fix(cli): preserve admin credentials in setup-generated config (#3267)

Co-authored-by: Cursor <cursoragent@cursor.com>

.github/scripts/docker-floating-tag-policy.sh

@@ -0,0 +1,101 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+IMAGE_REPO="${IMAGE_REPO:-gtstef/filebrowser}"
+SLIM_SUFFIX="${SLIM_SUFFIX:-}"
+
+if [[ -z "${GITHUB_OUTPUT:-}" ]]; then
+  echo "GITHUB_OUTPUT is not set" >&2
+  exit 1
+fi
+
+write_outputs() {
+  local update_track="$1"
+  local update_major="$2"
+  echo "update_track=${update_track}" >> "$GITHUB_OUTPUT"
+  echo "update_major=${update_major}" >> "$GITHUB_OUTPUT"
+}
+
+registry_version() {
+  local tag="$1"
+  local ver err err_file
+  err_file="$(mktemp)"
+  if ! ver="$(docker buildx imagetools inspect "${IMAGE_REPO}:${tag}" \
+    --format '{{ with index .Image "linux/amd64" }}{{ index .Config.Labels "org.opencontainers.image.version" }}{{ end }}' 2>"$err_file")"; then
+    err="$(cat "$err_file")"
+    rm -f "$err_file"
+    if grep -qiE 'not found|manifest unknown' <<<"$err"; then
+      ver=""
+    else
+      echo "Failed to inspect ${IMAGE_REPO}:${tag}: ${err}" >&2
+      exit 1
+    fi
+  else
+    rm -f "$err_file"
+    if [[ -z "$ver" ]]; then
+      echo "Missing org.opencontainers.image.version on ${IMAGE_REPO}:${tag} (linux/amd64)" >&2
+      exit 1
+    fi
+  fi
+  ver="${ver#v}"
+  printf '%s' "$ver"
+}
+
+semver_allows_update() {
+  local new="$1"
+  local incumbent="$2"
+  if [[ -z "$incumbent" ]]; then
+    return 0
+  fi
+  local winner
+  winner="$(printf '%s\n' "$incumbent" "$new" | sort -V | tail -n1)"
+  [[ "$winner" == "$new" ]]
+}
+
+ref="${GITHUB_REF_NAME:-}"
+ref="${ref#v}"
+
+if [[ ! "$ref" =~ ^([0-9]+\.[0-9]+\.[0-9]+)-(.+)$ ]]; then
+  echo "Tag '${GITHUB_REF_NAME:-}' has no X.Y.Z-suffix form; leaving major-only floats enabled, track floats disabled"
+  write_outputs false true
+  exit 0
+fi
+
+new_version="$ref"
+semver_core="${BASH_REMATCH[1]}"
+suffix="${BASH_REMATCH[2]}"
+major="$(echo "$semver_core" | cut -d. -f1)"
+
+track=""
+case "$suffix" in
+  beta) track="beta" ;;
+  stable) track="stable" ;;
+  *)
+    echo "Tag suffix '${suffix}' is not beta/stable; leaving major-only floats enabled, track floats disabled"
+    write_outputs false true
+    exit 0
+    ;;
+esac
+
+track_tag="${track}${SLIM_SUFFIX}"
+major_tag="${major}-${track}${SLIM_SUFFIX}"
+
+incumbent_track="$(registry_version "$track_tag")"
+incumbent_major="$(registry_version "$major_tag")"
+
+update_track=false
+if semver_allows_update "$new_version" "$incumbent_track"; then
+  update_track=true
+fi
+
+update_major=false
+if semver_allows_update "$new_version" "$incumbent_major"; then
+  update_major=true
+fi
+
+echo "Floating tag policy (${SLIM_SUFFIX:-full} image):"
+echo "  New version: ${new_version}"
+echo "  Track tag: ${track_tag} (incumbent: ${incumbent_track:-<none>}) -> update_track=${update_track}"
+echo "  Major tag: ${major_tag} (incumbent: ${incumbent_major:-<none>}) -> update_major=${update_major}"
+
+write_outputs "$update_track" "$update_major"

.github/workflows/tag.yaml

@@ -61,18 +61,23 @@ jobs:
           images: |
             gtstef/filebrowser
             ghcr.io/gtsteffaniak/filebrowser
+      - name: Decide floating Docker tags
+        id: floating
+        run: bash .github/scripts/docker-floating-tag-policy.sh
       - name: Modify tags (strip 'v' and add version tags)
         id: modify-json
         run: |
           JSON='${{ steps.meta.outputs.json }}'
-          MODIFIED_JSON=$(echo "$JSON" | jq '
+          MODIFIED_JSON=$(echo "$JSON" | jq \
+            --argjson updateTrack '${{ steps.floating.outputs.update_track == 'true' }}' \
+            --argjson updateMajor '${{ steps.floating.outputs.update_major == 'true' }}' '
             .tags |= map(
               sub(":v"; ":")      # Strip the 'v'
               | select(test(":latest") | not)
             ) |
-            # Find all version tags with suffix (X.Y.Z-suffix) and add major.minor and major tags
+            # Find all version tags with suffix (X.Y.Z-suffix) and add major.minor (always) and major tags (when allowed)
             .tags += [
-              .tags[] 
+              .tags[]
               | select(test(":[0-9]+\\.[0-9]+\\.[0-9]+-"))
               | split(":")
               | .[-1] as $version
@@ -83,18 +88,20 @@ jobs:
               | ($version_parts[0]) as $major
               | "gtstef/filebrowser:\($major_minor)-\($suffix)",
                 "ghcr.io/gtsteffaniak/filebrowser:\($major_minor)-\($suffix)",
-                "gtstef/filebrowser:\($major)-\($suffix)",
-                "ghcr.io/gtsteffaniak/filebrowser:\($major)-\($suffix)"
+                if $updateMajor then
+                  "gtstef/filebrowser:\($major)-\($suffix)",
+                  "ghcr.io/gtsteffaniak/filebrowser:\($major)-\($suffix)"
+                else empty end
             ] |
-            # Add suffix-only tags for beta (only if tag ends with -beta)
-            if any(.tags[]; split(":")[-1] | endswith("-beta")) then
+            # Add suffix-only tags for beta when semver policy allows
+            if $updateTrack and any(.tags[]; split(":")[-1] | endswith("-beta")) then
               .tags += [
                 "gtstef/filebrowser:beta",
                 "ghcr.io/gtsteffaniak/filebrowser:beta"
               ]
             else . end |
-            # Add suffix-only tags for stable (and latest) (only if tag ends with -stable)
-            if any(.tags[]; split(":")[-1] | endswith("-stable")) then
+            # Add suffix-only tags for stable (and latest) when semver policy allows
+            if $updateTrack and any(.tags[]; split(":")[-1] | endswith("-stable")) then
               .tags += [
                 "gtstef/filebrowser:stable",
                 "ghcr.io/gtsteffaniak/filebrowser:stable",
@@ -146,19 +153,26 @@ jobs:
           images: |
             gtstef/filebrowser
             ghcr.io/gtsteffaniak/filebrowser
+      - name: Decide floating Docker tags
+        id: floating
+        env:
+          SLIM_SUFFIX: -slim
+        run: bash .github/scripts/docker-floating-tag-policy.sh
       - name: Modify tags (strip 'v' and add 'slim' if needed)
         id: modify-json-slim
         run: |
           JSON='${{ steps.meta.outputs.json }}'
-          MODIFIED_JSON=$(echo "$JSON" | jq '
+          MODIFIED_JSON=$(echo "$JSON" | jq \
+            --argjson updateTrack '${{ steps.floating.outputs.update_track == 'true' }}' \
+            --argjson updateMajor '${{ steps.floating.outputs.update_major == 'true' }}' '
             .tags |= map(
               sub(":v"; ":")                 # Strip the 'v'
               | select(test(":latest") | not) # Remove the "latest" tag
               | . + "-slim"                   # Append "-slim" to the versioned tag
             ) |
-            # Find all version tags with suffix (X.Y.Z-suffix-slim) and add major.minor and major tags
+            # Find all version tags with suffix (X.Y.Z-suffix-slim) and add major.minor (always) and major tags (when allowed)
             .tags += [
-              .tags[] 
+              .tags[]
               | select(test(":[0-9]+\\.[0-9]+\\.[0-9]+-"))
               | split(":")
               | .[-1] as $version
@@ -169,18 +183,20 @@ jobs:
               | ($version_parts[0]) as $major
               | "gtstef/filebrowser:\($major_minor)-\($suffix)",
                 "ghcr.io/gtsteffaniak/filebrowser:\($major_minor)-\($suffix)",
-                "gtstef/filebrowser:\($major)-\($suffix)",
-                "ghcr.io/gtsteffaniak/filebrowser:\($major)-\($suffix)"
+                if $updateMajor then
+                  "gtstef/filebrowser:\($major)-\($suffix)",
+                  "ghcr.io/gtsteffaniak/filebrowser:\($major)-\($suffix)"
+                else empty end
             ] |
-            # Add suffix-only tags for beta-slim (only if tag ends with -beta-slim)
-            if any(.tags[]; split(":")[-1] | endswith("-beta-slim")) then
+            # Add suffix-only tags for beta-slim when semver policy allows
+            if $updateTrack and any(.tags[]; split(":")[-1] | endswith("-beta-slim")) then
               .tags += [
                 "gtstef/filebrowser:beta-slim",
                 "ghcr.io/gtsteffaniak/filebrowser:beta-slim"
               ]
             else . end |
-            # Add suffix-only tags for stable-slim (only if tag ends with -stable-slim)
-            if any(.tags[]; split(":")[-1] | endswith("-stable-slim")) then
+            # Add suffix-only tags for stable-slim when semver policy allows
+            if $updateTrack and any(.tags[]; split(":")[-1] | endswith("-stable-slim")) then
               .tags += [
                 "gtstef/filebrowser:stable-slim",
                 "ghcr.io/gtsteffaniak/filebrowser:stable-slim"

CHANGELOG.md

@@ -2,8 +2,205 @@
 
 All notable changes to this project will be documented in this file. For commit guidelines, please refer to [Standard Version](https://github.com/conventional-changelog/standard-version).
 
