#2508)
- - navigating using the up/down arrow keys in Listing View was "jumping randomly" in some view modes (#2521)
- - socket field in config.yaml is ignored (#2497)
- - fix keep opened file selected after closing its preview @anpryl (#2515)
-
-
 ## v1.4.2

 **Security**:
@@ -5,13 +5,13 @@ Thank you for your interest in contributing to FileBrowser Quantum! This guide w
 ## Prerequisites

 - **Go 1.25+** (see `backend/go.mod`)
- **Node.js 22.0.0+** with npm 9.0.0+ (see `frontend/package.json`)
+- **Node.js 20.0.0+** with npm 9.0.0+ (see `frontend/package.json`)
 - **Docker** (optional, for containerized development)
 - **Git** especially improtant on windows -- needed for bash support.

 ### Optional Tools

- **ffmpeg/ffprobe**: For media features (subtitles, thumbnails, heic)
+- **ffmpeg**: For media features (subtitles, thumbnails, heic)
  - Ubuntu/Debian: `sudo apt-get install ffmpeg`
  - macOS: `brew install ffmpeg`
  - Windows: Download from [ffmpeg.org](https://ffmpeg.org/download.html)
@@ -42,12 +42,11 @@ make dev

 ### Backend (Go)
 - **Entry Point**: `backend/main.go` → `backend/cmd/`
- **HTTP Server**: `backend/internal/web/` - API routes, middleware, auth
- **Storage**: SQLite via `backend/internal/database/`
- **Authentication**: Multiple providers in `backend/internal/auth/`
- **Indexing**: Real-time search in `backend/pkg/indexing/`
- **Previews**: Image/video/document generation in `backend/internal/preview/`
- **Activity**: Query, recording, and export logic in `backend/internal/activity/`
+- **HTTP Server**: `backend/http/` - API routes, middleware, auth
+- **Storage**: BoltDB via `backend/database/storage/`
+- **Authentication**: Multiple providers in `backend/auth/`
+- **Indexing**: Real-time search in `backend/indexing/`
+- **Previews**: Image/video/document generation in `backend/preview/`

 ### Frontend (Vue.js + TypeScript)
 - **Framework**: Vue 3 + Vite + TypeScript
@@ -91,6 +90,18 @@ make test-playwright   # E2E tests in Docker

 E2E tests run with three authentication modes: standard auth, no auth, and proxy auth.

+### Coverage & Performance
+```bash
+cd backend
+./run_check_coverage.sh  # Coverage report with HTML output
+./run_benchmark.sh       # Benchmarks
+```
+
+**Code Coverage:**
+- View report: Open `backend/coverage.html` after running coverage script
+- CI enforces coverage for critical packages
+- Use `go test -cover` for quick package coverage
+
 ## Code Standards

 ### Backend (Go)
@@ -145,3 +156,53 @@ type(scope): description

 Types: feat, fix, docs, refactor, test, chore
 ```
+
+## Roadmap
+
+Check the [Project Roadmap](https://github.com/users/gtsteffaniak/projects/4/views/2) to see issues sorted by priority. This helps you understand what features are planned and where you can contribute most effectively.
+
+## Troubleshooting
+
+### Common Issues
+
+**Build failures:**
+```bash
+# Frontend
+cd frontend && rm -rf node_modules && npm install
+
+# Backend
+cd backend && go mod tidy && go clean -modcache
+```
+
+**Authentication Issues:**
+
+Always first enable debug logging in your config file if you have issues.
+
+1. **OIDC Login Fails:**
+   - Check redirect URLs match your config
+   - Verify OIDC provider settings
+   - Enable debug logs to see auth flow
+   - Common issue: mismatched callback URLs
+
+2. **Proxy Auth Not Working:**
+   - Verify header names match config
+   - Check nginx/reverse proxy passes headers
+   - Test with: `curl -H "X-Auth: username" localhost:8080`
+   - Enable `--log-level debug` to see headers
+
+3. **TOTP Issues:**
+   - Ensure server time is synchronized
+   - Check QR code generation in logs
+   - Test with authenticator app time settings
+   - Database might have stale TOTP secrets
+
+4. **Session/Cookie Problems:**
+   - Clear browser cookies and localStorage
+   - Verify cookie domain settings
+   - Try incognito/private browsing mode
+
+### Getting Help
+
+- **Wiki**: [Project Wiki](https://github.com/gtsteffaniak/filebrowser/wiki)
+- **Issues**: [GitHub Issues](https://github.com/gtsteffaniak/filebrowser/issues)
+- **PR Template**: See `.github/PULL_REQUEST_TEMPLATE.md`
@@ -1,5 +1,6 @@
 <div align="center">

+  [![Go Report Card](https://goreportcard.com/badge/github.com/gtsteffaniak/filebrowser/backend)](https://goreportcard.com/report/github.com/gtsteffaniak/filebrowser/backend)
  [![Codacy Badge](https://app.codacy.com/project/badge/Grade/0b548794f2ac4871a0cf7aa9ecab049f)](https://app.codacy.com/gh/gtsteffaniak/filebrowser/dashboard?utm_source=gh&utm_medium=referral&utm_content=&utm_campaign=Badge_grade)
  [![latest version](https://img.shields.io/github/v/release/gtsteffaniak/filebrowser)](https://github.com/gtsteffaniak/filebrowser/releases)
  [![DockerHub Pulls](https://img.shields.io/docker/pulls/gtstef/filebrowser?label=latest%20Docker%20pulls)](https://hub.docker.com/r/gtstef/filebrowser)
@@ -7,18 +8,18 @@

  [![Donate](https://www.paypalobjects.com/en_US/i/btn/btn_donate_SM.gif)](https://github.com/gtsteffaniak/filebrowser/wiki/Q&A#is-there-a-way-to-donate-or-support-this-project)

-  <img width="150" alt="FileBrowser Quantum logo" src="https://github.com/user-attachments/assets/c40b22c9-33da-47b7-bc4c-ce69bb5cc174">
+  <img width="150" src="https://github.com/user-attachments/assets/c40b22c9-33da-47b7-bc4c-ce69bb5cc174" title="Logo">
  <h3>FileBrowser Quantum</h3>
  The best free self-hosted web-based file manager.
  <br/><br/>
-  <img width="800" alt="FileBrowser Quantum file listing in dark mode" src="https://filebrowserquantum.com/images/generated/listing/view-mode-normal-dark.jpg">
+  <img width="800" src="https://github.com/user-attachments/assets/162d7a95-33b7-49bd-976c-dd6822c0d22b">
 </div>

 ## Pinned

-:pushpin: [Read The Official Docs](https://filebrowserquantum.com/) (currently english-only)
+:loudspeaker: [New Announcement](https://github.com/gtsteffaniak/filebrowser/discussions/2048)

-:pushpin: [v2.0.0 is now in beta!](https://filebrowserquantum.com/en/docs/getting-started/v2/about/)
+:pushpin: [Read The Official Docs](https://filebrowserquantum.com/) (currently english-only)

 ## About

@@ -38,23 +39,21 @@ FileBrowser Quantum is a massive fork of the file browser open-source project wi
  2. ✅ Login support for OIDC, LDAP, JWT, password + 2FA, and proxy.
  3. ✅ Beautiful, Responsive, and Customizable user interface.
  4. ✅ Streamlined configuration via `config.yaml` config file.
-  5. ✅ Efficient search
+  5. ✅ Ultra-efficient Sqlite [indexing](https://github.com/gtsteffaniak/filebrowser/wiki/Indexing)
     - Real-time search results as you type.
     - Real-time monitoring and updates in the UI.
     - Search supports file and folder sizes, along with various filters.
  6. ✅ Better listing browsing
-     - Thumbnails support includes **office**, **video**, and **album artwork**, and **3D models**.
+     - Better thumbnail support including **office**, **video**, and **album artwork**, and **3D models**.
     - Faster and more responsive views with animations.
-     - **Folder sizes** are displayed and support thumbnails
+     - Folder sizes are displayed and support thumbnails
     - Navigating remembers the last scroll position.
-     - WebDAV support
-     - Granular permissions
  7. ✅ Highly configurable and [customizable sharing options](https://filebrowserquantum.com/en/docs/shares/options/)
     - share expiration time
     - users who can access share (including anonymous)
     - styling and themes
     - file viewing, editing, and uploading permissions
-  8. ✅ Access control that can be scoped to user or group and source path.
+  8. ✅ Directory-level access control that can be scoped to user or group.
  9. ✅ Developer API support
     - Ability to create long-lived API Tokens.
     - A helpful Swagger page is available at `/swagger` endpoint for API enabled users.
@@ -69,22 +68,24 @@ FileBrowser Quantum differs significantly from the original version. Many of the
 The UI has a simple three-component navigation system:

  1. (Left) Multi-action button with slide-out panel.
-  2. (Middle) The powerful search bar / title
-  3. (Right) The view change toggle / overflow menu
+  2. (Middle) The powerful search bar.
+  3. (Right) The view change toggle.

 All other functions are moved either into the action menu or pop-up menus.
 If the action does not depend on context, it will exist in the slide-out
 action panel. If the action is available based on context, it will show up as
 a pop-up menu.

-<img width="1200" height="750" alt="Aug-07-2026 14-54-55" src="https://github.com/user-attachments/assets/fd1c1747-f30f-4e21-b991-f45744416d7e" />
+<p align="center">
+  <img width="1000" src="https://github.com/user-attachments/assets/aa32b05c-f917-47bb-b07f-857edc5e47f7" title="Search GIF">
+</p>

 ## Official Docs

 See the [Official Docs](https://filebrowserquantum.com/). Contributions are welcome and encouraged! See [FilebrowserDocs Github](https://github.com/quantumx-apps/filebrowserDocs).

 ## Comparison Chart
-Application Name | <img width="48" alt="" src="https://github.com/user-attachments/assets/c40b22c9-33da-47b7-bc4c-ce69bb5cc174" > Quantum | <img width="48" alt="" src="https://github.com/filebrowser/filebrowser/blob/master/frontend/public/img/logo.svg" > Filebrowser | <img width="48" alt="" src="https://github.com/mickael-kerjean/filestash/blob/master/public/assets/logo/app_icon.png?raw=true" > Filestash | <img width="48" alt="" src="https://avatars.githubusercontent.com/u/19211038?s=200&v=4" >  Nextcloud | <img width="48" alt="" src="https://cdn.iconscout.com/icon/free/png-256/free-google-drive-logo-icon-svg-download-png-2476481.png" > Google_Drive | <img width="48" alt="" src="https://avatars.githubusercontent.com/u/6422152?v=4" > FileRun
+Application Name | <img width="48" src="https://github.com/user-attachments/assets/c40b22c9-33da-47b7-bc4c-ce69bb5cc174" > Quantum | <img width="48" src="https://github.com/filebrowser/filebrowser/blob/master/frontend/public/img/logo.svg" > Filebrowser | <img width="48" src="https://github.com/mickael-kerjean/filestash/blob/master/public/assets/logo/app_icon.png?raw=true" > Filestash | <img width="48" src="https://avatars.githubusercontent.com/u/19211038?s=200&v=4" >  Nextcloud | <img width="48" src="https://upload.wikimedia.org/wikipedia/commons/thumb/d/da/Google_Drive_logo.png/480px-Google_Drive_logo.png" > Google_Drive | <img width="48" src="https://avatars.githubusercontent.com/u/6422152?v=4" > FileRun
 --- | --- | --- | --- | --- | --- | --- |
 Filesystem support            | ✅ | ✅ | ✅ | ❌ | ❌ | ✅ |
 Linux                         | ✅ | ✅ | ✅ | ✅ | ❌ | ✅ |
@@ -124,10 +125,10 @@ Office file support           | ✅ | ❌ | ✅ | ✅ | ✅ | ✅ |
 Office file previews          | ✅ | ❌ | ❌ | ✅ | ✅ | ✅ |
 Themes                        | ✅ | ✅ | ✅ | ❌ | ❌ | ✅ |
 Branding support              | ✅ | ✅ | ✅ | ❌ | ❌ | ✅ |
-activity log                  | ✅ | ❌ | ✅ | ✅ | ✅ | ✅
+activity log                  | :construction: | ❌ | ✅ | ✅ | ✅ | ✅ |
 Comments support              | ❌ | ❌ | ✅ | ✅ | ✅ | ✅ |
 trash support                 | :construction: | ❌ | ✅ | ✅ | ✅ | ✅ |
-Starred/pinned files          | ✅ | ❌ | ✅ | ❌ | ✅ | ✅ |
+Starred/pinned files          | ❌ | ❌ | ✅ | ❌ | ✅ | ✅ |
 Chromecast support            | ❌ | ❌ | ✅ | ❌ | ❌ | ❌ |
 Share collections of files    | :construction: | ❌ | ❌ | ❌ | ❌ | ✅ |
 Can archive selected files    | ✅ | ❌ | ❌ | ❌ | ❌ | ✅ |
@@ -1,35 +1,33 @@
-FROM gtstef/ffmpeg:9.0-decode AS ffmpeg
+FROM gtstef/ffmpeg:8.1-decode AS ffmpeg
 FROM golang:alpine AS base
 ARG VERSION
 ARG REVISION
 WORKDIR /app
 COPY ./backend ./
 RUN apk update && apk add --no-cache gcc musl-dev
-RUN go mod download && go run ./scripts/setup-gofitz-cgo
 ENV CGO_ENABLED=1
-RUN go build -tags analytics,mupdf,musl -ldflags="-w -s \
-  -X 'github.com/gtsteffaniak/filebrowser/backend/internal/version.Version=${VERSION}' \
-  -X 'github.com/gtsteffaniak/filebrowser/backend/internal/version.CommitSHA=${REVISION}'" \
+RUN go build -tags mupdf,musl -ldflags="-w -s \
+  -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.Version=${VERSION}' \
+  -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.CommitSHA=${REVISION}'" \
  -o filebrowser .

 FROM node:jod-slim AS nbuild
-WORKDIR /build
-COPY ./frontend/package.json ./frontend/
+WORKDIR /app
+COPY ./frontend/package.json ./
 RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates \
    && git config --global url."https://github.com/".insteadOf "git@github.com:" \
    && git config --global url."https://github.com/".insteadOf "ssh://git@github.com/"
-RUN cd frontend && npm i --maxsockets 1
-COPY ./frontend/ ./frontend/
-WORKDIR /build/frontend
+RUN npm i --maxsockets 1
+COPY  ./frontend/ ./
 RUN npm run build:docker

 FROM alpine:latest
 COPY --from=ffmpeg [ "/ffmpeg", "/ffprobe", "/usr/local/bin/" ]
 ENV FILEBROWSER_FFMPEG_PATH="/usr/local/bin/"
-ENV FILEBROWSER_DATABASE_PATH="/home/filebrowser/data/database.sqlite"
+ENV FILEBROWSER_DATABASE="/home/filebrowser/data/database.db"
 ENV FILEBROWSER_CONFIG="/home/filebrowser/data/config.yaml"
 ENV PATH="$PATH:/home/filebrowser"
-RUN apk --no-cache add ca-certificates mailcap tzdata curl
+RUN apk --no-cache add ca-certificates mailcap tzdata curl exiftool
 RUN adduser -D -s /bin/true -u 1000 filebrowser
 USER filebrowser
 WORKDIR /home/filebrowser
@@ -38,11 +36,12 @@ COPY --from=base --chown=filebrowser:1000 [ "/app/filebrowser", "./" ]
 COPY --from=base --chown=filebrowser:1000 [ "/app/config.yaml", "./data/config.yaml" ]
 COPY --from=base --chown=filebrowser:1000 [ "/app/config.yaml", "./" ]
 COPY --from=base --chown=filebrowser:1000 [ "/app/reduce-rounded-corners.css", "./" ]
-COPY --from=nbuild --chown=filebrowser:1000 [ "/build/backend/internal/web/dist/", "./internal/web/dist/" ]
+COPY --from=nbuild --chown=filebrowser:1000 [ "/app/dist/", "./http/dist/" ]
 ## sanity checks
 RUN [ "filebrowser", "version" ]
 RUN [ "ffmpeg", "-version" ]
 RUN [ "ffprobe", "-version" ]
+RUN [ "exiftool", "-ver" ]
 # exposing default port for auto discovery.
 EXPOSE 80
 HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
@@ -9,14 +9,15 @@ COPY [ "./_docker/src/general/frontend/", "./" ]
 COPY [ "./frontend/tests/", "./tests" ]

 WORKDIR /app/backend/
-COPY [ "./backend/filebrowser", "./"]
+COPY [ "./backend/filebrowser*", "./"]
 COPY [ "./backend/reduce-rounded-corners.css", "./no-rounded.css" ]
-RUN mkdir -p ./internal/web/dist
-COPY [ "./backend/internal/web/embed/", "./internal/web/dist/"]
+RUN mkdir -p ./http/dist
+COPY [ "./backend/http/embed/", "./http/dist/"]

 # generate duplicate 1.1MB files
 RUN dd if=/dev/zero of=/app/frontend/tests/playwright-files/1.1MB.bin bs=1024 count=1126 && dd if=/dev/zero of=/app/frontend/tests/playwright-files/1.1mb.bin bs=1024 count=1126

 # Run tests
 ENV FILEBROWSER_PLAYWRIGHT_TEST=true
-RUN ./filebrowser user set testuser1 --password testuser1 && ./filebrowser & sleep 2 && cd ../frontend && npx playwright test
+RUN ./filebrowser set -u testuser1,testuser1
+RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test
@@ -5,8 +5,8 @@ WORKDIR /app/frontend
 COPY [ "./frontend/tests", "./tests" ]
 WORKDIR /app/backend/
 COPY [ "./backend/filebrowser", "./"]
-RUN mkdir -p ./internal/web/dist
-COPY [ "./backend/internal/web/embed/", "./internal/web/dist/"]
+RUN mkdir -p ./http/dist
+COPY [ "./backend/http/embed/", "./http/dist/"]
 RUN apt update && apt install nginx -y
 RUN mv default.conf /etc/nginx/conf.d/default.conf
 RUN sed -i 's/filebrowser/localhost/g' /etc/nginx/conf.d/default.conf
@@ -2,21 +2,13 @@ FROM ghcr.io/gtsteffaniak/playwright-base:chromium
 WORKDIR /app

 WORKDIR /app/frontend
-COPY [ "./frontend/tests/", "./tests" ]
-COPY [ "./frontend/tests/playwright-files", "/tests/playwright-files" ]
+COPY [ "./frontend/", "./" ]

 WORKDIR /app/backend/
 COPY [ "./backend/filebrowser*", "./"]
-COPY [ "./_docker/src/settings/backend/config.yaml", "./"]
-COPY [ "./_docker/src/settings/backend/database.db.old", "./"]
-COPY [ "./backend/reduce-rounded-corners.css", "./no-rounded.css"]
-RUN mkdir -p ./internal/web/dist
-COPY [ "./backend/internal/web/embed/", "./internal/web/dist/"]
+COPY [ "./_docker/src/screenshots/backend/*", "./"]

-ENV FILEBROWSER_PLAYWRIGHT_TEST=true
-RUN ./filebrowser user set testuser1 --password testuser1
-RUN ./filebrowser set rule -s access -p / -r user -v admin --allow -c config.yaml
-RUN ./filebrowser set rule -s access -p /excluded/showme.txt -r user -v admin --allow -c config.yaml
-RUN ./filebrowser set rule -s access -p /denied -r user -v admin -c config.yaml
-RUN ./filebrowser set rule -s access -p /excluded -r user -v admin -c config.yaml
-ENTRYPOINT [ "./filebrowser" ]
+RUN mkdir -p ./http/dist
+COPY [ "./backend/http/embed/", "./http/dist/"]
+
+ENTRYPOINT [ "./filebrowser" ]
@@ -9,9 +9,9 @@ COPY [ "./_docker/src/no-config/frontend/", "./" ]
 COPY [ "./frontend/tests/", "./tests" ]

 WORKDIR /app/backend/
-COPY [ "./backend/filebrowser", "./"]
-RUN mkdir -p ./internal/web/dist
-COPY [ "./backend/internal/web/embed/", "./internal/web/dist/"]
+COPY [ "./backend/filebrowser*", "./"]
+RUN mkdir -p ./http/dist
+COPY [ "./backend/http/embed/", "./http/dist/"]

 # Run tests
 ENV FILEBROWSER_PLAYWRIGHT_TEST=true
@@ -10,8 +10,8 @@ COPY [ "./frontend/tests/playwright-files", "./tests/playwright-files2" ]

 WORKDIR /app/backend/
 COPY [ "./backend/filebrowser", "./"]
-RUN mkdir -p ./internal/web/dist
-COPY [ "./backend/internal/web/embed/", "./internal/web/dist/"]
+RUN mkdir -p ./http/dist
+COPY [ "./backend/http/embed/", "./http/dist/"]

 # Run tests
 ENV FILEBROWSER_PLAYWRIGHT_TEST=true
@@ -4,10 +4,10 @@ COPY [ "./_docker/src/oidc/frontend/", "./" ]
 COPY [ "./frontend/tests/", "./tests" ]

 WORKDIR /app/backend/
-RUN mkdir -p ./internal/web/dist
+RUN mkdir -p ./http/dist
 COPY [ "./_docker/src/oidc/backend/", "./"]
 COPY ["./backend/filebrowser", "./"]
-COPY [ "./backend/internal/web/embed/", "./internal/web/dist/"]
+COPY [ "./backend/http/embed/", "./http/dist/"]

 # Run tests
 WORKDIR /app/frontend
@@ -9,8 +9,8 @@ COPY [ "./frontend/tests", "./tests" ]

 WORKDIR /app/backend/
 COPY [ "./backend/filebrowser", "./"]
-RUN mkdir -p ./internal/web/dist
-COPY [ "./backend/internal/web/embed/", "./internal/web/dist/"]
+RUN mkdir -p ./http/dist
+COPY [ "./backend/http/embed/", "./http/dist/"]

 # Run tests
 ENV FILEBROWSER_PLAYWRIGHT_TEST=true
@@ -5,8 +5,8 @@ WORKDIR /app/frontend
 COPY [ "./frontend/tests", "./tests" ]
 WORKDIR /app/backend/
 COPY [ "./backend/filebrowser", "./"]
-RUN mkdir -p ./internal/web/dist
-COPY [ "./backend/internal/web/embed/", "./internal/web/dist/"]
+RUN mkdir -p ./http/dist
+COPY [ "./backend/http/embed/", "./http/dist/"]
 RUN apt update && apt install nginx -y
 RUN mv default.conf /etc/nginx/conf.d/default.conf
 RUN mv .htpasswd /etc/nginx/conf.d/.htpasswd
@@ -2,15 +2,14 @@ FROM ghcr.io/gtsteffaniak/playwright-base:chromium
 WORKDIR /app

 WORKDIR /app/frontend
-COPY [ "./frontend/tests", "./tests" ]
-COPY [ "./_docker/src/screenshots/frontend/", "./" ]
+COPY [ "./frontend/", "./" ]

 WORKDIR /app/backend/
-COPY [ "./backend/filebrowser", "./"]
+COPY [ "./backend/filebrowser*", "./"]
 COPY [ "./_docker/src/screenshots/backend/*", "./"]

-RUN mkdir -p ./internal/web/dist
-COPY [ "./backend/internal/web/embed/", "./internal/web/dist/"]
+RUN mkdir -p ./http/dist
+COPY [ "./backend/http/embed/", "./http/dist/"]

 ENV FILEBROWSER_PLAYWRIGHT_TEST=true
 RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test --project dark-screenshots
@@ -10,16 +10,16 @@ COPY [ "./frontend/tests/", "./tests" ]
 COPY [ "./frontend/tests/playwright-files", "/tests/playwright-files" ]

 WORKDIR /app/backend/
-COPY [ "./backend/filebrowser", "./"]
+COPY [ "./backend/filebrowser*", "./"]
 COPY [ "./backend/reduce-rounded-corners.css", "./no-rounded.css"]
-RUN mkdir -p ./internal/web/dist
-COPY [ "./backend/internal/web/embed/", "./internal/web/dist/"]
+RUN mkdir -p ./http/dist
+COPY [ "./backend/http/embed/", "./http/dist/"]

 # Run tests
 ENV FILEBROWSER_PLAYWRIGHT_TEST=true
-RUN ./filebrowser user set testuser1 --password testuser1
-RUN ./filebrowser set rule -s access -p / -r user -v admin --allow -c config.yaml
-RUN ./filebrowser set rule -s access -p /excluded/showme.txt -r user -v admin --allow -c config.yaml
+RUN ./filebrowser set -u testuser1,testuser1
+RUN ./filebrowser set rule -s access -p / -r user -v admin -allow -c config.yaml
+RUN ./filebrowser set rule -s access -p /excluded/showme.txt -r user -v admin -allow -c config.yaml
 RUN ./filebrowser set rule -s access -p /denied -r user -v admin -c config.yaml
 RUN ./filebrowser set rule -s access -p /excluded -r user -v admin -c config.yaml
 RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test
@@ -9,9 +9,9 @@ COPY [ "./_docker/src/sharing/frontend/", "./" ]
 COPY [ "./frontend/tests/", "./tests" ]

 WORKDIR /app/backend/
-COPY [ "./backend/filebrowser", "./"]
-RUN mkdir -p ./internal/web/dist
-COPY [ "./backend/internal/web/embed/", "./internal/web/dist/"]
+COPY [ "./backend/filebrowser*", "./"]
+RUN mkdir -p ./http/dist
+COPY [ "./backend/http/embed/", "./http/dist/"]

 # Run tests
 ENV FILEBROWSER_PLAYWRIGHT_TEST=true
@@ -4,24 +4,23 @@ ARG REVISION
 WORKDIR /app
 COPY ./backend ./
 RUN apk update && apk add
-RUN go build -tags analytics -ldflags="-w -s \
-  -X 'github.com/gtsteffaniak/filebrowser/backend/internal/version.Version=${VERSION}' \
-  -X 'github.com/gtsteffaniak/filebrowser/backend/internal/version.CommitSHA=${REVISION}'" \
+RUN go build -ldflags="-w -s \
+  -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.Version=${VERSION}' \
+  -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.CommitSHA=${REVISION}'" \
  -o filebrowser .

 FROM node:jod-slim AS nbuild
-WORKDIR /build
-COPY ./frontend/package.json ./frontend/
+WORKDIR /app
+COPY ./frontend/package.json ./
 RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates \
    && git config --global url."https://github.com/".insteadOf "git@github.com:" \
    && git config --global url."https://github.com/".insteadOf "ssh://git@github.com/"
-RUN cd frontend && npm i
-COPY ./frontend/ ./frontend/
-WORKDIR /build/frontend
+RUN npm i
+COPY  ./frontend/ ./
 RUN npm run build:docker

 FROM alpine:latest
-ENV FILEBROWSER_DATABASE_PATH="/home/filebrowser/data/database.sqlite"
+ENV FILEBROWSER_DATABASE="/home/filebrowser/data/database.db"
 ENV FILEBROWSER_CONFIG="/home/filebrowser/data/config.yaml"
 ENV PATH="$PATH:/home/filebrowser"
 RUN apk --no-cache add ca-certificates mailcap tzdata curl
@@ -32,7 +31,7 @@ COPY --from=base --chown=filebrowser:1000 [ "/app/filebrowser", "./" ]
 COPY --from=base --chown=filebrowser:1000 [ "/app/config.yaml", "./data/config.yaml" ]
 COPY --from=base --chown=filebrowser:1000 [ "/app/config.yaml", "./" ]
 COPY --from=base --chown=filebrowser:1000 [ "/app/reduce-rounded-corners.css", "./" ]
-COPY --from=nbuild --chown=filebrowser:1000 [ "/build/backend/internal/web/dist/", "./internal/web/dist/" ]
+COPY --from=nbuild --chown=filebrowser:1000 [ "/app/dist/", "./http/dist/" ]
 ## sanity checks
 RUN [ "filebrowser", "version" ]
 # exposing default port for auto discovery.
@@ -12,7 +12,7 @@ services:
      - ../frontend/generated:/app/frontend/generated
    entrypoint: ["/bin/sh", "-c", "./filebrowser & sleep 2 && cd ../frontend && npx playwright test --project dark-screenshots && npx playwright test --project light-screenshots"]
    build:
-      dockerfile: ./_docker/Dockerfile.playwright-screenshots
+      dockerfile: ./_docker/Dockerfile.playwright-local
      context: ../
  nginx-proxy-auth:
    image: nginx
@@ -1,7 +1,5 @@
 server:
  <<: *server-main
-http:
-  <<: *http-main
 frontend:
  <<: *frontend-main

@@ -14,6 +12,7 @@ userDefaults:
    models: true
    office: true
    highQuality: true
-  account:
-    permissions:
-      share: true
+  permissions:
+    download: true
+    create: true
+    share: true
@@ -1,7 +1,6 @@
-http-main: &http-main
+server-main: &server-main
  port: 80
  baseURL:  "/"
-server-main: &server-main
  logging:
    - levels: "info|error|warning|debug"
      apiFilter: 'disabled'
@@ -10,11 +9,6 @@ server-main: &server-main
      name: "playwright + files"
      config:
        defaultEnabled: true
-        defaultPermissions:
-          view: true
-          download: true
-          modify: true
-          create: true
    - path: "."
      name: "docker"
      config:
@@ -1,6 +1,5 @@
-http:
-  port: 8080
 server:
+  port: 8080
  logging:
    - levels: "info|error|warning|debug"
      apiFilter: 'disabled'
@@ -9,11 +8,6 @@ server:
      config:
        defaultEnabled: true
        createUserDir: true
-        defaultPermissions:
-          view: true
-          download: true
-          modify: true
-          create: true

 frontend:
  name: "Graham's Filebrowser"
@@ -37,17 +31,19 @@ auth:
      groupsClaim: "mygroup"
      adminGroup: "admin"
 userDefaults:
-  ui:
-    darkMode: true
-  account:
-    disableSettings: false
-    permissions:
-      share: true
-  listing:
-    singleClick: false
  preview:
    image: true
    popup: true
    video: true
    office: true
    highQuality: true
+  darkMode: true
+  disableSettings: false
+  singleClick: false
+  permissions:
+    admin: false
+    modify: true
+    share: true
+    api: false
+    download: true
+    create: true
@@ -1,7 +1,6 @@
-http:
+server:
  port: 80
  baseURL:  "/files/"
-server:
  logging:
    - levels: "info|error|warning|debug"
      apiFilter: 'disabled'
@@ -10,11 +9,6 @@ server:
      name: "exclude"
      config:
        defaultEnabled: true
-        defaultPermissions:
-          view: true
-          download: true
-          modify: true
-          create: true
        rules:
          - folderPath: "excluded"
          - folderPath: "excludedButVisible"
@@ -34,13 +28,16 @@ server:
          - filePath: "/subfolderExclusions/exclusionlist.sh"
          - folderPath: "/subfolderExclusions/folderItem"
            viewable: true
-          - fileStartsWith: "startsWith"
-          - folderEndsWith: "Folder"
-          - folderName: "folderName"
-          - fileName: "fileName"
-          - fileName: "fileNames"
-          - folderName: ".hiddenDir"
-          - fileName: ".hidden"
+        conditionals:
+          rules:
+            - fileStartsWith: "startsWith"
+            - folderEndsWith: "Folder"
+            - folderNames: 'folderNames'
+            - fileNames: 'fileNames'
+            - folderName: 'folderName'
+            - fileName: 'fileName'
+            - folderName: '.hiddenDir'
+            - fileName: '.hidden'

 auth:
  methods:
@@ -57,11 +54,13 @@ frontend:
    disableEventThemes: true

 userDefaults:
-  listing:
-    showHidden: true
+  showHidden: true
  preview:
    image: true
    popup: true
    video: true
    office: true
-    highQuality: true
+    highQuality: true
+  permissions:
+    download: true
+    create: true
@@ -7,11 +7,6 @@ server:
      config:
        defaultEnabled: true
        createUserDir: true
-        defaultPermissions:
-          view: true
-          download: true
-          modify: true
-          create: true

 frontend:
  name: "Graham's Filebrowser"
@@ -41,13 +36,13 @@ userDefaults:
    video: true
    office: true
    highQuality: true
-  ui:
-    darkMode: true
-  listing:
-    singleClick: false
-  account:
-    disableSettings: false
-    permissions:
-      admin: false
-      share: false
-      api: false
+  darkMode: true
+  disableSettings: false
+  singleClick: false
+  permissions:
+    admin: false
+    modify: true
+    share: false
+    api: false
+    download: true
+    create: true
@@ -1,18 +1,11 @@
-http:
+server:
  port: 80
  baseURL:  "/"
-server:
  logging:
    - levels: "info|error|warning|debug"
      apiFilter: 'disabled'
  sources:
    - path: "../frontend/tests/playwright-files"
-      config:
-        defaultPermissions:
-          view: true
-          download: true
-          modify: true
-          create: true

 auth:
  methods:
@@ -29,8 +22,7 @@ frontend:
    disableEventThemes: true

 userDefaults:
-  listing:
-    showHidden: true
+  showHidden: true
  preview:
    image: true
    popup: true
@@ -39,3 +31,6 @@ userDefaults:
    office: true
    models: true
    highQuality: true
+  permissions:
+    download: true
+    create: true
@@ -1,8 +1,6 @@
-http:
-  port: 8080
-  baseURL: "/subpath"
-  trustProxyHeaders: true
 server:
+  port: 8080
+  baseURL:  "/subpath"
  logging:
    - levels: "info|error|warning|debug"
      apiFilter: 'disabled'
@@ -11,11 +9,6 @@ server:
      config:
        defaultEnabled: true
        createUserDir: true
-        defaultPermissions:
-          view: true
-          download: true
-          modify: true
-          create: true

 frontend:
  name: "Graham's Filebrowser"
@@ -37,6 +30,19 @@ auth:
      logoutRedirectUrl: "https://localhost/api/auth/logout2"

 userDefaults:
-  account:
-    permissions:
-      share: true
+  preview:
+    image: true
+    popup: true
+    video: true
+    office: true
+    highQuality: true
+  darkMode: true
+  disableSettings: false
+  singleClick: false
+  permissions:
+    admin: false
+    modify: true
+    share: true
+    api: false
+    download: true
+    create: true
@@ -1,7 +1,6 @@
-http:
+server:
  port: 8080
  baseURL:  "/files/"
-server:
  logging:
    - levels: "info|error|warning|debug"
      apiFilter: 'disabled'
@@ -1,9 +1,6 @@
-http:
+server:
  port: 80
  baseURL:  "/"
-server:
-  database:
-    migrateFrom: "database.db.old"
  logging:
    - levels: "info|error|warning|debug"
      apiFilter: 'disabled'
@@ -12,8 +9,6 @@ server:
      name: "playwright + files"
      config:
        defaultEnabled: true
-        defaultPermissions:
-          modify: false
    - path: "."
      name: "docker"
      config:
@@ -43,8 +38,4 @@ frontend:
 auth:
  methods:
    password:
-      signup: true
-
-userDefaults:
-  listing:
-    showHidden: true
+      signup: true
@@ -1,7 +1,6 @@
-http:
+server:
  port: 80
  baseURL:  "/"
-server:
  logging:
    - levels: "info|error|warning|debug"
      apiFilter: 'disabled'
@@ -2,12 +2,11 @@ root = "."
 tmp_dir = "tmp"

 [build]
-  pre_cmd = ["go run ./scripts/setup-gofitz-cgo"]
-  cmd = "go build -o ./tmp/filebrowser --tags=mupdf --ldflags=\"-w -s -X 'github.com/gtsteffaniak/filebrowser/backend/internal/version.CommitSHA=commitSHA' -X 'github.com/gtsteffaniak/filebrowser/backend/internal/version.Version=version'\" ."
-  entrypoint = "./tmp/filebrowser"
+  cmd = "go build -o ./tmp/filebrowser --tags=mupdf --ldflags=\"-w -s -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.CommitSHA=commitSHA' -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.Version=version'\" ."
+  bin = "tmp/filebrowser"
  full_bin = "FILEBROWSER_DEVMODE=true CGO_ENABLED=1 ./tmp/filebrowser -c test_config.yaml"
  include_ext = ["go", "tpl", "tmpl", "html"]
-  exclude_dir = ["tmp", "vendor", "internal/web/dist", "internal/web/embed", "internal/preview/testdata", "internal/preview/thumbnails", "internal/preview/heic", "swagger/docs"]
+  exclude_dir = ["tmp", "vendor", "http/dist", "http/embed", "swagger/docs", "preview/thumbnails", "preview/heic"]
  log = "air.log"
  delay = 1000 # ms

@@ -2,12 +2,11 @@ root = "."
 tmp_dir = "tmp"

 [build]
-  pre_cmd = ["go run ./scripts/setup-gofitz-cgo"]
-  cmd = "go build -o ./tmp/filebrowser.exe --tags=mupdf --ldflags=\"-w -s -X 'github.com/gtsteffaniak/filebrowser/backend/internal/version.CommitSHA=commitSHA' -X 'github.com/gtsteffaniak/filebrowser/backend/internal/version.Version=version'\" ."
-  entrypoint = "./tmp/filebrowser.exe"
-  full_bin = "FILEBROWSER_DEVMODE=true CGO_ENABLED=1 ./tmp/filebrowser.exe -c test_config.yaml"
+  cmd = "go build -o ./tmp/filebrowser.exe --ldflags=\"-w -s -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.CommitSHA=commitSHA' -X 'github.com/gtsteffaniak/filebrowser/backend/common/version.Version=version'\" ."
+  bin = "tmp/filebrowser.exe"
+  args_bin = ["-c", "test_config.yaml"]
  include_ext = ["go", "tpl", "tmpl", "html"]
-  exclude_dir = ["tmp", "vendor", "internal\\web\\dist", "internal\\web\\embed", "internal\\preview\\testdata", "internal\\preview\\thumbnails", "internal\\preview\\heic", "swagger\\docs"]
+  exclude_dir = ["tmp", "vendor", "http\\dist", "http\\embed", "swagger\\docs"]
  exclude_unchanged = true
  follow_symlink = false
  poll = true
@@ -2,11 +2,6 @@
 project_name: filebrowser
 version: 2

-before:
-  hooks:
-    - go mod download
-    - go run ./scripts/setup-gofitz-cgo
-
 builds:
  # Build configuration for linux amd64
  - id: linux-amd64
@@ -14,11 +9,10 @@ builds:
      - CGO_ENABLED=1
      - CC=zig cc -target x86_64-linux-musl
    tags:
-      - analytics
      - mupdf
      - musl
    ldflags: &ldflags
-      - -s -w -X github.com/gtsteffaniak/filebrowser/backend/internal/version.Version=v{{ .Version }} -X github.com/gtsteffaniak/filebrowser/backend/internal/version.CommitSHA={{ .ShortCommit }}
+      - -s -w -X github.com/gtsteffaniak/filebrowser/backend/common/version.Version=v{{ .Version }} -X github.com/gtsteffaniak/filebrowser/backend/common/version.CommitSHA={{ .ShortCommit }}
    main: main.go
    binary: filebrowser
    goos:
@@ -38,7 +32,6 @@ builds:
      - CGO_ENABLED=1
      - CC=zig cc -target aarch64-linux-musl
    tags:
-      - analytics
      - mupdf
      - musl
    goos:
@@ -54,8 +47,6 @@ builds:
    ldflags: *ldflags
    main: main.go
    binary: filebrowser
-    tags:
-      - analytics
    goos:
      - linux
    goarch:
@@ -71,10 +62,8 @@ builds:
  - id: windows
    env:
      - CGO_ENABLED=1
-      # windows-gnu avoids zig rejecting Go's -tsaware when cross-compiling from macOS
-      - CC=zig cc -target x86_64-windows-gnu -lc
+      - CC=zig cc -target x86_64-windows
    tags:
-      - analytics
      - mupdf
    ldflags: *ldflags
    main: main.go
@@ -92,20 +81,16 @@ builds:
    ldflags: *ldflags
    main: main.go
    binary: filebrowser
-    tags:
-      - analytics
    goos:
      - freebsd
    goarch:
      - amd64

-  # Build configuration for macos without upx (no mupdf: CGO cross-compile from Linux CI is unsupported)
+  # Build configuration for macos without upx
  - id: macos
    ldflags: *ldflags
    main: main.go
    binary: filebrowser
-    tags:
-      - analytics
    goos:
      - darwin
    goarch:
@@ -11,7 +11,7 @@ import (
 	"path/filepath"
 	"sync"

-	"github.com/gtsteffaniak/filebrowser/backend/internal/adapters/fs/fileutils"
+	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/fileutils"
 	"github.com/gtsteffaniak/go-logger/logger"
 )

@@ -6,7 +6,7 @@ import (
 	"path/filepath"
 	"testing"

-	"github.com/gtsteffaniak/filebrowser/backend/internal/adapters/fs/fileutils"
+	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/fileutils"
 	"github.com/stretchr/testify/require"
 )

@@ -11,12 +11,12 @@ import (
 	"testing"
 	"time"

-	"github.com/gtsteffaniak/filebrowser/backend/internal/adapters/fs/fileutils"
-	liberrors "github.com/gtsteffaniak/filebrowser/backend/internal/errors"
-	"github.com/gtsteffaniak/filebrowser/backend/pkg/settings"
-	dbsql "github.com/gtsteffaniak/filebrowser/backend/internal/database/sql"
-	"github.com/gtsteffaniak/filebrowser/backend/pkg/indexing"
-	"github.com/gtsteffaniak/filebrowser/backend/pkg/indexing/iteminfo"
+	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/fileutils"
+	liberrors "github.com/gtsteffaniak/filebrowser/backend/common/errors"
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	dbsql "github.com/gtsteffaniak/filebrowser/backend/database/sql"
+	"github.com/gtsteffaniak/filebrowser/backend/indexing"
+	"github.com/gtsteffaniak/filebrowser/backend/indexing/iteminfo"
 )

 func Test_GetRealPath(t *testing.T) {
@@ -357,7 +357,7 @@ func TestOverrideDirectoryToFile(t *testing.T) {
 			{Name: "Test Object", Type: "directory"},
 		},
 	}
-	idx.UpdateMetadata(rootInfo, nil, true) // nil scanner for test
+	idx.UpdateMetadata(rootInfo, nil) // nil scanner for test

 	// Delete the old directory item from the database before replacing it with a file
 	idx.DeleteMetadata("/Test Object", true, false)
@@ -375,7 +375,7 @@ func TestOverrideDirectoryToFile(t *testing.T) {
 			},
 		},
 	}
-	idx.UpdateMetadata(rootInfo, nil, true) // nil scanner for test
+	idx.UpdateMetadata(rootInfo, nil) // nil scanner for test

 	// Verify the directory was replaced with a file in the mock data
 	rootInfo, exists := idx.GetMetadataInfo("/", true, false)
@@ -467,7 +467,7 @@ func TestOverrideFileToDirectory(t *testing.T) {
 			{ItemInfo: iteminfo.ItemInfo{Name: "Test Object", Size: 12}}, // Length of "test content"
 		},
 	}
-	idx.UpdateMetadata(rootInfo, nil, true) // nil scanner for test
+	idx.UpdateMetadata(rootInfo, nil) // nil scanner for test

 	// Delete the old file item from the database before replacing it with a directory
 	idx.DeleteMetadata("/Test Object", false, false)
@@ -483,7 +483,7 @@ func TestOverrideFileToDirectory(t *testing.T) {
 			Type: "directory",
 		},
 	}
-	idx.UpdateMetadata(rootInfo, nil, true) // nil scanner for test
+	idx.UpdateMetadata(rootInfo, nil) // nil scanner for test

 	// Verify the file was replaced with a directory in the mock data
 	rootInfo, exists := idx.GetMetadataInfo("/", true, false)
@@ -600,11 +600,7 @@ func TestDeleteFilesRootProtection(t *testing.T) {
 // accidentally delete the root.
 // Regression test for path handling bug where /srv/srv could be mistaken for /srv.
 func TestDeleteFilesSubfolderWithRootName(t *testing.T) {
-	iters := raceStressIterations
-	if testing.Short() {
-		iters = 1
-	}
-	for iter := 1; iter <= iters; iter++ {
+	for iter := 1; iter <= raceStressIterations; iter++ {
 		iter := iter
 		t.Run(fmt.Sprintf("stress-iter-%d", iter), func(t *testing.T) {
 			runDeleteFilesSubfolderWithRaceStress(t, iter)
@@ -14,28 +14,26 @@ import (
 	"time"

 	"github.com/dhowden/tag"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/adapters/fs/fileutils"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/errors"
-	"github.com/gtsteffaniak/filebrowser/backend/pkg/settings"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/utils"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/database/users"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/ffmpeg"
-	"github.com/gtsteffaniak/filebrowser/backend/pkg/indexing"
-	"github.com/gtsteffaniak/filebrowser/backend/pkg/indexing/iteminfo"
+	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/fileutils"
+	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
+	"github.com/gtsteffaniak/filebrowser/backend/database/access"
+	"github.com/gtsteffaniak/filebrowser/backend/database/share"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+	"github.com/gtsteffaniak/filebrowser/backend/ffmpeg"
+	"github.com/gtsteffaniak/filebrowser/backend/indexing"
+	"github.com/gtsteffaniak/filebrowser/backend/indexing/iteminfo"
 	"github.com/gtsteffaniak/go-logger/logger"
 )

-var reDuration = regexp.MustCompile(`^\[(?:(\d{1,2}):)?(\d{1,2}):(\d{1,2})\.(\d+)\](.*)`)
-
 // CheckPermissionsFunc allows tests to override CheckPermissions behavior
-var CheckPermissionsFunc = func(opts utils.FileOptions, user *users.User) (string, string, error) {
-	return checkPermissionsImpl(opts, user, svc())
-}
+var CheckPermissionsFunc = checkPermissionsImpl

 // addMetadataToChildren runs concurrent ffmpeg/tag extraction for audio/video children.
 // Each goroutine is registered on wg. Caller must invoke wg.Wait() after scheduling.
 func addMetadataToChildren(response *iteminfo.ExtendedFileInfo, opts utils.FileOptions, wg *sync.WaitGroup) {
-	sharedFFmpegService := ffmpeg.Get()
+	sharedFFmpegService := ffmpeg.NewFFmpegService(10, false, "")
 	if sharedFFmpegService == nil {
 		return
 	}
@@ -76,7 +74,7 @@ func processDirectoryMetadata(response *iteminfo.ExtendedFileInfo, idx *indexing
 	var wg sync.WaitGroup

 	wg.Go(func() {
-		indexPath := idx.MakeIndexPath(response.Path, true).String()
+		indexPath := idx.MakeIndexPath(response.Path, true)
 		err := idx.RefreshDirectory(indexPath, false)
 		if err != nil {
 			logger.Debugf("Failed to refresh directory for folder size update: %v", err)
@@ -89,7 +87,7 @@ func processDirectoryMetadata(response *iteminfo.ExtendedFileInfo, idx *indexing
 	wg.Wait()
 }

-// finalizeResponse handles final response adjustments (OnlyOffice ID, scope stripping).
+// finalizeResponse handles final response adjustments (OnlyOffice ID, scope stripping)
 func finalizeResponse(response *iteminfo.ExtendedFileInfo, info *iteminfo.FileInfo, realPath string, user *users.User, userScope string) {
 	// Add OnlyOffice ID if applicable
 	if settings.Config.Integrations.OnlyOffice.Secret != "" && info.Type != "directory" && iteminfo.IsOnlyOffice(info.Name) {
@@ -105,28 +103,16 @@ func finalizeResponse(response *iteminfo.ExtendedFileInfo, info *iteminfo.FileIn
 	}
 }

-// normalizeFileInfoListing shapes files/folders for FileInfoFaster JSON:
-// non-directories omit children (nil + omitempty); directories use empty slices instead of null.
-func normalizeFileInfoListing(info *iteminfo.ExtendedFileInfo) {
-	if info == nil {
-		return
-	}
-	if info.Type == "directory" {
-		info.Files = utils.NonNilSlice(info.Files)
-		info.Folders = utils.NonNilSlice(info.Folders)
-		return
-	}
-	info.Files = nil
-	info.Folders = nil
-}
-
 // CheckPermissions validates user access and returns the resolved index path and user scope
-func CheckPermissions(opts utils.FileOptions, user *users.User) (string, string, error) {
-	return CheckPermissionsFunc(opts, user)
+func CheckPermissions(opts utils.FileOptions, access *access.Storage, user *users.User) (string, string, error) {
+	return CheckPermissionsFunc(opts, access, user)
 }

 // checkPermissionsImpl is the actual implementation of CheckPermissions
-func checkPermissionsImpl(opts utils.FileOptions, user *users.User, s *Service) (string, string, error) {
+func checkPermissionsImpl(opts utils.FileOptions, access *access.Storage, user *users.User) (string, string, error) {
+	if access == nil {
+		return "", "", fmt.Errorf("access not provided")
+	}
 	if user == nil {
 		return "", "", fmt.Errorf("user not provided")
 	}
@@ -149,17 +135,16 @@ func checkPermissionsImpl(opts utils.FileOptions, user *users.User, s *Service)
 		return "", "", fmt.Errorf("user has no access to source: %v", opts.Source)
 	}

-	safePath, err := utils.SanitizePath(opts.Path)
+	safePath, err := utils.SanitizeUserPath(opts.Path)
 	if err != nil {
 		return "", "", errors.ErrAccessDenied
 	}

-	indexPath := utils.JoinScopedIndexPath(userScope, safePath)
-	parsedPath, err := utils.ParseSanitizedIndexPath(indexPath, true)
-	if err != nil {
-		return "", "", errors.ErrAccessDenied
-	}
-	if !s.accessPermitted(idx.Path, parsedPath, user.Username) {
+	// Combine scope + sanitized path
+	indexPath := utils.JoinPathAsUnix(userScope, safePath)
+	// Layer 1: USER ACCESS CONTROL
+	// Quick check: Does THIS user have permission?
+	if !access.Permitted(idx.Path, indexPath, user.Username) {
 		return indexPath, "", errors.ErrAccessDenied
 	}
 	return indexPath, userScope, nil
@@ -184,13 +169,9 @@ func filterFilesByExt(files []iteminfo.ExtendedItemInfo, hideFileExt string) []i
 	return filtered
 }

-func GetDirItems(opts utils.FileOptions, user *users.User) (Items, error) {
-	return getDirItemsImpl(opts, user, svc())
-}
-
-func getDirItemsImpl(opts utils.FileOptions, user *users.User, s *Service) (Items, error) {
+func GetDirItems(opts utils.FileOptions, access *access.Storage, user *users.User) (Items, error) {
 	items := Items{}
-	indexPath, userScope, topLevelErr := checkPermissionsImpl(opts, user, s)
+	indexPath, _, topLevelErr := CheckPermissions(opts, access, user)
 	accessRulesErr := topLevelErr != nil && topLevelErr == errors.ErrAccessDenied && indexPath != ""
 	if topLevelErr != nil && !accessRulesErr {
 		return items, topLevelErr
@@ -200,25 +181,21 @@ func getDirItemsImpl(opts utils.FileOptions, user *users.User, s *Service) (Item
 	if idx == nil {
 		return items, fmt.Errorf("could not get index: %v ", opts.Source)
 	}
-	infoReq := indexing.FileInfoRequest{
+	info, err := idx.GetFileInfo(indexing.FileInfoRequest{
 		IndexPath:         indexPath,
 		FollowSymlinks:    opts.FollowSymlinks,
 		ShowHidden:        opts.ShowHidden,
 		HideFileExt:       opts.HideFileExt,
 		Expand:            true,
 		SkipExtendedAttrs: true,
-	}
-	if opts.FollowSymlinks {
-		infoReq.BoundIndexPath = userScope
-	}
-	info, err := idx.GetFileInfo(infoReq)
+	})
 	if err != nil {
 		return items, err // Path excluded by index rules OR doesn't exist
 	}
 	if info.Type != "directory" {
 		return items, fmt.Errorf("path is not a directory: %v ", indexPath)
 	}
-	if err := s.checkChildItemAccess(info, idx, user.Username); err != nil {
+	if err := access.CheckChildItemAccess(info, idx, user.Username); err != nil {
 		return items, err
 	}
 	hasAccessibleItems := len(info.Files) > 0 || len(info.Folders) > 0
@@ -242,18 +219,16 @@ func getDirItemsImpl(opts utils.FileOptions, user *users.User, s *Service) (Item
 }

 // FileInfoFasterFunc is a variable that can be mocked in tests
-var FileInfoFasterFunc = func(opts utils.FileOptions, user *users.User) (*iteminfo.ExtendedFileInfo, error) {
-	return fileInfoFasterImpl(opts, user, svc())
-}
+var FileInfoFasterFunc = fileInfoFasterImpl

-func FileInfoFaster(opts utils.FileOptions, user *users.User) (*iteminfo.ExtendedFileInfo, error) {
-	return FileInfoFasterFunc(opts, user)
+func FileInfoFaster(opts utils.FileOptions, access *access.Storage, user *users.User, share *share.Storage) (*iteminfo.ExtendedFileInfo, error) {
+	return FileInfoFasterFunc(opts, access, user, share)
 }

 // fileInfoFasterImpl is the actual implementation of FileInfoFaster
-func fileInfoFasterImpl(opts utils.FileOptions, user *users.User, s *Service) (*iteminfo.ExtendedFileInfo, error) {
+func fileInfoFasterImpl(opts utils.FileOptions, access *access.Storage, user *users.User, share *share.Storage) (*iteminfo.ExtendedFileInfo, error) {
 	response := &iteminfo.ExtendedFileInfo{}
-	indexPath, userScope, topLevelErr := checkPermissionsImpl(opts, user, s)
+	indexPath, userScope, topLevelErr := CheckPermissions(opts, access, user)
 	accessRulesErr := topLevelErr != nil && topLevelErr == errors.ErrAccessDenied && indexPath != ""
 	if topLevelErr != nil && !accessRulesErr {
 		return response, topLevelErr
@@ -265,24 +240,20 @@ func fileInfoFasterImpl(opts utils.FileOptions, user *users.User, s *Service) (*
 	}
 	// Layer 2: INDEX RULES (global)
 	// Get file info using unified entry point (applies IsViewable/ShouldSkip)
-	fileInfoReq := indexing.FileInfoRequest{
+	info, err := idx.GetFileInfo(indexing.FileInfoRequest{
 		IndexPath:         indexPath,
 		FollowSymlinks:    opts.FollowSymlinks,
 		ShowHidden:        opts.ShowHidden,
 		HideFileExt:       opts.HideFileExt,
 		Expand:            opts.Expand,
 		SkipExtendedAttrs: opts.SkipExtendedAttrs,
-	}
-	if opts.FollowSymlinks {
-		fileInfoReq.BoundIndexPath = userScope
-	}
-	info, err := idx.GetFileInfo(fileInfoReq)
+	})
 	if err != nil {
 		return response, err // Path excluded by index rules OR doesn't exist
 	}
 	// otherwise response keeps unfiltered Folders/Files while CheckChildItemAccess only mutates info.
 	if info.Type == "directory" {
-		if err := s.checkChildItemAccess(info, idx, user.Username); err != nil {
+		if err := access.CheckChildItemAccess(info, idx, user.Username); err != nil {
 			return response, err
 		}
 	}
@@ -293,43 +264,20 @@ func fileInfoFasterImpl(opts utils.FileOptions, user *users.User, s *Service) (*

 	// Build response
 	response.FileInfo = *info
-	if opts.FollowSymlinks && info.Type != "directory" {
-		realPath, _, err := idx.GetRealPathScoped(userScope, indexPath)
-		if err != nil {
-			return response, err
-		}
-		response.RealPath = realPath
-	} else {
-		response.RealPath = utils.JoinUnderSourceRoot(idx.Path, indexPath)
-	}
+	response.RealPath = filepath.Join(idx.Path, indexPath)
 	response.Source = opts.Source
-	if user.Permissions.Share && opts.ShowSharedAttr {
+	if share != nil && user.Permissions.Share && opts.ShowSharedAttr {
 		for i := range response.Files {
 			file := &response.Files[i]
-			file.IsShared = s.pathIsShared(response.Path+file.Name, idx.Path, user.ID)
+			file.IsShared = share.IsShared(response.Path+file.Name, idx.Path, user.ID)
 		}
 		for i := range response.Folders {
 			folder := &response.Folders[i]
-			folder.IsShared = s.pathIsShared(response.Path+folder.Name, idx.Path, user.ID)
+			folder.IsShared = share.IsShared(response.Path+folder.Name, idx.Path, user.ID)
 		}
-		response.IsShared = s.pathIsShared(response.Path, idx.Path, user.ID)
+		response.IsShared = share.IsShared(response.Path, idx.Path, user.ID)
 	}
-	if info.Type == "directory" && opts.ShowPinnedItems {
-		if opts.ShareHash != "" {
-			if link, ok := s.shareByHash(opts.ShareHash); ok {
-				if shareRelDir, err := link.ShareRelativeDir(response.Path); err == nil {
-					response.PinnedItems = link.PinnedItems.NamesForDirectory(shareRelDir)
-				}
-			}
-		} else if source, ok := users.ResolveSourceKey(response.Source); ok {
-			response.PinnedItems = user.PinnedNamesForDirectory(source.Path, response.Path)
-		}
-	}
-
-	defer func() {
-		finalizeResponse(response, info, response.RealPath, user, userScope)
-		normalizeFileInfoListing(response)
-	}()
+	defer finalizeResponse(response, info, response.RealPath, user, userScope)
 	if opts.SkipExtendedAttrs {
 		if info.Type == "directory" && opts.HideFileExt != "" {
 			response.Files = filterFilesByExt(response.Files, opts.HideFileExt)
@@ -433,12 +381,13 @@ func generateOfficeId(realPath string) string {
 func parseLRC(raw string) []iteminfo.Lyric {
 	var lines []iteminfo.Lyric
 	scanner := bufio.NewScanner(strings.NewReader(raw))
+	re := regexp.MustCompile(`^\[(?:(\d{1,2}):)?(\d{1,2}):(\d{1,2})\.(\d+)\](.*)`)
 	for scanner.Scan() {
 		line := strings.TrimSpace(scanner.Text())
 		if line == "" {
 			continue
 		}
-		matches := reDuration.FindStringSubmatch(line)
+		matches := re.FindStringSubmatch(line)
 		if len(matches) == 6 {
 			// Hours default to 0 (if not present in the timestamps)
 			h := 0
@@ -540,9 +489,10 @@ func extractAudioMetadata(ctx context.Context, item *iteminfo.ExtendedItemInfo,
 	// Extract duration ONLY if explicitly requested using the ffmpeg VideoService
 	// This respects concurrency limits and gracefully handles missing ffmpeg
 	if getDuration {
+		// Use provided service or create a new one for backward compatibility
 		service := ffmpegService
 		if service == nil {
-			service = ffmpeg.Get()
+			service = ffmpeg.NewFFmpegService(5, false, "")
 		}
 		if service != nil {
 			if duration, err := service.GetMediaDuration(ctx, realPath); err == nil {
@@ -599,45 +549,26 @@ func ExtractLyrics(realPath string) ([]iteminfo.Lyric, error) {
 	return lyrics, nil
 }

-// extractVideoMetadata extracts duration and codec info from video files using ffprobe.
+// extractVideoMetadata extracts duration from video files using ffprobe
 // If ffmpegService is nil, a new service will be created (for backward compatibility)
 func extractVideoMetadata(ctx context.Context, item *iteminfo.ExtendedItemInfo, realPath string, ffmpegService *ffmpeg.FFmpegService) error {
+	// Use provided service or create a new one for backward compatibility
 	service := ffmpegService
 	if service == nil {
-		service = ffmpeg.Get()
+		service = ffmpeg.NewFFmpegService(10, false, "")
 	}
-	if service == nil {
-		return nil
-	}
-
-	info, err := service.ProbeFile(ctx, realPath)
-	if err != nil {
-		duration, durErr := service.GetMediaDuration(ctx, realPath)
-		if durErr != nil {
+	if service != nil {
+		duration, err := service.GetMediaDuration(ctx, realPath)
+		if err != nil {
 			return err
 		}
 		if duration > 0 {
-			item.Metadata = &iteminfo.MediaMetadata{Duration: int(duration)}
+			item.Metadata = &iteminfo.MediaMetadata{
+				Duration: int(duration),
+			}
 		}
 		return nil
 	}
-
-	meta := &iteminfo.MediaMetadata{}
-	if info.Duration > 0 {
-		meta.Duration = int(info.Duration)
-	}
-	if info.VideoCodec != "" {
-		meta.VideoCodec = info.VideoCodec
-	}
-	if info.AudioCodec != "" {
-		meta.AudioCodec = info.AudioCodec
-	}
-	if info.FormatName != "" {
-		meta.Container = info.FormatName
-	}
-	if meta.Duration > 0 || meta.VideoCodec != "" || meta.AudioCodec != "" || meta.Container != "" {
-		item.Metadata = meta
-	}
 	return nil
 }

@@ -653,7 +584,7 @@ func DeleteFiles(source, absPath string, isDir bool) error {
 	}

 	if !index.Config.ResolvedRules.IndexingDisabled {
-		indexPath := index.MakeIndexPath(absPath, isDir).String()
+		indexPath := index.MakeIndexPath(absPath, isDir)

 		// Perform the physical deletion
 		err := os.RemoveAll(absPath)
@@ -673,7 +604,7 @@ func DeleteFiles(source, absPath string, isDir bool) error {

 		// Refresh the parent directory to recalculate sizes and update counts
 		refreshConfig := utils.FileOptions{
-			Path:  index.MakeIndexPath(filepath.Dir(absPath), true).String(),
+			Path:  index.MakeIndexPath(filepath.Dir(absPath), true),
 			IsDir: true,
 		}
 		err = index.RefreshFileInfo(refreshConfig)
@@ -693,7 +624,7 @@ func RefreshIndex(source string, path string, isDir bool, recursive bool) error
 		return nil
 	}
 	// Always normalize path using MakeIndexPath
-	path = idx.MakeIndexPath(path, isDir).String()
+	path = idx.MakeIndexPath(path, isDir)

 	// Check if path is a symlink
 	realPath, _, _ := idx.GetRealPath(path)
@@ -764,11 +695,7 @@ func validateMoveDestination(src, dst string, isSrcDir bool) error {
 	return nil
 }

-func MoveResource(isSrcDir bool, sourceIndex, destIndex, realsrc, realdst string) error {
-	return moveResourceImpl(isSrcDir, sourceIndex, destIndex, realsrc, realdst, svc())
-}
-
-func moveResourceImpl(isSrcDir bool, sourceIndex, destIndex, realsrc, realdst string, s *Service) error {
+func MoveResource(isSrcDir bool, sourceIndex, destIndex, realsrc, realdst string, s *share.Storage, a *access.Storage) error {
 	// Check if source and destination are the same file
 	if realsrc == realdst {
 		return fmt.Errorf("cannot move a file to itself: %s", realsrc)
@@ -790,7 +717,7 @@ func moveResourceImpl(isSrcDir bool, sourceIndex, destIndex, realsrc, realdst st
 	}

 	// Prepare paths for index operations
-	srcIndexPath := srcIdx.MakeIndexPath(realsrc, isSrcDir).String()
+	srcIndexPath := srcIdx.MakeIndexPath(realsrc, isSrcDir)
 	srcParentPath := filepath.Dir(realsrc)

 	// Perform the physical move
@@ -838,15 +765,16 @@ func moveResourceImpl(isSrcDir bool, sourceIndex, destIndex, realsrc, realdst st
 		}
 	}

-	// Share path reconciliation is handled by state.UpdateSharesForMovedResource (see http/resource.go).
+	// Use backend source paths to match how shares are stored
+	go s.UpdateShares(srcIdx.Path, srcIdx.MakeIndexPath(realsrc, isSrcDir), dstIdx.Path, dstIdx.MakeIndexPath(realdst, isSrcDir)) //nolint:errcheck

 	// Update access rules for the moved path
-	if srcIdx.Path == dstIdx.Path {
-		go s.updateAccessRulesOnMove(
-			srcIdx.Path,
-			srcIdx.MakeIndexPath(realsrc, isSrcDir),
-			dstIdx.MakeIndexPath(realdst, isSrcDir),
-		)
+	if a != nil {
+		// If moving within the same source, update the rules
+		if srcIdx.Path == dstIdx.Path {
+			go a.UpdateRules(srcIdx.Path, srcIdx.MakeIndexPath(realsrc, isSrcDir), dstIdx.MakeIndexPath(realdst, isSrcDir)) //nolint:errcheck
+		}
+		// Cross-source moves don't preserve access rules (they're source-specific)
 	}

 	return nil
@@ -5,8 +5,9 @@ import (
 	"os"
 	"path/filepath"

-	"github.com/gtsteffaniak/filebrowser/backend/pkg/settings"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/database/users"
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
 	"github.com/gtsteffaniak/go-logger/logger"
 )

@@ -23,15 +24,22 @@ func MakeUserDirs(u *users.User, createDir bool) error {
 	if cleanedUserName == "" || cleanedUserName == "-" || cleanedUserName == "." {
 		return fmt.Errorf("MakeUserDirs: invalid user for home dir creation: [%s]", u.Username)
 	}
-	settings.ExpandBackendScopesForCreateUserDir(u)
-	for i, scope := range u.BackendScopes {
-		source, ok := settings.Config.Server.SourceMap[scope.Path]
+	for i, scope := range u.Scopes {
+		info, ok := users.ResolveSourceKey(scope.Name)
 		if !ok {
-			return fmt.Errorf("MakeUserDirs: source not found: %s", scope.Path)
+			return fmt.Errorf("MakeUserDirs: source not found: %s", scope.Name)
+		}
+		source, ok := settings.Config.Server.SourceMap[info.Path]
+		if !ok {
+			return fmt.Errorf("MakeUserDirs: source not found: %s", scope.Name)
 		}
 		fullPath := filepath.Join(source.Path, scope.Scope)
 		parentDir := filepath.Dir(fullPath)
 		if createDir {
+			if source.Config.CreateUserDir && filepath.Base(scope.Scope) != cleanedUserName {
+				scope.Scope = utils.JoinPathAsUnix(scope.Scope, cleanedUserName)
+				fullPath = filepath.Join(fullPath, cleanedUserName)
+			}
 			if !Exists(parentDir) {
 				if err := MakeUserDir(parentDir); err != nil {
 					logger.Errorf("MakeUserDirs: failed to create parent scope directory: %s - %v", scope.Scope, err)
@@ -47,7 +55,8 @@ func MakeUserDirs(u *users.User, createDir bool) error {
 				return fmt.Errorf("MakeUserDirs: scope folder does not exist: %s", fullPath)
 			}
 		}
-		u.BackendScopes[i] = scope
+
+		u.Scopes[i] = scope
 	}
 	return nil
 }
@@ -1,36 +1,36 @@
-package fileutils
-
-import (
-	"io/fs"
-	"net/http"
-)
-
-var (
-	assetFs fs.FS
-)
-
-// Custom dirFS to handle both embedded and non-embedded file systems
-type dirFS struct {
-	http.Dir
-}
-
-// Implement the Open method for dirFS, which wraps http.Dir
-func (d dirFS) Open(name string) (fs.File, error) {
-	return d.Dir.Open(name)
-}
-
-// InitAssetFS initializes the asset filesystem for the application
-// This should be called once during startup before http or preview services start
-func InitAssetFS(embeddedAssets fs.FS, useEmbedded bool) {
-	if useEmbedded {
-		assetFs = embeddedAssets
-	} else {
-		// Dev mode: Serve files from internal/web/dist directory
-		assetFs = dirFS{Dir: http.Dir("internal/web/dist")}
-	}
-}
-
-// GetAssetFS returns the initialized asset filesystem
-func GetAssetFS() fs.FS {
-	return assetFs
-}
+package fileutils
+
+import (
+	"io/fs"
+	"net/http"
+)
+
+var (
+	assetFs fs.FS
+)
+
+// Custom dirFS to handle both embedded and non-embedded file systems
+type dirFS struct {
+	http.Dir
+}
+
+// Implement the Open method for dirFS, which wraps http.Dir
+func (d dirFS) Open(name string) (fs.File, error) {
+	return d.Dir.Open(name)
+}
+
+// InitAssetFS initializes the asset filesystem for the application
+// This should be called once during startup before http or preview services start
+func InitAssetFS(embeddedAssets fs.FS, useEmbedded bool) {
+	if useEmbedded {
+		assetFs = embeddedAssets
+	} else {
+		// Dev mode: Serve files from http/dist directory
+		assetFs = dirFS{Dir: http.Dir("http/dist")}
+	}
+}
+
+// GetAssetFS returns the initialized asset filesystem
+func GetAssetFS() fs.FS {
+	return assetFs
+}
@@ -53,10 +53,6 @@ func CopyDir(source, dest string) error {
 			}
 		}
 	}
-	// Preserve directory mod times
-	if err := os.Chtimes(dest, srcinfo.ModTime(), srcinfo.ModTime()); err != nil {
-		errs = append(errs, err)
-	}

 	var errString string
 	for _, err := range errs {
@@ -113,7 +113,7 @@ func copySingleFile(source, dest string) error {
 	defer src.Close()

 	// Create the destination directory if needed.
-	err = os.MkdirAll(filepath.Dir(dest), EffectiveDirPerm())
+	err = os.MkdirAll(filepath.Dir(dest), PermDir)
 	if err != nil {
 		return err
 	}
@@ -139,21 +139,14 @@ func copySingleFile(source, dest string) error {
 		// The file was copied successfully, so we continue
 		logger.Debugf("Could not set file permissions for %s (this may be expected in restricted environments): %v", dest, err)
 	}
-	// Preserve source file mod time
-	if err := os.Chtimes(dest, srcInfo.ModTime(), srcInfo.ModTime()); err != nil {
-		logger.Debugf("Could not preserve modification time for %s: %v", dest, err)
-	}
+
 	return nil
 }

 // copyDirectory handles copying directories recursively.
 func copyDirectory(source, dest string) error {
-	srcInfo, err := os.Stat(source)
-	if err != nil {
-		return err
-	}
 	// Create the destination directory.
-	err = os.MkdirAll(dest, EffectiveDirPerm())
+	err := os.MkdirAll(dest, PermDir)
 	if err != nil {
 		return err
 	}
@@ -183,40 +176,8 @@ func copyDirectory(source, dest string) error {
 			}
 		}
 	}
-	return os.Chtimes(dest, srcInfo.ModTime(), srcInfo.ModTime())
-}

-// PreserveModTimes copies the mod times from src onto dst, this is used by the webdav COPY handler
-func PreserveModTimes(src, dst string) error {
-	info, err := os.Lstat(src)
-	if err != nil {
-		return err
-	}
-	if !info.IsDir() {
-		return os.Chtimes(dst, info.ModTime(), info.ModTime())
-	}
-	return filepath.WalkDir(src, func(p string, d os.DirEntry, err error) error {
-		if err != nil {
-			logger.Debugf("Error accessing %s to set mod time: %v", p, err)
-			return nil
-		}
-		if d.IsDir() {
-			return nil
-		}
-		rel, err := filepath.Rel(src, p)
-		if err != nil {
-			return nil
-		}
-		info, err := d.Info()
-		if err != nil {
-			logger.Debugf("Error getting info for %s: %v", p, err)
-			return nil
-		}
-		if err := os.Chtimes(filepath.Join(dst, rel), info.ModTime(), info.ModTime()); err != nil {
-			logger.Debugf("Could not preserve modification time for %s: %v", filepath.Join(dst, rel), err)
-		}
-		return nil
-	})
+	return nil
 }

 // CommonPrefix returns the common directory path of provided files.
@@ -0,0 +1,62 @@
+package fileutils
+
+import (
+	"os"
+	"testing"
+)
+
+func TestUnixModeToFileMode_setgid(t *testing.T) {
+	m := unixModeToFileMode(0o2770)
+	if got := m.Perm(); got != 0o770 {
+		t.Fatalf("Perm() = %#o, want 0770", got)
+	}
+	if m&os.ModeSetgid == 0 {
+		t.Fatal("expected ModeSetgid")
+	}
+	if m&os.ModeSetuid != 0 || m&os.ModeSticky != 0 {
+		t.Fatalf("unexpected special bits: %#o", m)
+	}
+}
+
+func TestCommonPrefix(t *testing.T) {
+	testCases := map[string]struct {
+		paths []string
+		want  string
+	}{
+		"same lvl": {
+			paths: []string{
+				"/home/user/file1",
+				"/home/user/file2",
+			},
+			want: "/home/user",
+		},
+		"sub folder": {
+			paths: []string{
+				"/home/user/folder",
+				"/home/user/folder/file",
+			},
+			want: "/home/user/folder",
+		},
+		"relative path": {
+			paths: []string{
+				"/home/user/folder",
+				"/home/user/folder/../folder2",
+			},
+			want: "/home/user",
+		},
+		"no common path": {
+			paths: []string{
+				"/home/user/folder",
+				"/etc/file",
+			},
+			want: "",
+		},
+	}
+	for name, tt := range testCases {
+		t.Run(name, func(t *testing.T) {
+			if got := CommonPrefix('/', tt.paths...); got != tt.want {
+				t.Errorf("CommonPrefix() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
@@ -6,9 +6,9 @@ import (
 	"time"

 	"github.com/golang-jwt/jwt/v4"
-	"github.com/gtsteffaniak/filebrowser/backend/pkg/settings"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/database/access"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/database/users"
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/database/access"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
 )

 // Auther is the authentication interface.
@@ -52,16 +52,10 @@ func MakeSignedTokenAPI(user *users.User, name string, duration time.Duration, p
 		},
 	}
 	if !minimal {
-		claim.Permissions = users.SanitizeTokenPermissions(perms)
+		claim.Permissions = perms
 		claim.BelongsTo = user.ID
 	}
-	signedClaims := jwt.Claims(claim)
-	if minimal {
-		// Sign only standard JWT claims. The full AuthToken struct always JSON-marshals
-		// a zero Permissions object, which bloats the token past WebDAV client limits.
-		signedClaims = claim.MinimalAuthToken
-	}
-	token := jwt.NewWithClaims(jwt.SigningMethodHS256, signedClaims)
+	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claim)
 	tokenString, err := token.SignedString([]byte(settings.Config.Auth.Key))
 	if err != nil {
 		return "", users.AuthToken{}, err
@@ -0,0 +1,121 @@
+package auth
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/url"
+	"os"
+	"strings"
+
+	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
+	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+)
+
+// JSONAuth is a json implementation of an Auther.
+type JSONAuth struct {
+	ReCaptcha  *ReCaptcha `json:"recaptcha" yaml:"recaptcha"`
+	DisableOtp bool       `json:"disableOtp" yaml:"disableOtp"`
+}
+
+// Auth authenticates the user via a json in content body.
+func (auther JSONAuth) Auth(r *http.Request, userStore *users.Storage) (*users.User, error) {
+	username := r.URL.Query().Get("username")
+	recaptcha := r.URL.Query().Get("recaptcha")
+	password := r.Header.Get("X-Password")
+	totpCode := r.Header.Get("X-Secret")
+	// URL-decode password to support special characters in headers
+	password, err := url.QueryUnescape(password)
+	if err != nil {
+		return nil, fmt.Errorf("invalid password encoding: %v", err)
+	}
+
+	// If ReCaptcha is enabled, check the code.