-## v2.0.8
 
+## v2.0.2-stable
+
+ **Security**:
+ - [Low] SSE source-update and user-targeted delivery hold the client registry lock through nonblocking sends, preventing concurrent map mutation and send-on-closed-channel panics when Realtime clients connect, disconnect, or shut down (GHSA-p9wm-f5jj-75pj) reporter @tao0845
+ - [Moderate] Moving or renaming a folder updates only shares whose paths are under the moved prefix, preserving per-file share roots instead of retargeting unrelated substring matches (GHSA-26fh-r34c-qxh6) reporters @jayhemnani9910 @dylanzonix
+ - [High] File Size Analyzer hover tooltips render file paths as plain text instead of HTML, closing stored XSS via crafted file names (GHSA-rmjp-pfrq-cc3v) reporter @U3RhcnQ
+ - [Moderate] Passkey registration and deletion now require the account password when a passkey is already configured, and passkeys cannot be altered through generic user profile PATCH (GHSA-r744-4vm3-2px3) reporter @tonghuaroot
+ - [Moderate] Authenticated GET /api/resources/view no longer accepts view tokens minted for a public share when the caller lacks view permission on the requested source (GHSA-wxj5-g3qp-g732) reporter @BlueN0r
+ - [Low] Duplicate finder results are cached per requesting user so filtered file names from one account are not served to another (GHSA-4fhx-8pf6-5gmr) reporter @Nazarami
+ - [Moderate] WebDAV PUT now requires Create permission when the target path does not yet exist, so Modify-only users cannot create new files (GHSA-8655-2ph3-q7q7) reporter @levanduy181
+ - [Low] Failed-login lockout and auth rate limits now use the rightmost `X-Forwarded-For` hop when proxy headers are trusted, so a client cannot spoof the client IP with a leftmost forwarded value (GHSA-wjp8-g49g-xrhx) reporter @LECOQQ
+
+ **Bug Fixes**:
+ - fix(auth): apply stored permission caps for customized API tokens with no global flags enabled; minimal tokens still inherit the owner's permissions
+ - Preview generation for WebP images (encode as JPEG thumbnail) ([#3259](https://github.com/gtsteffaniak/filebrowser/pull/3259), [#3254](https://github.com/gtsteffaniak/filebrowser/issues/3254))
+ - Public share pages show configured banner when API returns `bannerUrl` ([#3250](https://github.com/gtsteffaniak/filebrowser/pull/3250), [#3246](https://github.com/gtsteffaniak/filebrowser/issues/3246))
+ - Tar extraction creates hard-linked files instead of skipping `TypeLink` entries ([#3234](https://github.com/gtsteffaniak/filebrowser/pull/3234))
+ - Embedded JPEG previews for additional RAW/camera formats (ARW, RW2, RAW, RWL) ([#3243](https://github.com/gtsteffaniak/filebrowser/pull/3243))
+ - fix(preview): generate WebP image previews by encoding thumbnails as JPEG ([#3259](https://github.com/gtsteffaniak/filebrowser/pull/3259)) ([#3254](https://github.com/gtsteffaniak/filebrowser/issues/3254))
+ - fix(frontend): show configured share banner on public share pages when API returns `bannerUrl` ([#3250](https://github.com/gtsteffaniak/filebrowser/pull/3250)) ([#3246](https://github.com/gtsteffaniak/filebrowser/issues/3246))
+ - fix(archive): extract tar hard-linked files instead of skipping `TypeLink` entries ([#3234](https://github.com/gtsteffaniak/filebrowser/pull/3234))
+ - fix(preview): embedded JPEG previews for additional RAW/camera formats (RTF, RW2, RAW, RWL) ([#3243](https://github.com/gtsteffaniak/filebrowser/pull/3243))
+ - fix(frontend): keep source named `files` in `extractSourceFromPath` ([#3143](https://github.com/gtsteffaniak/filebrowser/issues/3143), [#3099](https://github.com/gtsteffaniak/filebrowser/pull/3099))
+ - fix(frontend): load the default source when browsing `/files/` with a single configured source ([#3178](https://github.com/gtsteffaniak/filebrowser/issues/3178)) (related: [#3144](https://github.com/gtsteffaniak/filebrowser/issues/3144))
+ - fix(frontend): restore upload prompt close, tab-reload, and in-app navigation guards while uploads are active (including paused uploads)
+
+## v2.0.1-stable
+
+ **Security**:
+ - [High] New accounts named with ".." breaks out of scoped folder on creation (GHSA-c84q-q5g6-r47f) -- reporter @dylanzonix
+ - [Medium] Fixed session token collision issue when multiple users login simultaneously. (GHSA-c9cr-w724-gqj3) (#3135) Thanks @dl-pt reporters: @Ishtiaque-Ahmed-Risat @AlexWhiplash @tonghuaroot
+
+## v2.0.0-stable
+
+This version represents the most significant change to date. It **requires** both a database migration and config structural changes. See the [migration guide](https://filebrowserquantum.com/en/docs/getting-started/v2/migration/) for step-by-step upgrade instructions, [About v2.0.0](https://filebrowserquantum.com/en/docs/getting-started/v2/about/) for a full summary.
+
+Also, consider enabling "analytics" in admin settings which will help me populate an anonymous public dashboard for everyone to see. Currently, theres 60 deployments details populated from beta, so after a percentage of you enable this in staging there should be plenty to make the dashboard useful and available. No private information is used, you can see exactly what data is sent in the UI.
+
+ **Breaking Changes**:
+ - Removed: `GET /api/raw` and `GET /public/api/raw` download routes — use `/api/resources/download` instead.
+ - Removed: `/share/…` URL redirect to `/public/share/…` — use `/public/share/…` directly.
+ - Removed: singular `source` search api param (use `sources`), bare `scope` paths without `sourceName:` prefix, and `glob` / `useGlob` aliases (use `useWildcard`).
+ - Removed `config.conditionals`, source-level `indexingIntervalMinutes` (indexing always uses adaptive scheduling), and deprecated rule fields `fileNames` / `folderNames` / top-level `hidden` — use `config.rules` with `fileName`, `folderName`, and `ignoreHidden` on rules. See [Exclusion rules](https://filebrowserquantum.com/en/docs/user-guides/general-configuration/exclusion-rules/).
+ - Removed: deprecated `userDefaults` config formats (nested and flat) — use the [config migration tool](https://filebrowserquantum.com/en/docs/getting-started/v2/config-migration/) to convert before upgrading.
+ - Changed: `PUT /api/users` moved to the more appropriate `PATCH` method and requires specifying `which` in the body. Blank or `all` values are rejected.
+ - Changed: http related config options in `server` config key moved to `http` config key. See [HTTP settings](https://filebrowserquantum.com/en/docs/configuration/http/).
+ - Changed (reverse proxy): `http.trustedHeaders` (v1.5.x list) removed — use `http.trustProxyHeaders: true` when behind nginx, Traefik, or Caddy. When enabled, FileBrowser honors `X-Forwarded-Host`, `X-Forwarded-Proto`, `X-Forwarded-For`, and `X-Real-IP` for client IP, cookies, OIDC callbacks, WebAuthn, share URLs, rate limiting, and activity logs. Default is `false` (direct connection values). The [config migration tool](https://filebrowserquantum.com/en/docs/getting-started/v2/config-migration/) converts v1 `trustedHeaders` lists to `trustProxyHeaders: true`. See [Reverse proxy](https://filebrowserquantum.com/en/docs/getting-started/reverse-proxy/) and [HTTP trustProxyHeaders](https://filebrowserquantum.com/en/docs/configuration/http/#trustproxyheaders).
+ - Changed: `FILEBROWSER_DATABASE` environment variable — use `FILEBROWSER_DATABASE_PATH` instead. See [Environment variables](https://filebrowserquantum.com/en/docs/reference/environment-variables/) and [Server settings](https://filebrowserquantum.com/en/docs/configuration/server/).
+ - Changed: Moved stream api to `/api/media/stream`. See [API reference](https://filebrowserquantum.com/en/docs/reference/api/).
+ - Changed: CLI user management — canonical commands are `user set <username> --password [value]` and `user promote <username>`; `set -u username,password` is deprecated. See [CLI reference](https://filebrowserquantum.com/en/docs/reference/cli/).
+
+ **Security**:
+- [Critical] A forged JWT could authenticate as any known `belongsTo`. Auth signing keys are now persisted in the application database and JWT validation fails closed when no key is configured. (GHSA-8f9r-wg7w-pfw) (#2987) Thanks @d3do-23 and @whoamis3c.
+- [High] Restricted custom API tokens can no longer be upgraded to a full-permission session via `POST /api/auth/renew` (GHSA-6gr6-5qpq-888p) -- thanks @tao0845.
+- [High] TOTP re-enrollment no longer allows anonymous callers to replace an existing second factor using only the account password; requires an authenticated self or admin session (GHSA-qx86-4v5r-26g5) -- thanks @tao0845.
+- [Medium] Public upload shares with `allowReplacements=false` now reject overwrites when clients send `override=true`. (GHSA-3846-gh75-gp3m) Thanks @d3do-23
+- [Medium] OnlyOffice callbacks verify the shared `integrations.office.secret` JWT and require the document key to match the cached editor session; document downloads re-validate redirect targets against the configured document-server host (SSRF); public shares with `enableOnlyOffice=false` reject `/office/*` requests server-side.
+- [Low] Public share lyrics and subtitle routes honor the share's file-viewer setting, download disable flag, and download limits (GHSA-p7x3-p5jj-9xfh) -- thanks Yves Soete of Blacksight LLC. @yssoe
+- Fresh installs with default `admin`/`admin` generate a random initial password and log it once (#2977).
+- OIDC login binds OAuth `state` to an HttpOnly cookie and rejects tampered callbacks; login/logout/session-expiry redirects reject open-redirect targets, and signup sends credentials in a JSON body instead of query parameters.
+- Startup fails when the configured auth signing key differs from the persisted one; session/API token registrations record JWT expiry and expired mappings are pruned.
+
+ **New Features**:
+ - View grant mechanism to distinguish between UI viewing and download. See [Access control overview](https://filebrowserquantum.com/en/docs/access-control/access-control-overview/).
+ - granular per-source file permissions (view, download, modify, create, delete) with automatic migration from global permissions
+   - per-source defaults configurable in `settings > access management`
+   - `view` permission is automatically set to true unless explicitly set to false. See [Access control overview](https://filebrowserquantum.com/en/docs/access-control/access-control-overview/).
+   - can be enforced for all users. See [Access control overview](https://filebrowserquantum.com/en/docs/access-control/access-control-overview/).
+ - New activity logs for user activity.
+   - charts and historical data
+   - export to csv reports
+ - Media player improvements:
+   - Refreshed playback queue UI: Supports thumbnails, stored into session storage, and has a "clear queue" button (#2575) (#2600).
+   - Loop now has 3 states (off/single/all) and neither of them will clear the existing queue (#2600).
+   - New "Audio visualizer" for audio files (desktop-only), you can configure some basic things to your taste (#2575) (#2620).
+   - The current state of the audio panel now is stored into local storage.
+   - More gestures: Swipe up to enter/exit fullscreen, long-press to change playback speed, single tap to pause (#2575).
+   - Videos now will resume fullscreen and PiP when navigating (queue auto-navigation, swipes gestures or next/previous) (#2649).
+ - Added `F4` shortcut to refresh the current directory and metadata (#2600).
+ - opt-in feature to send deployment analytics to filebrowser quantum developer servers
+   - anonymized with a viewer so users can see what info would be sent.
+   - if opt-in, every month a snapshot of your deployment config would be sent to developer servers
+   - this will help me know what features are being used and what versions everyone is on over time. I will also provide a public dashboard with this information in the future. 
+ - WebDAV now supports set modification time via the `X-OC-Mtime` header for clients that support it (#2626). See [WebDAV docs](https://filebrowserquantum.com/en/docs/features/webdav/).
+ - Copy operations now preserve their original modification times (#2642) (#2647):
+   - WebUI preserves both, files and directories.
+   - WebDAV `COPY` preserves modification times only for files, is limitation we have with webdav.
+ - User default enhancements
+   - Config `userDefaults` seeds SQLite on first run; only fields explicitly set in config stay locked in **Settings → User defaults** (other defaults remain editable)
+   - Added administrator controls for universal user defaults and enforced preferences in `settings > user management > user defaults`.
+   - Added configurable default file permissions per source in `settings > access management`.
+   - Added a User Defaults editor for account, permission, and profile preferences in the edit/create user prompt. See [User management](https://filebrowserquantum.com/en/docs/configuration/users/).
+ - Database env var rename: `FILEBROWSER_DATABASE` is removed (startup fails if set). Use `FILEBROWSER_DATABASE_PATH` (default `filebrowser.sqlite`) or `server.database.path` in config. See [Environment variables](https://filebrowserquantum.com/en/docs/reference/environment-variables/) and [Server settings](https://filebrowserquantum.com/en/docs/configuration/server/).
+ - CLI: `user set` with `--password` (inline value, interactive prompt on TTY, or piped stdin); `user promote` for admin grant without password reset. See [CLI reference](https://filebrowserquantum.com/en/docs/reference/cli/).
+- Require password change at next login for password-based users: new user setting `requirePasswordChange` (user defaults + per-user admin toggle). Bootstrap admins with a generated initial password get this automatically ([#2977](https://github.com/gtsteffaniak/filebrowser/issues/2977)). Generated bootstrap passwords use a speakable `word-xxxxx-xx` form.
+- PWA improvements for installed mobile apps: dedicated maskable icons (192/512), manifest and splash colors that follow the instance default theme, runtime `theme-color` sync on dark-mode toggle, and edge-to-edge safe-area layout for notched devices (#2625) (#2869) -- thanks @APatenaude
+- Users can set default view mode and thumbnail size from Profile settings (Listing options). Admins can set the same defaults for existing users and edit all profile preference defaults from the user management panel ([#2884](https://github.com/gtsteffaniak/filebrowser/issues/2884)).
+- Added "Upload only what's missing" to the upload conflict prompt (#2985) (#2553)
+- Added `init` CLI command, which creates a minimal commented config.yaml instead of a full config (#2957)
+- Config YAML expands `$VAR` and `${VAR}` so values such as `userPassword: "${FILEBROWSER_LDAP_USER_PASSWORD}"` work (#3042).
+- Sidebar source links can switch between aggregated usage (default) and a root-filesystem-only view via a new "Limit disk usage to source filesystem" toggle.
+
+ **Notes**:
+ - v2.x.x uses a new write-through backend state management. Changes go through a fast memory layer and also write changes to database to stay in sync. See [About v2.0.0](https://filebrowserquantum.com/en/docs/getting-started/v2/about/).
+ - CLI server start (`./filebrowser`), `setup`, `version`, and `set rule` syntax unchanged; see [CLI docs](https://filebrowserquantum.com/en/docs/reference/cli/)
+ - new dropdown and input styles
+ - swipe gestures to dismiss notifications (#2672)
+ - user updates are more granular, don't include entire user payload.
+ - `user.id` has been moved to a backend property and all frontend apis now query users by username. Swagger has been updated. See [API reference](https://filebrowserquantum.com/en/docs/reference/api/).
+ - removed legacy and deprecated properties from API responses and generated config output
+ - `/api/media/stream` is audio/video only (range-based chunking). Non-media inline viewing uses `GET /api/resources/view`. Both endpoints use the same `viewToken` from file metadata. See [API reference](https://filebrowserquantum.com/en/docs/reference/api/).
+ - removed exiftool as an optional helper, always built with the supported libraries (requires 64 bit os)
+ - If migration issues arise, see [Migration troubleshooting](https://filebrowserquantum.com/en/docs/getting-started/migration/troubleshooting/).
+ - default browser media player option removed, always uses themed plyr
+ - [docker] upgraded ffmpeg from 8.1.2 to 9.0
+- Sidebar navigation tree rows are real hyperlinks: middle-click, Ctrl/Cmd+click, and Shift+click use the browser's default new-tab or new-window behavior.
+- Pop-up preview has a 200ms debounce delay so it doesn't flash when moving the cursor across files quickly.
+- Improved UI responsiveness for larger directories and Firefox, with marginal memory improvement (#1773) (#2879)
+- Improvements to document thumbnail generation performance.
+- Changed behavior for typing to select files in listing view; added more actions in advanced search (#2776).
+- Session renew is handled by client keep-alive; per-request `X-Renew-Token` header handling removed.
+- `defaultEnabled` now means the source is always added to users on startup and login.
+- Webdav always shows hidden files, ignores the user preference. (#3004)
+- Share download links no longer embed a token; they link to the UI, which prompts for the password before download. For direct downloads use the documented `/api/share/direct` API. (#2888)
+- Sidebar links follow source changes: renaming a source updates links, disabling/deleting a user source removes them (#2878) (#2942), and adding a source via scopes auto-adds a link.
+- `/api/resources/download` and `/public/api/resources/download` return HTTP 404 for missing files/directories instead of 500 (#2981); `GET /api/resources` returns 400 when `path` is missing or empty (#2801).
+- Added risc-v to official releases.
+- A CLI password reset returns the user to a password-method user.
+
+ **Bugfixes**:
+- Long uploads/downloads no longer lose the session mid-transfer; session keep-alive renews before expiry and auto-logout is disabled during active transfers (#2638).
+- GroupMap changes are written through to SQL so JWT/OIDC/LDAP group memberships survive restart (#2742).
+- OIDC: `groupsClaim` is always requested and falls back to UserInfo; the verified ID-token identifier is preserved on fallback; sessions respect `tokenExpirationHours` (#3006).
+- LDAP `userGroups` matching accepts CN-only values against full `memberOf` DNs and is case-insensitive (#3044).
+- Sidebar folder links with custom names/icons/styles persist across restarts, and deleted links stay deleted (#2809) (#2935).
+- Fixed PDF thumbnail process aborts (#2763), PDF preview blocking uploads (#2752), and 401 on the PDF download button (#2978).
+- Fixed ffmpeg unresponsive lock issue (#2996).
+- Fixed multiple embedded subtitles with the same language (#2756).
+- Fixed Fuji `.raf` thumbnail preview; unsupported image preview formats return HTTP 415 instead of 500.
+- Members without download permission could not open text-based files with OnlyOffice enabled (#2777).
+- Fixed iOS 26 / WebKit multi-chunk upload stall by isolating chunk connections (#2734).
+- Mobile/UI fixes: upload options cut off (#2685), uploaded image cut off (#2765), next/previous buttons hiding on photos (#2767), missing gallery download button (#2767), double-tap to zoom, html viewer height, tooltips on mobile, assorted styling inconsistencies (#2908).
+- Public share folder and multi-file ZIP downloads were empty for anonymous visitors on sources with deny-by-default/path rules (#2631) (#2365).
+- Preserve Ctrl-click selection with stale keyboard state (#2958) (#2923); avoid false stalls in parallel transfers (#2950) (#2948) thanks @gudcks0305; hide Replace on conflict prompts when the user lacks modify permission (#2837).
+- Disk usage: fixed overstatement on virtiofs/Docker Desktop (#2894), inflated usage across ZFS datasets/btrfs subvolumes (#3025) (#2997), capped usage bars at 100% and summed nested mounts on Linux (#2761) (#2238).
+- Support non-ASCII share passwords (#2933); fall back to buffered copies when FUSE rejects fast paths (#2938) (#2924); tilde (`~`) source paths expand properly.
+- Fixed slow/broken file listing when `http.baseURL` is a subpath.
+- SQLite: removed shared cache and set `busy_timeout` on every pooled connection; busy errors no longer reported as success or empty cache results.
+
+## v2.0.10
+
+ **Security**:
+ - [High] Restricted custom API tokens (`minimal=false`) can no longer be upgraded to a full-permission session via `POST /api/auth/renew`; renew accepts only web session tokens registered in `hashed_tokens` (GHSA-6gr6-5qpq-888p) -- thanks @tao0845.
+ - [High] TOTP re-enrollment via `POST /api/auth/otp/generate` and `POST /api/auth/otp/verify` no longer allows anonymous callers to replace an existing second factor using only the account password; reset or replace requires an authenticated self or admin session (first-time enrollment without MFA unchanged) (GHSA-qx86-4v5r-26g5) -- thanks @tao0845.
+ - [Low] Public share lyrics and subtitle media routes now honor the share's file-viewer setting, download disable flag, and download limits, matching the public download route (GHSA-p7x3-p5jj-9xfh) -- thanks Yves Soete of Blacksight LLC. @yssoe
+
+ **New Features**:
+ - Require password change at next login for password-based users: new user setting `requirePasswordChange` (user defaults + per-user admin toggle), login blocked until the user sets a new password; bootstrap admins with a generated initial password get this automatically ([#2977](https://github.com/gtsteffaniak/filebrowser/issues/2977)). Generated bootstrap passwords use a speakable `word-xxxxx-xx` form (random word from a fixed list plus a 5-character and 2-character code) instead of a long hex string, for easier handoff before the forced change.
+ - Config YAML expands `$VAR` and `${VAR}` so values such as `userPassword: "${FILEBROWSER_LDAP_USER_PASSWORD}"` work as documented (#3042).
+
+ **Notes**:
+ - Sidebar navigation tree rows are real hyperlinks: middle-click, Ctrl/Cmd+click, and Shift+click use the browser’s default new-tab or new-window behavior.
+ - Sidebar source links can now switch between aggregated usage (default) and a root-filesystem-only view via a new "Limit disk usage to source filesystem" toggle.
+ - [docker] upgraded ffmpeg from 9.0 to 9.0.2
+ - CLI setup command no longer produces full config, instead a minimal config.yaml with comments.
+
+ **Bugfixes**:
+ - Fixed slow or broken file listing when `http.baseURL` is a subpath (for example `/files/`): the default source redirect navigated to `/files/{source}` on top of the app base URL, producing `/files/files/{source}` and resolving the wrong storage source until the route recovered.
+ - Anonymous visitors on public shares could not play inline video or audio: `GET /public/api/media/stream` returned 403 because view grants were validated before share context was fully hydrated; playback now works when download and the file viewer are allowed ([#3041](https://github.com/gtsteffaniak/filebrowser/issues/3041)).
+ - Fixed inflated disk usage for sources spanning multiple ZFS datasets (or btrfs subvolumes): shared-pool filesystems are now grouped by pool and counted once, instead of multiplying capacity by the number of mounted datasets (#3025) (#2997) (#2761).
+ - LDAP `userGroups` matching now accepts CN-only config values against full `memberOf` DNs and compares case-insensitively, instead of failing the shared auth helper with strict string equality (#3044).
+ - OIDC session expires despite tokenExpirationHours (#3006).
+ - Media playback becomes stuck after opening a failing media file since v2.0.8-beta (#3031)
+
+## v2.0.9
+
+ **Security**:
+ - Fresh install with default `admin`/`admin` startup generates a random initial password and logs it once (#2977). Updated documentation to follow.
+ - OIDC login binds OAuth `state` to an HttpOnly cookie (crypto-random) and rejects tampered callbacks; post-login redirects must be same-app relative paths.
+ - Login, logout, and session-expiry redirects reject open-redirect targets (`//`, `/\\`, off-site URLs); signup sends credentials in a JSON body instead of query parameters.
+
+ **Notes**:
+ - Webdav always shows hidden files, ignores user preference. (#3004)
+ - SQLite shared cache (`cache=shared`) removed from the application database connection: its table-lock conflicts bypass `busy_timeout` and fail immediately. WAL mode already allows concurrent readers.
+
+ **Bugfixes**:
+ - Fixed intermittent blank page / blocked inline SPA script after CSP hardening (#2995)
+ - ffmpeg unresponsive lock issue (#2996)
+ - fixed token migration lockout regression from v2.0.8-beta (#2999)
+ - Public shares with OnlyOffice disabled (`enableOnlyOffice=false`) now reject `/office/config` and `/office/callback` requests server-side instead of only hiding the editor in the UI
+ - Session/API token registrations now record the JWT expiry; expired mappings are pruned at startup, and tokens expired beyond the same 2-minute grace window used for session rotation no longer resolve a user identity on public share routes
+ - Startup now fails when the configured/env auth signing key differs from the key persisted in the application database, instead of warning and minting tokens with divergent keys
+ - OnlyOffice document downloads now re-validate redirect targets against the configured document-server host, closing an SSRF gap where a redirect could send the fetch to an internal address
+ - OnlyOffice "closed with changes" callbacks now keep the document key until the save succeeds, so a failed save can be retried by the document server instead of being rejected as an unknown session
+ - External JWT (JwtAuth) requests now reuse an existing valid session cookie instead of minting and registering a new session token on every request
+ - SQLite index and application databases configure `busy_timeout` on every pooled connection, and busy/locked detection now uses driver result codes; index batch writes and maintenance no longer report success when the DB stays busy, and index cache reads return busy errors instead of empty results so listing can fall back to the filesystem.
+
+## v2.0.8
  **Security**:
  - [Critical] A forged JWT could authenticate as any known `belongsTo`. Auth signing keys are now persisted in the application database and JWT validation fails closed when no key is configured. (GHSA-8f9r-wg7w-pfw) (#2987) Thanks @d3do-23 and @whoamis3c.
  - [Medium] Public upload shares with replacements disabled (`allowReplacements=false`) now reject overwrites when clients send `override=true`. (GHSA-3846-gh75-gp3m) Thanks @d3do-23

_docker/Dockerfile

@@ -1,4 +1,4 @@
-FROM gtstef/ffmpeg:9.0-decode AS ffmpeg
+FROM ghcr.io/gtsteffaniak/ffmpeg:9.0.2-decode AS ffmpeg
 FROM golang:alpine AS base
 ARG VERSION
 ARG REVISION

_docker/Dockerfile.playwright-no-config

@@ -15,4 +15,5 @@ COPY [ "./backend/internal/web/embed/", "./internal/web/dist/"]
 
 # Run tests
 ENV FILEBROWSER_PLAYWRIGHT_TEST=true
+ENV FILEBROWSER_ADMIN_PASSWORD=playwright-password
 RUN ./filebrowser & sleep 2 && cd ../frontend && npx playwright test

_docker/src/general/backend/config.yaml

@@ -5,6 +5,9 @@ http:
 frontend:
   <<: *frontend-main
 
+auth:
+  <<: *auth-main
+
 userDefaults:
   preview:
     image: true

_docker/src/general/backend/server-config.yaml

@@ -21,4 +21,7 @@ server-main: &server-main
         defaultEnabled: true
         rules:
           - folderPath: "/"
-            viewable: true
+            viewable: true
+
+auth-main: &auth-main
+  adminPassword: "playwright-password"

_docker/src/performance/backend/config.yaml

@@ -5,6 +5,9 @@ http:
 frontend:
   <<: *frontend-main
 
+auth:
+  <<: *auth-main
+
 userDefaults:
   preview:
     image: true

_docker/src/performance/backend/server-config.yaml

@@ -21,4 +21,7 @@ server-main: &server-main
         defaultEnabled: true
         rules:
           - folderPath: "/"
-            viewable: true
+            viewable: true
+
+auth-main: &auth-main
+  adminPassword: "playwright-password"

_docker/src/screenshots/backend/config.yaml

@@ -1,6 +1,12 @@
 http:
   port: 8080
   baseURL:  "/files/"
+frontend:
+  styling:
+    disableEventThemes: true
+auth:
+  adminPassword: "playwright-password"
+
 server:
   logging:
     - levels: "info|error|warning|debug"

_docker/src/settings/backend/config.yaml

@@ -41,6 +41,7 @@ frontend:
       title: "Playwright"
 
 auth:
+  adminPassword: "playwright-password"
   methods:
     password:
       signup: true

_docker/src/sharing/backend/config.yaml

@@ -16,6 +16,9 @@ server:
         private: true
         defaultEnabled: true
 
+auth:
+  adminPassword: "playwright-password"
+
 frontend:
   name: "Graham's Filebrowser"
   disableDefaultLinks: true

backend/build/go.mod

@@ -28,7 +28,7 @@ require (
 	github.com/OpenPeeDeeP/depguard/v2 v2.2.1 // indirect
 	github.com/air-verse/air v1.67.4 // indirect
 	github.com/alecthomas/chroma/v2 v2.27.0 // indirect
-	github.com/alecthomas/go-check-sumtype v0.4.0 // indirect
+	github.com/alecthomas/go-check-sumtype v0.5.1-0.20260828200218-ae6904d28606 // indirect
 	github.com/alexkohler/nakedret/v2 v2.0.6 // indirect
 	github.com/alexkohler/prealloc v1.1.0 // indirect
 	github.com/alfatraining/structtag v1.0.0 // indirect
@@ -54,7 +54,7 @@ require (
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/charithe/durationcheck v0.0.11 // indirect
 	github.com/charmbracelet/colorprofile v0.4.3 // indirect
-	github.com/charmbracelet/ultraviolet v0.0.0-20260910203606-6c9e17dc7a16 // indirect
+	github.com/charmbracelet/ultraviolet v0.0.0-20260922123528-4e49372c11f9 // indirect
 	github.com/charmbracelet/x/ansi v0.11.8 // indirect
 	github.com/charmbracelet/x/term v0.2.2 // indirect
 	github.com/charmbracelet/x/termios v0.1.1 // indirect
@@ -105,7 +105,7 @@ require (
 	github.com/golangci/dupl v0.0.0-20260401084720-c99c5cf5c202 // indirect
 	github.com/golangci/go-printf-func-name v0.1.1 // indirect
 	github.com/golangci/gofmt v0.0.0-20260820135601-e84e05053792 // indirect
-	github.com/golangci/golangci-lint/v2 v2.13.2 // indirect
+	github.com/golangci/golangci-lint/v2 v2.14.0 // indirect
 	github.com/golangci/golines v0.15.0 // indirect
 	github.com/golangci/misspell v0.8.0 // indirect
 	github.com/golangci/plugin-module-register v0.1.2 // indirect
@@ -150,7 +150,7 @@ require (
 	github.com/mattn/go-colorable v0.1.15 // indirect
 	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/mattn/go-runewidth v0.0.30 // indirect
-	github.com/mgechev/revive v1.16.0 // indirect
+	github.com/mgechev/revive v1.17.0 // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/moricho/tparallel v0.3.2 // indirect
 	github.com/muesli/cancelreader v0.2.2 // indirect
@@ -200,7 +200,7 @@ require (
 	github.com/swaggo/swag v1.16.6 // indirect
 	github.com/tdewolff/parse/v2 v2.8.16 // indirect
 	github.com/tetafro/godot v1.5.6 // indirect
-	github.com/timakin/bodyclose v0.0.0-20260723120731-857993a2939c // indirect
+	github.com/timakin/bodyclose v0.0.0-20260923065923-98ded9ab4ef2 // indirect
 	github.com/timonwong/loggercheck v0.12.0 // indirect
 	github.com/tomarrell/wrapcheck/v2 v2.12.0 // indirect
 	github.com/tommy-muehle/go-mnd/v2 v2.5.1 // indirect