+	if auther.ReCaptcha != nil && len(auther.ReCaptcha.Secret) > 0 {
+		ok, err := auther.ReCaptcha.Ok(recaptcha) //nolint:govet
+
+		if err != nil {
+			return nil, err
+		}
+
+		if !ok {
+			return nil, os.ErrPermission
+		}
+	}
+
+	user, getErr := userStore.Get(username)
+	var passwordHash string
+	if getErr != nil {
+		passwordHash = utils.InvalidPasswordHash
+	} else {
+		passwordHash = user.Password
+	}
+	// always run checkPwd to prevent timing attacks
+	err = utils.CheckPwd(password, passwordHash)
+	if err != nil {
+		return nil, err
+	}
+	if getErr != nil {
+		return nil, fmt.Errorf("unable to get user from store: %v", err)
+	}
+	if user.TOTPSecret != "" && !auther.DisableOtp {
+		if totpCode == "" {
+			return nil, errors.ErrNoTotpProvided
+		}
+		err = VerifyTotpCode(user, totpCode, userStore)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	if user.LoginMethod != users.LoginMethodPassword {
+		return nil, errors.ErrWrongLoginMethod
+	}
+
+	return user, nil
+
+}
+
+const reCaptchaAPI = "/recaptcha/api/siteverify"
+
+// ReCaptcha identifies a recaptcha connection.
+type ReCaptcha struct {
+	Host   string `json:"host"`
+	Key    string `json:"key"`
+	Secret string `json:"secret"`
+}
+
+// Ok checks if a reCaptcha responde is correct.
+func (r *ReCaptcha) Ok(response string) (bool, error) {
+	body := url.Values{}
+	body.Set("secret", r.Secret)
+	body.Add("response", response)
+
+	client := &http.Client{}
+
+	resp, err := client.Post(
+		r.Host+reCaptchaAPI,
+		"application/x-www-form-urlencoded",
+		strings.NewReader(body.Encode()),
+	)
+	if err != nil {
+		return false, err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return false, nil
+	}
+
+	var data struct {
+		Success bool `json:"success"`
+	}
+
+	err = json.NewDecoder(resp.Body).Decode(&data)
+	if err != nil {
+		return false, err
+	}
+
+	return data.Success, nil
+}
@@ -29,45 +29,39 @@ import (
 	"testing"
 	"time"

-	"github.com/gtsteffaniak/filebrowser/backend/internal/auth"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/errors"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/utils"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/database/users"
+	"github.com/gtsteffaniak/filebrowser/backend/auth"
+	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
 )

 // mockUserBackend is a simple in-memory user storage for testing.
 type mockUserBackend struct {
 	usersByUsername map[string]*users.User
-	usersByID       map[uint64]*users.User
+	usersByID       map[uint]*users.User
 }

 func newMockUserBackend() *mockUserBackend {
 	return &mockUserBackend{
 		usersByUsername: make(map[string]*users.User),
-		usersByID:       make(map[uint64]*users.User),
+		usersByID:       make(map[uint]*users.User),
 	}
 }

-func (m *mockUserBackend) GetBy(id uint64) (*users.User, error) {
-	if user, ok := m.usersByID[id]; ok {
-		return user, nil
+func (m *mockUserBackend) GetBy(id interface{}) (*users.User, error) {
+	switch v := id.(type) {
+	case string:
+		if user, ok := m.usersByUsername[v]; ok {
+			return user, nil
+		}
+		return nil, fmt.Errorf("user not found: %s", v)
+	case uint:
+		if user, ok := m.usersByID[v]; ok {
+			return user, nil
+		}
+		return nil, fmt.Errorf("user not found: %d", v)
+	default:
+		return nil, fmt.Errorf("invalid id type")
 	}
-	return nil, fmt.Errorf("user not found: %d", id)
-}
-
-func (m *mockUserBackend) GetUserByID(id uint64) (users.User, error) {
-	u, err := m.GetBy(id)
-	if err != nil {
-		return users.User{}, err
-	}
-	return *u, nil
-}
-
-func (m *mockUserBackend) GetUserByUsername(username string) (users.User, error) {
-	if user, ok := m.usersByUsername[username]; ok {
-		return *user, nil
-	}
-	return users.User{}, errors.ErrNotExist
 }

 func (m *mockUserBackend) Gets() ([]*users.User, error) {
@@ -90,7 +84,7 @@ func (m *mockUserBackend) Update(u *users.User, adminActor bool, fields ...strin
 	return nil
 }

-func (m *mockUserBackend) DeleteByID(id uint64) error {
+func (m *mockUserBackend) DeleteByID(id uint) error {
 	if user, ok := m.usersByID[id]; ok {
 		delete(m.usersByUsername, user.Username)
 		delete(m.usersByID, id)
@@ -99,8 +93,17 @@ func (m *mockUserBackend) DeleteByID(id uint64) error {
 	return fmt.Errorf("user not found: %d", id)
 }

-// setupTestUsers creates mock user persistence for timing tests.
-func setupTestUsers(t *testing.T) *mockUserBackend {
+func (m *mockUserBackend) DeleteByUsername(username string) error {
+	if user, ok := m.usersByUsername[username]; ok {
+		delete(m.usersByID, user.ID)
+		delete(m.usersByUsername, username)
+		return nil
+	}
+	return fmt.Errorf("user not found: %s", username)
+}
+
+// setupTestUsers creates a user storage with 2 valid test users
+func setupTestUsers(t *testing.T) *users.Storage {
 	t.Helper()

 	// Reduce bcrypt cost for faster tests (default is 10, min is 4)
@@ -119,20 +122,7 @@ func setupTestUsers(t *testing.T) *mockUserBackend {
 	}

 	backend := newMockUserBackend()
-	authSvc := auth.New(backend)
-	auth.SetDefault(authSvc)
-	t.Cleanup(func() {
-		auth.SetDefault(nil)
-	})
-	users.SetUsernameToID(func(username string) (uint64, error) {
-		if u, ok := backend.usersByUsername[username]; ok {
-			return u.ID, nil
-		}
-		return 0, errors.ErrNotExist
-	})
-	t.Cleanup(func() {
-		users.SetUsernameToID(nil)
-	})
+	storage := users.NewStorage(backend)

 	// Create two valid users with hashed passwords
 	password1Hash, err := utils.HashPwd("password123")
@@ -146,42 +136,38 @@ func setupTestUsers(t *testing.T) *mockUserBackend {
 	}

 	user1 := &users.User{
-		ID: 1,
-		FrontendUser: users.FrontendUser{
-			Username: "admin",
-			NonAdminEditable: users.NonAdminEditable{
-				Password: password1Hash,
-			},
-			LoginMethod: users.LoginMethodPassword,
+		ID:       1,
+		Username: "admin",
+		NonAdminEditable: users.NonAdminEditable{
+			Password: password1Hash,
 		},
+		LoginMethod: users.LoginMethodPassword,
 	}

 	user2 := &users.User{
-		ID: 2,
-		FrontendUser: users.FrontendUser{
-			Username: "testuser",
-			NonAdminEditable: users.NonAdminEditable{
-				Password: password2Hash,
-			},
-			LoginMethod: users.LoginMethodPassword,
+		ID:       2,
+		Username: "testuser",
+		NonAdminEditable: users.NonAdminEditable{
+			Password: password2Hash,
 		},
+		LoginMethod: users.LoginMethodPassword,
 	}

-	err = backend.Save(user1, false, false)
+	err = storage.Save(user1, false, false)
 	if err != nil {
 		t.Fatalf("Failed to save user1: %v", err)
 	}

-	err = backend.Save(user2, false, false)
+	err = storage.Save(user2, false, false)
 	if err != nil {
 		t.Fatalf("Failed to save user2: %v", err)
 	}

-	return backend
+	return storage
 }

 // measureAuthTime measures the time taken to authenticate with given credentials
-func measureAuthTime(t *testing.T, auther auth.JSONAuth, username, password string) time.Duration {
+func measureAuthTime(t *testing.T, auther auth.JSONAuth, userStore *users.Storage, username, password string) time.Duration {
 	t.Helper()

 	// Create a mock HTTP request
@@ -192,7 +178,7 @@ func measureAuthTime(t *testing.T, auther auth.JSONAuth, username, password stri
 	req.Header.Set("X-Password", url.QueryEscape(password))

 	start := time.Now()
-	_, _ = auther.Auth(req, nil)
+	_, _ = auther.Auth(req, userStore)
 	elapsed := time.Since(start)

 	return elapsed
@@ -200,8 +186,10 @@ func measureAuthTime(t *testing.T, auther auth.JSONAuth, username, password stri

 // TestJSONAuth_NoTimingAttack tests that authentication timing does not leak user existence
 func TestJSONAuth_NoTimingAttack(t *testing.T) {
-	setupTestUsers(t)
+	storage := setupTestUsers(t)
 	auther := auth.JSONAuth{}
+
+	// Test cases: mix of valid and invalid usernames
 	testCases := []struct {
 		username string
 		isValid  bool
@@ -227,7 +215,7 @@ func TestJSONAuth_NoTimingAttack(t *testing.T) {
 	for i := 0; i < samplesPerCase; i++ {
 		// Randomize order to avoid cache effects
 		for _, tc := range testCases {
-			elapsed := measureAuthTime(t, auther, tc.username, "wrongpassword123")
+			elapsed := measureAuthTime(t, auther, storage, tc.username, "wrongpassword123")
 			measurements[tc.username] = append(measurements[tc.username], elapsed)
 		}
 	}
@@ -11,7 +11,7 @@ import (
 	"net/http"

 	"github.com/golang-jwt/jwt/v4"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/database/users"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
 	"github.com/gtsteffaniak/go-logger/logger"
 )

@@ -13,7 +13,7 @@ import (
 	"time"

 	"github.com/golang-jwt/jwt/v4"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/auth"
+	"github.com/gtsteffaniak/filebrowser/backend/auth"
 )

 func TestVerifyExternalJWT_ValidToken(t *testing.T) {
@@ -0,0 +1,18 @@
+package auth
+
+import (
+	"net/http"
+
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+)
+
+// MethodNoAuth is used to identify no auth.
+const MethodNoAuth = "noauth"
+
+// NoAuth is no auth implementation of auther.
+type NoAuth struct{}
+
+// Auth uses authenticates user 1.
+func (a NoAuth) Auth(r *http.Request, usr *users.Storage) (*users.User, error) {
+	return usr.Get(uint(1))
+}
@@ -0,0 +1,28 @@
+package auth
+
+import (
+	"net/http"
+	"os"
+
+	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+)
+
+// MethodProxyAuth is used to identify no auth.
+const MethodProxyAuth = "proxy"
+
+// ProxyAuth is a proxy implementation of an auther.
+type ProxyAuth struct {
+	Header string `json:"header"`
+}
+
+// Auth authenticates the user via an HTTP header.
+func (a ProxyAuth) Auth(r *http.Request, usr *users.Storage) (*users.User, error) {
+	username := r.Header.Get(a.Header)
+	user, err := usr.Get(username)
+	if err == errors.ErrNotExist {
+		return nil, os.ErrPermission
+	}
+
+	return user, err
+}
@@ -5,8 +5,8 @@ import (

 	"crypto/sha256"

-	"github.com/gtsteffaniak/filebrowser/backend/pkg/settings"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/database/users"
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
 	"github.com/gtsteffaniak/go-logger/logger"
 	"golang.org/x/crypto/pbkdf2"
 )
@@ -23,8 +23,21 @@ type Storage struct {
 	users *users.Storage
 }

-// InitializeEncryption initializes the encryption key for TOTP from config
-func InitializeEncryption() error {
+// NewStorage creates a auth storage from a backend.
+func NewStorage(back StorageBackend, userStore *users.Storage) (*Storage, error) {
+	store := &Storage{back: back, users: userStore}
+	err := store.Save(&JSONAuth{})
+	if err != nil {
+		return nil, err
+	}
+	err = store.Save(&ProxyAuth{})
+	if err != nil {
+		return nil, err
+	}
+	err = store.Save(&NoAuth{})
+	if err != nil {
+		return nil, err
+	}
 	if settings.Config.Auth.TotpSecret != "" {
 		key, err := base64.StdEncoding.DecodeString(settings.Config.Auth.TotpSecret)
 		keyLen := len(key)
@@ -39,31 +52,6 @@ func InitializeEncryption() error {
 			encryptionKey = pbkdf2.Key([]byte(settings.Config.Auth.TotpSecret), salt, 4096, 32, sha256.New)
 		}
 	}
-	return nil
-}
-
-// NewStorage creates a auth storage from a backend.
-func NewStorage(back StorageBackend, userStore *users.Storage) (*Storage, error) {
-	store := &Storage{back: back, users: userStore}
-	err := store.Save(&JSONAuth{DisableOtp: true})
-	if err != nil {
-		return nil, err
-	}
-	err = store.Save(&ProxyAuth{})
-	if err != nil {
-		return nil, err
-	}
-	err = store.Save(&NoAuth{})
-	if err != nil {
-		return nil, err
-	}
-
-	// Initialize encryption key
-	err = InitializeEncryption()
-	if err != nil {
-		return nil, err
-	}
-
 	return store, nil
 }

@@ -10,8 +10,8 @@ import (
 	"strings"
 	"time"

-	"github.com/gtsteffaniak/filebrowser/backend/pkg/settings"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/database/users"
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
 	"github.com/gtsteffaniak/go-cache/cache"
 	"github.com/gtsteffaniak/go-logger/logger"
 	"github.com/pquerna/otp"
@@ -51,7 +51,7 @@ var (
 	TotpCache     = cache.NewCache[string](5 * time.Minute)
 )

-func GenerateOtpForUser(user *users.User) (string, error) {
+func GenerateOtpForUser(user *users.User, userStore *users.Storage) (string, error) {
 	// Generate a new TOTP key using the defined constants.
 	key, err := totp.Generate(totp.GenerateOpts{
 		Issuer:      IssuerName,
@@ -145,12 +145,12 @@ func decryptSecret(b64Ciphertext, b64Nonce string) (string, error) {
 	return string(plaintext), nil
 }

-func VerifyTotpCode(user *users.User, code string) error {
+func VerifyTotpCode(user *users.User, code string, userStore *users.Storage) error {
 	cachedSecret, found := TotpCache.Get(user.Username)
 	if !found && user.TOTPSecret == "" {
 		return fmt.Errorf("OTP token not found in cache, please generate a new one")
 	}
-	useCache := found
+	useCache := found && user.TOTPSecret == ""
 	totpSecret := user.TOTPSecret // The encrypted or plaintext secret
 	totpNonce := user.TOTPNonce   // The nonce if encrypted, or empty if plaintext
 	if useCache {
@@ -188,9 +188,14 @@ func VerifyTotpCode(user *users.User, code string) error {
 		return fmt.Errorf("invalid OTP token")
 	}
 	if totpSecret != "" || !user.OtpEnabled {
-		user.TOTPSecret = totpSecret
-		user.TOTPNonce = totpNonce
-		user.OtpEnabled = true
+		user.TOTPSecret = totpSecret // The encrypted or plaintext secret
+		user.TOTPNonce = totpNonce   // The nonce if encrypted, or empty if plaintext
+		user.OtpEnabled = true       // Enable OTP for the user
+		// save user
+		if err := userStore.Update(user, true, "TOTPSecret", "TOTPNonce", "OtpEnabled"); err != nil {
+			logger.Error("error updating user with OTP token:", err)
+			return fmt.Errorf("error updating user with OTP token: %w", err)
+		}
 		TotpCache.Delete(user.Username)
 	} else {
 		return fmt.Errorf("opt secret is empty, cannot enable TOTP")
@@ -12,11 +12,10 @@ import (

 	"github.com/go-webauthn/webauthn/protocol"
 	"github.com/go-webauthn/webauthn/webauthn"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/errors"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/ports"
-	"github.com/gtsteffaniak/filebrowser/backend/pkg/settings"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/utils"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/database/users"
+	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
 )

 type webAuthnSession struct {
@@ -27,15 +26,13 @@ type webAuthnSession struct {

 type WebAuthnService struct {
 	wa       *webauthn.WebAuthn
-	users    ports.UserReader
 	sessions sync.Map
 	stopCh   chan struct{}
-	originMu sync.Mutex
 }

 var webAuthnInstance *WebAuthnService

-func InitWebAuthn(users ports.UserReader) error {
+func InitWebAuthn() error {
 	cfg := &settings.Config.Auth.Methods.PasskeyAuth
 	if !cfg.Enabled {
 		webAuthnInstance = nil
@@ -54,7 +51,6 @@ func InitWebAuthn(users ports.UserReader) error {

 	webAuthnInstance = &WebAuthnService{
 		wa:     wa,
-		users:  users,
 		stopCh: make(chan struct{}),
 	}
 	go webAuthnInstance.cleanupExpiredSessions()
@@ -69,24 +65,15 @@ func IsWebAuthnEnabled() bool {
 	return webAuthnInstance != nil
 }

-// EnsureOrigin dynamically adds the given origin to the allowed RP origins list.
-// This supports self-hosted deployments where the access domain may vary.
-func (s *WebAuthnService) EnsureOrigin(origin string) {
-	s.originMu.Lock()
-	defer s.originMu.Unlock()
-	for _, o := range s.wa.Config.RPOrigins {
-		if o == origin {
-			return
+// ValidateOrigin checks if the given origin is in the configured whitelist.
+// Returns true if the origin is allowed, false otherwise.
+func (s *WebAuthnService) ValidateOrigin(origin string) bool {
+	for _, allowedOrigin := range s.wa.Config.RPOrigins {
+		if allowedOrigin == origin {
+			return true
 		}
 	}
-	s.wa.Config.RPOrigins = append(s.wa.Config.RPOrigins, origin)
-}
-
-// EnsureRPID dynamically updates the relying party ID to match the request host.
-func (s *WebAuthnService) EnsureRPID(rpID string) {
-	s.originMu.Lock()
-	defer s.originMu.Unlock()
-	s.wa.Config.RPID = rpID
+	return false
 }

 func generateSessionID() string {
@@ -97,23 +84,8 @@ func generateSessionID() string {
 	return hex.EncodeToString(b)
 }

-func (s *WebAuthnService) userByID(id uint64) (*users.User, error) {
-	if s.users == nil {
-		return nil, errors.ErrNotExist
-	}
-	u, err := s.users.GetUserByID(id)
-	if err != nil {
-		return nil, err
-	}
-	return &u, nil
-}
-
-func (s *WebAuthnService) BeginMFALogin(username, password string, rpID string) (sessionID string, assertion *protocol.CredentialAssertion, err error) {
-	id, resErr := users.ResolveUsernameToID(username)
-	if resErr != nil {
-		return "", nil, resErr
-	}
-	user, getErr := s.userByID(id)
+func (s *WebAuthnService) BeginMFALogin(username, password string, rpID string, userStore *users.Storage) (sessionID string, assertion *protocol.CredentialAssertion, err error) {
+	user, getErr := userStore.Get(username)
 	passwordHash := utils.InvalidPasswordHash
 	if getErr == nil {
 		passwordHash = user.Password
@@ -142,14 +114,14 @@ func (s *WebAuthnService) BeginMFALogin(username, password string, rpID string)
 	sessionID = generateSessionID()
 	s.sessions.Store(sessionID, &webAuthnSession{
 		SessionData: sessionData,
-		UserID:      uint(user.ID),
+		UserID:      user.ID,
 		ExpiresAt:   time.Now().Add(5 * time.Minute),
 	})

 	return sessionID, assertion, nil
 }

-func (s *WebAuthnService) FinishMFALogin(sessionID string, r *http.Request) (*users.User, error) {
+func (s *WebAuthnService) FinishMFALogin(sessionID string, r *http.Request, userStore *users.Storage) (*users.User, error) {
 	sessionVal, ok := s.sessions.Load(sessionID)
 	if !ok {
 		return nil, errors.ErrPasskeyInvalidSession
@@ -164,7 +136,7 @@ func (s *WebAuthnService) FinishMFALogin(sessionID string, r *http.Request) (*us
 		return nil, errors.ErrPasskeyInvalidSession
 	}

-	user, err := s.userByID(uint64(sess.UserID))
+	user, err := userStore.Get(sess.UserID)
 	if err != nil {
 		return nil, fmt.Errorf("user not found: %w", err)
 	}
@@ -178,6 +150,9 @@ func (s *WebAuthnService) FinishMFALogin(sessionID string, r *http.Request) (*us
 	for i := range user.PasskeyCredentials {
 		if user.PasskeyCredentials[i].ID == credB64 {
 			users.UpdateCredentialFromLibrary(&user.PasskeyCredentials[i], credential)
+			if err := userStore.Update(user, false, "PasskeyCredentials"); err != nil {
+				return nil, fmt.Errorf("failed to update credential: %w", err)
+			}
 			return user, nil
 		}
 	}
@@ -198,7 +173,7 @@ func (s *WebAuthnService) BeginRegistration(user *users.User, rpID string) (sess
 	sessionID = generateSessionID()
 	s.sessions.Store(sessionID, &webAuthnSession{
 		SessionData: sessionData,
-		UserID:      uint(user.ID),
+		UserID:      user.ID,
 		ExpiresAt:   time.Now().Add(5 * time.Minute),
 	})

@@ -220,7 +195,7 @@ func (s *WebAuthnService) FinishRegistration(user *users.User, sessionID string,
 		return errors.ErrPasskeyInvalidSession
 	}

-	if sess.UserID != uint(user.ID) {
+	if sess.UserID != user.ID {
 		return errors.ErrUnauthorized
 	}

@@ -278,8 +253,8 @@ func (s *WebAuthnService) cleanupExpiredSessions() {
 func deriveWebAuthnConfig(cfg *settings.PasskeyAuthConfig) (*webauthn.Config, error) {
 	rpID := cfg.RPID
 	if rpID == "" {
-		if settings.Config.Http.ExternalUrl != "" {
-			if u, err := url.Parse(settings.Config.Http.ExternalUrl); err == nil {
+		if settings.Config.Server.ExternalUrl != "" {
+			if u, err := url.Parse(settings.Config.Server.ExternalUrl); err == nil {
 				rpID = u.Hostname()
 			}
 		}
@@ -298,11 +273,11 @@ func deriveWebAuthnConfig(cfg *settings.PasskeyAuthConfig) (*webauthn.Config, er

 	origins := cfg.RPOrigins
 	if len(origins) == 0 {
-		if settings.Config.Http.ExternalUrl != "" {
-			origins = append(origins, settings.Config.Http.ExternalUrl)
+		if settings.Config.Server.ExternalUrl != "" {
+			origins = append(origins, settings.Config.Server.ExternalUrl)
 		}
-		if settings.Config.Http.InternalUrl != "" && settings.Config.Http.InternalUrl != settings.Config.Http.ExternalUrl {
-			origins = append(origins, settings.Config.Http.InternalUrl)
+		if settings.Config.Server.InternalUrl != "" && settings.Config.Server.InternalUrl != settings.Config.Server.ExternalUrl {
+			origins = append(origins, settings.Config.Server.InternalUrl)
 		}
 		if len(origins) == 0 {
 			origins = append(origins, "http://localhost")
@@ -310,9 +285,9 @@ func deriveWebAuthnConfig(cfg *settings.PasskeyAuthConfig) (*webauthn.Config, er
 	}

 	return &webauthn.Config{
-		RPID:                  rpID,
-		RPDisplayName:         displayName,
-		RPOrigins:             origins,
+		RPID:          rpID,
+		RPDisplayName: displayName,
+		RPOrigins:     origins,
 		AttestationPreference: protocol.PreferNoAttestation,
 		AuthenticatorSelection: protocol.AuthenticatorSelection{
 			UserVerification: protocol.VerificationPreferred,
@@ -4,23 +4,27 @@ import (
 	"fmt"
 	"strings"

-	"github.com/gtsteffaniak/filebrowser/backend/internal/errors"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/state"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/utils"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/database/access"
-	"github.com/gtsteffaniak/filebrowser/backend/pkg/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/database/access"
 	"github.com/gtsteffaniak/go-logger/logger"
 )

 // validateAccessRules migrates old-style access rules (without trailing slashes) to new format
 func validateAccessRules() {
+	if store.Access == nil {
+		return
+	}
+	// Get all sources
 	for sourcePath := range settings.Config.Server.SourceMap {
-		rules, err := state.GetAllRules(sourcePath)
+		// Get all rules for this source
+		rules, err := store.Access.GetAllRules(sourcePath)
 		if err != nil {
 			logger.Errorf("Failed to get access rules for source %s: %v", sourcePath, err)
 			continue
 		}

+		// Check if there are any rules that need migration
 		needsMigration := false
 		for oldPath := range rules {
 			if oldPath != "/" && !strings.HasSuffix(oldPath, "/") {
@@ -35,55 +39,78 @@ func validateAccessRules() {

 		migratedCount := 0
 		for oldPath, rule := range rules {
+			// Check if this path needs migration (doesn't have trailing slash and isn't root)
 			if oldPath != "/" && !strings.HasSuffix(oldPath, "/") {
+				// Create the new path with trailing slash
 				newPath := oldPath + "/"

-				if err := migrateAccessRule(sourcePath, newPath, rule); err != nil {
+				// Migrate the rule to the new path
+				if err := migrateAccessRule(sourcePath, oldPath, newPath, rule); err != nil {
 					logger.Errorf("Failed to migrate rule from %s to %s: %v", oldPath, newPath, err)
 					continue
 				}

-				state.RemoveRuleByPathKey(sourcePath, oldPath)
+				// Remove the old rule
+				if err := removeOldAccessRule(sourcePath, oldPath); err != nil {
+					logger.Errorf("Failed to remove old rule %s: %v", oldPath, err)
+					continue
+				}
+
 				migratedCount++
 			}
 		}

+		// After migration, clear cache
 		if migratedCount > 0 {
 			logger.Infof("Migrated %d access rules for source %s", migratedCount, sourcePath)
 		}
 	}
 }

-func migrateAccessRule(sourcePath, newPath string, rule access.FrontendAccessRule) error {
+// migrateAccessRule creates a new access rule with the new path format
+func migrateAccessRule(sourcePath, oldPath, newPath string, rule access.FrontendAccessRule) error {
+	// Add deny users
 	for _, user := range rule.Deny.Users {
-		if err := state.DenyUser(sourcePath, utils.IndexPathFromNormalized(newPath, true), user); err != nil && err != errors.ErrExist {
+		if err := store.Access.DenyUser(sourcePath, newPath, user); err != nil && err != errors.ErrExist {
 			return fmt.Errorf("failed to add deny user %s: %w", user, err)
 		}
 	}

+	// Add deny groups
 	for _, group := range rule.Deny.Groups {
-		if err := state.DenyGroup(sourcePath, utils.IndexPathFromNormalized(newPath, true), group); err != nil && err != errors.ErrExist {
+		if err := store.Access.DenyGroup(sourcePath, newPath, group); err != nil && err != errors.ErrExist {
 			return fmt.Errorf("failed to add deny group %s: %w", group, err)
 		}
 	}

+	// Add allow users
 	for _, user := range rule.Allow.Users {
-		if err := state.AllowUser(sourcePath, utils.IndexPathFromNormalized(newPath, true), user); err != nil && err != errors.ErrExist {
+		if err := store.Access.AllowUser(sourcePath, newPath, user); err != nil && err != errors.ErrExist {
 			return fmt.Errorf("failed to add allow user %s: %w", user, err)
 		}
 	}

+	// Add allow groups
 	for _, group := range rule.Allow.Groups {
-		if err := state.AllowGroup(sourcePath, utils.IndexPathFromNormalized(newPath, true), group); err != nil && err != errors.ErrExist {
+		if err := store.Access.AllowGroup(sourcePath, newPath, group); err != nil && err != errors.ErrExist {
 			return fmt.Errorf("failed to add allow group %s: %w", group, err)
 		}
 	}

+	// Add deny all rule if needed
 	if rule.DenyAll {
-		if err := state.DenyAll(sourcePath, utils.IndexPathFromNormalized(newPath, true)); err != nil && err != errors.ErrExist {
+		if err := store.Access.DenyAll(sourcePath, newPath); err != nil && err != errors.ErrExist {
 			return fmt.Errorf("failed to add deny all rule: %w", err)
 		}
 	}

 	return nil
 }
+
+// removeOldAccessRule removes the old access rule by directly accessing the internal storage
+func removeOldAccessRule(sourcePath, oldPath string) error {
+	// Access the internal storage directly to remove the old rule
+	// We need to use the unnormalized path since that's how it was stored originally
+	store.Access.RemoveRuleByPath(sourcePath, oldPath)
+	return nil
+}
@@ -1,224 +0,0 @@
-package cmd
-
-import (
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/gtsteffaniak/filebrowser/backend/internal/app"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/database/users"
-	"github.com/gtsteffaniak/filebrowser/backend/pkg/settings"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/state"
-)
-
-func TestAdminHasSharePermissionAfterPlaywrightStartup(t *testing.T) {
-	t.Setenv("FILEBROWSER_ONLYOFFICE_SECRET", "")
-	sharingConfig := "../../_docker/src/sharing/backend/config.yaml"
-	settings.Initialize(sharingConfig)
-	settings.Env.IsPlaywright = true
-
-	dbPath := filepath.Join(t.TempDir(), "filebrowser.sqlite")
-	_, err := state.Initialize(dbPath)
-	if err != nil {
-		t.Fatal(err)
-	}
-	app.MustWireServices(state.Default())
-	t.Cleanup(func() { _ = state.Close() })
-
-	validateUserInfo(true)
-
-	admin, err := state.GetUserByUsername("admin")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !admin.Permissions.Share {
-		t.Fatalf("admin Share=false after validateUserInfo; perms=%+v", admin.Permissions)
-	}
-	if !admin.Permissions.Admin {
-		t.Fatalf("admin Admin=false; perms=%+v", admin.Permissions)
-	}
-
-	_ = state.Close()
-	_, err = state.Initialize(dbPath)
-	if err != nil {
-		t.Fatal(err)
-	}
-	app.MustWireServices(state.Default())
-	admin, err = state.GetUserByUsername("admin")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !admin.Permissions.Share {
-		t.Fatalf("admin Share=false after DB reload; perms=%+v", admin.Permissions)
-	}
-}
-
-func TestAdminHasSharePermissionAfterSettingsMigration(t *testing.T) {
-	t.Setenv("FILEBROWSER_ONLYOFFICE_SECRET", "")
-	settings.Initialize(settingsMigrationConfigPath(t))
-	settings.Env.IsPlaywright = true
-	alignSettingsSourcesForMigrationFixture(t)
-
-	dbPath := filepath.Join(t.TempDir(), "filebrowser.sqlite")
-	settings.Config.Server.DatabaseV2.Path = dbPath
-	settings.Config.Server.DatabaseV2.MigrateFrom = settingsMigrationBoltPath(t)
-
-	if err := migrateFromBoltToSQLite(); err != nil {
-		t.Fatal(err)
-	}
-
-	_, err := state.Initialize(dbPath)
-	if err != nil {
-		t.Fatal(err)
-	}
-	app.MustWireServices(state.Default())
-	t.Cleanup(func() { _ = state.Close() })
-
-	validateUserInfo(false)
-
-	admin, err := state.GetUserByUsername("admin")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !admin.Permissions.Share {
-		t.Fatalf("admin Share=false after settings migration; perms=%+v", admin.Permissions)
-	}
-	assertSourceSidebarLinkCount(t, &admin, 3)
-}
-
-func TestGrahamGainsAccessAfterSettingsMigrationStartup_dockerSourcePaths(t *testing.T) {
-	t.Setenv("FILEBROWSER_ONLYOFFICE_SECRET", "")
-	configPath := filepath.Join(t.TempDir(), "config.yaml")
-	configYAML := `server:
-  sources:
-    - path: "/app/frontend/tests/playwright-files"
-      name: "playwright + files"
-      config:
-        defaultEnabled: true
-    - path: "/app/backend"
-      name: "docker"
-      config:
-        defaultEnabled: true
-    - path: "/tests/playwright-files"
-      name: "access"
-      config:
-        defaultEnabled: true
-        denyByDefault: true
-auth:
-  methods:
-    password:
-      enabled: true
-`
-	if err := os.WriteFile(configPath, []byte(configYAML), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	settings.Initialize(configPath)
-	settings.Env.IsPlaywright = true
-
-	dbPath := filepath.Join(t.TempDir(), "filebrowser.sqlite")
-	settings.Config.Server.DatabaseV2.Path = dbPath
-	settings.Config.Server.DatabaseV2.MigrateFrom = settingsMigrationBoltPath(t)
-	if err := migrateFromBoltToSQLite(); err != nil {
-		t.Fatal(err)
-	}
-
-	_, err := state.Initialize(dbPath)
-	if err != nil {
-		t.Fatal(err)
-	}
-	app.MustWireServices(state.Default())
-	t.Cleanup(func() { _ = state.Close() })
-
-	validateUserInfo(false)
-
-	graham, err := state.GetUserByUsername("graham")
-	if err != nil {
-		t.Fatal(err)
-	}
-	foundScope := false
-	for _, scope := range graham.BackendScopes {
-		if scope.Path == fixtureAccessSource {
-			foundScope = true
-			break
-		}
-	}
-	if !foundScope {
-		t.Fatalf("graham should gain access scope after validateUserInfo: %#v", graham.BackendScopes)
-	}
-	foundLink := false
-	for _, link := range graham.SidebarLinks {
-		if link.Name == "access" || link.SourceName == fixtureAccessSource {
-			foundLink = true
-			break
-		}
-	}
-	if !foundLink {
-		t.Fatalf("graham should have access sidebar link after validateUserInfo: %#v", graham.SidebarLinks)
-	}
-}
-
-func TestGrahamGainsAccessAfterSettingsMigrationStartup(t *testing.T) {
-	t.Setenv("FILEBROWSER_ONLYOFFICE_SECRET", "")
-	settings.Initialize(settingsMigrationConfigPath(t))
-	settings.Env.IsPlaywright = true
-	alignSettingsSourcesForMigrationFixture(t)
-
-	dbPath := filepath.Join(t.TempDir(), "filebrowser.sqlite")
-	settings.Config.Server.DatabaseV2.Path = dbPath
-	settings.Config.Server.DatabaseV2.MigrateFrom = settingsMigrationBoltPath(t)
-	if err := migrateFromBoltToSQLite(); err != nil {
-		t.Fatal(err)
-	}
-
-	_, err := state.Initialize(dbPath)
-	if err != nil {
-		t.Fatal(err)
-	}
-	app.MustWireServices(state.Default())
-	t.Cleanup(func() { _ = state.Close() })
-
-	validateUserInfo(false)
-
-	graham, err := state.GetUserByUsername("graham")
-	if err != nil {
-		t.Fatal(err)
-	}
-	foundScope := false
-	for _, scope := range graham.BackendScopes {
-		if scope.Path == fixtureAccessSource {
-			foundScope = true
-			break
-		}
-	}
-	if !foundScope {
-		t.Fatalf("graham should gain access scope after validateUserInfo: %#v", graham.BackendScopes)
-	}
-	foundLink := false
-	for _, link := range graham.SidebarLinks {
-		if link.Name == "access" || link.SourceName == fixtureAccessSource {
-			foundLink = true
-			break
-		}
-	}
-	if !foundLink {
-		t.Fatalf("graham should have access sidebar link after validateUserInfo: %#v", graham.SidebarLinks)
-	}
-	if len(graham.SidebarLinks) == 0 {
-		t.Fatal("graham should have sidebar links after migration so frontend does not fall back to all sources")
-	}
-}
-
-func assertSourceSidebarLinkCount(t *testing.T, user *users.User, want int) {
-	t.Helper()
-	count := 0
-	for _, link := range user.SidebarLinks {
-		if strings.HasPrefix(link.Category, "source") {
-			count++
-		}
-	}
-	if count != want {
-		t.Fatalf("user %q has %d source sidebar links, want %d: %v",
-			user.Username, count, want, user.SidebarLinks)
-	}
-}
@@ -2,6 +2,7 @@ package cmd

 import (
 	"bufio"
+	"flag"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -9,12 +10,11 @@ import (
 	"strings"

 	"github.com/goccy/go-yaml"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/adapters/fs/files"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/database/users"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/state"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/utils"
-	"github.com/gtsteffaniak/filebrowser/backend/pkg/indexing/iteminfo"
-	"github.com/gtsteffaniak/filebrowser/backend/pkg/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/common/version"
+	"github.com/gtsteffaniak/filebrowser/backend/database/storage"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+	"github.com/gtsteffaniak/filebrowser/backend/indexing/iteminfo"
 	"github.com/gtsteffaniak/go-logger/logger"
 )

@@ -22,44 +22,169 @@ var (
 	configPath string
 )

-func setRule(backendSourcePath, indexPath, ruleCategory, value string, allow bool) error {
-	if backendSourcePath == "" {
-		return fmt.Errorf("backend source path is missing; check --source / -s")
+// return bool to indicate if the program should continue running
+func runCLI() (bool, bool) {
+
+	generateYaml()
+
+	// Global flags
+	var help bool
+	// Override the default usage output to use generalUsage()
+	flag.Usage = generalUsage
+	flag.StringVar(&configPath, "c", "", "Path to the config file, default: config.yaml")
+	flag.BoolVar(&help, "h", false, "Get help about commands")
+
+	if configPath == "" {
+		configPath = os.Getenv("FILEBROWSER_CONFIG")
+		// backwards compatibility in docker, prefer config.yaml if it exists
+		if configPath != "" {
+			_, err := os.Stat(configPath)
+			if err != nil {
+				logger.Fatalf("config file %v does not exist, please create it or set the FILEBROWSER_CONFIG environment variable to a valid config file path", configPath)
+			}
+		} else {
+			configPath = "config.yaml"
+		}
+	}
+
+	// Parse global flags (before subcommands)
+	flag.Parse() // print generalUsage on error
+
+	// Show help if requested
+	if help {
+		generalUsage()
+		return false, false
+	}
+
+	// Create a new FlagSet for the 'set' subcommand
+	setCmd := flag.NewFlagSet("set", flag.ExitOnError)
+	var user, dbConfig string
+	var asAdmin bool
+	var sourceName, indexPath, ruleCategory, value string
+	var allow bool
+
+	setCmd.StringVar(&user, "u", "", "Comma-separated username and password: \"set -u <username>,<password>\"")
+	setCmd.BoolVar(&asAdmin, "a", false, "Create a user as admin user, used in combination with -u")
+	setCmd.StringVar(&dbConfig, "c", "config.yaml", "Path to the config file, default: config.yaml")
+	setCmd.StringVar(&sourceName, "s", "", "source name to apply the rule to")
+	setCmd.StringVar(&indexPath, "p", "", "Index path (e.g. /secret) for rule command")
+	setCmd.StringVar(&ruleCategory, "r", "", "Rule category: 'user', 'group', or 'all' (for deny only)")
+	setCmd.StringVar(&value, "v", "", "Value: username or groupname (not required if ruleCategory is 'all')")
+	setCmd.BoolVar(&allow, "allow", false, "Allow access (default: false, which means deny)")
+
+	storeCfg := configPath
+	cliSubcmd := ""
+	var setKind string
+
+	if len(os.Args) > 1 {
+		switch os.Args[1] {
+		case "version":
+			fmt.Printf(`FileBrowser Quantum - A modern web-based file manager
+	Version 	 : %v
+	Commit 		 : %v
+	Release Info 	 : https://github.com/gtsteffaniak/filebrowser/releases/tag/%v
+`, version.Version, version.CommitSHA, version.Version)
+			return false, false
+		case "setup":
+			cliSubcmd = "setup"
+		case "set":
+			cliSubcmd = "set"
+			if len(os.Args) < 3 {
+				fmt.Printf("error: missing subcommand for 'set'. Use 'set user' or 'set rule'\n")
+				os.Exit(1)
+			}
+			setKind = os.Args[2]
+			var err error
+			// Handle old syntax: "set -u user,pass -c config.yaml"
+			if setKind == "-u" {
+				err = setCmd.Parse(os.Args[2:])
+			} else {
+				// New pattern: subcommand-based (e.g., "set user" or "set rule")
+				err = setCmd.Parse(os.Args[3:])
+			}
+			if err != nil {
+				setCmd.PrintDefaults()
+				os.Exit(1)
+			}
+			storeCfg = dbConfig
+		}
+	}
+
+	switch cliSubcmd {
+	case "setup":
+		createConfig(configPath)
+		return false, false
+	case "set":
+		if setKind == "-u" {
+			dbExists := getStore(storeCfg)
+			logger.Debugf("setUser called with args: %v, config: %v, admin: %v", os.Args, dbConfig, asAdmin)
+			err := setUser(dbConfig, asAdmin)
+			if err != nil {
+				fmt.Printf("error: %v\n", err)
+				os.Exit(1)
+			}
+			return false, dbExists
+		}
+		switch setKind {
+		case "rule":
+			dbExists := getStore(storeCfg)
+			sourceInfo, ok := settings.Config.Server.NameToSource[sourceName] // backend source is path
+			if !ok {
+				fmt.Printf("error: invalid source name: %s\n", sourceName)
+				os.Exit(1)
+			}
+			err := setRule(dbConfig, sourceInfo.Path, indexPath, ruleCategory, value, allow)
+			if err != nil {
+				fmt.Printf("error: %v\n", err)
+				os.Exit(1)
+			}
+			return false, dbExists
+		default:
+			fmt.Printf("error: unknown subcommand '%s' for 'set'. Use 'set user' or 'set rule'\n", setKind)
+			os.Exit(1)
+		}
+		return false, false
+	default:
+		dbExists := getStore(storeCfg)
+		return true, dbExists
+	}
+}
+
+func setRule(dbConfig, fsPath, indexPath, ruleCategory, value string, allow bool) error {
+	// Validate required parameters
+	if fsPath == "" {
+		return fmt.Errorf("real filesystem path is required: use -f <fsPath>")
 	}
 	if indexPath == "" {
-		return fmt.Errorf("--path / -p is required (index path within the source, e.g. /)")
+		return fmt.Errorf("index path is required: use -p <indexPath>")
 	}
 	if ruleCategory == "" {
-		return fmt.Errorf("role is required: use --role / -r <user|group|all>")
+		return fmt.Errorf("ruleCategory is required: use -r <user|group|all>")
 	}
 	if ruleCategory != "all" && value == "" {
-		return fmt.Errorf("value is required when role is 'user' or 'group': use --value / -v <username|groupname>")
+		return fmt.Errorf("value is required when ruleCategory is 'user' or 'group': use -v <username|groupname>")
 	}
-
-	parsedPath, err := utils.ParseSanitizedIndexPath(indexPath, true)
-	if err != nil {
-		return err
-	}
-
+	// Apply the rule based on allow flag and ruleCategory
+	var err error
 	if allow {
 		switch ruleCategory {
 		case "user":
-			err = state.AllowUser(backendSourcePath, parsedPath, value)
+			err = store.Access.AllowUser(fsPath, indexPath, value)
 		case "group":
-			err = state.AllowGroup(backendSourcePath, parsedPath, value)
+			err = store.Access.AllowGroup(fsPath, indexPath, value)
 		default:
-			return fmt.Errorf("invalid role for allow: must be 'user' or 'group'")
+			return fmt.Errorf("invalid ruleCategory for allow: must be 'user' or 'group'")
 		}
 	} else {
 		switch ruleCategory {
 		case "user":
-			err = state.DenyUser(backendSourcePath, parsedPath, value)
+			err = store.Access.DenyUser(fsPath, indexPath, value)
 		case "group":
-			err = state.DenyGroup(backendSourcePath, parsedPath, value)
+			err = store.Access.DenyGroup(fsPath, indexPath, value)
 		case "all":
-			err = state.DenyAll(backendSourcePath, parsedPath)
+			err = store.Access.DenyAll(fsPath, indexPath)
 		default:
-			return fmt.Errorf("invalid role: must be 'user', 'group', or 'all'")
+			return fmt.Errorf("invalid ruleCategory: must be 'user', 'group', or 'all'")
 		}
 	}

@@ -72,31 +197,42 @@ func setRule(backendSourcePath, indexPath, ruleCategory, value string, allow boo
 		action = "allow"
 	}
 	if ruleCategory == "all" {
-		fmt.Printf("successfully added %s rule for all users on index path '%s' in filesystem path '%s'\n", action, indexPath, backendSourcePath)
+		fmt.Printf("successfully added %s rule for all users on index path '%s' in filesystem path '%s'\n", action, indexPath, fsPath)
 	} else {
-		fmt.Printf("successfully added %s rule for %s '%s' on index path '%s' in filesystem path '%s'\n", action, ruleCategory, value, indexPath, backendSourcePath)
+		fmt.Printf("successfully added %s rule for %s '%s' on index path '%s' in filesystem path '%s'\n", action, ruleCategory, value, indexPath, fsPath)
 	}
 	return nil
 }

-func setUser(username, password string, asAdmin bool) error {
-	user, err := state.GetUserByUsername(username)
+func setUser(dbConfig string, asAdmin bool) error {
+	if len(os.Args) < 4 {
+		return fmt.Errorf("missing username and password for 'set user'. Use 'set -u username,password'")
+	}
+	userInfo := strings.Split(os.Args[3], ",")
+	if len(userInfo) < 2 {
+		return fmt.Errorf("not enough info to create user: \"set -u username,password\", only provided %v", userInfo)
+	}
+	username := userInfo[0]
+	password := userInfo[1]
+	user, err := store.Users.Get(username)
 	if err != nil {
 		newUser := users.User{
-			FrontendUser: users.FrontendUser{
-				Username:    username,
-				LoginMethod: users.LoginMethodPassword,
+			Username:    username,
+			LoginMethod: users.LoginMethodPassword,
+			NonAdminEditable: users.NonAdminEditable{
+				Password: password,
 			},
 		}
 		for _, source := range settings.Config.Server.SourceMap {
 			if source.Config.DefaultEnabled {
-				newUser.BackendScopes = append(newUser.BackendScopes, users.BackendScope{
-					Path:  source.Path,
+				newUser.Scopes = append(newUser.Scopes, users.SourceScope{
+					Name:  source.Path,
 					Scope: source.Config.DefaultUserScope,
 				})
 			}
 		}

+		// Create the user logic
 		if asAdmin {
 			logger.Infof("Creating user as admin: %s\n", username)
 		} else {
@@ -104,29 +240,28 @@ func setUser(username, password string, asAdmin bool) error {
 		}
 		newUser.Permissions = settings.ConvertPermissionsToUsers(settings.Config.UserDefaults.Account.Permissions)
 		newUser.Permissions.Admin = asAdmin
-		err = state.CreateUser(&newUser, password)
+		err = storage.CreateUser(newUser, newUser.Permissions)
 		if err != nil {
 			return fmt.Errorf("could not create user: %v", err)
 		}
-		if dirErr := files.MakeUserDirs(&newUser, true); dirErr != nil {
-			logger.Error(dirErr.Error())
-		}
 		fmt.Printf("successfully created user")
 		return nil
 	}
 	if user.LoginMethod != users.LoginMethodPassword {
 		return fmt.Errorf("user %s is not allowed to login with password authentication, cannot set password", username)
 	}
-	user.TOTPSecret = ""
-	user.TOTPNonce = ""
+	user.Password = password
+	user.TOTPSecret = "" // reset TOTP secret if it exists
+	user.TOTPNonce = ""  // reset TOTP nonce if it exists
 	user.LoginMethod = users.LoginMethodPassword
 	if asAdmin {
 		user.Permissions.Admin = true
 	}
+	// Ensure version is set for existing users being updated
 	if user.Version == 0 {
 		user.Version = users.CurrentUserMigrationVersion
 	}
-	err = state.UpdateUser(&user, password, "password", "totpSecret", "totpNonce", "loginMethod", "permissions", "version")
+	err = store.Users.Save(user, true, false)
 	if err != nil {
 		return fmt.Errorf("could not update user: %v", err)
 	}
@@ -134,27 +269,8 @@ func setUser(username, password string, asAdmin bool) error {
 	return nil
 }

-func promoteUser(username string) error {
-	user, err := state.GetUserByUsername(username)
-	if err != nil {
-		return fmt.Errorf("user %s not found", username)
-	}
-	if user.Permissions.Admin {
-		fmt.Printf("user %s is already an admin\n", username)
-		return nil
-	}
-	user.Permissions.Admin = true
-	if user.Version == 0 {
-		user.Version = users.CurrentUserMigrationVersion
-	}
-	err = state.UpdateUser(&user, "", "permissions")
-	if err != nil {
-		return fmt.Errorf("could not promote user: %v", err)
-	}
-	fmt.Printf("successfully promoted user to admin: %s\n", username)
-	return nil
-}
-
+// askQuestion displays a prompt and reads a line of input from the user.