backend/build/go.sum

@@ -56,8 +56,8 @@ github.com/alecthomas/assert/v2 v2.11.0 h1:2Q9r3ki8+JYXvGsDyBXwH3LcJ+WK5D0gc5E8v
 github.com/alecthomas/assert/v2 v2.11.0/go.mod h1:Bze95FyfUr7x34QZrjL+XP+0qgp/zg8yS+TtBj1WA3k=
 github.com/alecthomas/chroma/v2 v2.27.0 h1:FodwmyOBgJULFYmDqibcp9pvfDLWdtPRh9v/r5BXYZs=
 github.com/alecthomas/chroma/v2 v2.27.0/go.mod h1:NjJ3ciIgrqBNeIkWZ4e46nseoLDslxU1LmfCoL+wcY8=
-github.com/alecthomas/go-check-sumtype v0.4.0 h1:gd4mE4QsA62sXlnFIs8GUv8/0xH3DOUqTkYQR1l2v28=
-github.com/alecthomas/go-check-sumtype v0.4.0/go.mod h1:aYYllI8IXNjo7ZYUzI2+wyLRECMg3zo+8CZj9JTBAWU=
+github.com/alecthomas/go-check-sumtype v0.5.1-0.20260828200218-ae6904d28606 h1:dXPJ+uOJLWb8rjlAuLX7JPiRJtZKw/53Ol+WxdDJ1Eo=
+github.com/alecthomas/go-check-sumtype v0.5.1-0.20260828200218-ae6904d28606/go.mod h1:ZH31IJyNpxpStxP2ayCcPQz+3T2G/OnxIQqe4LWvSDw=
 github.com/alecthomas/repr v0.5.2 h1:SU73FTI9D1P5UNtvseffFSGmdNci/O6RsqzeXJtP0Qs=
 github.com/alecthomas/repr v0.5.2/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
 github.com/alexkohler/nakedret/v2 v2.0.6 h1:ME3Qef1/KIKr3kWX3nti3hhgNxw6aqN5pZmQiFSsuzQ=
@@ -138,8 +138,8 @@ github.com/charithe/durationcheck v0.0.11 h1:g1/EX1eIiKS57NTWsYtHDZ/APfeXKhye1Di
 github.com/charithe/durationcheck v0.0.11/go.mod h1:x5iZaixRNl8ctbM+3B2RrPG5t856TxRyVQEnbIEM2X4=
 github.com/charmbracelet/colorprofile v0.4.3 h1:QPa1IWkYI+AOB+fE+mg/5/4HRMZcaXex9t5KX76i20Q=
 github.com/charmbracelet/colorprofile v0.4.3/go.mod h1:/zT4BhpD5aGFpqQQqw7a+VtHCzu+zrQtt1zhMt9mR4Q=
-github.com/charmbracelet/ultraviolet v0.0.0-20260910203606-6c9e17dc7a16 h1:/hSCZO1puetbGd2JikHKN0nAcb2mFevzxJElFoduhaw=
-github.com/charmbracelet/ultraviolet v0.0.0-20260910203606-6c9e17dc7a16/go.mod h1:JFvmQPZh3uAu7PpSZU91bcR0BrIy24HhW+0EsW1uGxE=
+github.com/charmbracelet/ultraviolet v0.0.0-20260922123528-4e49372c11f9 h1:ZGHc3eaN2TIhkpwRibtr8N9jLQJOY1rh6GEByRoRmp4=
+github.com/charmbracelet/ultraviolet v0.0.0-20260922123528-4e49372c11f9/go.mod h1:D9SVXVpAsD1pP6xR6BiERbe4+dUU6EW9US1TFrNutGA=
 github.com/charmbracelet/x/ansi v0.11.8 h1:JMFwp0CgDC2+jcOB162HH5k7I3FVbgFSMMYg7dSPBQQ=
 github.com/charmbracelet/x/ansi v0.11.8/go.mod h1:ZNN+3mXny/516oTQPLMPIBeSINvNJJQ8uQXDgbeJxY0=
 github.com/charmbracelet/x/term v0.2.2 h1:xVRT/S2ZcKdhhOuSP4t5cLi5o+JxklsoEObBSgfgZRk=
@@ -290,8 +290,8 @@ github.com/golangci/go-printf-func-name v0.1.1 h1:hIYTFJqAGp1iwoIfsNTpoq1xZAarog
 github.com/golangci/go-printf-func-name v0.1.1/go.mod h1:Es64MpWEZbh0UBtTAICOZiB+miW53w/K9Or/4QogJss=
 github.com/golangci/gofmt v0.0.0-20260820135601-e84e05053792 h1:WL8YKrt3UbOBqSRU7GpP5BTtQTMWtVtj+mfPijgZeIg=
 github.com/golangci/gofmt v0.0.0-20260820135601-e84e05053792/go.mod h1:te5hX0dW4C5r6YbXs+6ysNr8Q5UTmdIqGbb+mlFiYmA=
-github.com/golangci/golangci-lint/v2 v2.13.2 h1:bCyq3E4vo9qwzifjpzJqYndEt7Ncva80qkk8G2B4TXU=
-github.com/golangci/golangci-lint/v2 v2.13.2/go.mod h1:5xaMd1kAxV7GSBPEyngw8gnnjoRocqW9UVKdBR6627w=
+github.com/golangci/golangci-lint/v2 v2.14.0 h1:ot8QffRa4LzAAEgtvNYrVs9esxQ7xoTwoAv6uhp4ngA=
+github.com/golangci/golangci-lint/v2 v2.14.0/go.mod h1:amHimCzNDP1GfVno3hIiNssjvqXmuW+CPZAHOdR4cIc=
 github.com/golangci/golines v0.15.0 h1:Qnph25g8Y1c5fdo1X7GaRDGgnMHgnxh4Gk4VfPTtRx0=
 github.com/golangci/golines v0.15.0/go.mod h1:AZjXd23tbHMpowhtnGlj9KCNsysj72aeZVVHnVcZx10=
 github.com/golangci/misspell v0.8.0 h1:qvxQhiE2/5z+BVRo1kwYA8yGz+lOlu5Jfvtx2b04Jbg=
@@ -414,8 +414,8 @@ github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsRe
 github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/mattn/go-runewidth v0.0.30 h1:+KUuiDA4fF0R1p5FeueHefjDm+GIM+kWfFnDjybOPgk=
 github.com/mattn/go-runewidth v0.0.30/go.mod h1:3qAiGCV4Koz/yuveO58qUefmUTRm8r0IGEXZ9jeHp/8=
-github.com/mgechev/revive v1.16.0 h1:9OZVO8xOPUwIYynplHXv7liMllPQ/BTNZLp07sM/Im0=
-github.com/mgechev/revive v1.16.0/go.mod h1:nT854jMmvQsS/qqxEaMPM4pJSUpxhcPoHM788ZxDvdQ=
+github.com/mgechev/revive v1.17.0 h1:hwTTVC3svSv9X2FA2hiYT17Uws+lfxDWhPxzBZZCREg=
+github.com/mgechev/revive v1.17.0/go.mod h1:uiVNUF8ruVh4WHm/aPs7kKEeuo+m6oO3tuOfniyzP/g=
 github.com/microcosm-cc/bluemonday v1.0.27 h1:MpEUotklkwCSLeH+Qdx1VJgNqLlpY2KXwXFM08ygZfk=
 github.com/microcosm-cc/bluemonday v1.0.27/go.mod h1:jFi9vgW+H7c3V0lb6nR74Ib/DIB5OBs92Dimizgw2cA=
 github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
@@ -567,8 +567,8 @@ github.com/tetafro/godot v1.5.6 h1:IEkrFCwXaYHlOn4mGzGS3F3dkP6m9t0jpwqBFPIkKiA=
 github.com/tetafro/godot v1.5.6/go.mod h1:eOkMrVQurDui411nBY2FA05EYH01r14LuWY/NrVDVcU=
 github.com/tetratelabs/wazero v1.12.0 h1:DuWcpNu/FzgEXgGBDp8J1Spc+CWOvvtvVyjKlaZopYU=
 github.com/tetratelabs/wazero v1.12.0/go.mod h1:LvKtzl2RqO4gyF27BiXU+nKAjcV8f38U+kP/q2vgxh0=
-github.com/timakin/bodyclose v0.0.0-20260723120731-857993a2939c h1:d/FUP8GD4QiY/rdFzZmBu3KqL9eBNVzMu7W/5pGkaMM=
-github.com/timakin/bodyclose v0.0.0-20260723120731-857993a2939c/go.mod h1:sDHLK7rb/59v/ZxZ7KtymgcoxuUMxjXq8gtu9VMOK8M=
+github.com/timakin/bodyclose v0.0.0-20260923065923-98ded9ab4ef2 h1:HECVafB2AKntWWRfsiQ4gdunLx5WOYQzFdCsxqOrzp8=
+github.com/timakin/bodyclose v0.0.0-20260923065923-98ded9ab4ef2/go.mod h1:JLoPVtROtNgJ99yXTIxuGNttvmJa85tkJAO6lr05qBA=
 github.com/timonwong/loggercheck v0.12.0 h1:7Cb9XGLJZSWYNjgL459DIhpSiEHupD+MLQ6vaN2Pl3g=
 github.com/timonwong/loggercheck v0.12.0/go.mod h1:Wa6Y+SJHQR01mViZlLLY5GAZVOWOLNMbkXddMjFWQCs=
 github.com/tomarrell/wrapcheck/v2 v2.12.0 h1:H/qQ1aNWz/eeIhxKAFvkfIA+N7YDvq6TWVFL27Of9is=

backend/cmd/cli.go

@@ -8,7 +8,6 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/goccy/go-yaml"
 	"github.com/gtsteffaniak/filebrowser/backend/internal/adapters/fs/files"
 	"github.com/gtsteffaniak/filebrowser/backend/internal/database/users"
 	"github.com/gtsteffaniak/filebrowser/backend/internal/state"
@@ -225,19 +224,11 @@ func createConfig(configpath string, noInput bool) error {
 		fmt.Printf("Error: '%s' is not a valid port. Please enter a number between 1 and 65535.\n", portStr)
 	}
 
-	for {
-		levels := askQuestion(reader, "What should the log levels be?", "info|warning|error")
-		checkLevels := SplitByMultiple(levels)
-		invalidOptions := []string{}
-		for _, level := range checkLevels {
-			if !(level == "info" || level == "warning" || level == "error" || level == "debug") {
-				invalidOptions = append(invalidOptions, level)
-			}
-		}
-		if len(invalidOptions) == 0 {
-			break
-		}
-		fmt.Printf("Error: invalid options given '%s'. valid options: 'info|warning|error|debug'.\n", invalidOptions)
+	config.Server.Logging = []settings.LogConfig{
+		{
+			Output: "stdout",
+			Levels: "info|warning|error",
+		},
 	}
 
 	for {
@@ -250,9 +241,20 @@ func createConfig(configpath string, noInput bool) error {
 		}
 		fmt.Printf("Error: '%s' is not a valid path. Please enter a path to a file ending in .sqlite", config.Server.DatabaseV2.Path)
 	}
-	config.Frontend.Name = askQuestion(reader, "What should the application brand name be?", "FileBrowser Quantum")
-	config.Auth.AdminUsername = askQuestion(reader, "What should the default admin username be?", "admin")
-	config.Auth.AdminPassword = askQuestion(reader, "What should the default admin password be?", "admin")
+	const defaultFrontendName = "FileBrowser Quantum"
+	brandName := askQuestion(reader, "What should the application brand name be?", defaultFrontendName)
+	if brandName != defaultFrontendName {
+		config.Frontend.Name = brandName
+	}
+	adminUsername := askQuestion(reader, "What should the default admin username be?", "admin")
+	if adminUsername != "admin" {
+		config.Auth.AdminUsername = adminUsername
+	}
+	const adminPasswordGenerateDefault = "generate on startup"
+	adminPassword := askQuestion(reader, "What should the default admin password be?", adminPasswordGenerateDefault)
+	if adminPassword != "" && !strings.EqualFold(adminPassword, adminPasswordGenerateDefault) {
+		config.Auth.AdminPassword = adminPassword
+	}
 
 	modifyDefault := askYesNoQuestion(reader, "Should a new user be able to modify content by default?", "no")
 	config.Server.Sources[0].Config.DefaultPermissions = settings.NormalizeSourceFilePermissions(users.SourceFilePermissions{
@@ -266,12 +268,12 @@ func createConfig(configpath string, noInput bool) error {
 
 	fmt.Println("--- 	Configuration Complete 	---")
 
-	yamlData, err := yaml.Marshal(&config)
+	yamlData, err := generateSetupConfigYAML(&config)
 	if err != nil {
-		return fmt.Errorf("marshaling config: %w", err)
+		return fmt.Errorf("generating config YAML: %w", err)
 	}
 
-	err = os.WriteFile(configpath, yamlData, 0600)
+	err = os.WriteFile(configpath, []byte(yamlData), 0600)
 	if err != nil {
 		return fmt.Errorf("writing config file: %w", err)
 	}
@@ -291,6 +293,22 @@ func createConfig(configpath string, noInput bool) error {
 	return nil
 }
 