+// It returns the defaultValue if the user's input is empty.
 func askQuestion(reader *bufio.Reader, prompt string, defaultValue string) string {
 	fmt.Printf("%s (default: %s): ", prompt, defaultValue)
 	input, _ := reader.ReadString('\n')
@@ -165,6 +281,9 @@ func askQuestion(reader *bufio.Reader, prompt string, defaultValue string) strin
 	return input
 }

+// askYesNoQuestion prompts the user with a yes/no question and returns a boolean.
+// It retries until valid input ("yes", "y", "no", "n") is received.
+// The defaultValue must be "yes" or "no".
 func askYesNoQuestion(reader *bufio.Reader, prompt string, defaultValue string) bool {
 	for {
 		answer := askQuestion(reader, prompt, defaultValue)
@@ -179,45 +298,43 @@ func askYesNoQuestion(reader *bufio.Reader, prompt string, defaultValue string)
 	}
 }

-func createConfig(configpath string, noInput bool) error {
-	if noInput {
-		return fmt.Errorf("'setup' requires interactive input; rerun without --no-input")
-	}
-
+// createConfig orchestrates the configuration process by asking the user a series of questions.
+func createConfig(configpath string) {
 	reader := bufio.NewReader(os.Stdin)
 	config := settings.SetDefaults(false)
 	config.Server.Sources = []*settings.Source{{Path: "./"}}

-	if configpath == "" {
-		configpath = "config.yaml"
-	}
-
 	fmt.Println("--- Starting Configuration Setup ---")
 	realPath := ""
+	// 1. Ask for the source filesystem path (with validation)
 	for {
 		config.Server.Sources[0].Path = askQuestion(reader, "What is the source filesystem path?", "./")
+		// Convert relative path to absolute path
 		absolutePath, err := filepath.Abs(config.Server.Sources[0].Path)
 		if err == nil {
 			var isDir bool
+			// Resolve symlinks and get the real path
 			realPath, isDir, _ = iteminfo.ResolveSymlinks(absolutePath)
 			if realPath != "" && isDir {
-				break
+				break // Valid path found, exit loop
 			}
 		}
 		fmt.Printf("Error: The path '%s' does not exist or isn't valid. Please try again.\n", config.Server.Sources[0].Path)
 	}
+	// 2. Ask for the source name
 	defaultSourceName := filepath.Base(realPath)
 	sourceName := askQuestion(reader, "What should the first source name be?", defaultSourceName)
 	if sourceName != defaultSourceName {
 		config.Server.Sources[0].Name = sourceName
 	}

+	// 3. Ask for server port (with validation)
 	for {
 		portStr := askQuestion(reader, "What port should the server listen on?", "80")
 		port, err := strconv.Atoi(portStr)
 		if err == nil && (port >= 1 && port <= 65535) {
-			config.Http.Port = port
-			break
+			config.Server.Port = port
+			break // Port is valid, exit loop
 		}
 		fmt.Printf("Error: '%s' is not a valid port. Please enter a number between 1 and 65535.\n", portStr)
 	}
@@ -238,54 +355,53 @@ func createConfig(configpath string, noInput bool) error {
 	}

 	for {
-		// "database.db" is the reserved legacy-bolt filename and is rejected
-		// at startup (see backend/cmd/migrate.go), so the wizard must not
-		// suggest it as the default.
-		config.Server.DatabaseV2.Path = askQuestion(reader, "What should the file name and path be for the database?", "./filebrowser.sqlite")
-		if strings.HasSuffix(config.Server.DatabaseV2.Path, ".sqlite") {
-			break
+		config.Server.Database = askQuestion(reader, "What should the file name and path be for the database?", "./database.db")
+		if strings.HasSuffix(config.Server.Database, ".db") {
+			break // Valid path found, exit loop
 		}
-		fmt.Printf("Error: '%s' is not a valid path. Please enter a path to a file ending in .sqlite", config.Server.DatabaseV2.Path)
+		fmt.Printf("Error: '%s' is not a valid path. Please enter a path to a file ending in .db", config.Server.Database)
 	}
+	// 4. Ask for the application brand name
 	config.Frontend.Name = askQuestion(reader, "What should the application brand name be?", "FileBrowser Quantum")
+
+	// 5. Ask for admin username and password
 	config.Auth.AdminUsername = askQuestion(reader, "What should the default admin username be?", "admin")
 	config.Auth.AdminPassword = askQuestion(reader, "What should the default admin password be?", "admin")

-	modifyDefault := askYesNoQuestion(reader, "Should a new user be able to modify content by default?", "no")
-	config.Server.Sources[0].Config.DefaultPermissions = settings.NormalizeSourceFilePermissions(users.SourceFilePermissions{
-		View:     true,
-		Download: true,
-		Modify:   modifyDefault,
-		Create:   modifyDefault,
-		Delete:   modifyDefault,
-	})
+	// 6. Ask boolean (Yes/No) questions using the helper
+	config.UserDefaults.Account.Permissions.Modify = askYesNoQuestion(reader, "Should a new user be able to modify content by default?", "no")
 	config.UserDefaults.Account.Permissions.Share = askYesNoQuestion(reader, "Should a new user be able to create shares by default?", "no")

 	fmt.Println("--- 	Configuration Complete 	---")

+	// marshall yaml and write to file
+	// Marshal the struct to YAML bytes
 	yamlData, err := yaml.Marshal(&config)
 	if err != nil {
-		return fmt.Errorf("marshaling config: %w", err)
+		return
 	}

-	err = os.WriteFile(configpath, yamlData, 0600)
+	// Write the YAML data to the file
+	err = os.WriteFile("config.yaml", yamlData, 0644) // 0644 provides read/write for owner, read for others
 	if err != nil {
-		return fmt.Errorf("writing config file: %w", err)
+		return
 	}
-	if _, err := os.Stat(config.Server.DatabaseV2.Path); err == nil {
+	// cleanup database if it exists
+	if _, err := os.Stat(config.Server.Database); err == nil {
 		response := askYesNoQuestion(reader, "Database specified already exists. Move database file to backup to start fresh?", "no")
 		if !response {
-			return nil
+			return
 		}
-		backupPath := config.Server.DatabaseV2.Path + ".bak"
-		err = os.Rename(config.Server.DatabaseV2.Path, backupPath)
+		// move database file to backup
+		backupPath := config.Server.Database + ".bak"
+		err = os.Rename(config.Server.Database, backupPath)
 		if err != nil {
 			fmt.Printf("Error moving database file to backup: %v\n", err)
 		} else {
 			fmt.Printf("Database file moved to backup: %s\n", backupPath)
 		}
 	}
-	return nil
+
 }

 func generateYaml() {
@@ -298,6 +414,7 @@ func generateYaml() {
 	if generateConfig {
 		os.Exit(0)
 	}
+
 }

 func SplitByMultiple(str string) []string {
@@ -1,185 +0,0 @@
-package cmd
-
-import (
-	"bytes"
-	"io"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/alecthomas/kong"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func freshCLI() cliRoot {
-	return cliRoot{}
-}
-
-func newCLIParser(t *testing.T, cli *cliRoot) *kong.Kong {
-	t.Helper()
-	parser, err := kong.New(cli, kong.Name("filebrowser"), kong.Bind(&cli.Globals))
-	require.NoError(t, err)
-	return parser
-}
-
-func TestParseDefaultServerCommand(t *testing.T) {
-	cli := freshCLI()
-	parser := newCLIParser(t, &cli)
-	ctx, err := parser.Parse([]string{})
-	require.NoError(t, err)
-	assert.Equal(t, "run", ctx.Command())
-}
-
-func TestParseVersionCommand(t *testing.T) {
-	cli := freshCLI()
-	parser := newCLIParser(t, &cli)
-	ctx, err := parser.Parse([]string{"version"})
-	require.NoError(t, err)
-	assert.Equal(t, "version", ctx.Command())
-}
-
-func TestParseGlobalConfigFlag(t *testing.T) {
-	cli := freshCLI()
-	parser := newCLIParser(t, &cli)
-	_, err := parser.Parse([]string{"-c", "/tmp/custom.yaml", "version"})
-	require.NoError(t, err)
-	assert.Equal(t, "/tmp/custom.yaml", cli.Config)
-}
-
-func TestParseUserSetWithPasswordFlag(t *testing.T) {
-	cli := freshCLI()
-	parser := newCLIParser(t, &cli)
-	ctx, err := parser.Parse([]string{"user", "set", "alice", "--password", "secret", "--admin"})
-	require.NoError(t, err)
-	assert.Equal(t, "user set <username>", ctx.Command())
-	assert.Equal(t, "alice", cli.User.Set.Username)
-	assert.True(t, cli.User.Set.Password.Provided)
-	assert.Equal(t, "secret", cli.User.Set.Password.Inline)
-	assert.True(t, cli.User.Set.Admin)
-}
-
-func TestParseUserSetConfigFlagOrder(t *testing.T) {
-	cli := freshCLI()
-	parser := newCLIParser(t, &cli)
-	_, err := parser.Parse([]string{"-c", "other.yaml", "user", "set", "bob", "--password", "x"})
-	require.NoError(t, err)
-	assert.Equal(t, "other.yaml", cli.Config)
-}
-
-func TestParseSetRuleFlags(t *testing.T) {
-	cli := freshCLI()
-	parser := newCLIParser(t, &cli)
-	ctx, err := parser.Parse([]string{
-		"set", "rule",
-		"-s", "access", "-p", "/", "-r", "user", "-v", "admin", "--allow",
-	})
-	require.NoError(t, err)
-	assert.Equal(t, "set rule", ctx.Command())
-	assert.Equal(t, "access", cli.Set.Rule.Source)
-	assert.Equal(t, "/", cli.Set.Rule.Path)
-	assert.Equal(t, "user", cli.Set.Rule.Role)
-	assert.Equal(t, "admin", cli.Set.Rule.Value)
-	assert.True(t, cli.Set.Rule.Allow)
-}
-
-func TestParseLegacySetUser(t *testing.T) {
-	cli := freshCLI()
-	parser := newCLIParser(t, &cli)
-	ctx, err := parser.Parse([]string{"set", "-u", "alice,secret", "-a"})
-	require.NoError(t, err)
-	assert.Equal(t, "set", ctx.Command())
-	assert.Equal(t, "alice,secret", cli.Set.User)
-	assert.True(t, cli.Set.Admin)
-}
-
-func TestPasswordFlagResolveInline(t *testing.T) {
-	p := passwordFlag{Provided: true, Inline: "inline-pass"}
-	got, err := p.resolve(true)
-	require.NoError(t, err)
-	assert.Equal(t, "inline-pass", got)
-}
-
-func TestPasswordFlagResolveStdin(t *testing.T) {
-	r, w, err := os.Pipe()
-	require.NoError(t, err)
-	oldStdin := os.Stdin
-	os.Stdin = r
-	t.Cleanup(func() { os.Stdin = oldStdin })
-
-	_, err = w.WriteString("piped-secret\n")
-	require.NoError(t, err)
-	require.NoError(t, w.Close())
-
-	p := passwordFlag{Provided: true}
-	got, err := p.resolve(false)
-	require.NoError(t, err)
-	assert.Equal(t, "piped-secret", got)
-}
-
-func TestPasswordFlagMissing(t *testing.T) {
-	p := passwordFlag{}
-	_, err := p.resolve(false)
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "--password is required")
-}
-
-func TestPasswordFlagNoInputRequiresInline(t *testing.T) {
-	p := passwordFlag{Provided: true}
-	_, err := p.resolve(true)
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "--no-input")
-}
-
-func TestSplitByMultiple(t *testing.T) {
-	assert.Equal(t, []string{"info", "warning", "error"}, SplitByMultiple("info|warning|error"))
-}
-
-func TestSetCmdRunSkipsWhenRuleSelected(t *testing.T) {
-	cli := freshCLI()
-	parser := newCLIParser(t, &cli)
-	ctx, err := parser.Parse([]string{"set", "rule", "-s", "x", "-p", "/", "-r", "all"})
-	require.NoError(t, err)
-	cli.Set.User = "should-not-run"
-	err = cli.Set.Run(ctx)
-	require.NoError(t, err)
-}
-
-func TestSetCmdRunLegacyUser(t *testing.T) {
-	cli := freshCLI()
-	parser := newCLIParser(t, &cli)
-	ctx, err := parser.Parse([]string{"set", "-u", "bad"})
-	require.NoError(t, err)
-	err = cli.Set.Run(ctx)
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "not enough info")
-}
-
-func TestPasswordReadAllFromReader(t *testing.T) {
-	var buf bytes.Buffer
-	buf.WriteString("  trimmed  \n")
-	data, err := io.ReadAll(&buf)
-	require.NoError(t, err)
-	assert.Equal(t, "trimmed", strings.TrimSpace(string(data)))
-}
-
-func TestResolveConfigPathEnvMissingFile(t *testing.T) {
-	missing := filepath.Join(t.TempDir(), "does-not-exist.yaml")
-	t.Setenv("FILEBROWSER_CONFIG", missing)
-	config := ""
-	resolveConfigPath(&config)
-	assert.Equal(t, missing, config)
-	_, err := os.Stat(config)
-	assert.Error(t, err)
-}
-
-func TestSetupNoInputRejected(t *testing.T) {
-	cli := freshCLI()
-	parser := newCLIParser(t, &cli)
-	ctx, err := parser.Parse([]string{"setup", "--no-input"})
-	require.NoError(t, err)
-	err = ctx.Run()
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "interactive input")
-}
@@ -1,83 +0,0 @@
-package cmd
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/gtsteffaniak/filebrowser/backend/pkg/settings"
-)
-
-const settingsMigrationBoltMinSize = 1024
-
-// Docker source paths stored in the committed database.db.old Bolt fixture.
-const (
-	fixturePlaywrightSource = "/app/frontend/tests/playwright-files"
-	fixtureDockerSource     = "/app/backend"
-	fixtureAccessSource     = "/tests/playwright-files"
-)
-
-// settingsMigrationBoltPath returns the committed read-only BoltDB reference used by
-// migration tests and the Playwright settings Docker image. Tests must never write to it.
-func settingsMigrationBoltPath(t *testing.T) string {
-	t.Helper()
-	path, err := filepath.Abs(filepath.Join("..", "..", "_docker", "src", "settings", "backend", "database.db.old"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	info, err := os.Stat(path)
-	if err != nil {
-		t.Fatalf(
-			"settings migration fixture not found at %s: %v (commit _docker/src/settings/backend/database.db.old)",
-			path,
-			err,
-		)
-	}
-	if info.Size() < settingsMigrationBoltMinSize {
-		t.Fatalf("settings migration fixture at %s is empty or too small (%d bytes)", path, info.Size())
-	}
-	return path
-}
-
-func settingsMigrationConfigPath(t *testing.T) string {
-	t.Helper()
-	path, err := filepath.Abs(filepath.Join("..", "..", "_docker", "src", "settings", "backend", "config.yaml"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err := os.Stat(path); err != nil {
-		t.Fatalf("settings migration config not found at %s: %v", path, err)
-	}
-	return path
-}
-
-// alignSettingsSourcesForMigrationFixture maps config sources to the Docker paths
-// stored in database.db.old so migration tests can run locally without modifying
-// the committed Bolt fixture.
-func alignSettingsSourcesForMigrationFixture(t *testing.T) {
-	t.Helper()
-	byName := map[string]string{
-		"playwright + files": fixturePlaywrightSource,
-		"docker":             fixtureDockerSource,
-		"access":             fixtureAccessSource,
-	}
-	newSourceMap := make(map[string]*settings.Source, len(byName))
-	for name, dockerPath := range byName {
-		source, ok := settings.Config.Server.NameToSource[name]
-		if !ok {
-			t.Fatalf("source %q not in config", name)
-		}
-		if source.Path != dockerPath {
-			delete(settings.Config.Server.SourceMap, source.Path)
-			source.Path = dockerPath
-		}
-		newSourceMap[dockerPath] = source
-		settings.Config.Server.NameToSource[name] = source
-	}
-	settings.Config.Server.SourceMap = newSourceMap
-	sources := make([]*settings.Source, 0, len(byName))
-	for _, name := range []string{"playwright + files", "docker", "access"} {
-		sources = append(sources, settings.Config.Server.NameToSource[name])
-	}
-	settings.Config.Server.Sources = sources
-}
@@ -1,227 +0,0 @@
-package cmd
-
-import (
-	"fmt"
-	"io"
-	"os"
-	"strings"
-
-	"github.com/alecthomas/kong"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/version"
-	"github.com/gtsteffaniak/filebrowser/backend/pkg/settings"
-	"github.com/gtsteffaniak/go-logger/logger"
-	"golang.org/x/term"
-)
-
-// Globals holds flags shared across all commands (order-independent).
-type Globals struct {
-	Config  string `short:"c" name:"config" default:"config.yaml" env:"FILEBROWSER_CONFIG" help:"Path to config file"`
-	NoInput bool   `name:"no-input" help:"Disable interactive prompts (fail if input required)"`
-}
-
-type runCmd struct{}
-
-type versionCmd struct{}
-
-type setupCmd struct{}
-
-type SetCmd struct {
-	User  string     `short:"u" help:"Deprecated: comma-separated username,password. Use 'user set' instead."`
-	Admin bool       `short:"a" help:"Create user as admin (used with -u)"`
-	Rule  SetRuleCmd `cmd:"" name:"rule" help:"Add or update an access rule"`
-}
-
-type SetRuleCmd struct {
-	Source string `short:"s" name:"source" aliases:"f,sourceName" required:"" help:"Source name from config"`
-	Path   string `short:"p" name:"path" aliases:"sourcePath" required:"" help:"Index path within the source"`
-	Role   string `short:"r" name:"role" enum:"user,group,all" required:"" help:"Rule target type"`
-	Value  string `short:"v" name:"value" help:"Username or group name (required for user/group)"`
-	Allow  bool   `name:"allow" help:"Allow access (default: deny)"`
-}
-
-type UserCmd struct {
-	Set     UserSetCmd     `cmd:"" name:"set" help:"Create or update a password-authenticated user"`
-	Promote UserPromoteCmd `cmd:"" name:"promote" help:"Grant admin permissions without changing password"`
-}
-
-type UserPromoteCmd struct {
-	Username string `arg:"" help:"Username to promote"`
-}
-
-type UserSetCmd struct {
-	Username string       `arg:"" help:"Username"`
-	Password passwordFlag `name:"password" help:"Password; omit value to prompt (TTY) or read stdin (pipe)"`
-	Admin    bool         `short:"a" name:"admin" help:"Grant admin permissions"`
-}
-
-// passwordFlag accepts --password VALUE (inline) or --password alone (prompt/pipe).
-type passwordFlag struct {
-	Provided bool
-	Inline   string
-}
-
-func (p *passwordFlag) Decode(ctx *kong.DecodeContext) error {
-	p.Provided = true
-	if ctx.Scan.Peek().IsValue() {
-		return ctx.Scan.PopValueInto("password", &p.Inline)
-	}
-	return nil
-}
-
-func (p passwordFlag) resolve(noInput bool) (string, error) {
-	if !p.Provided {
-		return "", fmt.Errorf("--password is required (inline value, interactive prompt, or piped stdin)")
-	}
-	if p.Inline != "" {
-		return p.Inline, nil
-	}
-	if noInput {
-		return "", fmt.Errorf("--password requires an inline value or piped stdin when --no-input is set")
-	}
-	if term.IsTerminal(int(os.Stdin.Fd())) {
-		return promptPassword()
-	}
-	data, err := io.ReadAll(os.Stdin)
-	if err != nil {
-		return "", fmt.Errorf("read password from stdin: %w", err)
-	}
-	password := strings.TrimSpace(string(data))
-	if password == "" {
-		return "", fmt.Errorf("password must not be empty")
-	}
-	return password, nil
-}
-
-func promptPassword() (string, error) {
-	if _, err := fmt.Fprint(os.Stderr, "Password: "); err != nil {
-		return "", err
-	}
-	bytePassword, err := term.ReadPassword(int(os.Stdin.Fd()))
-	fmt.Fprintln(os.Stderr)
-	if err != nil {
-		return "", fmt.Errorf("read password: %w", err)
-	}
-	password := string(bytePassword)
-	if password == "" {
-		return "", fmt.Errorf("password must not be empty")
-	}
-	return password, nil
-}
-
-var rootCLI cliRoot
-
-type cliRoot struct {
-	Globals `embed:""`
-
-	Run     runCmd     `cmd:"" default:"1" hidden:"" help:"Start the FileBrowser server"`
-	Version versionCmd `cmd:"" name:"version" help:"Print version information"`
-	Setup   setupCmd   `cmd:"" name:"setup" help:"Interactive configuration setup"`
-	Set     SetCmd     `cmd:"" name:"set" help:"Set configuration values (deprecated: use 'user set' for users)"`
-	User    UserCmd    `cmd:"" name:"user" help:"User management"`
-}
-
-func (versionCmd) Run() error {
-	fmt.Printf(`FileBrowser Quantum - A modern web-based file manager
-	Version 	 : %v
-	Commit 		 : %v
-	Release Info 	 : https://github.com/gtsteffaniak/filebrowser/releases/tag/%v
-`, version.Version, version.CommitSHA, version.Version)
-	return nil
-}
-
-func (setupCmd) Run(globals *Globals) error {
-	return createConfig(globals.Config, globals.NoInput)
-}
-
-func (s *SetCmd) Run(ctx *kong.Context) error {
-	if strings.HasPrefix(ctx.Command(), "set rule") {
-		return nil
-	}
-	if s.User == "" {
-		return fmt.Errorf("missing subcommand for 'set'. Use 'set rule' or 'user set'")
-	}
-	fmt.Fprintln(os.Stderr, "warning: 'set -u' is deprecated; use 'user set' instead")
-	userInfo := strings.SplitN(s.User, ",", 2)
-	if len(userInfo) < 2 || userInfo[0] == "" || userInfo[1] == "" {
-		return fmt.Errorf("not enough info to create user: \"set -u username,password\", only provided %v", strings.Split(s.User, ","))
-	}
-	return setUser(userInfo[0], userInfo[1], s.Admin)
-}
-
-func (r *SetRuleCmd) Run() error {
-	sourceInfo, ok := settings.Config.Server.NameToSource[r.Source]
-	if !ok {
-		return fmt.Errorf("invalid source name: %s", r.Source)
-	}
-	return setRule(sourceInfo.Path, r.Path, r.Role, r.Value, r.Allow)
-}
-
-func (u *UserSetCmd) Run(globals *Globals) error {
-	password, err := u.Password.resolve(globals.NoInput)
-	if err != nil {
-		return err
-	}
-	return setUser(u.Username, password, u.Admin)
-}
-
-func (p *UserPromoteCmd) Run() error {
-	return promoteUser(p.Username)
-}
-
-func resolveConfigPath(config *string) {
-	envConfig := os.Getenv("FILEBROWSER_CONFIG")
-	if *config == "" {
-		if envConfig != "" {
-			*config = envConfig
-		} else {
-			*config = "config.yaml"
-		}
-	}
-}
-
-func requireExistingConfig(config string) {
-	envConfig := os.Getenv("FILEBROWSER_CONFIG")
-	if envConfig != "" && config == envConfig {
-		if _, err := os.Stat(config); err != nil {
-			logger.Fatalf("config file %v does not exist, please create it or set the FILEBROWSER_CONFIG environment variable to a valid config file path", config)
-		}
-	}
-}
-
-func runCLI() (keepGoing bool, dbExists bool) {
-	generateYaml()
-
-	parser, err := kong.New(&rootCLI,
-		kong.Name("filebrowser"),
-		kong.Description("FileBrowser Quantum - A modern web-based file manager"),
-		kong.Bind(&rootCLI.Globals),
-	)
-	if err != nil {
-		logger.Fatalf("failed to configure CLI: %v", err)
-	}
-
-	ctx, err := parser.Parse(os.Args[1:])
-	parser.FatalIfErrorf(err)
-
-	resolveConfigPath(&rootCLI.Config)
-	configPath = rootCLI.Config
-
-	cmd := ctx.Command()
-	switch {
-	case cmd == "" || cmd == "run":
-		requireExistingConfig(configPath)
-		dbExists = initializeDatabase(configPath)
-		return true, dbExists
-	case cmd == "version" || cmd == "setup":
-		parser.FatalIfErrorf(ctx.Run(&rootCLI))
-		return false, false
-	case cmd == "set rule" || cmd == "set" || strings.HasPrefix(cmd, "user set") || strings.HasPrefix(cmd, "user promote"):
-		requireExistingConfig(configPath)
-		dbExists = initializeDatabase(configPath)
-		parser.FatalIfErrorf(ctx.Run(&rootCLI))
-		return false, dbExists
-	default:
-		parser.Fatalf("unexpected command: %q", cmd)
-		return false, false
-	}
-}
@@ -1,483 +0,0 @@
-package cmd
-
-import (
-	"encoding/json"
-	"fmt"
-	"os"
-	"path/filepath"
-
-	storm "github.com/asdine/storm/v3"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/database/access"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/database/dbindex"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/database/share"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/database/sqldb"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/database/users"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/state"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/usersidebar"
-	"github.com/gtsteffaniak/filebrowser/backend/pkg/settings"
-	"github.com/gtsteffaniak/go-logger/logger"
-)
-
-const migrationGuideURL = "https://filebrowserquantum.com/en/docs/getting-started/v2/migration"
-
-func migrationErrf(format string, args ...any) error {
-	return fmt.Errorf(format+" See the v2 migration guide: "+migrationGuideURL, args...)
-}
-
-// checkMigrationNeeded is true when server.database.migrateFrom points at a BoltDB file to import and
-// server.database.path (SQLite) does not exist yet or is empty.
-func checkMigrationNeeded() bool {
-	boltPath := settings.Config.Server.DatabaseV2.MigrateFrom
-	if boltPath == "" {
-		return false
-	}
-	if sqliteDatabasePopulated(settings.Config.Server.DatabaseV2.Path) {
-		return false
-	}
-	return legacyBoltDatabasePopulated(boltPath)
-}
-
-// validateDatabasePaths enforces database path rules before opening or creating SQLite:
-//  1. On a fresh install, fail if server.database.path is database.db or an unrenamed
-//     legacy database file (database.db) is present in the working directory.
-//  2. On a fresh install with server.database.migrateFrom set, fail if the legacy database file is missing
-//     or empty.
-//  3. When SQLite already exists and server.database.migrateFrom is set, fail if the legacy database file
-//     is missing or empty.
-//
-// Otherwise the existing SQLite database is used, or a new one is created on first open.
-func validateDatabasePaths() error {
-	sqlitePath := settings.Config.Server.DatabaseV2.Path
-	boltPath := settings.Config.Server.DatabaseV2.MigrateFrom
-	sqliteExists := sqliteDatabasePopulated(sqlitePath)
-
-	if !sqliteExists {
-		if filepath.Base(sqlitePath) == "database.db" {
-			return migrationErrf(
-				`server.database.path cannot be "database.db": that name is reserved for the legacy database file. ` +
-					`Rename database.db to database.db.old, set server.database.path to a new SQLite filename ` +
-					`and set server.database.migrateFrom to "database.db.old".`,
-			)
-		}
-		if _, err := os.Stat("database.db"); err == nil {
-			return migrationErrf(
-				`legacy database file found in the working directory. ` +
-					`Rename it to database.db.old, set server.database.migrateFrom to "database.db.old" ` +
-					`or use migrateFrom: "default".`,
-			)
-		}
-		if boltPath != "" {
-			return legacyBoltDatabaseError(boltPath, sqlitePath, true)
-		}
-		return nil
-	}
-
-	if boltPath != "" {
-		return legacyBoltDatabaseError(boltPath, sqlitePath, false)
-	}
-	return nil
-}
-
-func legacyBoltDatabaseError(boltPath, sqlitePath string, freshInstall bool) error {
-	stat, err := os.Stat(boltPath)
-	if err != nil {
-		if os.IsNotExist(err) {
-			if freshInstall {
-				return migrationErrf(
-					`server.database.migrateFrom is %q but that file does not exist, and no SQLite database exists at server.database.path (%q). `+
-						`Check the migrateFrom path or restore your renamed legacy database backup.`,
-					boltPath, sqlitePath,
-				)
-			}
-			return migrationErrf(
-				`server.database.migrateFrom is %q but that file does not exist. `+
-					`Migration appears complete — remove server.database.migrateFrom from your config.`,
-				boltPath,
-			)
-		}
-		return migrationErrf(
-			`server.database.migrateFrom is %q but cannot be read: %v. `+
-				`Check file permissions or restore your backed-up database file.`,
-			boltPath, err,
-		)
-	}
-	if stat.Size() == 0 {
-		if freshInstall {
-			return migrationErrf(
-				`server.database.migrateFrom is %q but that file is empty, and no SQLite database exists at server.database.path (%q). `+
-					`Restore your backed-up database file or fix the migrateFrom path.`,
-				boltPath, sqlitePath,
-			)
-		}
-		return migrationErrf(
-			`server.database.migrateFrom is %q but that file is empty. `+
-				`Remove server.database.migrateFrom from your config, or restore the legacy database backup if migration is not complete.`,
-			boltPath,
-		)
-	}
-	return nil
-}
-
-func sqliteDatabasePopulated(path string) bool {
-	stat, err := os.Stat(path)
-	return err == nil && stat.Size() > 0
-}
-
-func legacyBoltDatabasePopulated(path string) bool {
-	stat, err := os.Stat(path)
-	return err == nil && stat.Size() > 0
-}
-
-// migrateFromBoltToSQLite migrates essential data from BoltDB to SQLite
-func migrateFromBoltToSQLite() error {
-	oldDBPath := settings.Config.Server.DatabaseV2.MigrateFrom
-	newDBPath := settings.Config.Server.DatabaseV2.Path
-
-	logger.Info("========================================")
-	logger.Info("Starting migration from legacy database")
-	logger.Info("========================================")
-	// Open old BoltDB (read-only)
-	logger.Info("Opening old database...")
-	oldDB, err := storm.Open(oldDBPath)
-	if err != nil {
-		return fmt.Errorf("failed to open old database: %w", err)
-	}
-	logger.Info("✓ Old database opened")
-
-	// Initialize new database
-	logger.Info("Initializing new database...")
-	sqlStore, _, err := sqldb.NewSQLStoreWithOptions(newDBPath, sqldb.NewSQLStoreOpts{SkipQuickSetup: true})
-	if err != nil {
-		oldDB.Close()
-		return fmt.Errorf("failed to initialize new database: %w", err)
-	}
-	logger.Info("✓ New database initialized")
-
-	// Ensure cleanup on error - remove incomplete database for retry
-	migrationSuccess := false
-	defer func() {
-		oldDB.Close()
-		sqlStore.Close()
-
-		if !migrationSuccess {
-			// Migration failed - remove the new database so it can be retried
-			logger.Warning("Migration failed, cleaning up new database file for retry...")
-			if err := os.Remove(newDBPath); err != nil && !os.IsNotExist(err) {
-				logger.Errorf("Failed to remove incomplete database file: %v", err)
-			} else {
-				logger.Info("✓ Incomplete database file removed, migration can be retried on next startup")
-			}
-		}
-	}()
-
-	// Migrate users (bolt User.ID is stored as SQLite users.user_id)
-	logger.Info("Migrating users...")
-	if err := migrateUsers(oldDB, sqlStore); err != nil {
-		return fmt.Errorf("failed to migrate users: %w", err)
-	}
-	if err := state.EnsureNoAuthAdminUserAfterMigration(sqlStore); err != nil {
-		return fmt.Errorf("failed to configure noauth admin user: %w", err)
-	}
-
-	// Migrate shares
-	logger.Info("Migrating shares...")
-	if err := migrateShares(oldDB, sqlStore); err != nil {
-		return fmt.Errorf("failed to migrate shares: %w", err)
-	}
-
-	// Migrate access rules and groups
-	logger.Info("Migrating access rules and groups...")
-	if err := migrateAccessRules(oldDB, sqlStore); err != nil {
-		return fmt.Errorf("failed to migrate access rules: %w", err)
-	}
-
-	// Migrate index info
-	logger.Info("Migrating index info...")
-	if err := migrateIndexInfo(oldDB, sqlStore); err != nil {
-		return fmt.Errorf("failed to migrate index info: %w", err)
-	}
-
-	// Mark migration as successful
-	migrationSuccess = true
-
-	logger.Info("========================================")
-	logger.Info("Migration completed successfully!")
-	logger.Info("========================================")
-	logger.Infof("Your legacy database file is unchanged at: %s", oldDBPath)
-	logger.Infof("New SQLite database created at: %s", newDBPath)
-
-	return nil
-}
-
-// normalizeUserScopesBeforeSQLite copies scopes from FrontendScopes into BackendScopes when the Bolt
-// record only had JSON key "scopes" (FrontendUser) and nothing under backendScopes — CreateUser
-// persists only BackendScopes in SQLite user_data.
-func normalizeUserScopesBeforeSQLite(user *users.User) error {
-	if len(user.BackendScopes) > 0 {
-		return nil
-	}
-	backendScopes, err := users.APIScopesToBackend(user.FrontendScopes)
-	if err != nil {
-		return fmt.Errorf("convert frontend scopes to backend: %w", err)
-	}
-	for i := range backendScopes {
-		backendScopes[i].Permissions = users.SourceFilePermissions{
-			View:     true,
-			Download: user.Permissions.Download,
-			Modify:   user.Permissions.Modify,
-			Delete:   user.Permissions.Delete,
-			Create:   user.Permissions.Create,
-		}
-	}
-	user.FrontendScopes = nil
-	user.BackendScopes = backendScopes
-	return nil
-}
-
-// migrateUsers migrates all users from BoltDB to SQLite. Each bolt user.ID is written as user_id
-func migrateUsers(oldDB *storm.DB, sqlStore *sqldb.SQLStore) error {
-	var usersList []*users.User
-	err := oldDB.All(&usersList)
-	if err != nil {
-		if err.Error() == "not found" {
-			logger.Info("  No users to migrate")
-			return nil
-		}
-		return fmt.Errorf("failed to read users from old DB: %w", err)
-	}
-
-	promoted := 0
-	for _, user := range usersList {
-		oldScopesCount := len(user.FrontendScopes)
-		newScopesCount := len(user.BackendScopes)
-		if err := normalizeUserScopesBeforeSQLite(user); err != nil {
-			return fmt.Errorf("failed to normalize scopes for user %s: %w", user.Username, err)
-		}
-		if normalized, changed := usersidebar.NormalizeSidebarLinks(user.SidebarLinks); changed {
-			user.SidebarLinks = normalized
-		}
-		if merged, changed := usersidebar.EnsureSidebarLinksFromScopes(user.SidebarLinks, user.BackendScopes); changed {
-			user.SidebarLinks = merged
-		}
-		if normalized, changed := usersidebar.NormalizeSidebarLinks(user.SidebarLinks); changed {
-			user.SidebarLinks = normalized
-		}
-		prevVersion := user.Version
-		if len(user.BackendScopes) == 0 {
-			settings.ApplyUserDefaults(user)
-		}
-		if prevVersion < users.SourcePermissionsMigrationVersion {
-			// ApplyUserDefaults bumps Version; restore pre-defaults version so legacy global file ops migrate to scopes.
-			user.Version = prevVersion
-			users.MigrateToSourcePermissions(user)
-		}
-		normalizeUserTokensBeforeSQLite(user)
-		updateTokens(user)
-		user.Version = users.ProfileStorageVersion
-		if newScopesCount > oldScopesCount {
-			promoted++
-			logger.Infof("  user %q: legacy database had %d scopes, SQLite now has %d",
-				user.Username, oldScopesCount, newScopesCount)
-		}
-		boltID := user.ID
-		if err := sqlStore.CreateUser(user); err != nil {
-			return fmt.Errorf("failed to save user %s (bolt id: %d): %w", user.Username, boltID, err)
-		}
-	}
-
-	if promoted > 0 {
-		logger.Infof("  Promoted frontend-only Bolt scopes to backend for %d user(s) before SQLite insert", promoted)
-	}
-	logger.Infof("  ✓ Migrated %d users", len(usersList))
-	return nil
-}
-
-// normalizeUserTokensBeforeSQLite ensures Bolt name-keyed tokens have Name set so
-// TokensForPersist retains them in SQLite user_data (Bolt often stores the name only as the map key).
-func normalizeUserTokensBeforeSQLite(user *users.User) {
-	if len(user.Tokens) == 0 {
-		return
-	}
-	normalized := make(map[string]users.AuthToken)
-	for key, token := range user.Tokens {
-		name := token.Name
-		if name == "" {
-			if key == token.Token {
-				continue
-			}
-			name = key
-		}
-		if _, exists := normalized[name]; exists {
-			continue
-		}
-		token.Name = name
-		if token.Token == "" {
-			token.Token = token.Key
-		}
-		token.Permissions = users.SanitizeTokenPermissions(token.Permissions)
-		users.StoreToken(normalized, token)
-	}
-	user.Tokens = normalized
-}
-
-// migrateShares migrates all shares from BoltDB to SQLite.
-//
-// Legacy Bolt "Link" / "Share" JSON (flat CommonShare + Link fields):
-//   - "source"  → Share.SourcePath (backend source path; not the share item path)
-//   - "path"    → Share.Path (index-relative path within that source)
-//   - "userID"  → Share.UserID unchanged (same numeric id as migrated users in SQLite)
-//   - "password_hash" → Share.PasswordHash (username is never stored on the share row)
-//
-// New users created after migration get random uint64 ids (utils.RandomUint64ID); Bolt ids 1,2,3…
-// remain valid. PrepForFrontend resolves Share.UserID to username for API responses only.
-func migrateShares(oldDB *storm.DB, sqlStore *sqldb.SQLStore) error {
-	boltShareBuckets := []string{"Share", "Link"}
-	var sharesList []*share.LegacyShare
-	for _, bucket := range boltShareBuckets {
-		var batch []*share.LegacyShare
-		err := oldDB.Select().Bucket(bucket).Find(&batch)
-		if err != nil && err != storm.ErrNotFound {
-			return fmt.Errorf("failed to read shares from legacy DB bucket %q: %w", bucket, err)
-		}
-		if len(batch) > 0 {
-			sharesList = append(sharesList, batch...)
-		}
-	}
-
-	if len(sharesList) == 0 {
-		logger.Info("  No shares to migrate")
-		return nil
-	}
-
-	for _, legacy := range sharesList {
-		link := legacy.ToShare()
-		if link.UserID == 0 {
-			return fmt.Errorf("failed to save share %s: owner user id is missing", link.Hash)
-		}
-		// Legacy Bolt "source" → SourcePath; normalize when it was stored as a display name.
-		if link.SourcePath != "" {
-			if _, ok := settings.Config.Server.SourceMap[link.SourcePath]; !ok {
-				if src, ok := settings.Config.Server.NameToSource[link.SourcePath]; ok {
-					link.SourceName = src.Name
-					link.SourcePath = src.Path
-				}
-			} else if link.SourceName == "" {
-				link.SourceName = settings.Config.Server.SourceMap[link.SourcePath].Name
-			}
-		}
-		// Do not persist API-only fields; PrepForFrontend fills these on read.
-		link.ShareURL = ""
-		link.DownloadURL = ""
-		link.FrontendShareInfo.SourceURL = ""
-		link.CanEditShare = false
-		if err := sqlStore.SaveShare(&link); err != nil {
-			return fmt.Errorf("failed to save share %s: %w", link.Hash, err)
-		}
-	}
-
-	logger.Infof("  ✓ Migrated %d shares", len(sharesList))
-	return nil
-}
-
-// migrateAccessRules migrates access control data from BoltDB to SQLite.
-// Path rules (AllRules) and group definitions (Groups) are unchanged through migration
-func migrateAccessRules(oldDB *storm.DB, sqlStore *sqldb.SQLStore) error {
-	// Read the access rules JSON blob from BoltDB
-	var data []byte
-	err := oldDB.Get("access_rules", "rules", &data)
-	if err != nil {
-		if err.Error() == "not found" {
-			logger.Info("  No access rules to migrate")
-			return nil
-		}
-		return fmt.Errorf("failed to read access rules: %w", err)
-	}
-
-	// Unmarshal the data
-	type dbStorage struct {
-		AllRules      access.SourceRuleMap `json:"all_rules"`
-		Groups        access.GroupMap      `json:"groups"`
-		RevokedTokens map[string]struct{}  `json:"revoked_tokens"`
-		HashedTokens  map[string]uint      `json:"hashed_tokens"`
-	}
-
-	var storage dbStorage
-	if err := json.Unmarshal(data, &storage); err != nil {
-		return fmt.Errorf("failed to unmarshal access rules: %w", err)
-	}
-
-	// Migrate access rules
-	ruleCount := 0
-	for source, rules := range storage.AllRules {
-		resolvedSource := source
-		if info, ok := users.ResolveSourceKey(source); ok {
-			resolvedSource = info.Path
-		} else if src, ok := settings.Config.Server.NameToSource[source]; ok {
-			resolvedSource = src.Path
-		}
-		for path, rule := range rules {
-			err := sqlStore.SaveAccessRule(resolvedSource, path, rule)
-			if err != nil {
-				return fmt.Errorf("failed to save access rule: %w", err)
-			}
-			ruleCount++
-		}
-	}
-	logger.Infof("  ✓ Migrated %d access rules", ruleCount)
-
-	// Migrate groups
-	for name, members := range storage.Groups {
-		err := sqlStore.SaveGroup(name, members)
-		if err != nil {
-			return fmt.Errorf("failed to save group %s: %w", name, err)
-		}
-	}
-	logger.Infof("  ✓ Migrated %d groups", len(storage.Groups))
-
-	// Migrate revoked tokens
-	for tokenHash := range storage.RevokedTokens {
-		err := sqlStore.SaveRevokedToken(tokenHash)
-		if err != nil {
-			return fmt.Errorf("failed to save revoked token: %w", err)
-		}
-	}
-	logger.Infof("  ✓ Migrated %d revoked tokens", len(storage.RevokedTokens))
-
-	// Migrate hashed tokens (bolt stored owner user id)
-	for tokenHash, userID := range storage.HashedTokens {
-		if userID == 0 {
-			logger.Warningf("  skipping hashed token: invalid user id 0")
-			continue
-		}
-		err := sqlStore.SaveHashedToken(tokenHash, uint64(userID))
-		if err != nil {
-			return fmt.Errorf("failed to save hashed token: %w", err)
-		}
-	}
-	logger.Infof("  ✓ Migrated %d hashed tokens", len(storage.HashedTokens))
-
-	return nil
-}
-
-// migrateIndexInfo migrates index info metadata from BoltDB to SQLite
-func migrateIndexInfo(oldDB *storm.DB, sqlStore *sqldb.SQLStore) error {
-	var indexList []*dbindex.IndexInfo
-	err := oldDB.All(&indexList)
-	if err != nil {
-		if err.Error() == "not found" {
-			logger.Info("  No index info to migrate")
-			return nil
-		}
-		return fmt.Errorf("failed to read index info: %w", err)
-	}
-
-	for _, info := range indexList {
-		err := sqlStore.SaveIndexInfo(info)
-		if err != nil {
-			return fmt.Errorf("failed to save index info for %s: %w", info.Path, err)
-		}
-	}
-
-	logger.Infof("  ✓ Migrated %d index info entries", len(indexList))
-	return nil
-}
@@ -1,165 +0,0 @@
-package cmd
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/gtsteffaniak/filebrowser/backend/pkg/settings"
-)
-
-func TestValidateDatabasePaths_missingBoltOnFreshInstall(t *testing.T) {
-	dir := t.TempDir()
-	settings.Config.Server.DatabaseV2.MigrateFrom = filepath.Join(dir, "database.db.old")
-	settings.Config.Server.DatabaseV2.Path = filepath.Join(dir, "filebrowser.sqlite")
-
-	err := validateDatabasePaths()
-	if err == nil {
-		t.Fatal("expected error when migrateFrom file is missing on fresh install")
-	}
-}
-
-func TestValidateDatabasePaths_emptyBoltOnFreshInstall(t *testing.T) {
-	dir := t.TempDir()
-	boltPath := filepath.Join(dir, "database.db.old")
-	if err := os.WriteFile(boltPath, nil, 0o600); err != nil {
-		t.Fatal(err)
-	}
-	settings.Config.Server.DatabaseV2.MigrateFrom = boltPath
-	settings.Config.Server.DatabaseV2.Path = filepath.Join(dir, "filebrowser.sqlite")
-
-	err := validateDatabasePaths()
-	if err == nil {
-		t.Fatal("expected error when migrateFrom file is empty on fresh install")
-	}
-}
-
-func TestValidateDatabasePaths_missingBoltWhenSQLiteExists(t *testing.T) {
-	dir := t.TempDir()
-	settings.Config.Server.DatabaseV2.MigrateFrom = filepath.Join(dir, "missing.db.old")
-	sqlitePath := filepath.Join(dir, "filebrowser.sqlite")
-	if err := os.WriteFile(sqlitePath, []byte("sqlite"), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	settings.Config.Server.DatabaseV2.Path = sqlitePath
-
-	if err := validateDatabasePaths(); err == nil {
-		t.Fatal("expected error when migrateFrom is set but legacy file is missing after migration")
-	}
-}
-
-func TestValidateDatabasePaths_okWhenSQLiteExistsWithoutMigrateFrom(t *testing.T) {
-	dir := t.TempDir()
-	settings.Config.Server.DatabaseV2.MigrateFrom = ""
-	sqlitePath := filepath.Join(dir, "filebrowser.sqlite")
-	if err := os.WriteFile(sqlitePath, []byte("sqlite"), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	settings.Config.Server.DatabaseV2.Path = sqlitePath
-
-	if err := validateDatabasePaths(); err != nil {
-		t.Fatalf("expected no error: %v", err)
-	}
-	if checkMigrationNeeded() {
-		t.Fatal("migration should not run when sqlite already exists")
-	}
-}
-
-func TestValidateDatabasePaths_okWhenSQLiteAndBoltExist(t *testing.T) {
-	dir := t.TempDir()
-	boltPath := filepath.Join(dir, "database.db.old")
-	if err := os.WriteFile(boltPath, []byte("bolt"), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	sqlitePath := filepath.Join(dir, "filebrowser.sqlite")
-	if err := os.WriteFile(sqlitePath, []byte("sqlite"), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	settings.Config.Server.DatabaseV2.MigrateFrom = boltPath
-	settings.Config.Server.DatabaseV2.Path = sqlitePath
-
-	if err := validateDatabasePaths(); err != nil {
-		t.Fatalf("expected no error when both databases exist: %v", err)
-	}
-	if checkMigrationNeeded() {
-		t.Fatal("migration should not run when sqlite already exists")
-	}
-}
-
-func TestValidateDatabasePaths_rejectsDatabaseDBAsSQLitePath(t *testing.T) {
-	dir := t.TempDir()
-	settings.Config.Server.DatabaseV2.MigrateFrom = ""
-	settings.Config.Server.DatabaseV2.Path = filepath.Join(dir, "database.db")
-
-	if err := validateDatabasePaths(); err == nil {
-		t.Fatal("expected error when sqlite path is database.db on fresh install")
-	}
-}
-
-func TestValidateDatabasePaths_rejectsUnrenamedLegacyDatabaseDB(t *testing.T) {
-	dir := t.TempDir()
-	t.Chdir(dir)
-
-	settings.Config.Server.DatabaseV2.MigrateFrom = ""
-	settings.Config.Server.DatabaseV2.Path = filepath.Join(dir, "filebrowser.sqlite")
-	if err := os.WriteFile("database.db", []byte("legacy-bolt"), 0o600); err != nil {
-		t.Fatal(err)
-	}
-
-	if err := validateDatabasePaths(); err == nil {
-		t.Fatal("expected error when unrenamed database.db exists on fresh install")
-	}
-}
-
-func TestValidateDatabasePaths_migrateFromDefaultResolvesFromEnv(t *testing.T) {
-	dir := t.TempDir()
-	boltPath := filepath.Join(dir, "database.db.old")
-	if err := os.WriteFile(boltPath, []byte("bolt"), 0o600); err != nil {
-		t.Fatal(err)
-	}
-
-	t.Setenv("FILEBROWSER_DATABASE", boltPath)
-
-	settings.Config.Server.DatabaseV2.MigrateFrom = settings.MigrateFromDefault
-	settings.Config.Server.DatabaseV2.Path = filepath.Join(dir, "filebrowser.sqlite")
-
-	if err := settings.ResolveDatabasePaths(); err != nil {
-		t.Fatalf("ResolveDatabasePaths: %v", err)
-	}
-	if settings.Config.Server.DatabaseV2.MigrateFrom != boltPath {
-		t.Fatalf("migrateFrom = %q, want %q", settings.Config.Server.DatabaseV2.MigrateFrom, boltPath)
-	}
-	if err := validateDatabasePaths(); err != nil {
-		t.Fatalf("validateDatabasePaths: %v", err)
-	}
-	if !checkMigrationNeeded() {
-		t.Fatal("expected migration to be needed")
-	}
-}
-
-func TestCheckMigrationNeeded_trueWhenBoltPresentAndSQLiteMissing(t *testing.T) {
-	dir := t.TempDir()
-	boltPath := filepath.Join(dir, "database.db.old")
-	if err := os.WriteFile(boltPath, []byte("bolt"), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	settings.Config.Server.DatabaseV2.MigrateFrom = boltPath
-	settings.Config.Server.DatabaseV2.Path = filepath.Join(dir, "filebrowser.sqlite")
-
-	if err := validateDatabasePaths(); err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if !checkMigrationNeeded() {
-		t.Fatal("expected migration to be needed")
-	}
-}
-
-func TestValidateDatabasePaths_okFreshInstallWithoutMigrateFrom(t *testing.T) {
-	dir := t.TempDir()
-	settings.Config.Server.DatabaseV2.MigrateFrom = ""
-	settings.Config.Server.DatabaseV2.Path = filepath.Join(dir, "filebrowser.sqlite")
-
-	if err := validateDatabasePaths(); err != nil {
-		t.Fatalf("expected no error on fresh install without migrateFrom: %v", err)
-	}
-}
@@ -1,74 +0,0 @@
-package cmd
-
-import (
-	"encoding/json"
-	"os"
-	"path/filepath"
-	"testing"
-
-	storm "github.com/asdine/storm/v3"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/database/sqldb"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/database/users"
-)
-
-func TestMigrateAdminTokensRoundTripSQLite(t *testing.T) {
-	boltPath := settingsMigrationBoltPath(t)
-	sqlitePath := filepath.Join(t.TempDir(), "migrate-tokens.sqlite")
-
-	oldDB, err := storm.Open(boltPath)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer oldDB.Close()
-
-	sqlStore, _, err := sqldb.NewSQLStoreWithOptions(sqlitePath, sqldb.NewSQLStoreOpts{SkipQuickSetup: true})
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer sqlStore.Close()
-
-	var list []*users.User
-	if err = oldDB.All(&list); err != nil {
-		t.Fatal(err)
-	}
-	var admin *users.User
-	for _, u := range list {
-		if u.Username == "admin" {
-			admin = u
-			break
-		}
-	}
-	if admin == nil {
-		t.Fatal("admin not found")
-	}
-
-	normalizeUserTokensBeforeSQLite(admin)
-	if err = sqlStore.CreateUser(admin); err != nil {
-		t.Fatal(err)
-	}
-
-	loaded, err := sqlStore.GetUserByUsername("admin")
-	if err != nil {
-		t.Fatal(err)
-	}
-	customized, ok := loaded.Tokens["customized"]
-	if !ok {
-		t.Fatalf("customized missing after reload: %#v", loaded.Tokens)
-	}
-	if !customized.Permissions.Admin {
-		t.Fatalf("customized admin permission missing after reload: %#v", customized.Permissions)
-	}
-	if customized.Permissions.Api || customized.Permissions.Share || customized.Permissions.Realtime {
-		t.Fatalf("customized should only retain admin global after reload: %#v", customized.Permissions)
-	}
-	if customized.Permissions.Modify || customized.Permissions.Create || customized.Permissions.Delete || customized.Permissions.Download {
-		t.Fatalf("customized legacy file ops should be stripped: %#v", customized.Permissions)
-	}
-
-	out, _ := json.MarshalIndent(map[string]any{
-		"customizedPermissions": customized.Permissions,
-		"tokenNames":            len(loaded.Tokens),
-	}, "", "  ")
-	os.Stdout.Write(out)
-	os.Stdout.Write([]byte("\n"))
-}
@@ -1,89 +0,0 @@
-package cmd
-
-import (
-	"testing"
-
-	"github.com/gtsteffaniak/filebrowser/backend/internal/database/users"
-	"github.com/gtsteffaniak/filebrowser/backend/pkg/settings"
-)
-
-// Simulates migrateUsers() steps for a Bolt user without backend scopes or source permissions.
-func TestMigrateUsersFlow_appliesConfigDefaultsAndSourcePermissions(t *testing.T) {
-	loadMigrateTestConfig(t, "../../_docker/src/jwt/backend/config.yaml")
-
-	user := &users.User{
-		FrontendUser: users.FrontendUser{
-			Username: "legacy-bolt-user",
-			Permissions: users.Permissions{
-				Download: true,
-				Modify:   true,
-				Create:   true,
-				Share:    true,
-			},
-		},
-		Version: 2,
-	}
-
-	prevVersion := user.Version
-	if len(user.BackendScopes) == 0 {
-		settings.ApplyUserDefaults(user)
-	}
-	if prevVersion < users.SourcePermissionsMigrationVersion {
-		user.Version = prevVersion
-		if !users.MigrateToSourcePermissions(user) {
-			t.Fatal("expected source permission migration")
-		}
-	}
-	user.Version = users.ProfileStorageVersion
-
-	if !user.Permissions.Share {
-		t.Fatal("global share should remain after migration")
-	}
-	if user.Permissions.Modify || user.Permissions.Download {
-		t.Fatalf("legacy global file ops should be cleared: %+v", user.Permissions)
-	}
-	if len(user.BackendScopes) == 0 {
-		t.Fatal("ApplyUserDefaults should assign default-enabled sources")
-	}
-	perms := user.BackendScopes[0].Permissions
-	if !perms.View || !perms.Modify || !perms.Create || !perms.Download {
-		t.Fatalf("scope permissions after migration: %+v", perms)
-	}
-	if user.BackendScopes[0].Scope != "/legacy-bolt-user" {
-		t.Fatalf("createUserDir scope=%q", user.BackendScopes[0].Scope)
-	}
-}
-
-func TestMigrateUsersFlow_existingScopeGetsLegacyGlobalFileOps(t *testing.T) {
-	loadMigrateTestConfig(t, "../../_docker/src/proxy/backend/config.yaml")
-
-	user := &users.User{
-		FrontendUser: users.FrontendUser{
-			Username: "scoped",
-			Permissions: users.Permissions{
-				Download: true,
-				Modify:   false,
-				Create:   false,
-				Share:    true,
-			},
-		},
-		BackendScopes: []users.BackendScope{
-			{Path: settings.Config.Server.Sources[0].Path, Scope: "/"},
-		},
-		Version: 2,
-	}
-
-	users.MigrateToSourcePermissions(user)
-	perms := user.BackendScopes[0].Permissions
-	if !perms.Download || perms.Modify || perms.Create {
-		t.Fatalf("expected legacy global copied to scope: %+v", perms)
-	}
-}
-
-func loadMigrateTestConfig(t *testing.T, path string) {
-	t.Helper()
-	settings.Config = settings.SetDefaults(true)
-	if err := settings.LoadConfigWithDefaultsForTest(path); err != nil {
-		t.Fatal(err)
-	}
-}
@@ -1,142 +0,0 @@
-package cmd
-
-import (
-	"path/filepath"
-	"testing"
-
-	"github.com/gtsteffaniak/filebrowser/backend/internal/database/share"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/database/sqldb"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/database/users"
-	"github.com/gtsteffaniak/filebrowser/backend/pkg/settings"
-)
-
-func TestMigrationFixturePostState(t *testing.T) {
-	t.Setenv("FILEBROWSER_ONLYOFFICE_SECRET", "")
-	settings.Initialize(settingsMigrationConfigPath(t))
-	settings.Env.IsPlaywright = true
-	alignSettingsSourcesForMigrationFixture(t)
-
-	dbPath := filepath.Join(t.TempDir(), "filebrowser.sqlite")
-	settings.Config.Server.DatabaseV2.Path = dbPath
-	settings.Config.Server.DatabaseV2.MigrateFrom = settingsMigrationBoltPath(t)
-
-	if err := migrateFromBoltToSQLite(); err != nil {
-		t.Fatal(err)
-	}
-
-	sqlStore, _, err := sqldb.NewSQLStoreWithOptions(dbPath, sqldb.NewSQLStoreOpts{SkipQuickSetup: true})
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer sqlStore.Close()
-
-	playwrightPath := fixturePlaywrightSource
-	dockerPath := fixtureDockerSource
-	accessPath := fixtureAccessSource
-
-	admin, err := sqlStore.GetUserByUsername("admin")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !admin.Permissions.Admin || !admin.Permissions.Api || !admin.Permissions.Share {
-		t.Fatalf("admin globals=%+v", admin.Permissions)
-	}
-	if admin.Permissions.Realtime {
-		t.Fatal("admin realtime should be false")
-	}
-
-	fullPerms := users.SourceFilePermissions{
-		View: true, Download: true, Modify: true, Create: true, Delete: true,
-	}
-	for _, sourcePath := range []string{playwrightPath, dockerPath, accessPath} {
-		assertSourceFilePerms(t, admin, sourcePath, fullPerms)
-	}
-
-	customized, ok := admin.Tokens["customized"]
-	if !ok {
-		t.Fatal("customized token missing")
-	}
-	if !customized.Permissions.Admin {
-		t.Fatalf("customized token globals=%+v", customized.Permissions)
-	}
-	if customized.Permissions.Api || customized.Permissions.Share || customized.Permissions.Realtime {
-		t.Fatalf("customized token should only have admin global: %+v", customized.Permissions)
-	}
-	if customized.Permissions.Modify || customized.Permissions.Create || customized.Permissions.Delete || customized.Permissions.Download {
-		t.Fatalf("customized token legacy file ops should be stripped: %+v", customized.Permissions)
-	}
-
-	basic, err := sqlStore.GetUserByUsername("basic")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !basic.Permissions.Share || basic.Permissions.Admin || basic.Permissions.Api {
-		t.Fatalf("basic globals=%+v", basic.Permissions)
-	}
-	viewOnly := users.SourceFilePermissions{View: true}
-	for _, sourcePath := range []string{playwrightPath, dockerPath, accessPath} {
-		assertSourceFilePerms(t, basic, sourcePath, viewOnly)
-	}
-
-	graham, err := sqlStore.GetUserByUsername("graham")
-	if err != nil {
-		t.Fatal(err)
-	}
-	grahamPerms := users.SourceFilePermissions{
-		View: true, Download: true, Modify: true, Create: true, Delete: false,
-	}
-	assertSourceFilePerms(t, graham, playwrightPath, grahamPerms)
-	assertSourceFilePerms(t, graham, dockerPath, grahamPerms)
-
-	allRules, err := sqlStore.GetAllAccessRules()
-	if err != nil {
-		t.Fatal(err)
-	}
-	playwrightRules := allRules[playwrightPath]
-	if rule, ok := playwrightRules["/text-files/bash.sh/"]; !ok || len(rule.Deny.Users) != 1 {
-		t.Fatalf("playwright access rule=%+v ok=%v", rule, ok)
-	} else if _, denied := rule.Deny.Users["admin"]; !denied {
-		t.Fatalf("playwright access rule deny=%+v", rule.Deny.Users)
-	}
-
-	accessRules := allRules[accessPath]
-	if len(accessRules) != 1 {
-		t.Fatalf("access source rule count=%d", len(accessRules))
-	}
-	if rule, ok := accessRules["/"]; !ok || len(rule.Deny.Users) != 1 {
-		t.Fatalf("access source rule=%+v ok=%v", rule, ok)
-	} else if _, denied := rule.Deny.Users["basic"]; !denied {
-		t.Fatalf("access source rule deny=%+v", rule.Deny.Users)
-	}
-
-	shares, err := sqlStore.GetSharesByUserID(admin.ID)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(shares) != 2 {
-		t.Fatalf("share count=%d", len(shares))
-	}
-	shareByHash := make(map[string]*share.Share, len(shares))
-	for _, s := range shares {
-		shareByHash[s.Hash] = s
-	}
-	if link, ok := shareByHash["lMhwHkF-hqCN92-QIJJZow"]; !ok || link.Path != "/myfolder/" ||
-		!link.AllowModify || !link.AllowCreate || !link.AllowDelete {
-		t.Fatalf("myfolder share=%+v", link)
-	}
-	if link, ok := shareByHash["dGhQi4AcMhva2Ne-7x7fvw"]; !ok || link.Path != "/test & test.txt/" ||
-		link.AllowModify || link.AllowCreate || link.AllowDelete {
-		t.Fatalf("test share=%+v", link)
-	}
-}
-
-func assertSourceFilePerms(t *testing.T, user *users.User, sourcePath string, want users.SourceFilePermissions) {
-	t.Helper()
-	got, ok := user.BackendSourcePermissions[sourcePath]
-	if !ok {
-		t.Fatalf("user %q missing source permissions for %q", user.Username, sourcePath)
-	}
-	if got != want {
-		t.Fatalf("user %q source %q perms=%+v want=%+v", user.Username, sourcePath, got, want)
-	}
-}
@@ -1,124 +0,0 @@
-package cmd
-
-import (
-	"path/filepath"
-	"testing"
-
-	storm "github.com/asdine/storm/v3"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/database/sqldb"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/database/users"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/usersidebar"
-	"github.com/gtsteffaniak/filebrowser/backend/pkg/settings"
-)
-
-func writeSidebarMigrationBolt(t *testing.T, path string) {
-	t.Helper()
-	db, err := storm.Open(path)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer db.Close()
-
-	user := &users.User{
-		ID: 1,
-		FrontendUser: users.FrontendUser{
-			NonAdminEditable: users.NonAdminEditable{
-				Password: "$2a$10$IYCsziHjzH0mPc.bZwRuXefQKPVXfFqjdyfVmNcL.XZJsgyfxljDy",
-				SidebarLinks: []users.SidebarLink{
-					{
-						Name:       "My Files",
-						Category:   string(users.SidebarLinkSourceMinimal),
-						Icon:       "folder",
-						SourceName: fixturePlaywrightSource,
-						Target:     "/",
-					},
-					{
-						Name:     "External Docs",
-						Category: string(users.SidebarLinkCustom),
-						Target:   "https://example.com/docs",
-						Icon:     "link",
-					},
-				},
-			},
-			Username:    "sidebaruser",
-			LoginMethod: users.LoginMethodPassword,
-			FrontendScopes: []users.FrontendScope{
-				{Name: fixturePlaywrightSource, Scope: "/"},
-				{Name: fixtureDockerSource, Scope: "/"},
-			},
-			Permissions: users.Permissions{
-				Download: true,
-			},
-		},
-		Version: 3,
-	}
-	if err := db.Save(user); err != nil {
-		t.Fatal(err)
-	}
-}
-
-func TestMigrationSidebarLinks_customMinimalPartialScopesAndCustomURL(t *testing.T) {
-	t.Setenv("FILEBROWSER_ONLYOFFICE_SECRET", "")
-	settings.Initialize(settingsMigrationConfigPath(t))
-	settings.Env.IsPlaywright = true
-	alignSettingsSourcesForMigrationFixture(t)
-
-	boltPath := filepath.Join(t.TempDir(), "sidebar-migration.db.old")
-	writeSidebarMigrationBolt(t, boltPath)
-
-	dbPath := filepath.Join(t.TempDir(), "filebrowser.sqlite")
-	settings.Config.Server.DatabaseV2.Path = dbPath
-	settings.Config.Server.DatabaseV2.MigrateFrom = boltPath
-
-	if err := migrateFromBoltToSQLite(); err != nil {
-		t.Fatal(err)
-	}
-
-	sqlStore, _, err := sqldb.NewSQLStoreWithOptions(dbPath, sqldb.NewSQLStoreOpts{SkipQuickSetup: true})
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer sqlStore.Close()
-
-	sidebarUser, err := sqlStore.GetUserByUsername("sidebaruser")
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	links := sidebarUser.SidebarLinks
-	if len(links) < 3 {
-		t.Fatalf("sidebaruser links=%#v, want at least 3 after scope merge", links)
-	}
-
-	var minimalLink *users.SidebarLink
-	var customLink *users.SidebarLink
-	var dockerLink *users.SidebarLink
-	for i := range links {
-		link := links[i]
-		switch {
-		case link.Category == string(users.SidebarLinkSourceMinimal):
-			minimalLink = &links[i]
-		case link.Category == string(users.SidebarLinkCustom):
-			customLink = &links[i]
-		case link.SourceName == fixtureDockerSource || link.Name == "docker":
-			dockerLink = &links[i]
-		}
-	}
-	if minimalLink == nil {
-		t.Fatalf("missing source-minimal link in %#v", links)
-	}
-	if minimalLink.Name != "My Files" || minimalLink.Icon != "folder" {
-		t.Fatalf("custom minimal link not preserved: %#v", *minimalLink)
-	}
-	if customLink == nil || customLink.Name != "External Docs" || customLink.Target != "https://example.com/docs" {
-		t.Fatalf("custom link not preserved: %#v", customLink)
-	}
-	if dockerLink == nil {
-		t.Fatalf("docker scope link missing after merge: %#v", links)
-	}
-
-	frontendLinks := usersidebar.FrontendLinks(links, true)
-	if len(frontendLinks) < 3 {
-		t.Fatalf("frontend links=%#v", frontendLinks)
-	}
-}
@@ -3,7 +3,7 @@ package cmd
 import (
 	"net/http"

-	"github.com/gtsteffaniak/filebrowser/backend/pkg/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
 	"github.com/gtsteffaniak/go-logger/logger"
 )

@@ -11,48 +11,47 @@ import (

 	_ "net/http/pprof"

-	"github.com/gtsteffaniak/filebrowser/backend/internal/adapters/fs/fileutils"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/analytics"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/app"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/icons"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/preview"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/state"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/utils"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/version"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/web"
-	"github.com/gtsteffaniak/filebrowser/backend/pkg/indexing"
-	"github.com/gtsteffaniak/filebrowser/backend/pkg/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/fileutils"
+	"github.com/gtsteffaniak/filebrowser/backend/auth"
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
+	"github.com/gtsteffaniak/filebrowser/backend/common/version"
+	"github.com/gtsteffaniak/filebrowser/backend/database/storage"
+	"github.com/gtsteffaniak/filebrowser/backend/database/storage/bolt"
+	"github.com/gtsteffaniak/filebrowser/backend/ffmpeg"
+	fbhttp "github.com/gtsteffaniak/filebrowser/backend/http"
+	"github.com/gtsteffaniak/filebrowser/backend/icons"
+	"github.com/gtsteffaniak/filebrowser/backend/indexing"
+	"github.com/gtsteffaniak/filebrowser/backend/preview"
 	"github.com/gtsteffaniak/filebrowser/backend/swagger/docs"
 	"github.com/gtsteffaniak/go-logger/logger"
 	"github.com/swaggo/swag"
 )

-var runtimeApp *app.App
+var store *bolt.BoltStore

-func initializeDatabase(configFile string) bool {
+func getStore(configFile string) bool {
+	// Use the config file (global flag)
 	settings.Initialize(configFile)
-
-	if err := validateDatabasePaths(); err != nil {
-		logger.Fatalf("%v", err)
-	}
-
-	if checkMigrationNeeded() {
-		logger.Info("Old database detected, starting migration...")