+func generateSetupConfigYAML(config *settings.Settings) (string, error) {
+	embeddedPaths := []string{
+		"frontend/public/config.generated.yaml",
+		"../frontend/public/config.generated.yaml",
+		"internal/web/dist/config.generated.yaml",
+		"../internal/web/dist/config.generated.yaml",
+	}
+	for _, path := range embeddedPaths {
+		embeddedYaml, err := os.ReadFile(path)
+		if err == nil && len(embeddedYaml) > 0 {
+			return settings.GenerateConfigYamlWithEmbedded(config, true, false, false, string(embeddedYaml), nil)
+		}
+	}
+	return settings.GenerateConfigYaml(config, true, false, false, nil)
+}
+
 func generateYaml() {
 	generateConfig := os.Getenv("FILEBROWSER_GENERATE_CONFIG") == "true"
 	if generateConfig || settings.Env.IsDevMode {

backend/cmd/cli_test.go

@@ -9,6 +9,7 @@ import (
 	"testing"
 
 	"github.com/alecthomas/kong"
+	"github.com/gtsteffaniak/filebrowser/backend/pkg/settings"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -191,3 +192,26 @@ func TestSetupNoInputRejected(t *testing.T) {
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "interactive input")
 }
+
+func TestGenerateSetupConfigYAML_MinimalWithComments(t *testing.T) {
+	t.Chdir("..")
+
+	cfg := settings.SetDefaults(false)
+	cfg.Server.Sources = []*settings.Source{{Path: "/var/lib/files"}}
+	cfg.Server.DatabaseV2.Path = "./filebrowser.sqlite"
+	cfg.Http.Port = 8080
+	cfg.Server.Logging = []settings.LogConfig{
+		{Output: "stdout", Levels: "info|warning|error"},
+	}
+
+	out, err := generateSetupConfigYAML(&cfg)
+	require.NoError(t, err)
+	assert.Contains(t, out, "#")
+	assert.Contains(t, out, "/var/lib/files")
+	assert.Contains(t, out, "8080")
+	assert.NotContains(t, out, "FileBrowser Quantum")
+	assert.NotContains(t, out, "darkMode")
+	assert.NotContains(t, out, "minSearchLength:")
+	assert.NotContains(t, out, "frontend:")
+	assert.NotContains(t, out, "rules:")
+}

backend/cmd/migrate.go

@@ -296,8 +296,9 @@ func migrateUsers(oldDB *storm.DB, sqlStore *sqldb.SQLStore) error {
 			users.MigrateToSourcePermissions(user)
 		}
 		normalizeUserTokensBeforeSQLite(user)
+		promoteLegacyApiKeysBeforeSQLite(user)
 		updateTokens(user)
-		user.Version = users.ProfileStorageVersion
+		user.Version = users.NewestUserVersion
 		if newScopesCount > oldScopesCount {
 			promoted++
 			logger.Infof("  user %q: legacy database had %d scopes, SQLite now has %d",
@@ -347,6 +348,34 @@ func normalizeUserTokensBeforeSQLite(user *users.User) {
 	user.Tokens = normalized
 }
 
+// promoteLegacyApiKeysBeforeSQLite merges Bolt apiKeys entries into Tokens so
+// they survive the SQLite migration and the hashed-tokens backfill (strict
+// auth ignores BelongsTo and requires a hash row per raw JWT).
+func promoteLegacyApiKeysBeforeSQLite(user *users.User) {
+	if len(user.ApiKeys) == 0 {
+		return
+	}
+	if user.Tokens == nil {
+		user.Tokens = make(map[string]users.AuthToken)
+	}
+	for name, token := range user.ApiKeys {
+		if token.Name == "" {
+			token.Name = name
+		}
+		if token.Token == "" {
+			token.Token = token.Key
+		}
+		if token.Token == "" {
+			continue
+		}
+		if _, exists := user.Tokens[token.Name]; exists {
+			continue
+		}
+		token.Permissions = users.SanitizeTokenPermissions(token.Permissions)
+		users.StoreToken(user.Tokens, token)
+	}
+}
+
 // migrateShares migrates all shares from BoltDB to SQLite.
 //
 // Legacy Bolt "Link" / "Share" JSON (flat CommonShare + Link fields):
@@ -476,7 +505,7 @@ func migrateAccessRules(oldDB *storm.DB, sqlStore *sqldb.SQLStore) error {
 			logger.Warningf("  skipping hashed token: invalid user id 0")
 			continue
 		}
-		err := sqlStore.SaveHashedToken(tokenHash, uint64(userID), false)
+		err := sqlStore.SaveHashedToken(tokenHash, uint64(userID), false, 0)
 		if err != nil {
 			return fmt.Errorf("failed to save hashed token: %w", err)
 		}

backend/cmd/migrate_tokens_test.go

@@ -2,6 +2,7 @@ package cmd
 
 import (
 	"encoding/json"
+	"errors"
 	"os"
 	"path/filepath"
 	"testing"
@@ -72,3 +73,88 @@ func TestMigrateAdminTokensRoundTripSQLite(t *testing.T) {
 	os.Stdout.Write(out)
 	os.Stdout.Write([]byte("\n"))
 }
+
+func TestPromoteLegacyApiKeysBeforeSQLite(t *testing.T) {
+	user := &users.User{
+		FrontendUser: users.FrontendUser{Username: "legacy-tokens"},
+		Tokens:       map[string]users.AuthToken{},
+	}
+	user.ApiKeys = map[string]users.AuthToken{
+		"legacy-sync": {Key: "raw-jwt-1"},
+		"empty":       {},
+	}
+	user.Tokens["obsidian"] = users.AuthToken{Name: "obsidian", Token: "raw-jwt-existing"}
+
+	promoteLegacyApiKeysBeforeSQLite(user)
+
+	// Existing Tokens entries win; empty raw tokens are skipped.
+	if got := user.Tokens["obsidian"].Token; got != "raw-jwt-existing" {
+		t.Fatalf("existing token must win, got %q", got)
+	}
+	if got := user.Tokens["legacy-sync"].Token; got != "raw-jwt-1" {
+		t.Fatalf("promoted token must carry raw JWT, got %q", got)
+	}
+	if _, ok := user.Tokens["raw-jwt-1"]; !ok {
+		t.Fatal("expected raw-JWT alias key after promotion")
+	}
+	if _, ok := user.Tokens["empty"]; ok {
+		t.Fatal("token without raw material must be skipped")
+	}
+}
+
+func TestUpdateTokenHashBackfillSuccessStampsVersion(t *testing.T) {
+	user := &users.User{FrontendUser: users.FrontendUser{Username: "no-tokens"}}
+	user.Version = users.ProfileStorageVersion
+
+	changed, failed := updateTokenHashBackfill(user)
+	if failed {
+		t.Fatal("tokenless user must not fail backfill")
+	}
+	if !changed {
+		t.Fatal("expected version bump to count as changed")
+	}
+	if user.Version != users.TokenHashBackfillVersion {
+		t.Fatalf("version = %d, want %d", user.Version, users.TokenHashBackfillVersion)
+	}
+}
+
+func TestUpdateTokenHashBackfillFailureSkipsBump(t *testing.T) {
+	// Force token hash registration to fail; the version must stay below
+	// newest so the backfill retries on next startup.
+	orig := addApiToken
+	addApiToken = func(string, uint64) error {
+		return errors.New("simulated token registration failure")
+	}
+	t.Cleanup(func() { addApiToken = orig })
+
+	user := &users.User{FrontendUser: users.FrontendUser{Username: "backfill-retry"}}
+	user.Version = users.ProfileStorageVersion
+	user.ApiKeys = map[string]users.AuthToken{
+		"legacy": {Key: "raw-jwt-retry"},
+	}
+
+	_, failed := updateTokenHashBackfill(user)
+	if !failed {
+		t.Fatal("expected failure when token registration fails")
+	}
+	if user.Version != users.ProfileStorageVersion {
+		t.Fatalf("failed backfill must not bump version, got %d", user.Version)
+	}
+	if bumpToNewestVersion(user, failed) {
+		t.Fatal("catch-all must not bump past a failed migration")
+	}
+}
+
+func TestBumpToNewestVersion(t *testing.T) {
+	user := &users.User{FrontendUser: users.FrontendUser{Username: "stale"}}
+	user.Version = users.ProfileStorageVersion
+	if !bumpToNewestVersion(user, false) {
+		t.Fatal("expected bump for stale version without failure")
+	}
+	if user.Version != users.NewestUserVersion {
+		t.Fatalf("version = %d, want %d", user.Version, users.NewestUserVersion)
+	}
+	if bumpToNewestVersion(user, false) {
+		t.Fatal("must not bump when already newest")
+	}
+}

backend/cmd/user.go

@@ -16,6 +16,10 @@ import (
 
 var createBackup = false
 
+// addApiToken registers a raw API token's hash with access storage. It is a
+// variable so tests can inject a failing registration deterministically.
+var addApiToken = state.AddApiToken
+
 func validateUserInfo(newDB bool) {
 	// update source info for users if names/sources/paths might have changed
 	usersList, err := state.GetAllUsers()
@@ -55,14 +59,19 @@ func validateUserInfo(newDB bool) {
 		if normalizeApiTokenPermissions(user) {
 			changedFields = append(changedFields, "tokens")
 		}
+		tokenBackfillChanged, tokenBackfillFailed := updateTokenHashBackfill(user)
+		if tokenBackfillChanged && !tokenBackfillFailed {
+			changedFields = append(changedFields, "tokens", "version")
+		} else if tokenBackfillChanged {
+			changedFields = append(changedFields, "tokens")
+		}
 		if state.ApplyEnforcedSyncToUser(user) {
 			changedFields = append(changedFields, settings.UserJSONFieldsForEnforcedSync()...)
 		}
 		if state.ApplyEnforcedSourcePermissionsSyncToUser(user) {
 			changedFields = append(changedFields, "backendScopes", "backendSourcePermissions")
 		}
-		if user.Version < users.ProfileStorageVersion {
-			user.Version = users.ProfileStorageVersion
+		if bumpToNewestVersion(user, tokenBackfillFailed) {
 			changedFields = append(changedFields, "version")
 		}
 		adminUser := settings.Config.Auth.AdminUsername
@@ -78,7 +87,7 @@ func validateUserInfo(newDB bool) {
 				changedFields = append(changedFields, "permissions")
 			}
 		}
-		if user.Username == adminUser && settings.Config.Auth.AdminPassword != "" && user.LoginMethod == users.LoginMethodPassword {
+		if user.Username == adminUser && settings.ConfigTriggersAdminPasswordReset() && user.LoginMethod == users.LoginMethodPassword {
 			logger.Info("Resetting admin user to default username and password.")
 			user.Permissions = settings.AdminPerms()
 			user.Password = settings.Config.Auth.AdminPassword
@@ -162,7 +171,7 @@ func updateShowFirstLogin(user *users.User) bool {
 
 // func to convert legacy user with perm key to permissions
 func updatePermissions(user *users.User) bool {
-	if user.Version >= 1 {
+	if user.Version >= users.PermMigrationVersion {
 		return false
 	}
 	updateUser := true
@@ -208,7 +217,7 @@ func updatePermissions(user *users.User) bool {
 		user.Permissions.Delete = true
 		updateUser = true
 	}
-	user.Version = 2
+	user.Version = users.PermMigrationVersion
 	if updateUser {
 		createBackup = true
 	}
@@ -248,7 +257,7 @@ func updateSidebarLinks(user *users.User, scopesChanged bool) bool {
 }
 
 func updateTokens(user *users.User) bool {
-	if user.Version >= 2 {
+	if user.Version >= users.TokenMigrationVersion {
 		return false
 	}
 	if user.ApiKeys != nil {
@@ -259,7 +268,7 @@ func updateTokens(user *users.User) bool {
 			users.StoreToken(user.Tokens, token)
 		}
 	}
-	user.Version = 2
+	user.Version = users.TokenMigrationVersion
 	return true
 }
 
@@ -281,3 +290,42 @@ func normalizeApiTokenPermissions(user *users.User) bool {
 	}
 	return changed
 }
+
+// updateTokenHashBackfill promotes legacy ApiKeys into Tokens and registers a
+// hashed_tokens row for every stored raw JWT so strict server-side auth (which
+// ignores BelongsTo) accepts pre-2.0.8 tokens. Runs once per user via
+// TokenHashBackfillVersion. It reports (changed, failed): when hash
+// registration fails the version is left alone so callers skip the newest
+// bump and the backfill retries on next startup.
+func updateTokenHashBackfill(user *users.User) (bool, bool) {
+	if user == nil || user.Version >= users.TokenHashBackfillVersion {
+		return false, false
+	}
+	before := len(user.Tokens)
+	promoteLegacyApiKeysBeforeSQLite(user)
+	changed := len(user.Tokens) != before
+	hashesRegistered := true
+	for _, raw := range state.CollectStoredRawTokens(user) {
+		if err := addApiToken(raw, user.ID); err != nil {
+			logger.Errorf("could not register token hash for user %s: %v", user.Username, err)
+			hashesRegistered = false
+		}
+	}
+	if hashesRegistered {
+		user.Version = users.TokenHashBackfillVersion
+		createBackup = true
+		return true, false
+	}
+	return changed, true
+}
+
+// bumpToNewestVersion stamps the user at NewestUserVersion. It is skipped when
+// a migration failed so the failed migration retries on next startup instead
+// of being buried by the catch-all bump.
+func bumpToNewestVersion(user *users.User, migrationFailed bool) bool {
+	if migrationFailed || user == nil || user.Version >= users.NewestUserVersion {
+		return false
+	}
+	user.Version = users.NewestUserVersion
+	return true
+}

backend/config.playwright-performance.yaml

@@ -1,6 +1,9 @@
 http:
   port: 8080
   baseURL: "/"
+frontend:
+  styling:
+    disableEventThemes: true
 server:
   logging:
     - levels: "info|warning|error"