-		err := migrateFromBoltToSQLite()
-		if err != nil {
-			logger.Fatalf("Migration failed: %v", err)
-		}
-	}
-
-	store, existingDb, err := state.Open(settings.Config.Server.DatabaseV2.Path)
+	s, hasDB, err := storage.InitializeDb(settings.Config.Server.Database)
 	if err != nil {
-		logger.Fatalf("could not initialize state: %v", err)
+		logger.Fatalf("could not load db info: %v", err)
 	}
-	runtimeApp, err = app.WireServices(store)
-	if err != nil {
-		logger.Fatalf("could not wire services: %v", err)
-	}
-	return existingDb
+	store = s
+	return hasDB
+}
+
+func generalUsage() {
+	fmt.Printf(`usage: ./filebrowser <command> [options]
+commands:
+	-h    	Print help
+	-c    	Print the default config file
+	version Print version information
+	set -u	Username and password for the new user
+	set -a	Create user as admin
+	set -s	Specify a user scope
+	set -h	Print this help message
+`)
 }

 func StartFilebrowser() {
@@ -60,9 +59,9 @@ func StartFilebrowser() {
 	if !keepGoing {
 		return
 	}
-	database := fmt.Sprintf("Using existing database  : %v", settings.Config.Server.DatabaseV2.Path)
+	database := fmt.Sprintf("Using existing database  : %v", settings.Config.Server.Database)
 	if !dbExists {
-		database = fmt.Sprintf("Creating new database    : %v", settings.Config.Server.DatabaseV2.Path)
+		database = fmt.Sprintf("Creating new database    : %v", settings.Config.Server.Database)
 	}
 	if !settings.Config.Server.DisableUpdateCheck {
 		info, _ := utils.CheckForUpdates()
@@ -84,8 +83,8 @@ func StartFilebrowser() {
 	shutdownComplete := make(chan struct{}) // Signals shutdown process is complete

 	// Dev mode enables development features like template hot-reloading
-	_, err := os.Stat("internal/web/dist")
-	// In dev mode, always use filesystem assets. Otherwise, check if internal/web/dist exists
+	_, err := os.Stat("http/dist")
+	// In dev mode, always use filesystem assets. Otherwise, check if http/dist exists
 	if !settings.Env.IsDevMode {
 		settings.Env.EmbeddedFs = os.IsNotExist(err)
 	}
@@ -116,7 +115,7 @@ func StartFilebrowser() {
 	}
 	serverConfig := settings.Config.Server
 	swagInfo := docs.SwaggerInfo
-	swagInfo.BasePath = settings.Config.Http.BaseURL
+	swagInfo.BasePath = serverConfig.BaseURL
 	swag.Register(docs.SwaggerInfo.InstanceName(), swagInfo)
 	// initialize indexing and schedule indexing ever n minutes (default 5)
 	if len(settings.Config.Server.SourceMap) == 0 {
@@ -129,24 +128,26 @@ func StartFilebrowser() {
 		logger.Fatalf("Failed to initialize index database: %v", err)
 	}

-	// Index metadata persistence is wired from app.WireServices during initializeDatabase.
-	if isNewDb {
-		if err := state.ResetAllIndexComplexities(); err != nil {
-			logger.Errorf("Failed to reset index complexities: %v", err)
+	// Set indexing storage for persistence
+	if store != nil && store.Indexing != nil {
+		indexing.SetIndexingStorage(store.Indexing)
+		if isNewDb {
+			if err := store.Indexing.ResetAllComplexities(); err != nil {
+				logger.Errorf("Failed to reset index complexities: %v", err)
+			}
 		}
 	}

 	for _, source := range settings.Config.Server.SourceMap {
 		go indexing.Initialize(source, false, isNewDb)
 	}
-	analytics.StartReporter()
 	validateUserInfo(!dbExists)
 	validateOfficeIntegration()
 	validateAccessRules()
 	validateShareInfo()
 	// Start the rootCMD in a goroutine
 	go func() {
-		if err := rootCMD(ctx, &serverConfig, runtimeApp, shutdownComplete); err != nil {
+		if err := rootCMD(ctx, store, &serverConfig, shutdownComplete); err != nil {
 			logger.Fatalf("Error starting filebrowser: %v", err)
 		}
 		close(done) // Signal that the server has stopped
@@ -182,16 +183,17 @@ func StartFilebrowser() {
 	logger.Info("Shutdown complete.")
 }

-func rootCMD(ctx context.Context, serverConfig *settings.Server, a *app.App, shutdownComplete chan struct{}) error {
+func rootCMD(ctx context.Context, store *bolt.BoltStore, serverConfig *settings.Server, shutdownComplete chan struct{}) error {
 	if serverConfig.NumImageProcessors < 1 {
 		logger.Fatal("Image resize workers count could not be < 1")
 	}
 	cacheDir := settings.Config.Server.CacheDir
 	numWorkers := settings.Config.Server.NumImageProcessors
+	ffmpeg.SetFFmpegPaths()

 	// Initialize asset filesystem before starting services
 	if settings.Env.EmbeddedFs {
-		embeddedAssets := web.GetEmbeddedAssets()
+		embeddedAssets := fbhttp.GetEmbeddedAssets()
 		subAssets, err := fs.Sub(embeddedAssets, "embed")
 		if err != nil {
 			logger.Fatalf("Failed to create sub filesystem: %v", err)
@@ -207,6 +209,8 @@ func rootCMD(ctx context.Context, serverConfig *settings.Server, a *app.App, shu
 		logger.Fatalf("Error starting preview service: %v", err)
 	}
 	logger.Debugf("MuPDF Enabled            : %v", settings.Env.MuPdfAvailable)
+	logger.Debugf("Media Enabled            : %v", settings.MediaEnabled())
+	logger.Debugf("Exiftool Enabled         : %v", settings.Config.Integrations.Media.ExiftoolPath != "")

 	// Generate PWA icons after preview service is initialized
 	if err := icons.GeneratePWAIcons(); err != nil {
@@ -216,10 +220,11 @@ func rootCMD(ctx context.Context, serverConfig *settings.Server, a *app.App, shu
 	// Initialize PWA manifest after icons are generated
 	icons.InitializePWAManifest()

-	web.StartHttp(ctx, web.Deps{
-		Store: a.Store,
-		Files: a.Files,
-		Auth:  a.Auth,
-	}, shutdownComplete)
+	// Initialize WebAuthn/Passkey service if enabled
+	if err := auth.InitWebAuthn(); err != nil {
+		logger.Fatalf("Failed to initialize WebAuthn: %v", err)
+	}
+
+	fbhttp.StartHttp(ctx, store, shutdownComplete)
 	return nil
 }
@@ -1,15 +1,18 @@
 package cmd

 import (
-	"github.com/gtsteffaniak/filebrowser/backend/internal/database/share"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/database/users"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/state"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
 	"github.com/gtsteffaniak/go-logger/logger"
 )

 // validateShareInfo migrates share links to add default sidebar links
 func validateShareInfo() {
-	shares, err := state.GetAllShares()
+	if store.Share == nil {
+		return
+	}
+
+	// Get all shares
+	shares, err := store.Share.All()
 	if err != nil {
 		logger.Debugf("No shares found or error getting shares: %v", err)
 		return
@@ -19,28 +22,27 @@ func validateShareInfo() {
 	for _, link := range shares {
 		// Check if this share needs migration (version not set or 0)
 		if link.Version == 0 {
-			hash := link.Hash
+			// Add default sidebar links
+			link.SidebarLinks = []users.SidebarLink{
+				{
+					Name:     "Share QR Code and Info",
+					Category: "shareInfo",
+					Target:   "#",
+					Icon:     "qr_code",
+				},
+				{
+					Name:     "Download",
+					Category: "download",
+					Target:   "#",
+					Icon:     "download",
+				},
+			}
+
+			// Set version to 1 to indicate migration is complete
+			link.Version = 1
+
 			// Save the updated share
-			if err := state.UpdateShare(hash, func(existingShare *share.Share) error {
-				// Set version to 1 to indicate migration is complete
-				existingShare.Version = 1
-				// Add default sidebar links
-				existingShare.SidebarLinks = []users.SidebarLink{
-					{
-						Name:     "Share QR Code and Info",
-						Category: "shareInfo",
-						Target:   "#",
-						Icon:     "qr_code",
-					},
-					{
-						Name:     "Download",
-						Category: "download",
-						Target:   "#",
-						Icon:     "download",
-					},
-				}
-				return nil
-			}); err != nil {
+			if err := store.Share.Save(link); err != nil {
 				logger.Errorf("Failed to migrate share %s: %v", link.Hash, err)
 				continue
 			}
@@ -6,11 +6,9 @@ import (
 	"reflect"
 	"strings"

-	"github.com/gtsteffaniak/filebrowser/backend/internal/adapters/fs/fileutils"
-	"github.com/gtsteffaniak/filebrowser/backend/pkg/settings"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/database/users"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/state"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/usersidebar"
+	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/fileutils"
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
 	"github.com/gtsteffaniak/go-logger/logger"
 )

@@ -18,136 +16,121 @@ var createBackup = false

 func validateUserInfo(newDB bool) {
 	// update source info for users if names/sources/paths might have changed
-	usersList, err := state.GetAllUsers()
+	usersList, err := store.Users.Gets()
 	if err != nil {
 		logger.Fatalf("could not load users: %v", err)
 	}
-	for i := range usersList {
-		user := &usersList[i]
-		changedFields := make([]string, 0, 8)
+	for _, user := range usersList {
 		changePass := false
-
+		updateUser := false
 		if updateUserScopes(user) {
-			changedFields = append(changedFields, "backendScopes")
+			updateUser = true
 		}
 		if updatePermissions(user) {
-			changedFields = append(changedFields, "permissions", "perm", "version")
-		}
-		if updateSourcePermissions(user) {
-			changedFields = append(changedFields, "backendScopes", "backendSourcePermissions", "version")
+			updateUser = true
 		}
 		if updatePreviewSettings(user) {
-			changedFields = append(changedFields, "preview")
+			updateUser = true
 		}
 		if updateLoginType(user) {
-			changedFields = append(changedFields, "loginMethod")
+			updateUser = true
 		}
 		if updateShowFirstLogin(user) {
-			changedFields = append(changedFields, "showFirstLogin")
+			updateUser = true
 		}
 		if updateSidebarLinks(user) {
-			changedFields = append(changedFields, "sidebarLinks")
+			updateUser = true
 		}
 		if updateTokens(user) {
-			changedFields = append(changedFields, "tokens", "version")
+			updateUser = true
 		}
-		if normalizeApiTokenPermissions(user) {
-			changedFields = append(changedFields, "tokens")
-		}
-		if state.ApplyEnforcedSyncToUser(user) {
-			changedFields = append(changedFields, settings.UserJSONFieldsForEnforcedSync()...)
-		}
-		if state.ApplyEnforcedSourcePermissionsSyncToUser(user) {
-			changedFields = append(changedFields, "backendScopes", "backendSourcePermissions")
-		}
-		if user.Version < users.ProfileStorageVersion {
-			user.Version = users.ProfileStorageVersion
-			changedFields = append(changedFields, "version")
+		if updateShowToolsInSidebar(user) {
+			updateUser = true
 		}
 		adminUser := settings.Config.Auth.AdminUsername
-		if adminUser == "" {
-			adminUser = "admin"
-		}
-		if user.Username == adminUser && user.Permissions.Admin {
-			adminPerms := settings.AdminPerms()
-			if user.Permissions.Share != adminPerms.Share || user.Permissions.Api != adminPerms.Api {
-				user.Permissions.Share = adminPerms.Share
-				user.Permissions.Api = adminPerms.Api
-				user.Permissions.Admin = true
-				changedFields = append(changedFields, "permissions")
-			}
-		}
-		if user.Username == adminUser && settings.Config.Auth.AdminPassword != "" && user.LoginMethod == users.LoginMethodPassword {
+		adminPass := settings.Config.Auth.AdminPassword
+		if user.Username == adminUser && adminPass != "" && user.LoginMethod == users.LoginMethodPassword {
 			logger.Info("Resetting admin user to default username and password.")
-			user.Permissions = settings.AdminPerms()
+			user.Permissions.Admin = true
 			user.Password = settings.Config.Auth.AdminPassword
-			changedFields = append(changedFields, "permissions", "password")
+			updateUser = true
 			changePass = true
 		}
-
-		changedFields = dedupeFields(changedFields)
-		if len(changedFields) == 0 {
-			continue
-		}
-
-		skipCreateBackup := os.Getenv("FILEBROWSER_DISABLE_AUTOMATIC_BACKUP") == "true" || newDB
-		if createBackup && !skipCreateBackup {
-			logger.Warning("Incompatible user settings detected, creating backup of database before converting.")
-			err = fileutils.CopyFile(settings.Config.Server.DatabaseV2.Path, fmt.Sprintf("%s.bak", settings.Config.Server.DatabaseV2.Path))
+		if updateUser {
+			skipCreateBackup := os.Getenv("FILEBROWSER_DISABLE_AUTOMATIC_BACKUP") == "true" || newDB
+			if createBackup && !skipCreateBackup {
+				logger.Warning("Incompatible user settings detected, creating backup of database before converting.")
+				err = fileutils.CopyFile(settings.Config.Server.Database, fmt.Sprintf("%s.bak", settings.Config.Server.Database))
+				if err != nil {
+					logger.Fatalf("Unable to create automatic backup of database due to error: %v", err)
+				}
+			}
+			fields := []string{"Scopes", "SidebarLinks", "Tokens", "Permissions", "Preview", "ShowFirstLogin", "LoginMethod", "Version", "ShowToolsInSidebar"}
+			if changePass {
+				fields = append(fields, "Password")
+			}
+			err := store.Users.Update(user, true, fields...)
 			if err != nil {
-				logger.Fatalf("Unable to create automatic backup of database due to error: %v", err)
+				logger.Errorf("could not update user: %v", err)
 			}
 		}
-		plainPass := ""
-		if changePass {
-			plainPass = user.Password
-		}
-		if err := state.UpdateUser(user, plainPass, changedFields...); err != nil {
-			logger.Errorf("could not update user: %v", err)
-		}
 	}
 }

-func dedupeFields(fields []string) []string {
-	seen := make(map[string]struct{}, len(fields))
-	out := make([]string, 0, len(fields))
-	for _, field := range fields {
-		field = strings.TrimSpace(field)
-		if field == "" {
-			continue
-		}
-		key := strings.ToLower(field)
-		if _, ok := seen[key]; ok {
-			continue
-		}
-		seen[key] = struct{}{}
-		out = append(out, field)
-	}
-	return out
-}
-
 func updateUserScopes(user *users.User) bool {
-	newScopes := settings.MergeDefaultEnabledBackendScopes(user.BackendScopes)
-	changed := !reflect.DeepEqual(user.BackendScopes, newScopes)
-	user.BackendScopes = newScopes
+	newScopes := []users.SourceScope{}
+	seen := make(map[string]struct{})
+
+	// Build map of existing scopes keyed by canonical source path (DB may use path or display name).
+	existing := make(map[string]users.SourceScope)
+	for _, s := range user.Scopes {
+		if info, ok := users.ResolveSourceKey(s.Name); ok {
+			existing[info.Path] = s
+		}
+	}
+
+	// Preserve order by using Config.Server.Sources
+	for _, src := range settings.Config.Server.Sources {
+		existingScope, ok := existing[src.Path]
+		if ok {
+			// If scope is empty and there's a default, apply default
+			if existingScope.Scope == "" {
+				existingScope.Scope = src.Config.DefaultUserScope
+			}
+		} else if src.Config.DefaultEnabled {
+			existingScope.Scope = src.Config.DefaultUserScope
+		} else {
+			continue
+		}
+		newScopes = append(newScopes, users.SourceScope{
+			Name:  src.Path,
+			Scope: existingScope.Scope,
+		})
+		seen[src.Path] = struct{}{}
+	}
+
+	// Preserve explicit or legacy scopes not already merged (e.g. non-defaultEnabled sources, removed sources).
+	for _, s := range user.Scopes {
+		if info, ok := users.ResolveSourceKey(s.Name); ok {
+			if _, already := seen[info.Path]; already {
+				continue
+			}
+		}
+		newScopes = append(newScopes, s)
+	}
+	changed := !reflect.DeepEqual(user.Scopes, newScopes)
+	user.Scopes = newScopes
 	return changed
 }

-func updateSourcePermissions(user *users.User) bool {
-	changed := false
-	if user.Version < users.SourcePermissionsMigrationVersion {
-		if users.MigrateToSourcePermissions(user) {
-			changed = true
-		}
+// updateShowToolsInSidebar one-time defaults for legacy users (Version < CurrentUserMigrationVersion) from configured userDefaults.
+func updateShowToolsInSidebar(user *users.User) bool {
+	if user.Version >= 3 {
+		return false
 	}
-	if users.EnsureSourcePermissionsForScopes(
-		user,
-		settings.DefaultSourceFilePermissions(),
-		settings.AdminSourceFilePermissions(),
-	) {
-		changed = true
-	}
-	return changed
+	user.ShowToolsInSidebar = true
+	user.Version = users.CurrentUserMigrationVersion
+	return true
 }

 func updateShowFirstLogin(user *users.User) bool {
@@ -164,7 +147,6 @@ func updatePermissions(user *users.User) bool {
 		return false
 	}
 	updateUser := true
-	user.Permissions.Download = true
 	// if any keys are true, set the permissions to true
 	if user.Perm.Api {
 		user.Permissions.Api = true
@@ -206,7 +188,7 @@ func updatePermissions(user *users.User) bool {
 		user.Permissions.Delete = true
 		updateUser = true
 	}
-	user.Version = 2
+	user.Version = users.CurrentUserMigrationVersion
 	if updateUser {
 		createBackup = true
 	}
@@ -231,37 +213,58 @@ func updatePreviewSettings(user *users.User) bool {
 	return false
 }

-// updateSidebarLinks normalizes sidebar links and ensures scoped sources have sidebar entries.
+// updateSidebarLinks checks if user has stale source links and rebuilds them if needed
 func updateSidebarLinks(user *users.User) bool {
-	updated := false
+	// Count source links and check if any are still valid
+	sourceLinksCount := 0
+	validSourceLinksCount := 0

-	if normalized, changed := usersidebar.NormalizeSidebarLinks(user.SidebarLinks); changed {
-		user.SidebarLinks = normalized
-		updated = true
+	for _, link := range user.SidebarLinks {
+		if strings.HasPrefix(link.Category, "source") {
+			sourceLinksCount++
+			if link.SourceName == "" {
+				continue
+			}
+			if _, ok := users.ResolveSourceKey(link.SourceName); ok {
+				validSourceLinksCount++
+			}
+		}
 	}

-	if !usersidebar.NeedsSidebarLinksFromScopes(user.SidebarLinks, user.BackendScopes) {
-		return updated
+	// If user has no source links, don't update anything
+	if sourceLinksCount == 0 {
+		return false
 	}

-	if usersidebar.ValidSourceSidebarLinkCount(user.SidebarLinks) == 0 && len(user.SidebarLinks) > 0 {
-		logger.Infof("User %s has stale source sidebar links, merging missing links from scopes", user.Username)
-	} else if usersidebar.ValidSourceSidebarLinkCount(user.SidebarLinks) == 0 {
-		logger.Infof("User %s has no source sidebar links, building from scopes", user.Username)
-	} else {
-		logger.Infof("User %s is missing sidebar links for some scoped sources, merging from scopes", user.Username)
+	// If user has source links but NONE are valid, rebuild from their scopes
+	if validSourceLinksCount == 0 {
+		// Remove all existing source links
+		newLinks := []users.SidebarLink{}
+		for _, link := range user.SidebarLinks {
+			if !strings.HasPrefix(link.Category, "source") {
+				newLinks = append(newLinks, link)
+			}
+		}
+
+		for _, scope := range user.Scopes {
+			info, ok := users.ResolveSourceKey(scope.Name)
+			if !ok {
+				continue
+			}
+			newLinks = append(newLinks, users.SidebarLink{
+				Name:       info.Name,
+				Category:   "source",
+				Target:     "/",
+				Icon:       "",
+				SourceName: info.Path,
+			})
+		}
+
+		user.SidebarLinks = newLinks
+		return true
 	}

-	merged, changed := usersidebar.EnsureSidebarLinksFromScopes(user.SidebarLinks, user.BackendScopes)
-	if changed {
-		user.SidebarLinks = merged
-		updated = true
-	}
-	if normalized, changed := usersidebar.NormalizeSidebarLinks(user.SidebarLinks); changed {
-		user.SidebarLinks = normalized
-		updated = true
-	}
-	return updated
+	return false
 }

 func updateTokens(user *users.User) bool {
@@ -272,29 +275,9 @@ func updateTokens(user *users.User) bool {
 		user.Tokens = make(map[string]users.AuthToken)
 		for name, token := range user.ApiKeys {
 			token.Token = token.Key
-			token.Name = name
-			users.StoreToken(user.Tokens, token)
+			user.Tokens[name] = token
 		}
 	}
-	user.Version = 2
+	user.Version = users.CurrentUserMigrationVersion
 	return true
 }
-
-func normalizeApiTokenPermissions(user *users.User) bool {
-	if user == nil || len(user.Tokens) == 0 {
-		return false
-	}
-	changed := false
-	for name, token := range user.Tokens {
-		if token.Name == "" || name != token.Name {
-			continue
-		}
-		sanitized := users.SanitizeTokenPermissions(token.Permissions)
-		if sanitized != token.Permissions {
-			token.Permissions = sanitized
-			user.Tokens[name] = token
-			changed = true
-		}
-	}
-	return changed
-}
@@ -1,124 +0,0 @@
-package cmd
-
-import (
-	"path/filepath"
-	"testing"
-
-	"github.com/gtsteffaniak/filebrowser/backend/internal/database/sqldb"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/database/users"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/usersidebar"
-	"github.com/gtsteffaniak/filebrowser/backend/pkg/settings"
-)
-
-func TestUpdateUserScopes_mergesMissingDefaultEnabled(t *testing.T) {
-	settings.Initialize(settingsMigrationConfigPath(t))
-	alignSettingsSourcesForMigrationFixture(t)
-
-	user := &users.User{
-		FrontendUser: users.FrontendUser{Username: "graham"},
-		BackendScopes: []users.BackendScope{
-			{Path: fixturePlaywrightSource, Scope: "/myfolder"},
-			{Path: fixtureDockerSource, Scope: "/"},
-		},
-	}
-
-	if !updateUserScopes(user) {
-		t.Fatal("expected missing defaultEnabled access source to be merged")
-	}
-	if len(user.BackendScopes) != 3 {
-		t.Fatalf("scopes=%#v want 3 including access", user.BackendScopes)
-	}
-	found := false
-	for _, scope := range user.BackendScopes {
-		if scope.Path == fixtureAccessSource {
-			found = true
-			break
-		}
-	}
-	if !found {
-		t.Fatalf("access source should be added for defaultEnabled: %#v", user.BackendScopes)
-	}
-	// Preserve existing scope paths
-	for _, scope := range user.BackendScopes {
-		if scope.Path == fixturePlaywrightSource && scope.Scope != "/myfolder" {
-			t.Fatalf("playwright scope path changed: %#v", scope)
-		}
-	}
-}
-
-func TestMigrationGraham_gainsAccessAfterScopeMerge(t *testing.T) {
-	t.Setenv("FILEBROWSER_ONLYOFFICE_SECRET", "")
-	settings.Initialize(settingsMigrationConfigPath(t))
-	settings.Env.IsPlaywright = true
-	alignSettingsSourcesForMigrationFixture(t)
-
-	dbPath := filepath.Join(t.TempDir(), "filebrowser.sqlite")
-	settings.Config.Server.DatabaseV2.Path = dbPath
-	settings.Config.Server.DatabaseV2.MigrateFrom = settingsMigrationBoltPath(t)
-	if err := migrateFromBoltToSQLite(); err != nil {
-		t.Fatal(err)
-	}
-
-	sqlStore, _, err := sqldb.NewSQLStoreWithOptions(dbPath, sqldb.NewSQLStoreOpts{SkipQuickSetup: true})
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer sqlStore.Close()
-
-	graham, err := sqlStore.GetUserByUsername("graham")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if graham.BackendSourcePermissions == nil {
-		t.Fatal("expected backend source permissions after migration")
-	}
-	// Migration fixture itself may omit access; merge happens in updateUserScopes.
-	if _, ok := graham.BackendSourcePermissions[fixtureAccessSource]; ok {
-		t.Fatalf("graham should not have access permissions from migration alone: %#v", graham.BackendSourcePermissions)
-	}
-
-	updateUserScopes(graham)
-	updateSourcePermissions(graham)
-	updateSidebarLinks(graham)
-
-	foundScope := false
-	for _, scope := range graham.BackendScopes {
-		if scope.Path == fixtureAccessSource {
-			foundScope = true
-			break
-		}
-	}
-	if !foundScope {
-		t.Fatalf("graham should gain access scope after merge: %#v", graham.BackendScopes)
-	}
-	if _, ok := graham.BackendSourcePermissions[fixtureAccessSource]; !ok {
-		t.Fatalf("graham should have access source permissions after merge: %#v", graham.BackendSourcePermissions)
-	}
-
-	foundLink := false
-	for _, link := range usersidebar.FrontendLinks(graham.SidebarLinks, true) {
-		if link.Name == "access" || link.SourceName == fixtureAccessSource {
-			foundLink = true
-			break
-		}
-	}
-	if !foundLink {
-		t.Fatalf("graham should have access sidebar link after merge: %#v", graham.SidebarLinks)
-	}
-}
-
-func TestUpdateUserScopes_seedsDefaultEnabledWhenEmpty(t *testing.T) {
-	settings.Initialize(settingsMigrationConfigPath(t))
-	alignSettingsSourcesForMigrationFixture(t)
-
-	user := &users.User{
-		FrontendUser: users.FrontendUser{Username: "newuser"},
-	}
-
-	if !updateUserScopes(user) {
-		t.Fatal("expected default-enabled scopes to be seeded")
-	}
-	if len(user.BackendScopes) != 3 {
-		t.Fatalf("scopes=%#v want all default-enabled sources", user.BackendScopes)
-	}
-}
@@ -1,79 +0,0 @@
-package cmd
-
-import (
-	"strings"
-	"testing"
-
-	"github.com/gtsteffaniak/filebrowser/backend/internal/database/users"
-	"github.com/gtsteffaniak/filebrowser/backend/pkg/settings"
-)
-
-func TestUpdateSidebarLinks_dedupesDuplicateMigratedLinks(t *testing.T) {
-	settingsConfig := "../../_docker/src/settings/backend/config.yaml"
-	settings.Initialize(settingsConfig)
-
-	user := &users.User{
-		FrontendUser: users.FrontendUser{
-			Username: "admin",
-			NonAdminEditable: users.NonAdminEditable{
-				SidebarLinks: []users.SidebarLink{
-					{Name: "playwright + files", Category: "source", SourceName: "/app/frontend/tests/playwright-files", Target: "/"},
-					{Name: "docker", Category: "source", SourceName: "/app/backend", Target: "/"},
-					{Name: "access", Category: "source", SourceName: "/tests/playwright-files", Target: "/"},
-					{Name: "playwright + files", Category: "source", SourceName: "../frontend/tests/playwright-files", Target: "/"},
-					{Name: "docker", Category: "source", SourceName: ".", Target: "/"},
-					{Name: "access", Category: "source", SourceName: "/tests/playwright-files", Target: "/"},
-				},
-			},
-		},
-		BackendScopes: []users.BackendScope{
-			{Path: "../frontend/tests/playwright-files", Scope: "/"},
-			{Path: ".", Scope: "/"},
-			{Path: "/tests/playwright-files", Scope: "/"},
-		},
-	}
-
-	if !updateSidebarLinks(user) {
-		t.Fatal("expected updateSidebarLinks to return true")
-	}
-
-	count := 0
-	for _, link := range user.SidebarLinks {
-		if strings.HasPrefix(link.Category, "source") {
-			count++
-		}
-	}
-	if count != 3 {
-		t.Fatalf("got %d source links, want 3: %v", count, user.SidebarLinks)
-	}
-}
-
-func TestUpdateSidebarLinks_buildsFromScopesWhenNoSourceLinks(t *testing.T) {
-	settings.Initialize(settingsMigrationConfigPath(t))
-	alignSettingsSourcesForMigrationFixture(t)
-
-	user := &users.User{
-		FrontendUser: users.FrontendUser{
-			Username: "admin",
-		},
-		BackendScopes: []users.BackendScope{
-			{Path: fixturePlaywrightSource, Scope: "/"},
-			{Path: fixtureDockerSource, Scope: "/"},
-			{Path: fixtureAccessSource, Scope: "/"},
-		},
-	}
-
-	if !updateSidebarLinks(user) {
-		t.Fatal("expected updateSidebarLinks to return true")
-	}
-
-	count := 0
-	for _, link := range user.SidebarLinks {
-		if strings.HasPrefix(link.Category, "source") {
-			count++
-		}
-	}
-	if count != 3 {
-		t.Fatalf("got %d source links, want 3: %v", count, user.SidebarLinks)
-	}
-}
@@ -4,8 +4,8 @@ import (
 	"reflect"
 	"testing"

-	"github.com/gtsteffaniak/filebrowser/backend/pkg/settings"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/database/users"
+	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
 	"github.com/stretchr/testify/assert"
 )

@@ -33,110 +33,108 @@ func TestUpdateUserScopes_Phases(t *testing.T) {
 	testCases := []struct {
 		name           string
 		user           *users.User
-		expectedPhase1 []users.BackendScope
-		expectedPhase2 []users.BackendScope
+		expectedPhase1 []users.SourceScope
+		expectedPhase2 []users.SourceScope
 	}{
 		{
 			name: "Single valid scope",
 			user: &users.User{
-				BackendScopes: []users.BackendScope{
-					{Scope: "/home", Path: "/pathA"},
+				Scopes: []users.SourceScope{
+					{Scope: "/home", Name: "/pathA"},
 				},
 			},
-			expectedPhase1: []users.BackendScope{
-				{Scope: "/home", Path: "/pathA"},
-				{Scope: "/defaultB", Path: "/pathB"},
+			expectedPhase1: []users.SourceScope{
+				{Scope: "/home", Name: "/pathA"},
+				{Scope: "/defaultB", Name: "/pathB"},
 			},
-			// Phase2: both already present after phase1 merge.
-			expectedPhase2: []users.BackendScope{
-				{Scope: "/home", Path: "/pathA"},
-				{Scope: "/defaultB", Path: "/pathB"},
+			expectedPhase2: []users.SourceScope{
+				{Scope: "/home", Name: "/pathA"},
+				{Scope: "/defaultB", Name: "/pathB"},
 			},
 		},
 		{
 			name: "Single empty scope path",
 			user: &users.User{
-				BackendScopes: []users.BackendScope{
-					{Scope: "", Path: "/pathB"},
+				Scopes: []users.SourceScope{
+					{Scope: "", Name: "/pathB"},
 				},
 			},
-			expectedPhase1: []users.BackendScope{
-				{Scope: "/defaultB", Path: "/pathB"},
+			expectedPhase1: []users.SourceScope{
+				{Scope: "/defaultB", Name: "/pathB"},
 			},
-			expectedPhase2: []users.BackendScope{
-				{Scope: "/defaultA", Path: "/pathA"},
-				{Scope: "/defaultB", Path: "/pathB"},
+			expectedPhase2: []users.SourceScope{
+				{Scope: "/defaultA", Name: "/pathA"},
+				{Scope: "/defaultB", Name: "/pathB"},
 			},
 		},
 		{
 			name: "Two scopes, one includes username in path",
 			user: &users.User{
-				FrontendUser: users.FrontendUser{Username: "user123"},
-				BackendScopes: []users.BackendScope{
-					{Scope: "/home/user123", Path: "/pathA"},
-					{Scope: "/data", Path: "/pathB"},
+				Username: "user123",
+				Scopes: []users.SourceScope{
+					{Scope: "/home/user123", Name: "/pathA"},
+					{Scope: "/data", Name: "/pathB"},
 				},
 			},
-			expectedPhase1: []users.BackendScope{
-				{Scope: "/home/user123", Path: "/pathA"},
-				{Scope: "/data", Path: "/pathB"},
+			expectedPhase1: []users.SourceScope{
+				{Scope: "/home/user123", Name: "/pathA"},
+				{Scope: "/data", Name: "/pathB"},
 			},
-			expectedPhase2: []users.BackendScope{
-				{Scope: "/home/user123", Path: "/pathA"},
-				{Scope: "/data", Path: "/pathB"},
+			expectedPhase2: []users.SourceScope{
+				{Scope: "/home/user123", Name: "/pathA"},
+				{Scope: "/data", Name: "/pathB"},
 			},
 		},
 		{
 			name: "Two scopes, one with empty name",
 			user: &users.User{
-				BackendScopes: []users.BackendScope{
-					{Scope: "/home", Path: "/pathB"},
-					{Scope: "/data", Path: "/somethingElse"},
+				Scopes: []users.SourceScope{
+					{Scope: "/home", Name: "/pathB"},
+					{Scope: "/data", Name: "/somethingElse"},
 				},
 			},
-			expectedPhase1: []users.BackendScope{
-				{Scope: "/home", Path: "/pathB"},
-				{Scope: "/data", Path: "/somethingElse"},
+			expectedPhase1: []users.SourceScope{
+				{Scope: "/home", Name: "/pathB"},
+				{Scope: "/data", Name: "/somethingElse"},
 			},
-			expectedPhase2: []users.BackendScope{
-				{Scope: "/defaultA", Path: "/pathA"},
-				{Scope: "/home", Path: "/pathB"},
-				{Scope: "/data", Path: "/somethingElse"},
+			expectedPhase2: []users.SourceScope{
+				{Scope: "/defaultA", Name: "/pathA"},
+				{Scope: "/home", Name: "/pathB"},
+				{Scope: "/data", Name: "/somethingElse"},
 			},
 		},
 		{
 			name: "No scopes at all",
 			user: &users.User{
-				BackendScopes: []users.BackendScope{},
+				Scopes: []users.SourceScope{},
 			},
-			expectedPhase1: []users.BackendScope{
-				{Scope: "/defaultB", Path: "/pathB"},
+			expectedPhase1: []users.SourceScope{
+				{Scope: "/defaultB", Name: "/pathB"},
 			},
-			expectedPhase2: []users.BackendScope{
-				{Scope: "/defaultA", Path: "/pathA"},
-				{Scope: "/defaultB", Path: "/pathB"},
+			expectedPhase2: []users.SourceScope{
+				{Scope: "/defaultA", Name: "/pathA"},
+				{Scope: "/defaultB", Name: "/pathB"},
 			},
 		},
 		{
 			name: "All user Scope and source change",
 			user: &users.User{
-				FrontendUser: users.FrontendUser{Username: "user123"},
-				BackendScopes: []users.BackendScope{
-					{Scope: "/defaultC/user123", Path: "/pathC"},
-					{Scope: "/defaultA/user123", Path: "/pathA"},
-					{Scope: "/defaultB/user123", Path: "/pathB"},
+				Username: "user123",
+				Scopes: []users.SourceScope{
+					{Scope: "/defaultC/user123", Name: "/pathC"},
+					{Scope: "/defaultA/user123", Name: "/pathA"},
+					{Scope: "/defaultB/user123", Name: "/pathB"},
 				},
 			},
-			// updateUserScopes emits configured sources first (Sources order), then unknown paths.