backend/go.mod

@@ -9,17 +9,17 @@ require (
 	github.com/coreos/go-systemd/v22 v22.7.0
 	github.com/dhowden/tag v0.0.0-20240417053706-3d75831295e8
 	github.com/dsoprea/go-exif/v3 v3.0.1
-	github.com/evanoberholster/imagemeta v1.0.0
+	github.com/evanoberholster/imagemeta v1.1.0
 	github.com/gen2brain/go-fitz v1.28.2
 	github.com/go-ldap/ldap/v3 v3.4.14
-	github.com/go-playground/validator/v10 v10.30.4
-	github.com/go-webauthn/webauthn v0.18.1
+	github.com/go-playground/validator/v10 v10.30.5
+	github.com/go-webauthn/webauthn v0.18.2
 	github.com/goccy/go-yaml v1.19.2
 	github.com/golang-jwt/jwt/v4 v4.5.2
 	github.com/google/go-cmp v0.7.0
 	github.com/google/uuid v1.6.0
 	github.com/gtsteffaniak/go-cache v1.1.0
-	github.com/gtsteffaniak/go-ffmpeg v1.0.0
+	github.com/gtsteffaniak/go-ffmpeg v0.5.2
 	github.com/gtsteffaniak/go-logger v1.1.0
 	github.com/kovidgoyal/imaging v1.8.23
 	github.com/mattn/go-sqlite3 v1.14.52
@@ -48,7 +48,7 @@ require (
 	github.com/dsoprea/go-logging v0.0.0-20200710184922-b02d349568dd // indirect
 	github.com/dsoprea/go-utility/v2 v2.0.0-20221003172846-a3e1774ef349 // indirect
 	github.com/dustin/go-humanize v1.1.0 // indirect
-	github.com/ebitengine/purego v0.11.0 // indirect
+	github.com/ebitengine/purego v0.11.1 // indirect
 	github.com/fxamacker/cbor/v2 v2.9.4 // indirect
 	github.com/gabriel-vasile/mimetype v1.4.15 // indirect
 	github.com/go-asn1-ber/asn1-ber v1.5.8 // indirect
@@ -65,7 +65,7 @@ require (
 	github.com/go-openapi/swag/typeutils v0.29.2 // indirect
 	github.com/go-openapi/swag/yamlutils v0.29.2 // indirect
 	github.com/go-playground/locales v0.14.1 // indirect
-	github.com/go-playground/universal-translator v0.18.1 // indirect
+	github.com/go-playground/universal-translator v0.18.2 // indirect
 	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
 	github.com/go-webauthn/x v0.3.1 // indirect
 	github.com/golang-jwt/jwt/v5 v5.3.1 // indirect
@@ -95,7 +95,7 @@ require (
 	google.golang.org/protobuf v1.36.12 // indirect
 	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
-	modernc.org/libc v1.76.0 // indirect
+	modernc.org/libc v1.77.1 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
 	modernc.org/memory v1.12.1 // indirect
 )

backend/go.sum

@@ -47,10 +47,10 @@ github.com/dsoprea/go-utility/v2 v2.0.0-20221003172846-a3e1774ef349 h1:DilThiXje
 github.com/dsoprea/go-utility/v2 v2.0.0-20221003172846-a3e1774ef349/go.mod h1:4GC5sXji84i/p+irqghpPFZBF8tRN/Q7+700G0/DLe8=
 github.com/dustin/go-humanize v1.1.0 h1:dbKTrvD0klcbBV/h4AWJdMuZogJACoMlvWIWZ5b2xWg=
 github.com/dustin/go-humanize v1.1.0/go.mod h1:hc1CvRkJMsgxqjmjMQF3QNRAZBwY8AXBAzKYoSX9sFI=
-github.com/ebitengine/purego v0.11.0 h1:jhp/D+Nyv7UUW8HAcmcjt2N2rYrYi9m3SL21k0Ua/NI=
-github.com/ebitengine/purego v0.11.0/go.mod h1:DCHPP08djqhNSoTfImcnHYQRZmd0qhakvrozqaEYhGQ=
-github.com/evanoberholster/imagemeta v1.0.0 h1:FlSihlsjkWIoS83wmgPOP3CbAxlRpxM8jQGZgLu+MWQ=
-github.com/evanoberholster/imagemeta v1.0.0/go.mod h1:2ITZJjD1ygzWIhepvn8coRvpaFcnDNk3E6hx6v7z8DU=
+github.com/ebitengine/purego v0.11.1 h1:2zpWRSQNVKN4eKsKO9eM1ILDgWfYMY9GwqRmK6XeQ/0=
+github.com/ebitengine/purego v0.11.1/go.mod h1:DCHPP08djqhNSoTfImcnHYQRZmd0qhakvrozqaEYhGQ=
+github.com/evanoberholster/imagemeta v1.1.0 h1:0iBtgVxLORZTZAlKxRcNodBmjMfHCSFwUh8Asmi83oI=
+github.com/evanoberholster/imagemeta v1.1.0/go.mod h1:nmf6le+qSyoRAXgp2psPbtfkxcEgf/AZGgai9pnN8d0=
 github.com/fxamacker/cbor/v2 v2.9.4 h1:xwjVlxEMR3S605oUlgBjKLTTeGFciYPGYCtF/35LKGo=
 github.com/fxamacker/cbor/v2 v2.9.4/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
 github.com/gabriel-vasile/mimetype v1.4.15 h1:05iP/CYtZ/w455R/KZM6rZ5ieAdh99UPtd+d3YzLmaI=
@@ -100,14 +100,14 @@ github.com/go-playground/assert/v2 v2.2.0 h1:JvknZsQTYeFEAhQwI4qEt9cyV5ONwRHC+lY
 github.com/go-playground/assert/v2 v2.2.0/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
 github.com/go-playground/locales v0.14.1 h1:EWaQ/wswjilfKLTECiXz7Rh+3BjFhfDFKv/oXslEjJA=
 github.com/go-playground/locales v0.14.1/go.mod h1:hxrqLVvrK65+Rwrd5Fc6F2O76J/NuW9t0sjnWqG1slY=
-github.com/go-playground/universal-translator v0.18.1 h1:Bcnm0ZwsGyWbCzImXv+pAJnYK9S473LQFuzCbDbfSFY=
-github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91TpwSH2VMlDf28Uj24BCp08ZFTUY=
-github.com/go-playground/validator/v10 v10.30.4 h1:9Rcod2ZPO6mOEG6b4GqyoHE/H6//Ze0RuhOo1hT1x0w=
-github.com/go-playground/validator/v10 v10.30.4/go.mod h1:numpT+RPLE91R9oYWMY/R9zRgJBewr3IXHko4OISPpk=
+github.com/go-playground/universal-translator v0.18.2 h1:LCsMLC9RzmbUMNUPVYD15dmcjwYAJhmX8mPZRW4rAVU=
+github.com/go-playground/universal-translator v0.18.2/go.mod h1:67VZIMp5lQpDWlnStOct22q1bkdJGJqHghbOtmkawxk=
+github.com/go-playground/validator/v10 v10.30.5 h1:YyCXvVShZbs2Sm3Mb53eNOlhRXctSOzW5QJAouCTZL4=
+github.com/go-playground/validator/v10 v10.30.5/go.mod h1:wEqiaov48pXX1kjhc3Da8y0M0Dtg/BK7gurFBLgwFrQ=
 github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=
 github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
-github.com/go-webauthn/webauthn v0.18.1 h1:KaQw6M+ODLvxHwddyeo6zFhhmicfLup/BClhigB6A+0=
-github.com/go-webauthn/webauthn v0.18.1/go.mod h1:s4rZTQnKHWxIh6G3yEGqlxvtiLceA1jigll8FpqSgQ8=
+github.com/go-webauthn/webauthn v0.18.2 h1:0BeftmEHU7i3Dv0VFwBtidy/ba37Vcdjvqst9EYu8Sk=
+github.com/go-webauthn/webauthn v0.18.2/go.mod h1:hEXaOuLxvZ3zG9miZe3ehlyeVso9AtklXG+kTn36k+A=
 github.com/go-webauthn/x v0.3.1 h1:1ff37z3XfmTTomkhlURgGizLIDyOvPgTt2t9nlzKLRo=
 github.com/go-webauthn/x v0.3.1/go.mod h1:ZInxAynYXfBPvvm5gzKZ7geBlL23K71xASMgohHl/Rg=
 github.com/goccy/go-yaml v1.19.2 h1:PmFC1S6h8ljIz6gMRBopkjP1TVT7xuwrButHID66PoM=
@@ -143,6 +143,8 @@ github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gtsteffaniak/go-cache v1.1.0 h1:ni/2cJpCxpGmaMZd92iTDIGOy+yUcMcxQuW7bSKhkCE=
 github.com/gtsteffaniak/go-cache v1.1.0/go.mod h1:rHUZvf4huhMX/bnNK4/oQ3sNAE2fYC2jFpAWZiBPWac=
+github.com/gtsteffaniak/go-ffmpeg v0.5.2 h1:KVnKM3zewY9yeZVd59Hb0/10gSbhYf01yRM5RftXGEU=
+github.com/gtsteffaniak/go-ffmpeg v0.5.2/go.mod h1:FefhoD+KZzHWqBaUpntcKp6lXtUzdFW00F74axnENUQ=
 github.com/gtsteffaniak/go-ffmpeg v1.0.0 h1:dUWvlZmWnkiujDtIMLGwrpfSAOnM+IOtk93HXF6HR0U=
 github.com/gtsteffaniak/go-ffmpeg v1.0.0/go.mod h1:FefhoD+KZzHWqBaUpntcKp6lXtUzdFW00F74axnENUQ=
 github.com/gtsteffaniak/go-logger v1.1.0 h1:baFds+iibuLLNpNLwygz32bDqdsunI6dGWcdxwMIVKI=
@@ -313,8 +315,8 @@ gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 modernc.org/cc/v4 v4.29.7 h1:q+NXGJ0bK3b4TXFYQQVr9pYETGnmwFWkrUzJnMya/Tg=
 modernc.org/cc/v4 v4.29.7/go.mod h1:OnovgIhbbMXMu1aISnJ0wvVD1KnW+cAUJkIrAWh+kVI=
-modernc.org/ccgo/v4 v4.35.2 h1:JPAIttQRHdY7aRdr04+iTW7Sx+6OSZcmKJ0OZl/tNaA=
-modernc.org/ccgo/v4 v4.35.2/go.mod h1:9sddcpn4NuDAFGtBPa2Dk3NHfnQfcoKveCC5crwWp8I=
+modernc.org/ccgo/v4 v4.36.1 h1:ZNIUZAryN0UgnJwtyxrdEzcFc3yD4Cu4AzjfPXsLsIE=
+modernc.org/ccgo/v4 v4.36.1/go.mod h1:rrtGc2QkS239nYb/mQNuBMyjq3/y3ZXWbBjPoV3wqzA=
 modernc.org/fileutil v1.4.0 h1:j6ZzNTftVS054gi281TyLjHPp6CPHr2KCxEXjEbD6SM=
 modernc.org/fileutil v1.4.0/go.mod h1:EqdKFDxiByqxLk8ozOxObDSfcVOv/54xDs/DUHdvCUU=
 modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI=
@@ -323,8 +325,8 @@ modernc.org/gc/v3 v3.1.5 h1:21ldfPfRYE31Tb7B3mwAK8gy1AxP4+dKjrOQPfqakoc=
 modernc.org/gc/v3 v3.1.5/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
 modernc.org/goabi0 v0.2.0 h1:HvEowk7LxcPd0eq6mVOAEMai46V+i7Jrj13t4AzuNks=
 modernc.org/goabi0 v0.2.0/go.mod h1:CEFRnnJhKvWT1c1JTI3Avm+tgOWbkOu5oPA8eH8LnMI=
-modernc.org/libc v1.76.0 h1:eaJHMv2zn5oXT6IPXPwxAMVpzmQzSDsCdKcNl1ZpaRg=
-modernc.org/libc v1.76.0/go.mod h1:2h0dedmVSE8qH2DrxzYDXbQaxLMl0XNg8Z7/HJRdk2M=
+modernc.org/libc v1.77.1 h1:Ct8j47QtiZ1Enj2DtFXQtUqrPCAjdCmPjtCuvrYQ0Hs=
+modernc.org/libc v1.77.1/go.mod h1:87/pZ4L6nD1zqW4nItuS12YO7hN1igAah34xjnQo/W0=
 modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
 modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
 modernc.org/memory v1.12.1 h1:nFMiWrpStgZczNl6XI9GnIk/rWhYIyHGUaR04pGbp9g=

backend/internal/activity/diff_test.go

@@ -53,7 +53,7 @@ func TestUserUpdateChangesFiltersUnchangedFields(t *testing.T) {
 	which := []string{
 		"preview", "stickySidebar", "darkMode", "locale", "singleClick", "sorting",
 		"showHidden", "dateFormat", "themeColor", "quickDownload", "fileLoading",
-		"sidebarLinks", "deleteAfterArchive", "preferEditorForMarkdown", "showFirstLogin",
+		"sidebarLinks", "deleteAfterArchive", "preferEditorForMarkdown", "showFirstLogin", "requirePasswordChange",
 	}
 
 	changes := UserUpdateChanges(before, &after, which, false)

backend/internal/adapters/fs/files/files.go

@@ -961,7 +961,14 @@ func WriteDirectory(opts utils.FileOptions) error {
 	return nil
 }
 