-			expectedPhase1: []users.BackendScope{
-				{Scope: "/defaultA/user123", Path: "/pathA"},
-				{Scope: "/defaultB/user123", Path: "/pathB"},
-				{Scope: "/defaultC/user123", Path: "/pathC"},
+			expectedPhase1: []users.SourceScope{
+				{Scope: "/defaultA/user123", Name: "/pathA"},
+				{Scope: "/defaultB/user123", Name: "/pathB"},
+				{Scope: "/defaultC/user123", Name: "/pathC"},
 			},
-			expectedPhase2: []users.BackendScope{
-				{Scope: "/defaultA/user123", Path: "/pathA"},
-				{Scope: "/defaultB/user123", Path: "/pathB"},
-				{Scope: "/defaultC/user123", Path: "/pathC"},
+			expectedPhase2: []users.SourceScope{
+				{Scope: "/defaultA/user123", Name: "/pathA"},
+				{Scope: "/defaultB/user123", Name: "/pathB"},
+				{Scope: "/defaultC/user123", Name: "/pathC"},
 			},
 		},
 	}
@@ -146,10 +144,10 @@ func TestUpdateUserScopes_Phases(t *testing.T) {
 	// ---------------------
 	for _, tc := range testCases {
 		t.Run(tc.name+"_Phase1", func(t *testing.T) {
-			originalScopes := tc.user.BackendScopes
+			originalScopes := tc.user.Scopes
 			updated := updateUserScopes(tc.user)
-			assert.Equal(t, tc.expectedPhase1, tc.user.BackendScopes, "Phase1 scope mismatch for test case: %s", tc.name)
-			assert.Equal(t, updated, !reflect.DeepEqual(originalScopes, tc.user.BackendScopes), "Phase2 scope change detection failed:\t %s vs expected:\t %s", tc.user.BackendScopes, tc.expectedPhase1)
+			assert.Equal(t, tc.expectedPhase1, tc.user.Scopes, "Phase1 scope mismatch for test case: %s", tc.name)
+			assert.Equal(t, updated, !reflect.DeepEqual(originalScopes, tc.user.Scopes), "Phase2 scope change detection failed:\t %s vs expected:\t %s", tc.user.Scopes, tc.expectedPhase1)
 		})
 	}

@@ -174,10 +172,10 @@ func TestUpdateUserScopes_Phases(t *testing.T) {
 	// Run again without resetting user objects to test idempotency + renaming
 	for _, tc := range testCases {
 		t.Run(tc.name+"_Phase2", func(t *testing.T) {
-			originalScopes := tc.user.BackendScopes
+			originalScopes := tc.user.Scopes
 			updated := updateUserScopes(tc.user)
-			assert.Equal(t, tc.expectedPhase2, tc.user.BackendScopes, "Phase2 scope mismatch for test case: %s", tc.name)
-			assert.Equal(t, updated, !reflect.DeepEqual(originalScopes, tc.user.BackendScopes), "Phase2 scope change detection failed:\t %s vs expected:\t %s", tc.user.BackendScopes, tc.expectedPhase1)
+			assert.Equal(t, tc.expectedPhase2, tc.user.Scopes, "Phase2 scope mismatch for test case: %s", tc.name)
+			assert.Equal(t, updated, !reflect.DeepEqual(originalScopes, tc.user.Scopes), "Phase2 scope change detection failed:\t %s vs expected:\t %s", tc.user.Scopes, tc.expectedPhase1)

 		})
 	}
@@ -23,10 +23,8 @@ var (
 	ErrUnauthorized         = errors.New("user unauthorized")
 	ErrNotIndexed           = errors.New("directory or item excluded from indexing")
 	ErrNotViewable          = errors.New("directory or item is not viewable")
-	ErrPathEscapesScope     = errors.New("resolved path escapes scope")
 	ErrWrongLoginMethod     = errors.New("user attempted to login with wrong login method")
 	ErrDownloadNotAllowed   = errors.New("downloads are not allowed for this share")
-	ErrUseMediaStream       = errors.New("use /media/stream for audio and video")
 	ErrUploadNotAllowed     = errors.New("upload permission not allowed for this share")
 	ErrPasskeyMFARequired   = errors.New("passkey MFA is required")
 	ErrPasskeyVerification  = errors.New("passkey verification failed")
@@ -5,7 +5,7 @@ import (

 	"github.com/google/go-cmp/cmp"

-	"github.com/gtsteffaniak/filebrowser/backend/internal/database/users"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
 )

 // TestApplyUserDefaults_copiesUserDefaultsOntoUser guards against drift between
@@ -15,6 +15,7 @@ func TestApplyUserDefaults_copiesUserDefaultsOntoUser(t *testing.T) {
 	defer func() { Config = saved }()

 	dark := false
+	dlFalse := false
 	Config = Settings{
 		Server: Server{},
 		UserDefaults: UserDefaults{
@@ -58,6 +59,7 @@ func TestApplyUserDefaults_copiesUserDefaultsOntoUser(t *testing.T) {
 				DisableOnlyOfficeExt:    ".x",
 				PreferEditorForMarkdown: true,
 				DebugOffice:             true,
+				DefaultMediaPlayer:      true,
 			},
 			Search: UserDefaultsSearch{
 				DisableOptions: true,
@@ -77,8 +79,12 @@ func TestApplyUserDefaults_copiesUserDefaultsOntoUser(t *testing.T) {
 				Permissions: UserDefaultsAccountPermissions{
 					Api:      true,
 					Admin:    true,
+					Modify:   true,
 					Share:    true,
 					Realtime: true,
+					Delete:   true,
+					Create:   true,
+					Download: &dlFalse,
 				},
 				LockPassword:               true,
 				DisableSettings:            true,
@@ -88,69 +94,68 @@ func TestApplyUserDefaults_copiesUserDefaultsOntoUser(t *testing.T) {
 		},
 	}

-	u := &users.User{
-		FrontendUser: users.FrontendUser{
-			Username: "alice",
-		},
-	}
+	u := &users.User{Username: "alice"}
 	ApplyUserDefaults(u)

 	want := users.User{
-		FrontendUser: users.FrontendUser{
-			DisableSettings: true,
-			LockPassword:    true,
-			LoginMethod:     users.LoginMethodPassword,
-			Permissions: users.Permissions{
-				Api:      true,
-				Admin:    true,
-				Share:    true,
-				Realtime: true,
+		DisableSettings: true,
+		LockPassword:    true,
+		LoginMethod:     users.LoginMethodPassword,
+		Permissions: users.Permissions{
+			Api:      true,
+			Admin:    true,
+			Modify:   true,
+			Share:    true,
+			Realtime: true,
+			Delete:   true,
+			Create:   true,
+			Download: false,
+		},
+		NonAdminEditable: users.NonAdminEditable{
+			EditorQuickSave:            true,
+			HideSidebarFileActions:     true,
+			DisableQuickToggles:        true,
+			DisableSearchOptions:       true,
+			StickySidebar:              false,
+			HideFilesInTree:            true,
+			DarkMode:                   false,
+			Locale:                     "de",
+			ViewMode:                   "list",
+			SingleClick:                true,
+			ShowHidden:                 true,
+			DateFormat:                 true,
+			GallerySize:                7,
+			ThemeColor:                 "var(--red)",
+			QuickDownload:              true,
+			DisablePreviewExt:          ".exe",
+			DisableViewingExt:          ".bat",
+			DisableUpdateNotifications: true,
+			DisableOfficePreviewExt:    ".x", // deprecated: mapped to DisableOnlyOfficeExt
+			DisableOnlyOfficeExt:       ".x",
+			CustomTheme:                "Night",
+			ShowSelectMultiple:         true,
+			DebugOffice:                true,
+			DeleteWithoutConfirming:    true,
+			DeleteAfterArchive:         false,
+			PreferEditorForMarkdown:    true,
+			ShowToolsInSidebar:         true,
+			FileLoading: users.FileLoading{
+				MaxConcurrent:     3,
+				UploadChunkSize:   5,
+				DownloadChunkSize: 2,
 			},
-			NonAdminEditable: users.NonAdminEditable{
-				EditorQuickSave:            true,
-				HideSidebarFileActions:     true,
-				DisableQuickToggles:        true,
-				DisableSearchOptions:       true,
-				StickySidebar:              false,
-				HideFilesInTree:            true,
-				DarkMode:                   false,
-				Locale:                     "de",
-				ViewMode:                   "list",
-				SingleClick:                true,
-				ShowHidden:                 true,
-				DateFormat:                 true,
-				GallerySize:                7,
-				ThemeColor:                 "var(--red)",
-				QuickDownload:              true,
-				DisablePreviewExt:          ".exe",
-				DisableViewingExt:          ".bat",
-				DisableUpdateNotifications: true,
-				DisableOfficePreviewExt:    ".x", // deprecated: mapped to DisableOnlyOfficeExt
-				DisableOnlyOfficeExt:       ".x",
-				CustomTheme:                "Night",
-				ShowSelectMultiple:         true,
-				DebugOffice:                true,
-				DeleteWithoutConfirming:    true,
-				DeleteAfterArchive:         false,
-				PreferEditorForMarkdown:    true,
-				ShowToolsInSidebar:         true,
-				FileLoading: users.FileLoading{
-					MaxConcurrent:     3,
-					UploadChunkSize:   5,
-					DownloadChunkSize: 2,
-				},
-				Preview: users.Preview{
-					DisableHideSidebar: true,
-					Image:              false,
-					Video:              false,
-					Audio:              false,
-					MotionVideoPreview: false,
-					Office:             false,
-					PopUp:              false,
-					AutoplayMedia:      false,
-					Folder:             false,
-					Models:             false,
-				},
+			Preview: users.Preview{
+				DisableHideSidebar: true,
+				Image:              false,
+				Video:              false,
+				Audio:              false,
+				MotionVideoPreview: false,
+				Office:             false,
+				PopUp:              false,
+				AutoplayMedia:      false,
+				DefaultMediaPlayer: true,
+				Folder:             false,
+				Models:             false,
 			},
 		},
 	}
@@ -184,9 +189,7 @@ func TestApplyUserDefaults_setsLoginMethodWhenEmpty(t *testing.T) {
 			},
 		},
 	}
-	u := &users.User{
-		FrontendUser: users.FrontendUser{Username: "x"},
-	}
+	u := &users.User{Username: "x"}
 	ApplyUserDefaults(u)
 	if u.LoginMethod != users.LoginMethodJwt {
 		t.Fatalf("LoginMethod: got %q want jwt", u.LoginMethod)
@@ -205,31 +208,9 @@ func TestApplyUserDefaults_preservesLoginMethodWhenAlreadySet(t *testing.T) {
 			},
 		},
 	}
-	u := &users.User{
-		FrontendUser: users.FrontendUser{
-			Username:    "x",
-			LoginMethod: users.LoginMethodProxy,
-		},
-	}
+	u := &users.User{Username: "x", LoginMethod: users.LoginMethodProxy}
 	ApplyUserDefaults(u)
 	if u.LoginMethod != users.LoginMethodProxy {
 		t.Fatalf("LoginMethod: got %q want proxy", u.LoginMethod)
 	}
 }
-
-func TestExpandBackendScopesForCreateUserDir(t *testing.T) {
-	loadConfigForUserDefaultsTests(t, jwtPlaywrightConfig)
-	u := &users.User{
-		FrontendUser: users.FrontendUser{Username: "testadmin"},
-		BackendScopes: []users.BackendScope{
-			{Path: Config.Server.Sources[0].Path, Scope: "/"},
-		},
-	}
-	ExpandBackendScopesForCreateUserDir(u)
-	if len(u.BackendScopes) != 1 {
-		t.Fatalf("scopes: %+v", u.BackendScopes)
-	}
-	if u.BackendScopes[0].Scope != "/testadmin" {
-		t.Fatalf("scope=%q want /testadmin", u.BackendScopes[0].Scope)
-	}
-}
@@ -11,7 +11,7 @@ import (

 	"github.com/coreos/go-oidc/v3/oidc"
 	ldap "github.com/go-ldap/ldap/v3"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/version"
+	"github.com/gtsteffaniak/filebrowser/backend/common/version"
 	"github.com/gtsteffaniak/go-logger/logger"
 )

@@ -149,7 +149,6 @@ func ValidateLdapAuth() error {
 	if ldapCfg.UserFilter == "" {
 		ldapCfg.UserFilter = "(&(cn=%s)(objectClass=user))"
 	}
-	applyAuthCommonDefaults(&ldapCfg.AuthCommon)
 	if err := verifyLdapConnection(); err != nil {
 		logger.Fatalf("LDAP connection check failed: %v", err)
 	}
@@ -159,7 +158,9 @@ func ValidateLdapAuth() error {
 // ValidateOidcAuth processes the OIDC callback and retrieves user identity
 func validateOidcAuth() error {
 	oidcCfg := &Config.Auth.Methods.OidcAuth // Use a pointer to modify the original config
-	applyAuthCommonDefaults(&oidcCfg.AuthCommon)
+	if oidcCfg.GroupsClaim == "" {
+		oidcCfg.GroupsClaim = "groups"
+	}
 	if oidcCfg.UserIdentifier == "" {
 		oidcCfg.UserIdentifier = "preferred_username"
 	}
@@ -288,7 +289,9 @@ func ValidateJwtAuth() error {
 	if jwtCfg.Algorithm == "" {
 		jwtCfg.Algorithm = "HS256"
 	}
-	applyAuthCommonDefaults(&jwtCfg.AuthCommon)
+	if jwtCfg.GroupsClaim == "" {
+		jwtCfg.GroupsClaim = "groups"
+	}
 	if jwtCfg.UserIdentifier == "" {
 		jwtCfg.UserIdentifier = "sub"
 	}
@@ -2,13 +2,13 @@ package settings

 import (
 	"bytes"
-	"context"
-	"flag"
 	"fmt"
 	"io"
 	"log"
 	"os"
+	"os/exec"
 	"path/filepath"
+	"runtime"
 	"slices"
 	"strconv"
 	"strings"
@@ -16,11 +16,10 @@ import (

 	"github.com/go-playground/validator/v10"
 	"github.com/goccy/go-yaml"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/adapters/fs/fileutils"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/database/users"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/ffmpeg"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/utils"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/version"
+	"github.com/gtsteffaniak/filebrowser/backend/adapters/fs/fileutils"
+	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
+	"github.com/gtsteffaniak/filebrowser/backend/common/version"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
 	"github.com/gtsteffaniak/go-logger/logger"
 )

@@ -40,6 +39,8 @@ func Initialize(configFile string) {
 	setupLogging()
 	// setup logging first to ensure we log any errors
 	setupEnv()
+	// Migrate deprecated UserDefaults fields to new organized structure
+	migrateUserDefaults()
 	err = ValidateConfig(Config)
 	if err != nil {
 		errmsg := "The provided config file failed validation. "
@@ -57,16 +58,19 @@ func Initialize(configFile string) {
 	setupSources(false)
 	InitializeUserResolvers() // Initialize user package resolvers after sources are set up
 	setupUrls()
-	warnHttpProxyConfig()
 	setupFrontend(false)
 	setupMedia(false)
 }

 func setupServer() {
+	if Config.Server.ListenAddress == "" {
+		Config.Server.ListenAddress = "0.0.0.0"
+	}
 	// Check environment variable first (overrides config file)
 	if os.Getenv("FILEBROWSER_SQL_WAL") == "true" {
 		Config.Server.IndexSqlConfig.WalMode = true
 	}
+	// WalMode is false by default (OFF journaling)
 }

 func setupEnv() {
@@ -81,41 +85,14 @@ func setupEnv() {
 }

 func setupHttp() {
-	if err := ValidateHttpConfig(Config.Http); err != nil {
-		logger.Fatal(err.Error())
-	}
-	if Config.Http.ListenAddress == "" {
-		Config.Http.ListenAddress = "0.0.0.0"
-	}
-}
-
-func warnHttpProxyConfig() {
-	if Env.IsDevMode || Env.IsPlaywright {
-		return
-	}
-	if Config.Http.BaseURL != "/" && !Config.Http.TrustProxyHeaders {
-		logger.Warning(`http.baseURL is not "/" but http.trustProxyHeaders is false. Behind a reverse proxy on a subpath, set trustProxyHeaders: true so cookies, client IP, OIDC redirects, and URLs resolve correctly. See https://filebrowserquantum.com/en/docs/configuration/http/#trustproxyheaders`)
-	}
-	if !Env.IsDevMode {
-		if u := Config.Http.ExternalUrl; u != "" && strings.HasPrefix(strings.ToLower(u), "http://") {
-			logger.Warning("http.externalUrl uses http when the url should be https for a production environment")
-		}
-		if u := Config.Integrations.OnlyOffice.Url; u != "" && strings.HasPrefix(strings.ToLower(u), "http://") {
-			logger.Warning("integrations.office.url uses http when it should be https for a production environment.")
+	if len(Config.Http.TrustedHeadersArray) > 0 {
+		Config.Http.TrustedHeaders = make(map[string]bool)
+		for _, header := range Config.Http.TrustedHeadersArray {
+			Config.Http.TrustedHeaders[strings.ToLower(header)] = true
 		}
 	}
 }

-func warnOidcProxyHeaders() {
-	if !Config.Auth.Methods.OidcAuth.Enabled {
-		return
-	}
-	if Config.Http.TrustProxyHeaders {
-		return
-	}
-	logger.Warning("OIDC is enabled but http.trustProxyHeaders is false. Behind a reverse proxy, FileBrowser builds the OIDC redirect_uri from the incoming request; set trustProxyHeaders: true and configure your proxy to send X-Forwarded-Proto and X-Forwarded-Host. http.externalUrl does not apply to OIDC redirects.")
-}
-
 func setupFs() {
 	// Convert permission values (like 644, 755) to octal interpretation
 	filePermOctal, err := strconv.ParseUint(Config.Server.Filesystem.CreateFilePermission, 8, 32)
@@ -355,45 +332,18 @@ func setupMedia(generate bool) {
 		Config.Integrations.Media.Convert.VideoPreview[k] = v
 	}

-	if !generate && !isGoTest() {
-		setupFFmpegIntegration()
+	// Resolve exiftool path once at startup: validate user path or discover via PATH
+	if Config.Integrations.Media.ExiftoolPath != "" && !generate {
+		if err := exec.Command(Config.Integrations.Media.ExiftoolPath, "-ver").Run(); err != nil {
+			logger.Warningf("exiftool path is invalid or not executable: %q (%v); disabling exiftool", Config.Integrations.Media.ExiftoolPath, err)
+			Config.Integrations.Media.ExiftoolPath = ""
+		}
 	}
-}
-
-func isGoTest() bool {
-	return flag.Lookup("test.v") != nil
-}
-
-func setupFFmpegIntegration() {
-	maxConcurrent := Config.Server.NumImageProcessors
-	if maxConcurrent < 1 {
-		maxConcurrent = 4
+	if Config.Integrations.Media.ExiftoolPath == "" && !generate {
+		if path, err := exec.LookPath("exiftool"); err == nil && path != "" {
+			Config.Integrations.Media.ExiftoolPath = path
+		}
 	}
-	ffmpegConcurrency := (maxConcurrent + 1) / 2
-	err := ffmpeg.Initialize(context.Background(), ffmpeg.InitOptions{
-		FFmpegPath:           Config.Integrations.Media.FfmpegPath,
-		MaxConcurrent:        ffmpegConcurrency,
-		CacheDir:             Config.Server.CacheDir,
-		SkipHWTests:          !Config.Integrations.Media.HardwareAcceleration,
-		HardwareAcceleration: Config.Integrations.Media.HardwareAcceleration,
-	})
-	if err != nil {
-		logger.Warningf("ffmpeg unavailable: %v", err)
-		Env.FFmpegAvailable = false
-		Env.FFmpegPath = ""
-		Env.FFprobePath = ""
-		return
-	}
-
-	svc := ffmpeg.Get()
-	if svc == nil {
-		Env.FFmpegAvailable = false
-		return
-	}
-
-	Env.FFmpegAvailable = true
-	Env.FFmpegPath = svc.FFmpegPath()
-	Env.FFprobePath = svc.FFprobePath()
 }

 func setupSources(generate bool) {
@@ -440,7 +390,7 @@ func setupSources(generate bool) {
 	}
 	// clean up the in memory source list to be accurate and unique
 	sourceList := []*Source{}
-	defaultScopes := []users.BackendScope{}
+	defaultScopes := []users.SourceScope{}
 	allSourceNames := []string{}
 	if len(Config.Server.Sources) == 1 {
 		Config.Server.Sources[0].Config.DefaultEnabled = true
@@ -455,8 +405,8 @@ func setupSources(generate bool) {
 		if ok && !slices.Contains(allSourceNames, source.Name) {
 			sourceList = append(sourceList, source)
 			if source.Config.DefaultEnabled {
-				defaultScopes = append(defaultScopes, users.BackendScope{
-					Path:  source.Path,
+				defaultScopes = append(defaultScopes, users.SourceScope{
+					Name:  source.Path,
 					Scope: source.Config.DefaultUserScope,
 				})
 			}
@@ -467,40 +417,23 @@ func setupSources(generate bool) {
 	}
 	Config.UserDefaults.DefaultScopes = defaultScopes
 	Config.Server.Sources = sourceList
-	finalizeConfigSourceDefaultPermissions()
-}
-
-func finalizeConfigSourceDefaultPermissions() {
-	Env.ConfigSourceDefaultPermissions = nil
-	for _, source := range Config.Server.Sources {
-		if source == nil || len(source.Config.DefaultPermissionsFromConfig) == 0 {
-			continue
-		}
-		Env.ConfigSourceDefaultPermissions = source.Config.DefaultPermissionsFromConfig
-		perms := NormalizeSourceFilePermissions(source.Config.DefaultPermissions)
-		for flag, val := range source.Config.DefaultPermissionsFromConfig {
-			setSourcePermissionFlag(&perms, flag, val)
-		}
-		source.Config.DefaultPermissions = users.MarkSourceFilePermissionsConfigured(perms)
-		return
-	}
 }

 func setupUrls() {
-	baseurl := strings.Trim(Config.Http.BaseURL, "/")
+	baseurl := strings.Trim(Config.Server.BaseURL, "/")
 	if baseurl == "" {
-		Config.Http.BaseURL = "/"
+		Config.Server.BaseURL = "/"
 	} else {
-		Config.Http.BaseURL = "/" + baseurl + "/"
+		Config.Server.BaseURL = "/" + baseurl + "/"
 	}
-	if Config.Http.BaseURL != "/" {
-		if Config.Http.ExternalUrl != "" {
-			Config.Http.ExternalUrl = strings.TrimSuffix(Config.Http.ExternalUrl, "/") + "/"
-			Config.Http.ExternalUrl = strings.TrimSuffix(Config.Http.ExternalUrl, Config.Http.BaseURL)
+	if Config.Server.BaseURL != "/" {
+		if Config.Server.ExternalUrl != "" {
+			Config.Server.ExternalUrl = strings.TrimSuffix(Config.Server.ExternalUrl, "/") + "/"
+			Config.Server.ExternalUrl = strings.TrimSuffix(Config.Server.ExternalUrl, Config.Server.BaseURL)
 		}
-		if Config.Http.InternalUrl != "" {
-			Config.Http.InternalUrl = strings.TrimSuffix(Config.Http.InternalUrl, "/") + "/"
-			Config.Http.InternalUrl = strings.TrimSuffix(Config.Http.InternalUrl, Config.Http.BaseURL)
+		if Config.Server.InternalUrl != "" {
+			Config.Server.InternalUrl = strings.TrimSuffix(Config.Server.InternalUrl, "/") + "/"
+			Config.Server.InternalUrl = strings.TrimSuffix(Config.Server.InternalUrl, Config.Server.BaseURL)
 		}
 	}
 	Config.Integrations.OnlyOffice.Url = strings.Trim(Config.Integrations.OnlyOffice.Url, "/")
@@ -515,7 +448,6 @@ func setupAuth(generate bool) {
 		Config.Auth.AuthMethods = append(Config.Auth.AuthMethods, "password")
 	}
 	if Config.Auth.Methods.ProxyAuth.Enabled {
-		applyAuthCommonDefaults(&Config.Auth.Methods.ProxyAuth.AuthCommon)
 		Config.Auth.AuthMethods = append(Config.Auth.AuthMethods, "proxy")
 	}
 	if Config.Auth.Methods.NoAuth {
@@ -529,9 +461,6 @@ func setupAuth(generate bool) {
 			logger.Fatalf("Error validating OIDC auth: %v", err)
 		}
 		logger.Info("OIDC Auth configured successfully")
-		if !generate {
-			warnOidcProxyHeaders()
-		}
 	}
 	if Config.Auth.Methods.LdapAuth.Enabled || generate {
 		Config.Auth.AuthMethods = append(Config.Auth.AuthMethods, "ldap")
@@ -599,6 +528,294 @@ func setupLogging() {
 	}
 }

+// migrateUserDefaults migrates deprecated UserDefaults fields to the new organized structure.
+// This function maintains backwards compatibility by checking if new fields are unset and copying
+// values from old deprecated fields if found. Logs warnings when old fields are migrated.
+func migrateUserDefaults() {
+	ud := &Config.UserDefaults
+	hasOldFields := false
+
+	// Helper function to check if a bool pointer is unset (nil)
+	isUnsetBoolPtr := func(v *bool) bool {
+		return v == nil
+	}
+
+	// Helper function to check if a string is unset (empty)
+	isUnsetString := func(v string) bool {
+		return v == ""
+	}
+
+	// Helper function to check if an int is unset (zero)
+	isUnsetInt := func(v int) bool {
+		return v == 0
+	}
+
+	// Migrate Preview-related deprecated fields
+	if !ud.Sidebar.DisableHideOnPreview && ud.Preview.DisableHideSidebar {
+		ud.Sidebar.DisableHideOnPreview = ud.Preview.DisableHideSidebar
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'preview.disableHideSidebar' to 'sidebar.disableHideOnPreview'")
+	}
+
+	if !ud.FileViewer.DefaultMediaPlayer && ud.Preview.DefaultMediaPlayer {
+		ud.FileViewer.DefaultMediaPlayer = ud.Preview.DefaultMediaPlayer
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'preview.defaultMediaPlayer' to 'fileViewer.defaultMediaPlayer'")
+	}
+
+	if isUnsetBoolPtr(ud.FileViewer.AutoplayMedia) && ud.Preview.AutoplayMedia {
+		autoplay := ud.Preview.AutoplayMedia
+		ud.FileViewer.AutoplayMedia = &autoplay
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'preview.autoplayMedia' to 'fileViewer.autoplayMedia'")
+	}
+
+	if isUnsetString(ud.Preview.DisablePreviewExt) && !isUnsetString(ud.DisablePreviewExt) {
+		ud.Preview.DisablePreviewExt = ud.DisablePreviewExt
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'disablePreviewExt' to 'preview.disablePreviewExt'")
+	}
+
+	// Migrate Sidebar fields
+	if !ud.Sidebar.DisableQuickToggles && ud.DisableQuickToggles {
+		ud.Sidebar.DisableQuickToggles = ud.DisableQuickToggles
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'disableQuickToggles' to 'sidebar.disableQuickToggles'")
+	}
+
+	if !ud.Sidebar.HideFileActions && ud.HideSidebarFileActions {
+		ud.Sidebar.HideFileActions = ud.HideSidebarFileActions
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'hideSidebarFileActions' to 'sidebar.hideFileActions'")
+	}
+
+	if !ud.Sidebar.Sticky && ud.StickySidebar {
+		ud.Sidebar.Sticky = ud.StickySidebar
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'stickySidebar' to 'sidebar.sticky'")
+	}
+
+	if isUnsetString(ud.Listing.ViewMode) && !isUnsetString(ud.ViewMode) {
+		ud.Listing.ViewMode = ud.ViewMode
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'viewMode' to 'sidebar.viewMode'")
+	}
+
+	if isUnsetInt(ud.Listing.GallerySize) && !isUnsetInt(ud.GallerySize) {
+		ud.Listing.GallerySize = ud.GallerySize
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'gallerySize' to 'sidebar.gallerySize'")
+	}
+
+	if !ud.Sidebar.HideFiles && ud.HideFilesInTree {
+		ud.Sidebar.HideFiles = ud.HideFilesInTree
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'hideFilesInTree' to 'sidebar.hideFiles'")
+	}
+
+	if isUnsetBoolPtr(ud.Sidebar.ShowTools) && ud.ShowToolsInSidebar != nil {
+		ud.Sidebar.ShowTools = ud.ShowToolsInSidebar
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'showToolsInSidebar' to 'sidebar.showTools'")
+	}
+
+	// Migrate Listing fields
+	if !ud.Listing.DeleteWithoutConfirming && ud.DeleteWithoutConfirming {
+		ud.Listing.DeleteWithoutConfirming = ud.DeleteWithoutConfirming
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'deleteWithoutConfirming' to 'listing.deleteWithoutConfirming'")
+	}
+
+	if !ud.Listing.DateFormat && ud.DateFormat {
+		ud.Listing.DateFormat = ud.DateFormat
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'dateFormat' to 'listing.dateFormat'")
+	}
+
+	if !ud.Listing.ShowHidden && ud.ShowHidden {
+		ud.Listing.ShowHidden = ud.ShowHidden
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'showHidden' to 'listing.showHidden'")
+	}
+
+	if !ud.Listing.QuickDownload && ud.QuickDownload {
+		ud.Listing.QuickDownload = ud.QuickDownload
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'quickDownload' to 'listing.quickDownload'")
+	}
+
+	if !ud.Listing.ShowSelectMultiple && ud.ShowSelectMultiple {
+		ud.Listing.ShowSelectMultiple = ud.ShowSelectMultiple
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'showSelectMultiple' to 'listing.showSelectMultiple'")
+	}
+
+	if !ud.Listing.SingleClick && ud.SingleClick {
+		ud.Listing.SingleClick = ud.SingleClick
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'singleClick' to 'listing.singleClick'")
+	}
+
+	if isUnsetString(ud.Listing.HideFileExt) && !isUnsetString(ud.HideFileExt) {
+		ud.Listing.HideFileExt = ud.HideFileExt
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'hideFileExt' to 'listing.hideFileExt'")
+	}
+
+	if !ud.Listing.ShowCopyPath && ud.ShowCopyPath {
+		ud.Listing.ShowCopyPath = ud.ShowCopyPath
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'showCopyPath' to 'listing.showCopyPath'")
+	}
+
+	if !ud.Listing.DeleteAfterArchive && ud.DeleteAfterArchive {
+		ud.Listing.DeleteAfterArchive = ud.DeleteAfterArchive
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'deleteAfterArchive' to 'listing.deleteAfterArchive'")
+	}
+
+	// Migrate FileViewer fields
+	if !ud.FileViewer.EditorQuickSave && ud.EditorQuickSave {
+		ud.FileViewer.EditorQuickSave = ud.EditorQuickSave
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'editorQuickSave' to 'fileViewer.editorQuickSave'")
+	}
+
+	if isUnsetString(ud.FileViewer.DisableViewingExt) && !isUnsetString(ud.DisableViewingExt) {
+		ud.FileViewer.DisableViewingExt = ud.DisableViewingExt
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'disableViewingExt' to 'fileViewer.disableViewingExt'")
+	}
+
+	if isUnsetString(ud.FileViewer.DisableOnlyOfficeExt) && !isUnsetString(ud.DisableOnlyOfficeExt) {
+		ud.FileViewer.DisableOnlyOfficeExt = ud.DisableOnlyOfficeExt
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'disableOnlyOfficeExt' to 'fileViewer.disableOnlyOfficeExt'")
+	}
+
+	if !ud.FileViewer.PreferEditorForMarkdown && ud.PreferEditorForMarkdown {
+		ud.FileViewer.PreferEditorForMarkdown = ud.PreferEditorForMarkdown
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'preferEditorForMarkdown' to 'fileViewer.preferEditorForMarkdown'")
+	}
+
+	if !ud.FileViewer.DebugOffice && ud.DebugOffice {
+		ud.FileViewer.DebugOffice = ud.DebugOffice
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'debugOffice' to 'fileViewer.debugOffice'")
+	}
+
+	// Migrate Search fields
+	if !ud.Search.DisableOptions && ud.DisableSearchOptions {
+		ud.Search.DisableOptions = ud.DisableSearchOptions
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'disableSearchOptions' to 'search.disableOptions'")
+	}
+
+	// Migrate UI fields
+	if isUnsetBoolPtr(ud.UI.DarkMode) && ud.DarkMode != nil {
+		ud.UI.DarkMode = ud.DarkMode
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'darkMode' to 'ui.darkMode'")
+	}
+
+	if isUnsetString(ud.UI.ThemeColor) && !isUnsetString(ud.ThemeColor) {
+		ud.UI.ThemeColor = ud.ThemeColor
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'themeColor' to 'ui.themeColor'")
+	}
+
+	if isUnsetString(ud.UI.CustomTheme) && !isUnsetString(ud.CustomTheme) {
+		ud.UI.CustomTheme = ud.CustomTheme
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'customTheme' to 'ui.customTheme'")
+	}
+
+	if isUnsetString(ud.UI.Locale) && !isUnsetString(ud.Locale) {
+		ud.UI.Locale = ud.Locale
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'locale' to 'ui.locale'")
+	}
+
+	// Migrate Account fields
+	if !ud.Account.LockPassword && ud.LockPassword {
+		ud.Account.LockPassword = ud.LockPassword
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'lockPassword' to 'account.lockPassword'")
+	}
+
+	if !ud.Account.DisableSettings && ud.DisableSettings {
+		ud.Account.DisableSettings = ud.DisableSettings
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'disableSettings' to 'account.disableSettings'")
+	}
+
+	if isUnsetString(ud.Account.LoginMethod) && !isUnsetString(ud.LoginMethod) {
+		ud.Account.LoginMethod = ud.LoginMethod
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'loginMethod' to 'account.loginMethod'")
+	}
+
+	if !ud.Account.DisableUpdateNotifications && ud.DisableUpdateNotifications {
+		ud.Account.DisableUpdateNotifications = ud.DisableUpdateNotifications
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'disableUpdateNotifications' to 'account.disableUpdateNotifications'")
+	}
+
+	// Migrate Account Permissions fields
+	if !ud.Account.Permissions.Api && ud.Permissions.Api {
+		ud.Account.Permissions.Api = ud.Permissions.Api
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'permissions.api' to 'account.permissions.api'")
+	}
+
+	if !ud.Account.Permissions.Admin && ud.Permissions.Admin {
+		ud.Account.Permissions.Admin = ud.Permissions.Admin
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'permissions.admin' to 'account.permissions.admin'")
+	}
+
+	if !ud.Account.Permissions.Modify && ud.Permissions.Modify {
+		ud.Account.Permissions.Modify = ud.Permissions.Modify
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'permissions.modify' to 'account.permissions.modify'")
+	}
+
+	if !ud.Account.Permissions.Share && ud.Permissions.Share {
+		ud.Account.Permissions.Share = ud.Permissions.Share
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'permissions.share' to 'account.permissions.share'")
+	}
+
+	if !ud.Account.Permissions.Realtime && ud.Permissions.Realtime {
+		ud.Account.Permissions.Realtime = ud.Permissions.Realtime
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'permissions.realtime' to 'account.permissions.realtime'")
+	}
+
+	if !ud.Account.Permissions.Delete && ud.Permissions.Delete {
+		ud.Account.Permissions.Delete = ud.Permissions.Delete
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'permissions.delete' to 'account.permissions.delete'")
+	}
+
+	if !ud.Account.Permissions.Create && ud.Permissions.Create {
+		ud.Account.Permissions.Create = ud.Permissions.Create
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'permissions.create' to 'account.permissions.create'")
+	}
+
+	if isUnsetBoolPtr(ud.Account.Permissions.Download) && ud.Permissions.Download != nil {
+		ud.Account.Permissions.Download = ud.Permissions.Download
+		hasOldFields = true
+		logger.Warning("userDefaults: migrating deprecated field 'permissions.download' to 'account.permissions.download'")
+	}
+
+	if hasOldFields {
+		logger.Warning("userDefaults: Please update your configuration to use the new organized structure. See documentation for details.")
+	}
+}
+
 func loadConfigWithDefaults(configFile string, generate bool) error {
 	Config = SetDefaults(generate)

@@ -613,7 +830,7 @@ func loadConfigWithDefaults(configFile string, generate bool) error {
 			},
 		}
 		loadEnvConfig()
-		return ResolveDatabasePaths()
+		return nil
 	}

 	// Try multi-file config first (combine all YAML files in the directory)
@@ -638,7 +855,6 @@ func loadConfigWithDefaults(configFile string, generate bool) error {
 		"integrations": true,
 		"frontend":     true,
 		"userDefaults": true,
-		"http":         true,
 	}

 	filteredConfig := make(map[string]interface{})
@@ -648,19 +864,6 @@ func loadConfigWithDefaults(configFile string, generate bool) error {
 		}
 	}

-	if udRaw, ok := filteredConfig["userDefaults"]; ok {
-		Env.ConfigUserDefaultsSpecified = true
-		if udMap, ok := udRaw.(map[string]interface{}); ok {
-			Env.ConfigUserDefaultsSpecifiedPaths = CollectMapLeafPaths(udMap, "")
-		}
-	}
-
-	// check if database is set in the config
-	val, ok := filteredConfig["server"].(map[string]interface{})["database"].(string)
-	if ok && val != "" {
-		return fmt.Errorf("old database path is set in the config, please migrate your database to SQLite")
-	}
-
 	// Marshal the filtered config back to YAML
 	filteredYAML, err := yaml.Marshal(filteredConfig)
 	if err != nil {
@@ -674,67 +877,10 @@ func loadConfigWithDefaults(configFile string, generate bool) error {
 		return fmt.Errorf("error unmarshaling YAML data: %v", err)
 	}

-	if err := applyLoadedUserDefaultsFromConfig(generate); err != nil {
-		return err
-	}
-
-	attachSourceDefaultPermissionsFromConfig(filteredConfig)
-
 	loadEnvConfig()
-	return ResolveDatabasePaths()
-}
-
-// applyLoadedUserDefaultsFromConfig merges config-specified userDefaults paths onto
-// SetDefaults so partial YAML (e.g. only account.permissions.share) does not zero
-// unspecified sections such as preview thumbnails or fileViewer.autoplayMedia.