+// WriteFileFunc is a variable that can be mocked in tests
+var WriteFileFunc = writeFile
+
 func WriteFile(source, path string, in io.Reader) error {
+	return WriteFileFunc(source, path, in)
+}
+
+func writeFile(source, path string, in io.Reader) error {
 	idx := indexing.GetIndex(source)
 	if idx == nil {
 		return fmt.Errorf("could not get index: %v ", source)

backend/internal/adapters/fs/fileutils/partition_aggregate.go

@@ -0,0 +1,30 @@
+package fileutils
+
+// PartitionUsage is a capacity view of a source path: total and used bytes.
+type PartitionUsage struct {
+	Total uint64 `json:"total"`
+	Used  uint64 `json:"used"`
+}
+
+// singlePathPartitionUsage statfs's a single path: the filesystem covering it.
+func singlePathPartitionUsage(path string) (PartitionUsage, error) {
+	total, err := GetPartitionSize(path)
+	if err != nil {
+		return PartitionUsage{}, err
+	}
+	used, err := GetPartitionUsed(path)
+	if err != nil {
+		return PartitionUsage{}, err
+	}
+	return PartitionUsage{Total: total, Used: used}, nil
+}
+
+// GetAggregatedPartitionUsage returns total and used bytes summed across distinct
+// capacity groups mounted at or under root. See GetPartitionUsageVariants.
+func GetAggregatedPartitionUsage(root string) (total, used uint64, err error) {
+	aggregate, _, err := GetPartitionUsageVariants(root)
+	if err != nil {
+		return 0, 0, err
+	}
+	return aggregate.Total, aggregate.Used, nil
+}

backend/internal/adapters/fs/fileutils/partition_aggregate_freebsd.go

@@ -0,0 +1,188 @@
+//go:build freebsd
+
+package fileutils
+
+import (
+	"fmt"
+	"path/filepath"
+	"strings"
+
+	"golang.org/x/sys/unix"
+)
+
+// bsdMount is one Getfsstat record reduced to what capacity aggregation
+// needs: fstype, source, mountpoint, usage, and the mount's own fsid.
+type bsdMount struct {
+	fstype     string
+	source     string
+	mountpoint string
+	usage      rawUsage
+	fsid       unix.Fsid
+}
+
+// resolvedMount is what a path lookup reports for a mountpoint: the
+// mountpoint of the filesystem that actually owns the path and that
+// filesystem's fsid.
+type resolvedMount struct {
+	mountpoint string
+	fsid       unix.Fsid
+	ok         bool
+}
+
+// statfsMountpoint resolves which filesystem a mountpoint path lands on.
+func statfsMountpoint(mp string) resolvedMount {
+	var st unix.Statfs_t
+	if err := unix.Statfs(mp, &st); err != nil {
+		return resolvedMount{}
+	}
+	return resolvedMount{
+		mountpoint: filepath.Clean(unix.ByteSliceToString(st.Mntonname[:])),
+		fsid:       st.Fsid,
+		ok:         true,
+	}
+}
+
+// GetPartitionUsageVariants returns the aggregate and root-only capacity views
+// of root. FreeBSD has no mountinfo; Getfsstat already carries per-mount statfs
+// data, so grouping happens on the result set directly (ZFS datasets grouped by
+// pool name, everything else by fsid).
+func GetPartitionUsageVariants(root string) (aggregate, rootOnly PartitionUsage, err error) {
+	if root == "" {
+		return aggregate, rootOnly, fmt.Errorf("empty path")
+	}
+	root = filepath.Clean(root)
+
+	rootOnly, rootErr := singlePathPartitionUsage(root)
+
+	count, statErr := unix.Getfsstat(nil, unix.MNT_WAIT)
+	if statErr != nil || count <= 0 {
+		if rootErr != nil {
+			return aggregate, rootOnly, rootErr
+		}
+		return rootOnly, rootOnly, nil
+	}
+	stats := make([]unix.Statfs_t, count)
+	if _, statErr = unix.Getfsstat(stats, unix.MNT_WAIT); statErr != nil {
+		if rootErr != nil {
+			return aggregate, rootOnly, rootErr
+		}
+		return rootOnly, rootOnly, nil
+	}
+
+	var mounts []bsdMount
+	for i := range stats {
+		s := &stats[i]
+		avail := uint64(0)
+		if s.Bavail > 0 {
+			avail = uint64(s.Bavail)
+		}
+		mounts = append(mounts, bsdMount{
+			fstype:     unix.ByteSliceToString(s.Fstypename[:]),
+			source:     unix.ByteSliceToString(s.Mntfromname[:]),
+			mountpoint: filepath.Clean(unix.ByteSliceToString(s.Mntonname[:])),
+			usage: rawUsage{
+				total: s.Blocks * s.Bsize,
+				avail: avail * s.Bsize,
+			},
+			fsid: s.Fsid,
+		})
+	}
+
+	covering, nested := selectCapacityMounts(mounts, root, statfsMountpoint)
+
+	key := func(m bsdMount) string {
+		if isZFSType(m.fstype) {
+			return "zfs:" + zfsPoolName(m.source)
+		}
+		if m.fsid.Val[0] == 0 && m.fsid.Val[1] == 0 {
+			// fsid-less filesystems (e.g. some tmpfs mounts): keep per mountpoint.
+			return "mp:" + m.mountpoint
+		}
+		return fmt.Sprintf("fsid:%x:%x", m.fsid.Val[0], m.fsid.Val[1])
+	}
+
+	groups := make(map[string][]rawUsage)
+	fstypes := make(map[string]string)
+	add := func(m bsdMount) {
+		k := key(m)
+		fstypes[k] = m.fstype
+		groups[k] = append(groups[k], m.usage)
+	}
+	if covering != nil {
+		add(*covering)
+	}
+	for _, m := range nested {
+		add(m)
+	}
+	if len(groups) == 0 {
+		if rootErr != nil {
+			return aggregate, rootOnly, rootErr
+		}
+		return rootOnly, rootOnly, nil
+	}
+
+	for k, stats := range groups {
+		u := combineGroupUsage(stats)
+		if !isZFSType(fstypes[k]) && len(stats) > 1 {
+			// Non-shared-pool mounts dedupe to a single measurement.
+			u = combineGroupUsage(stats[:1])
+		}
+		aggregate.Total += u.Total
+		aggregate.Used += u.Used
+	}
+	return aggregate, rootOnly, rootErr
+}
+
+// selectCapacityMounts picks the mounts contributing capacity under root: the
+// filesystem covering root plus mounts nested beneath it.
+//
+// Getfsstat retains records that path lookups no longer reach: mounts stacked
+// under a later mount at the same mountpoint, and mounts below an overmounted
+// ancestor (stacked records have no documented order, so position cannot
+// identify the visible one). A record counts only when a lookup on its
+// mountpoint still lands on it: the resolved mountpoint must equal the
+// record's and, for filesystems carrying an fsid, the resolved fsid must match
+// the record's (every stacked record resolves to the topmost fsid). fsid-less
+// records keep the first match at a mountpoint; stacked fsid-less mounts are
+// indistinguishable.
+func selectCapacityMounts(mounts []bsdMount, root string, lookup func(string) resolvedMount) (*bsdMount, []bsdMount) {
+	var covering *bsdMount
+	var nested []bsdMount
+	claimed := make(map[string]bool)
+	resolved := make(map[string]resolvedMount)
+	for i := range mounts {
+		m := mounts[i]
+		covers := m.mountpoint == root || m.mountpoint == "/" || strings.HasPrefix(root, m.mountpoint+"/")
+		nests := strings.HasPrefix(m.mountpoint, root+"/")
+		if !covers && !nests {
+			continue
+		}
+		r, seen := resolved[m.mountpoint]
+		if !seen {
+			r = lookup(m.mountpoint)
+			resolved[m.mountpoint] = r
+		}
+		if !r.ok || r.mountpoint != m.mountpoint {
+			continue
+		}
+		if m.fsid.Val[0] != 0 || m.fsid.Val[1] != 0 {
+			if r.fsid != m.fsid {
+				continue
+			}
+		} else if claimed[m.mountpoint] {
+			continue
+		}
+		claimed[m.mountpoint] = true
+		if covers && (covering == nil || len(m.mountpoint) > len(covering.mountpoint)) {
+			c := m
+			covering = &c
+		}
+		if nests {
+			if isZFSType(m.fstype) && isZFSSnapshotMount(m.source, m.mountpoint) {
+				continue
+			}
+			nested = append(nested, m)
+		}
+	}
+	return covering, nested
+}

backend/internal/adapters/fs/fileutils/partition_aggregate_freebsd_test.go

@@ -0,0 +1,161 @@
+//go:build freebsd
+
+package fileutils
+
+import (
+	"testing"
+
+	"golang.org/x/sys/unix"
+)
+
+func fsidVal(a, b int32) unix.Fsid {
+	return unix.Fsid{Val: [2]int32{a, b}}
+}
+
+func resolvedOK(mp string, fsid unix.Fsid) resolvedMount {
+	return resolvedMount{mountpoint: mp, fsid: fsid, ok: true}
+}
+
+// TestSelectCapacityMountsOvermountedAncestorHidesNested reproduces the
+// reviewed layout: /srv/child was mounted first, then /srv was overmounted.
+// Getfsstat still reports the unique /srv/child record, but a lookup of that
+// path lands inside the covering filesystem, so its usage must be excluded.
+func TestSelectCapacityMountsOvermountedAncestorHidesNested(t *testing.T) {
+	rootFs, childFs, coverFs := fsidVal(1, 1), fsidVal(2, 2), fsidVal(3, 3)
+	mounts := []bsdMount{
+		{fstype: "ufs", source: "/dev/da0p2", mountpoint: "/", fsid: rootFs, usage: rawUsage{total: 100, avail: 50}},
+		{fstype: "ufs", source: "/dev/da1p1", mountpoint: "/srv/child", fsid: childFs, usage: rawUsage{total: 200, avail: 100}},
+		{fstype: "ufs", source: "/dev/da2p1", mountpoint: "/srv", fsid: coverFs, usage: rawUsage{total: 300, avail: 150}},
+	}
+	lookup := func(mp string) resolvedMount {
+		switch mp {
+		case "/":
+			return resolvedOK("/", rootFs)
+		case "/srv":
+			return resolvedOK("/srv", coverFs)
+		case "/srv/child":
+			// Hidden: resolves to the covering filesystem at /srv.
+			return resolvedOK("/srv", coverFs)
+		}
+		return resolvedMount{}
+	}
+
+	covering, nested := selectCapacityMounts(mounts, "/srv", lookup)
+	if covering == nil || covering.mountpoint != "/srv" {
+		t.Fatalf("covering = %+v, want mountpoint /srv", covering)
+	}
+	if len(nested) != 0 {
+		t.Fatalf("nested = %+v, want hidden /srv/child excluded", nested)
+	}
+}
+
+// TestSelectCapacityMountsUnreachableNestedSkipped covers the same hidden
+// layout when the covered path no longer exists in the new filesystem: the
+// lookup fails outright and the stale record is dropped.
+func TestSelectCapacityMountsUnreachableNestedSkipped(t *testing.T) {
+	rootFs, coverFs := fsidVal(1, 1), fsidVal(3, 3)
+	mounts := []bsdMount{
+		{fstype: "ufs", mountpoint: "/", fsid: rootFs},
+		{fstype: "ufs", source: "/dev/da2p1", mountpoint: "/srv", fsid: coverFs},
+		{fstype: "ufs", source: "/dev/da1p1", mountpoint: "/srv/gone", fsid: fsidVal(2, 2), usage: rawUsage{total: 200, avail: 100}},
+	}
+	lookup := func(mp string) resolvedMount {
+		switch mp {
+		case "/":
+			return resolvedOK("/", rootFs)
+		case "/srv":
+			return resolvedOK("/srv", coverFs)
+		}
+		return resolvedMount{} // ENOENT under the overmount
+	}
+
+	_, nested := selectCapacityMounts(mounts, "/srv", lookup)
+	if len(nested) != 0 {
+		t.Fatalf("nested = %+v, want unreachable /srv/gone excluded", nested)
+	}
+}
+
+// TestSelectCapacityMountsStackedTopmostOnly checks that of several records
+// at one mountpoint only the one a lookup resolves to is counted.
+func TestSelectCapacityMountsStackedTopmostOnly(t *testing.T) {
+	rootFs, lowerFs, upperFs := fsidVal(1, 1), fsidVal(4, 4), fsidVal(5, 5)
+	mounts := []bsdMount{
+		{fstype: "ufs", mountpoint: "/", fsid: rootFs},
+		{fstype: "ufs", source: "/dev/da1p1", mountpoint: "/srv/data", fsid: lowerFs, usage: rawUsage{total: 200, avail: 100}},
+		{fstype: "tmpfs", source: "tmpfs", mountpoint: "/srv/data", fsid: upperFs, usage: rawUsage{total: 60, avail: 30}},
+	}
+	lookup := func(mp string) resolvedMount {
+		switch mp {
+		case "/":
+			return resolvedOK("/", rootFs)
+		case "/srv/data":
+			return resolvedOK("/srv/data", upperFs)
+		}
+		return resolvedMount{}
+	}
+
+	_, nested := selectCapacityMounts(mounts, "/srv", lookup)
+	if len(nested) != 1 || nested[0].fsid != upperFs {
+		t.Fatalf("nested = %+v, want only the topmost /srv/data record", nested)
+	}
+}
+
+// TestSelectCapacityMountsHiddenCoveringAncestor: when the deepest ancestor
+// mount of root is itself hidden by an overmount, covering must fall back to
+// the deepest visible ancestor.
+func TestSelectCapacityMountsHiddenCoveringAncestor(t *testing.T) {
+	rootFs, overFs, staleFs := fsidVal(1, 1), fsidVal(8, 8), fsidVal(9, 9)
+	mounts := []bsdMount{
+		{fstype: "ufs", mountpoint: "/", fsid: rootFs},
+		{fstype: "ufs", source: "/dev/da2p1", mountpoint: "/x", fsid: overFs},
+		{fstype: "ufs", source: "/dev/da1p1", mountpoint: "/x/y", fsid: staleFs, usage: rawUsage{total: 200, avail: 100}},
+	}
+	// /x was mounted over the parent chain of /x/y: lookups of /x/y resolve
+	// inside the /x filesystem.
+	lookup := func(mp string) resolvedMount {
+		switch mp {
+		case "/":
+			return resolvedOK("/", rootFs)
+		case "/x":
+			return resolvedOK("/x", overFs)
+		case "/x/y":
+			return resolvedOK("/x", overFs)
+		}
+		return resolvedMount{}
+	}
+
+	covering, nested := selectCapacityMounts(mounts, "/x/y/z", lookup)
+	if covering == nil || covering.mountpoint != "/x" {
+		t.Fatalf("covering = %+v, want deepest visible ancestor /x", covering)
+	}
+	if len(nested) != 0 {
+		t.Fatalf("nested = %+v, want none", nested)
+	}
+}
+
+// TestSelectCapacityMountsNestedVisibleKept is the baseline: a nested mount
+// that still resolves to itself contributes its usage.
+func TestSelectCapacityMountsNestedVisibleKept(t *testing.T) {
+	rootFs, zfsFs := fsidVal(1, 1), fsidVal(7, 7)
+	mounts := []bsdMount{
+		{fstype: "ufs", mountpoint: "/", fsid: rootFs},
+		{fstype: "zfs", source: "tank/data", mountpoint: "/srv/data", fsid: zfsFs, usage: rawUsage{total: 400, avail: 200}},
+	}
+	lookup := func(mp string) resolvedMount {
+		switch mp {
+		case "/":
+			return resolvedOK("/", rootFs)
+		case "/srv/data":
+			return resolvedOK("/srv/data", zfsFs)
+		}
+		return resolvedMount{}
+	}
+
+	covering, nested := selectCapacityMounts(mounts, "/srv", lookup)
+	if covering == nil || covering.mountpoint != "/" {
+		t.Fatalf("covering = %+v, want /", covering)
+	}
+	if len(nested) != 1 || nested[0].mountpoint != "/srv/data" {
+		t.Fatalf("nested = %+v, want [/srv/data]", nested)
+	}
+}