-func applyLoadedUserDefaultsFromConfig(generate bool) error {
-	if !Env.ConfigUserDefaultsSpecified {
-		return nil
-	}
-	base := SetDefaults(generate).UserDefaults
-	merged, err := ApplyConfigSpecifiedPathsToUserDefaults(base, Config.UserDefaults)
-	if err != nil {
-		return fmt.Errorf("merge user defaults with config: %w", err)
-	}
-	Config.UserDefaults = merged
 	return nil
 }

-func attachSourceDefaultPermissionsFromConfig(raw map[string]interface{}) {
-	server, ok := raw["server"].(map[string]interface{})
-	if !ok {
-		return
-	}
-	sources, ok := server["sources"].([]interface{})
-	if !ok {
-		return
-	}
-	for i, srcRaw := range sources {
-		if i >= len(Config.Server.Sources) || Config.Server.Sources[i] == nil {
-			continue
-		}
-		src, ok := srcRaw.(map[string]interface{})
-		if !ok {
-			continue
-		}
-		config, ok := src["config"].(map[string]interface{})
-		if !ok {
-			continue
-		}
-		dp, ok := config["defaultPermissions"].(map[string]interface{})
-		if !ok || len(dp) == 0 {
-			continue
-		}
-		fromConfig := make(map[string]bool, len(dp))
-		for key, val := range dp {
-			if b, ok := val.(bool); ok {
-				fromConfig[key] = b
-			}
-		}
-		Config.Server.Sources[i].Config.DefaultPermissionsFromConfig = fromConfig
-	}
-}
-
 func ValidateConfig(config Settings) error {
 	validate := validator.New()

@@ -825,31 +971,29 @@ func loadEnvConfig() {
 }

 func SetDefaults(generate bool) Settings {
-	// New SQLite database path
-	databaseV2 := os.Getenv("FILEBROWSER_DATABASE_PATH")
-	if databaseV2 == "" {
-		databaseV2 = "filebrowser.sqlite"
+	// get number of CPUs available
+	numCpus := 4 // default to 4 CPUs if runtime.NumCPU() fails or is not available
+	cpus := runtime.NumCPU()
+	if cpus > 0 && !generate {
+		numCpus = cpus
+	}
+	database := os.Getenv("FILEBROWSER_DATABASE")
+	if database == "" {
+		database = "database.db"
+	}
+	if _, err := os.Stat(database); os.IsNotExist(err) {
+		logger.Warning("database file could not be found. If this is unexpected, please set the FILEBROWSER_DATABASE environment variable to the correct path.")
 	}
-
 	s := Settings{
-		Http: Http{
-			Port:    80,
-			BaseURL: "",
-		},
 		Server: Server{
-			NumImageProcessors: 4,
-			DatabaseV2: Database{
-				Path: databaseV2,
-				Activity: ActivityConfig{
-					RetentionDays:        30,
-					FlushIntervalSeconds: 10,
-					MaxBufferSize:        10000,
-				},
-			},
-			SourceMap:        map[string]*Source{},
-			NameToSource:     map[string]*Source{},
-			CacheDir:         "tmp",
-			MaxArchiveSizeGB: 20,
+			Port:               80,
+			NumImageProcessors: numCpus,
+			BaseURL:            "",
+			Database:           database,
+			SourceMap:          map[string]*Source{},
+			NameToSource:       map[string]*Source{},
+			CacheDir:           "tmp",
+			MaxArchiveSizeGB:   20,
 			IndexSqlConfig: IndexSqlConfig{
 				WalMode:               false,
 				BatchSize:             1000,
@@ -918,6 +1062,7 @@ func SetDefaults(generate bool) Settings {
 				DisableOnlyOfficeExt:    ".md .txt .pdf .html .xml",
 				PreferEditorForMarkdown: false,
 				DebugOffice:             false,
+				DefaultMediaPlayer:      false,
 			},
 			Search: UserDefaultsSearch{
 				DisableOptions: false,
@@ -937,8 +1082,12 @@ func SetDefaults(generate bool) Settings {
 				Permissions: UserDefaultsAccountPermissions{
 					Api:      false,
 					Admin:    false,
+					Modify:   false,
 					Share:    false,
 					Realtime: false,
+					Delete:   false,
+					Create:   false,
+					Download: boolPtr(true), // defaults to true
 				},
 				LockPassword:               false,
 				DisableSettings:            false,
@@ -1069,9 +1218,11 @@ func loadLoginIcon() {
 	logger.Infof("Using custom login icon: %s", Env.LoginIconPath)
 }

-// setConditionals builds optimized map structures from source rules for O(1) lookups.
+// setConditionalsMap builds optimized map structures from conditional rules for O(1) lookups
 func setConditionals(config *Source) {
-	rules := config.Config.Rules
+
+	// Merge rules from both old format (Conditionals.ItemRules) and new format (Rules)
+	rules := append(config.Config.Conditionals.ItemRules, config.Config.Rules...)

 	// Initialize the maps structure (only exact match maps for Names)
 	resolved := ResolvedRulesConfig{
@@ -1139,6 +1290,12 @@ func setConditionals(config *Source) {
 		if rule.IncludeRootItem != "" {
 			resolved.IncludeRootItems[rule.IncludeRootItem] = struct{}{}
 		}
+		if rule.FileNames != "" {
+			resolved.FileNames[rule.FileNames] = rule
+		}
+		if rule.FolderNames != "" {
+			resolved.FolderNames[rule.FolderNames] = rule
+		}
 		if rule.FileName != "" {
 			resolved.FileNames[rule.FileName] = rule
 		}
@@ -1171,12 +1328,16 @@ func modifyExcludeInclude(config *Source) {
 		return normalized
 	}

+	// Helper to normalize a name-based value (FileNames, FolderNames, StartsWith, EndsWith)
+	// These match against baseName, so no leading slash
 	normalizeName := func(value string) string {
+		// Just trim slashes - names shouldn't have slashes
 		return strings.Trim(value, "/")
 	}

 	// Normalize []ConditionalRule slices for full paths
-	allRules := config.Config.Rules
+	// Handle both old format (Conditionals.ItemRules) and new format (Rules)
+	allRules := append(config.Config.Conditionals.ItemRules, config.Config.Rules...)

 	for i, rule := range allRules {
 		// normalize full paths
@@ -1199,10 +1360,15 @@ func modifyExcludeInclude(config *Source) {
 		}

 		// normalize names
+		allRules[i].FileNames = normalizeName(rule.FileNames)
+		allRules[i].FolderNames = normalizeName(rule.FolderNames)
 		allRules[i].FileName = normalizeName(rule.FileName)
 		allRules[i].FolderName = normalizeName(rule.FolderName)
 	}

-	config.Config.Rules = allRules
+	// Update the original slices with normalized values
+	itemRulesLen := len(config.Config.Conditionals.ItemRules)
+	config.Config.Conditionals.ItemRules = allRules[:itemRulesLen]
+	config.Config.Rules = allRules[itemRulesLen:]

 }
@@ -23,5 +23,5 @@ func CanConvertVideo(ext string) bool {
 }

 func MediaEnabled() bool {
-	return Env.FFmpegAvailable
+	return Env.FFmpegPath != "" && Env.FFprobePath != ""
 }
@@ -3,11 +3,45 @@ package settings
 import (
 	"os"
 	"path/filepath"
+	"reflect"
 	"testing"

 	"github.com/google/go-cmp/cmp"
 )

+func TestInitialize(t *testing.T) {
+	type args struct {
+		configFile string
+	}
+	tests := []struct {
+		name string
+		args args
+	}{
+		// TODO: Add test cases.
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			Initialize(tt.args.configFile)
+		})
+	}
+}
+
+func Test_setDefaults(t *testing.T) {
+	tests := []struct {
+		name string
+		want Settings
+	}{
+		// TODO: Add test cases.
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := SetDefaults(true); !reflect.DeepEqual(got, tt.want) {
+				t.Errorf("setDefaults() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
 func TestConfigLoadChanged(t *testing.T) {
 	// Create isolated test directory
 	testDir := t.TempDir()
@@ -45,7 +79,8 @@ func TestConfigLoadEnvVars(t *testing.T) {

 	defaultConfig := SetDefaults(true)
 	expectedKey := "MYKEY"
-	t.Setenv("FILEBROWSER_ONLYOFFICE_SECRET", expectedKey)
+	// mock environment variables
+	os.Setenv("FILEBROWSER_ONLYOFFICE_SECRET", expectedKey)
 	err = loadConfigWithDefaults(configFile, true)
 	if err != nil {
 		t.Fatalf("error loading config file: %v", err)
@@ -59,33 +94,6 @@ func TestConfigLoadEnvVars(t *testing.T) {
 	}
 }

-func TestConfigLoadHttpSection(t *testing.T) {
-	testDir := t.TempDir()
-	configContent := []byte(`
-server:
-  sources:
-    - path: "."
-http:
-  trustProxyHeaders: true
-  disableRateLimit: true
-`)
-	configFile := filepath.Join(testDir, "config.yaml")
-	if err := os.WriteFile(configFile, configContent, 0644); err != nil {
-		t.Fatalf("failed to write test config: %v", err)
-	}
-
-	if err := loadConfigWithDefaults(configFile, true); err != nil {
-		t.Fatalf("error loading config file: %v", err)
-	}
-
-	if !Config.Http.TrustProxyHeaders {
-		t.Fatal("expected http.trustProxyHeaders to be true")
-	}
-	if !Config.Http.DisableRateLimit {
-		t.Fatal("expected http.disableRateLimit to be true")
-	}
-}
-
 func TestConfigLoadSpecificValues(t *testing.T) {
 	// Create isolated test directory
 	testDir := t.TempDir()
@@ -108,7 +116,7 @@ func TestConfigLoadSpecificValues(t *testing.T) {
 		globalVal interface{}
 		newVal    interface{}
 	}{
-		{"Server.DatabaseV2", Config.Server.DatabaseV2, defaultConfig.Server.DatabaseV2},
+		{"Server.Database", Config.Server.Database, defaultConfig.Server.Database},
 	}

 	for _, tc := range testCases {
@@ -1,9 +1,8 @@
 package settings

 import (
-	"fmt"
-
-	"github.com/gtsteffaniak/filebrowser/backend/internal/database/users"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
+	"github.com/gtsteffaniak/go-logger/logger"
 )

 // InitializeUserResolvers sets up the global resolvers and config providers in the users package
@@ -13,7 +12,8 @@ func InitializeUserResolvers() {
 	users.SetSourceNameResolver(func(sourceName string) (string, error) {
 		source, ok := Config.Server.NameToSource[sourceName]
 		if !ok {
-			return "", fmt.Errorf("source name not found: %s", sourceName)
+			logger.Debug("Could not get scope from source name: ", sourceName)
+			return "", nil
 		}
 		return source.Path, nil
 	})
@@ -53,7 +53,7 @@ func InitializeUserResolvers() {
 			}
 			return sources
 		},
-		GetDefaultScopes: func() []users.BackendScope {
+		GetDefaultScopes: func() []users.SourceScope {
 			return Config.UserDefaults.DefaultScopes
 		},
 	})
@@ -13,7 +13,6 @@ import (
 	"reflect"
 	"sort"
 	"strings"
-	"sync"

 	"golang.org/x/tools/go/packages"
 	"gopkg.in/yaml.v3"
@@ -28,45 +27,6 @@ type SecretFieldsMap map[string]map[string]bool
 // DeprecatedFieldsMap[typeName][fieldName] = true if field is deprecated
 type DeprecatedFieldsMap map[string]map[string]bool

-var (
-	collectCommentsCacheMu sync.RWMutex
-	collectCommentsCache   = map[string]collectCommentsCacheEntry{}
-)
-
-type collectCommentsCacheEntry struct {
-	comments   CommentsMap
-	secrets    SecretFieldsMap
-	deprecated DeprecatedFieldsMap
-}
-
-func cloneCommentsMap(src CommentsMap) CommentsMap {
-	if src == nil {
-		return nil
-	}
-	out := make(CommentsMap, len(src))
-	for typeName, fieldMap := range src {
-		out[typeName] = make(map[string]string, len(fieldMap))
-		for fieldName, comment := range fieldMap {
-			out[typeName][fieldName] = comment
-		}
-	}
-	return out
-}
-
-func cloneBoolFieldMap(src map[string]map[string]bool) map[string]map[string]bool {
-	if src == nil {
-		return nil
-	}
-	out := make(map[string]map[string]bool, len(src))
-	for typeName, fieldMap := range src {
-		out[typeName] = make(map[string]bool, len(fieldMap))
-		for fieldName, v := range fieldMap {
-			out[typeName][fieldName] = v
-		}
-	}
-	return out
-}
-
 // getStringStyle determines whether a string should be quoted in YAML
 func getStringStyle(value string) yaml.Style {
 	// Always quote all strings for consistency
@@ -81,38 +41,42 @@ func CollectComments(srcPath string) (CommentsMap, error) {

 // CollectCommentsAndSecrets parses all Go source and returns comments, secrets, and deprecated field mappings
 func CollectCommentsAndSecrets(srcPath string) (CommentsMap, SecretFieldsMap, DeprecatedFieldsMap, error) {
+	// Determine directories to parse - include settings and users packages
 	dir := srcPath
-	if fi, err := os.Stat(srcPath); err == nil && !fi.IsDir() {
+	if filepath.IsAbs(srcPath) {
+		// If it's an absolute path to a file, get the directory
 		dir = filepath.Dir(srcPath)
 	}
-	settingsDir, err := filepath.Abs(dir)
-	if err != nil {
-		return nil, nil, nil, err
-	}

-	collectCommentsCacheMu.RLock()
-	if cached, ok := collectCommentsCache[settingsDir]; ok && shouldCacheCollectComments(settingsDir) {
-		collectCommentsCacheMu.RUnlock()
-		return cloneCommentsMap(cached.comments), cloneBoolFieldMap(cached.secrets), cloneBoolFieldMap(cached.deprecated), nil
-	}
-	collectCommentsCacheMu.RUnlock()
-
-	// settings lives at backend/pkg/settings; users at backend/internal/database/users
+	// List of directories to parse for comments
 	dirsToparse := []string{
-		settingsDir,
-		filepath.Join(settingsDir, "..", "..", "internal", "database", "users"),
+		dir, // settings package
+	}
+
+	// Add users package directory
+	// From common/settings, go up to backend root, then into database/users
+	var usersDir string
+	if filepath.IsAbs(dir) {
+		// If absolute path, calculate relative to it
+		usersDir = filepath.Join(filepath.Dir(filepath.Dir(dir)), "database/users")
+	} else {
+		// If relative path like "common/settings" or ".", calculate from current working directory
+		usersDir = "database/users"
+	}
+	if absUsersDir, err := filepath.Abs(usersDir); err == nil {
+		dirsToparse = append(dirsToparse, absUsersDir)
 	}

 	comments := make(CommentsMap)
 	secrets := make(SecretFieldsMap)
 	deprecated := make(DeprecatedFieldsMap)

+	// Parse each directory
 	for _, parseDir := range dirsToparse {
-		if _, err := os.Stat(parseDir); err != nil {
-			continue
-		}
 		dirComments, dirSecrets, dirDeprecated, err := parseDirectoryComments(parseDir)
 		if err != nil {
+			// Log error but continue with other directories
+			fmt.Printf("Warning: failed to parse directory %s: %v\n", parseDir, err)
 			continue
 		}

@@ -145,26 +109,7 @@ func CollectCommentsAndSecrets(srcPath string) (CommentsMap, SecretFieldsMap, De
 		}
 	}

-	entry := collectCommentsCacheEntry{
-		comments:   cloneCommentsMap(comments),
-		secrets:    cloneBoolFieldMap(secrets),
-		deprecated: cloneBoolFieldMap(deprecated),
-	}
-	collectCommentsCacheMu.Lock()
-	if shouldCacheCollectComments(settingsDir) {
-		collectCommentsCache[settingsDir] = entry
-	}
-	collectCommentsCacheMu.Unlock()
-
-	return cloneCommentsMap(comments), cloneBoolFieldMap(secrets), cloneBoolFieldMap(deprecated), nil
-}
-
-// shouldCacheCollectComments avoids caching parses of ephemeral test fixture dirs under os.TempDir().
-func shouldCacheCollectComments(settingsDir string) bool {
-	if _, err := os.Stat(filepath.Join(settingsDir, "structs.go")); err == nil {
-		return true
-	}
-	return !strings.HasPrefix(settingsDir, os.TempDir())
+	return comments, secrets, deprecated, nil
 }

 // parseDirectoryComments parses a single directory for comments, secrets, and deprecated fields.
@@ -173,9 +118,6 @@ func parseDirectoryComments(dir string) (CommentsMap, SecretFieldsMap, Deprecate
 	if err != nil {
 		return nil, nil, nil, err
 	}
-	if _, err = os.Stat(absDir); err != nil {
-		return nil, nil, nil, err
-	}

 	var files []*ast.File
 	cfg := &packages.Config{
@@ -551,10 +493,10 @@ func parseDefaultsFromEmbeddedYaml(embeddedYaml string) (*Settings, error) {
 // readEmbeddedYaml attempts to read the embedded config.generated.yaml file
 func readEmbeddedYaml() (string, error) {
 	// Try to read from the relative path that should work when the binary includes embedded files
-	embeddedContent, err := os.ReadFile("internal/web/dist/config.generated.yaml")
+	embeddedContent, err := os.ReadFile("http/dist/config.generated.yaml")
 	if err != nil {
 		// Try alternative path
-		embeddedContent, err = os.ReadFile("backend/internal/web/dist/config.generated.yaml")
+		embeddedContent, err = os.ReadFile("backend/http/dist/config.generated.yaml")
 		if err != nil {
 			// Try current directory path
 			embeddedContent, err = os.ReadFile("dist/config.generated.yaml")
@@ -944,7 +886,7 @@ func GenerateYaml() {

 	// Generate YAML with comments enabled, full config, and deprecated fields filtered
 	// Use multi-directory comment parsing to get comments from all packages
-	yamlContent, err := GenerateConfigYamlWithSource(&Config, true, true, true, "pkg/settings")
+	yamlContent, err := GenerateConfigYamlWithSource(&Config, true, true, true, "common/settings")
 	if err != nil {
 		fmt.Fprintf(os.Stderr, "error generating YAML: %v\n", err)
 		os.Exit(1)
@@ -961,9 +903,9 @@ func GenerateYaml() {
 func GenerateConfigYaml(config *Settings, showComments bool, showFull bool, filterDeprecated bool) (string, error) {
 	// Try different source paths to handle both runtime and test scenarios
 	sourcePaths := []string{
-		".",               // When running tests from settings directory
-		"../pkg/settings", // When running from backend directory
-		"pkg/settings",    // Alternative path
+		".",                  // When running tests from settings directory
+		"../common/settings", // When running from backend directory
+		"common/settings",    // Alternative path
 	}

 	for _, sourcePath := range sourcePaths {
@@ -0,0 +1,236 @@
+package settings
+
+import (
+	"regexp"
+	"strings"
+	"testing"
+)
+
+func TestGenerateConfigYaml_Basic(t *testing.T) {
+	reNumber := regexp.MustCompile(`^-?\d+(\.\d+)?$`)
+	// Test using the actual source directory structure
+	trueVal := true
+	config := &Settings{
+		UserDefaults: UserDefaults{
+			Locale:                  "es",          // Non-default value
+			DarkMode:                &trueVal,      // Default value
+			DisableOfficePreviewExt: ".docx .xlsx", // This field is deprecated
+		},
+		Auth: Auth{
+			Key:           "secret123",    // This is a secret field
+			AdminUsername: "testadmin",    // This is a secret field
+			AdminPassword: "testpassword", // This is a secret field
+		},
+	}
+
+	// Test different combinations
+	testCases := []struct {
+		name             string
+		showComments     bool
+		showFull         bool
+		filterDeprecated bool
+		expectSecrets    bool
+		expectDeprecated bool
+	}{
+		{
+			name:             "API_mode_all_fields",
+			showComments:     false,
+			showFull:         true,
+			filterDeprecated: false,
+			expectSecrets:    true, // Secrets should be hidden
+			expectDeprecated: true, // Deprecated should be shown
+		},
+		{
+			name:             "Static_config_filter_deprecated",
+			showComments:     true,
+			showFull:         true,
+			filterDeprecated: true,
+			expectSecrets:    true,  // Secrets should be hidden
+			expectDeprecated: false, // Deprecated should be filtered
+		},
+		{
+			name:             "Filtered_non_defaults",
+			showComments:     false,
+			showFull:         false,
+			filterDeprecated: false,
+			expectSecrets:    true,  // Secrets should be hidden
+			expectDeprecated: false, // Might not appear if matches default
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			// Use the current directory structure for real testing
+			yamlOutput, err := GenerateConfigYaml(config, tc.showComments, tc.showFull, tc.filterDeprecated)
+			if err != nil {
+				t.Fatalf("GenerateConfigYaml failed: %v", err)
+			}
+
+			// Basic validation - should produce some output
+			if len(yamlOutput) == 0 {
+				t.Fatal("Generated empty YAML")
+			}
+
+			// Test string quoting - string values should be quoted, numbers and booleans should not
+			lines := strings.Split(yamlOutput, "\n")
+			for _, line := range lines {
+				if strings.Contains(line, ":") && !strings.HasSuffix(strings.TrimSpace(line), ":") {
+					// This is a key-value line, skip comment portion
+					parts := strings.SplitN(line, ":", 2)
+					if len(parts) == 2 {
+						value := strings.TrimSpace(parts[1])
+						// Remove comments
+						if commentIdx := strings.Index(value, "#"); commentIdx >= 0 {
+							value = strings.TrimSpace(value[:commentIdx])
+						}
+
+						// Skip empty values, arrays, and objects
+						if value == "" || strings.HasPrefix(value, "[") || strings.HasPrefix(value, "{") {
+							continue
+						}
+
+						// Check if it's a number (should NOT be quoted)
+						if reNumber.MatchString(value) {
+							if strings.HasPrefix(value, "\"") {
+								t.Errorf("Numeric value should not be quoted in line: %s (value: '%s')", line, value)
+							}
+							continue
+						}
+
+						// Check if it's a boolean (should NOT be quoted)
+						if value == "true" || value == "false" {
+							if strings.HasPrefix(value, "\"") {
+								t.Errorf("Boolean value should not be quoted in line: %s (value: '%s')", line, value)
+							}
+							continue
+						}
+
+						// Check if it's null (should NOT be quoted - it's a YAML literal for nil)
+						if value == "null" {
+							continue
+						}
+
+						// Everything else should be a quoted string
+						if !strings.HasPrefix(value, "\"") || !strings.HasSuffix(value, "\"") {
+							// Add debug info to see what's wrong
+							t.Logf("DEBUG: Checking value '%s' from line '%s'", value, strings.TrimSpace(line))
+							t.Errorf("String value should be quoted in line: %s (value: %s)", strings.TrimSpace(line), value)
+						}
+					}
+				}
+			}
+
+			// Test secret hiding
+			if tc.expectSecrets {
+				if !strings.Contains(yamlOutput, "**hidden**") {
+					t.Error("Expected secrets to be hidden with **hidden**")
+				}
+				if strings.Contains(yamlOutput, "secret123") || strings.Contains(yamlOutput, "testadmin") || strings.Contains(yamlOutput, "testpassword") {
+					t.Error("Secret values should not appear in output")
+				}
+			}
+
+			// Test deprecated field filtering
+			hasDeprecated := strings.Contains(yamlOutput, "disableOfficePreviewExt")
+			if tc.expectDeprecated && !hasDeprecated {
+				t.Error("Expected deprecated field to be present")
+			}
+			if !tc.expectDeprecated && hasDeprecated && tc.filterDeprecated {
+				t.Error("Expected deprecated field to be filtered out when filterDeprecated=true")
+			}
+
+			// Test comments
+			hasComments := strings.Contains(yamlOutput, "#")
+			if tc.showComments && !hasComments {
+				t.Error("Expected comments to be present when showComments=true")
+			}
+
+			t.Logf("Test case: %s\nGenerated YAML:\n%s\n", tc.name, yamlOutput)
+		})
+	}
+}
+
+func TestCollectCommentsAndSecrets_Basic(t *testing.T) {
+	// Test the comment and secret collection directly
+	comments, secrets, deprecated, err := CollectCommentsAndSecrets(".")
+	if err != nil {
+		t.Fatalf("CollectCommentsAndSecrets failed: %v", err)
+	}
+
+	// Should find some secrets in the actual source files
+	foundSecrets := false
+	for typeName, typeSecrets := range secrets {
+		for fieldName := range typeSecrets {
+			t.Logf("Found secret: %s.%s", typeName, fieldName)
+			foundSecrets = true
+		}
+	}
+	if !foundSecrets {
+		t.Error("Expected to find some secret fields in the actual source code")
+	}
+
+	// Should find some deprecated fields
+	foundDeprecated := false
+	for typeName, typeDeprecated := range deprecated {
+		for fieldName := range typeDeprecated {
+			t.Logf("Found deprecated: %s.%s", typeName, fieldName)
+			foundDeprecated = true
+		}
+	}
+	if !foundDeprecated {
+		t.Error("Expected to find some deprecated fields in the actual source code")
+	}
+
+	t.Logf("Comments: %d types", len(comments))
+	t.Logf("Secrets: %d types", len(secrets))
+	t.Logf("Deprecated: %d types", len(deprecated))
+}
+
+func TestGenerateYaml_StaticGeneration(t *testing.T) {
+	// Test the static generation function that's used by FILEBROWSER_GENERATE_CONFIG=true
+
+	// Create a temporary config for testing
+	config := &Settings{
+		UserDefaults: UserDefaults{
+			Locale:                  "en",
+			DisableOfficePreviewExt: ".docx .xlsx", // This should be filtered out
+		},
+		Auth: Auth{
+			Key: "test-secret", // This should be redacted
+		},
+	}
+
+	// Test static generation with comments and deprecated filtering
+	yamlOutput, err := GenerateConfigYamlWithSource(config, true, true, true, ".")
+	if err != nil {
+		t.Fatalf("Static generation failed: %v", err)
+	}
+
+	// Verify comments are included
+	if !strings.Contains(yamlOutput, "#") {
+		t.Error("Static generation should include comments")
+	}
+
+	// Verify deprecated field is filtered out
+	if strings.Contains(yamlOutput, "disableOfficePreviewExt") {
+		t.Error("Static generation should filter out deprecated field disableOfficePreviewExt")
+	}
+
+	// Verify secrets are redacted
+	if !strings.Contains(yamlOutput, "**hidden**") {
+		t.Error("Static generation should redact secrets")
+	}
+	if strings.Contains(yamlOutput, "test-secret") {
+		t.Error("Static generation should not contain actual secret values")
+	}
+
+	// Verify it has proper structure
+	if !strings.Contains(yamlOutput, "userDefaults:") {
+		t.Error("Static generation should contain userDefaults section")
+	}
+	if !strings.Contains(yamlOutput, "auth:") {
+		t.Error("Static generation should contain auth section")
+	}
+
+	t.Logf("Static generation successful with comments and proper filtering")
+}
@@ -2,7 +2,6 @@ package settings

 import (
 	"os"
-	"path/filepath"
 	"regexp"
 	"strings"
 	"testing"
@@ -25,14 +24,23 @@ type TestNested struct {
 	NestedDeprecated string `json:"nestedDeprecated"` // deprecated: nested deprecated field
 }

-// Helper to create test source files for comment parsing (isolated dir per test for go/packages).
+// Helper to create test source files for comment parsing
 func createTestSourceFile(t *testing.T, content string) (string, func()) {
-	dir := t.TempDir()
-	path := filepath.Join(dir, "fixture.go")
-	if err := os.WriteFile(path, []byte(content), 0o600); err != nil {
+	tmpFile, err := os.CreateTemp("", "test_*.go")
+	if err != nil {
 		t.Fatal(err)
 	}
-	return path, func() {}
+
+	if _, err := tmpFile.WriteString(content); err != nil {
+		t.Fatal(err)
+	}
+	tmpFile.Close()
+
+	cleanup := func() {
+		os.Remove(tmpFile.Name())
+	}
+
+	return tmpFile.Name(), cleanup
 }

 func TestGenerateConfigYaml_StringQuoting(t *testing.T) {
@@ -60,9 +68,7 @@ type Auth struct {
 	// Create real Settings with string values to test quoting
 	settings := &Settings{
 		UserDefaults: UserDefaults{
-			UI: UserDefaultsUI{
-				Locale: "en-US",
-			},
+			Locale: "en-US",
 		},
 		Auth: Auth{
 			AdminUsername: "admin",
@@ -206,10 +212,8 @@ type UserDefaults struct {
 	trueVal := true
 	config := &Settings{
 		UserDefaults: UserDefaults{
-			UI: UserDefaultsUI{
-				DarkMode: &trueVal,
-				Locale:   "es",
-			},
+			DarkMode: &trueVal, // This matches default
+			Locale:   "es",     // This differs from default ("en")
 		},
 	}

@@ -245,9 +249,7 @@ func TestGenerateConfigYaml_CommentsOnOff(t *testing.T) {
 	// Use the actual settings source directory since comments work there
 	config := &Settings{
 		UserDefaults: UserDefaults{
-			UI: UserDefaultsUI{
-				Locale: "en",
-			},
+			Locale: "en",
 		},
 	}

@@ -285,13 +287,9 @@ func TestGenerateConfigYaml_IntegrationTest(t *testing.T) {
 	trueVal := true
 	config := &Settings{
 		UserDefaults: UserDefaults{
-			UI: UserDefaultsUI{
-				Locale:   "es",
-				DarkMode: &trueVal,
-			},
-			FileViewer: UserDefaultsFileViewer{
-				DisableOnlyOfficeExt: ".docx .xlsx",
-			},
+			Locale:                  "es",          // Non-default
+			DarkMode:                &trueVal,      // Default
+			DisableOfficePreviewExt: ".docx .xlsx", // This is deprecated
 		},
 		Auth: Auth{
 			Key:           "secret123", // This is secret
@@ -316,7 +314,7 @@ func TestGenerateConfigYaml_IntegrationTest(t *testing.T) {
 			showFull:         true,
 			filterDeprecated: false,
 			expectSecret:     true,  // secrets should be hidden
-			expectDeprecated: false,
+			expectDeprecated: true,  // deprecated should be shown
 			expectFull:       true,  // all fields shown
 			expectComments:   false, // no comments
 		},
@@ -442,10 +440,8 @@ func TestGenerateConfigYaml_EdgeCases(t *testing.T) {
 			name: "only_defaults",
 			config: &Settings{
 				UserDefaults: UserDefaults{
-					UI: UserDefaultsUI{
-						DarkMode: boolPtr(true), // default value
-						Locale:   "en",          // default value
-					},
+					DarkMode: boolPtr(true), // default value
+					Locale:   "en",          // default value
 				},
 			},
 			desc: "Config with only default values",
@@ -454,42 +450,28 @@ func TestGenerateConfigYaml_EdgeCases(t *testing.T) {

 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			// Spot-check flag combinations (full cartesian product is slow without comment-parse cache)
-			cases := []struct {
-				showComments, showFull, filterDeprecated bool
-			}{
-				{false, true, false},
-				{true, true, true},
-				{false, false, true},
-			}
-			if testing.Short() {
-				cases = cases[:1]
-			}
-			for _, tc := range cases {
-				yamlOutput, err := GenerateConfigYaml(tt.config, tc.showComments, tc.showFull, tc.filterDeprecated)
-				if err != nil {
-					t.Fatalf("GenerateConfigYaml failed for %s (comments=%v, full=%v, filterDeprecated=%v): %v",
-						tt.desc, tc.showComments, tc.showFull, tc.filterDeprecated, err)
-				}
-				if yamlOutput == "" {
-					t.Errorf("Generated empty YAML for %s", tt.desc)
-				}
-				if strings.Contains(yamlOutput, "Error:") || strings.Contains(yamlOutput, "ERROR:") {
-					t.Errorf("YAML contains error for %s", tt.desc)
+			// Test all combinations
+			for _, showComments := range []bool{false, true} {
+				for _, showFull := range []bool{false, true} {
+					for _, filterDeprecated := range []bool{false, true} {
+						yamlOutput, err := GenerateConfigYaml(tt.config, showComments, showFull, filterDeprecated)
+						if err != nil {
+							t.Fatalf("GenerateConfigYaml failed for %s (comments=%v, full=%v, filterDeprecated=%v): %v",
+								tt.desc, showComments, showFull, filterDeprecated, err)
+						}
+
+						// Basic validation - should produce valid YAML structure
+						if yamlOutput == "" {
+							t.Errorf("Generated empty YAML for %s", tt.desc)
+						}
+
+						// Should not contain obvious error messages (but allow "error" in log levels etc)
+						if strings.Contains(yamlOutput, "Error:") || strings.Contains(yamlOutput, "ERROR:") {
+							t.Errorf("YAML contains error for %s", tt.desc)
+						}
+					}
 				}
 			}
 		})
 	}
 }
-
-func TestGenerateConfigYaml_defaultPermissionsDocumentsView(t *testing.T) {
-	cfg := SetDefaults(true)
-	cfg.Server.Sources = []*Source{{Path: ".", Config: SourceConfig{}}}
-	out, err := GenerateConfigYamlWithSource(&cfg, true, true, true, ".")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !strings.Contains(out, "defaultPermissions:") || !strings.Contains(out, "view:") {
-		t.Fatalf("expected defaultPermissions to include view, got excerpt around block")
-	}
-}
Author	SHA1	Message	Date
Graham Steffaniak	6a997d4605	updated with rate limiting (#2484 )	2026-05-22 10:28:19 -05:00
Graham Steffaniakandcodacy-production[bot]	2633768d9f	fix panic on shutdown or folder deletion (#2467 ) Co-authored-by: codacy-production[bot] <61871480+codacy-production[bot]@users.noreply.github.com>	2026-05-20 14:20:26 -05:00
Graham Steffaniak	4bca80a156	Fix allow listing override (#2471 )	2026-05-20 14:20:05 -05:00
Graham Steffaniak	fc929970b3	Fix onlyoffice rewrite and remove CSP (#2466 )	2026-05-19 18:26:41 -05:00
Graham Steffaniak	12c71d38a9	Read only source config (#2464 )	2026-05-19 11:47:53 -05:00
Graham Steffaniak	641e4c5397	updated readme	2026-05-18 17:15:49 -05:00
Graham Steffaniak	587cd62da6	updated readme	2026-05-18 17:03:20 -05:00
Graham Steffaniak	ea19302c25	Merge branch 'dev/v1.4.2' of github.com:gtsteffaniak/filebrowser into dev/v1.4.2	2026-05-18 16:54:14 -05:00
Graham Steffaniak Kevin B.Stephan Paternotte codacy-production[bot]	d4dd0c70f4	Update linting for codacy (#2460 ) Co-authored-by: Kevin B. <kurami32_kbm@proton.me> Co-authored-by: Stephan Paternotte <Stephan-P@users.noreply.github.com> Co-authored-by: codacy-production[bot] <61871480+codacy-production[bot]@users.noreply.github.com>	2026-05-18 16:53:35 -05:00
Graham Steffaniak	1babfa03bc	Merge branch 'dev/v1.4.2' of github.com:gtsteffaniak/filebrowser into dev/v1.4.2	2026-05-18 16:45:13 -05:00
Graham Steffaniak Kevin B.Stephan Paternotte codacy-production[bot]	daa48c3c31	Add rate limiting for auth (#2458 ) Co-authored-by: Kevin B. <kurami32_kbm@proton.me> Co-authored-by: Stephan Paternotte <Stephan-P@users.noreply.github.com> Co-authored-by: codacy-production[bot] <61871480+codacy-production[bot]@users.noreply.github.com>	2026-05-18 16:00:40 -05:00
Graham Steffaniak	a9e4fc27b0	Merge branch 'dev/v1.4.2' of github.com:gtsteffaniak/filebrowser into dev/v1.4.2	2026-05-18 14:52:00 -05:00
Graham Steffaniak Kevin B.Stephan Paternotte codacy-production[bot]	1715577d99	Merge main changes to v1.4.2 (#2457 ) Co-authored-by: Kevin B. <kurami32_kbm@proton.me> Co-authored-by: Stephan Paternotte <Stephan-P@users.noreply.github.com> Co-authored-by: codacy-production[bot] <61871480+codacy-production[bot]@users.noreply.github.com>	2026-05-18 14:51:24 -05:00
Graham Steffaniak	5eb4dc7f7c	Merge branch 'main' into dev/v1.4.2	2026-05-18 14:43:49 -05:00
Graham Steffaniak	4248849bb6	Merge branch 'main' of github.com:gtsteffaniak/filebrowser	2026-05-18 14:43:36 -05:00
Graham Steffaniak	c5eeb308fa	Merge branch 'main' into dev/v1.4.2	2026-05-18 14:42:47 -05:00
Graham Steffaniak	12cd81340e	Merge branch 'staging/v1.3.3'	2026-05-18 14:42:26 -05:00
Kevin B.Graham Steffaniak Graham Steffaniak	2b532c368d	fix logout and closing of profile settings in shares + other fixes (#2445 ) Co-authored-by: Graham Steffaniak <graham.steffaniak@autodesk.com> Co-authored-by: Graham Steffaniak <42989099+gtsteffaniak@users.noreply.github.com>	2026-05-18 14:36:26 -05:00
Graham Steffaniak	28e9b81e43	Public patch transversal fix (#2444 )	2026-05-18 14:35:14 -05:00
Graham Steffaniak	6d4bffd407	updated with static content handler change (#2439 )	2026-05-18 14:33:49 -05:00
Kevin B.	5e49e1ecdd	fix path slash issue on windows (#2451 )	2026-05-18 09:45:25 -05:00
Graham Steffaniak	1aba10b87f	updated share hash middleware (#2443 )	2026-05-16 13:45:32 -05:00
Graham Steffaniak	15f484fba5	updated with new tests (#2429 )	2026-05-15 10:10:38 -05:00
Graham Steffaniak	d4eb051294	added codacy changes (#2430 )	2026-05-15 10:10:25 -05:00
Graham Steffaniak	5597b28f10	update anonymous user access	2026-05-13 20:03:23 -05:00
Graham Steffaniak	6bfc397419	Fix inline svg attack (#2376 )	2026-05-01 13:49:55 -05:00
Graham Steffaniak	112740bdd4	security bugfix (#2374 )	2026-05-01 13:38:44 -05:00
Graham Steffaniak	9117fb2b5f	fix context menu (#2373 )	2026-05-01 10:05:04 -05:00