backend/internal/adapters/fs/fileutils/partition_aggregate_linux.go

@@ -7,94 +7,64 @@ import (
 	"os"
 	"path/filepath"
 	"syscall"
-
-	"golang.org/x/sys/unix"
 )
 
-// GetAggregatedPartitionUsage returns total and used bytes summed across distinct
-// filesystems mounted at or under root (deduped by major:minor from mountinfo).
-// Falls back to a single-path probe when mountinfo cannot be read.
-func GetAggregatedPartitionUsage(root string) (total, used uint64, err error) {
+// GetPartitionUsageVariants returns two capacity views of root:
+//   - aggregate: total/used summed across distinct capacity groups mounted at or
+//     under root, deduped so shared-pool filesystems (ZFS datasets, btrfs
+//     subvolumes) are counted once per pool.
+//   - rootOnly: a single statfs of root, ignoring nested mounts.
+//
+// Falls back to the single-path probe for both when mountinfo cannot be read.
+func GetPartitionUsageVariants(root string) (aggregate, rootOnly PartitionUsage, err error) {
 	if root == "" {
-		return 0, 0, fmt.Errorf("empty path")
+		return aggregate, rootOnly, fmt.Errorf("empty path")
 	}
 	root = filepath.Clean(root)
 
-	paths, parseErr := distinctMountPathsUnder(root)
-	if parseErr != nil || len(paths) == 0 {
-		return singlePathPartitionUsage(root)
+	rootOnly, rootErr := singlePathPartitionUsage(root)
+
+	groups, parseErr := mountGroupsUnder(root)
+	if parseErr != nil || len(groups) == 0 {
+		if rootErr != nil {
+			return aggregate, rootOnly, rootErr
+		}
+		return rootOnly, rootOnly, nil
 	}
 
 	var firstErr error
-	for _, path := range paths {
-		t, u, stErr := partitionUsageAt(path)
-		if stErr != nil {
-			if firstErr == nil {
-				firstErr = stErr
+	for _, group := range groups {
+		stats := make([]rawUsage, 0, len(group.paths))
+		for _, p := range group.paths {
+			stat, stErr := partitionStatfs(p)
+			if stErr != nil {
+				if firstErr == nil {
+					firstErr = stErr
+				}
+				continue
 			}
-			continue
+			stats = append(stats, stat)
 		}
-		total += t
-		used += u
+		u := combineGroupUsage(stats)
+		aggregate.Total += u.Total
+		aggregate.Used += u.Used
 	}
 
-	if total == 0 && used == 0 {
+	if aggregate.Total == 0 && aggregate.Used == 0 {
 		if firstErr != nil {
-			return 0, 0, firstErr
+			return aggregate, rootOnly, firstErr
 		}
-		return singlePathPartitionUsage(root)
+		aggregate = rootOnly
 	}
-	return total, used, nil
+	return aggregate, rootOnly, rootErr
 }
 
-func singlePathPartitionUsage(root string) (total, used uint64, err error) {
-	total, err = GetPartitionSize(root)
-	if err != nil {
-		return 0, 0, err
-	}
-	used, err = GetPartitionUsed(root)
-	if err != nil {
-		return 0, 0, err
-	}
-	return total, used, nil
-}
-
-func distinctMountPathsUnder(root string) ([]string, error) {
+func mountGroupsUnder(root string) ([]mountGroup, error) {
 	data, err := readMountinfo()
 	if err != nil {
 		return nil, err
 	}
-	paths, err := distinctMountPathsFromMountinfo(data, root)
-	if err != nil {
-		return nil, err
-	}
-	// If mountinfo had no covering mount for root, ensure root is probed.
-	if len(paths) == 0 {
-		return []string{root}, nil
-	}
-	hasRoot := false
-	for _, p := range paths {
-		if p == root {
-			hasRoot = true
-			break
-		}
-	}
-	if !hasRoot {
-		if dev, stErr := deviceIDFromPath(root); stErr == nil {
-			// Avoid duplicating a device already selected under another path.
-			already := false
-			for _, p := range paths {
-				if d, e := deviceIDFromPath(p); e == nil && d == dev {
-					already = true
-					break
-				}
-			}
-			if !already {
-				paths = append(paths, root)
-			}
-		}
-	}
-	return paths, nil
+	return mountGroupsFromMountinfo(data, root)
 }
 
 func readMountinfo() (string, error) {
@@ -107,24 +77,14 @@ func readMountinfo() (string, error) {
 	return "", fmt.Errorf("mountinfo not available")
 }
 
-func deviceIDFromPath(path string) (string, error) {
-	var st unix.Stat_t
-	if err := unix.Stat(path, &st); err != nil {
-		return "", err
-	}
-	return fmt.Sprintf("%d:%d", unix.Major(uint64(st.Dev)), unix.Minor(uint64(st.Dev))), nil
-}
-
-func partitionUsageAt(path string) (total, used uint64, err error) {
+func partitionStatfs(path string) (rawUsage, error) {
 	var stat syscall.Statfs_t
 	if err := syscall.Statfs(path, &stat); err != nil {
-		return 0, 0, err
+		return rawUsage{}, err
 	}
 	bsize := blockSize(&stat)
-	total = uint64(stat.Blocks) * bsize
-	free := uint64(stat.Bavail) * bsize
-	if total >= free {
-		used = total - free
-	}
-	return total, used, nil
+	return rawUsage{
+		total: uint64(stat.Blocks) * bsize,
+		avail: uint64(stat.Bavail) * bsize,
+	}, nil
 }

backend/internal/adapters/fs/fileutils/partition_aggregate_mountinfo.go

@@ -12,55 +12,111 @@ import (
 type mountEntry struct {
 	deviceID   string
 	mountpoint string
+	fstype     string
+	source     string
 }
 
-// distinctMountPathsFromMountinfo selects one path per distinct filesystem that
-// contributes capacity for root: the FS that owns root, plus nested mounts under
-// root. Deduped by major:minor from mountinfo.
-func distinctMountPathsFromMountinfo(mountinfo string, root string) ([]string, error) {
+// mountGroup is a set of mountpoints that share one capacity pool. Groups keyed
+// by filesystem identity get one probe path; shared-pool filesystems (zfs) keep
+// every dataset mountpoint so per-dataset used space can be summed.
+type mountGroup struct {
+	key    string
+	fstype string
+	paths  []string
+}
+
+// capacityKey identifies mounts that share the same underlying capacity.
+//   - zfs: every dataset has its own device ID but draws from the pool; group by pool.
+//   - btrfs: subvolume mounts have distinct device IDs but report the whole
+//     filesystem; group by mount source.
+//   - everything else: device major:minor, as before.
+func (e *mountEntry) capacityKey() string {
+	switch e.fstype {
+	case "zfs", "zfsfuse":
+		return "zfs:" + zfsPoolName(e.source)
+	case "btrfs":
+		return "btrfs:" + e.source
+	default:
+		return "dev:" + e.deviceID
+	}
+}
+
+// mountGroupsFromMountinfo selects the mounts contributing capacity for root:
+// the filesystem that owns root, plus nested mounts under root, grouped by
+// capacity key. ZFS snapshot mounts are excluded.
+func mountGroupsFromMountinfo(mountinfo string, root string) ([]mountGroup, error) {
 	root = path.Clean(root)
 	entries, err := parseAllMounts(mountinfo)
 	if err != nil {
 		return nil, err
 	}
 
-	seen := make(map[string]string)
+	groupIndex := make(map[string]int)
+	var groups []mountGroup
+	addPath := func(e *mountEntry, p string) {
+		key := e.capacityKey()
+		i, ok := groupIndex[key]
+		if !ok {
+			i = len(groups)
+			groupIndex[key] = i
+			groups = append(groups, mountGroup{key: key, fstype: e.fstype})
+		}
+		// Only shared-pool filesystems (zfs) need every mountpoint; other groups
+		// report identical statfs per mount, so one probe path suffices.
+		if !isZFSType(groups[i].fstype) && len(groups[i].paths) > 0 {
+			return
+		}
+		for _, existing := range groups[i].paths {
+			if existing == p {
+				return
+			}
+		}
+		groups[i].paths = append(groups[i].paths, p)
+	}
 
 	var covering *mountEntry
 	for i := range entries {
 		e := &entries[i]
 		mp := e.mountpoint
 		if mp == root || strings.HasPrefix(root, mp+"/") || mp == "/" {
-			if covering == nil || len(mp) > len(covering.mountpoint) {
+			// >= keeps the later entry: stacked mounts at one mountpoint are
+			// shadowed by the topmost (last in mountinfo order).
+			if covering == nil || len(mp) >= len(covering.mountpoint) {
 				covering = e
 			}
 		}
 	}
 	if covering != nil {
-		seen[covering.deviceID] = root
+		// Probe root itself for the covering filesystem: root may be a plain
+		// directory inside a mount whose mountpoint is an ancestor.
+		addPath(covering, root)
+	} else {
+		// No mount covers root (e.g. hidden bind mount); probe it directly so
+		// it is not dropped when nested mounts under root do exist.
+		groups = append(groups, mountGroup{key: "self:" + root, paths: []string{root}})
 	}
 
-	for _, e := range entries {
+	// Stacked mounts: only the topmost (last in mountinfo order) is reachable.
+	lastAtMountpoint := make(map[string]int)
+	for i := range entries {
+		lastAtMountpoint[entries[i].mountpoint] = i
+	}
+	for i := range entries {
+		e := &entries[i]
 		mp := e.mountpoint
 		if mp != root && !strings.HasPrefix(mp, root+"/") {
 			continue
 		}
-		if _, ok := seen[e.deviceID]; ok {
+		if lastAtMountpoint[mp] != i {
 			continue
 		}
-		seen[e.deviceID] = mp
+		if isZFSType(e.fstype) && isZFSSnapshotMount(e.source, mp) {
+			continue
+		}
+		addPath(e, mp)
 	}
 
-	out := make([]string, 0, len(seen))
-	uniq := make(map[string]struct{}, len(seen))
-	for _, p := range seen {
-		if _, ok := uniq[p]; ok {
-			continue
-		}
-		uniq[p] = struct{}{}
-		out = append(out, p)
-	}
-	return out, nil
+	return groups, nil
 }
 
 func parseAllMounts(mountinfo string) ([]mountEntry, error) {
@@ -88,9 +144,16 @@ func parseMountinfoLine(line string) (mountEntry, bool) {
 	if len(fields) < 5 {
 		return mountEntry{}, false
 	}
+	// After " - ": "fstype source super-options".
+	post := strings.Fields(parts[1])
+	if len(post) < 2 {
+		return mountEntry{}, false
+	}
 	return mountEntry{
 		deviceID:   fields[2],
 		mountpoint: unescapeFstab(fields[4]),
+		fstype:     post[0],
+		source:     unescapeFstab(post[1]),
 	}, true
 }
 

backend/internal/adapters/fs/fileutils/partition_aggregate_mountinfo_test.go

@@ -7,6 +7,25 @@ import (
 	"testing"
 )
 
+// allGroupPaths flattens groups into a sorted list of probe paths.
+func allGroupPaths(groups []mountGroup) []string {
+	var out []string
+	for _, g := range groups {
+		out = append(out, g.paths...)
+	}
+	sort.Strings(out)
+	return out
+}
+
+func findGroup(groups []mountGroup, prefix string) *mountGroup {
+	for i := range groups {
+		if len(groups[i].key) >= len(prefix) && groups[i].key[:len(prefix)] == prefix {
+			return &groups[i]
+		}
+	}
+	return nil
+}
+
 func TestDistinctMountPathsNestedDisk(t *testing.T) {
 	// /srv lives on rootfs 8:1; /srv/data is a separate 2TB disk 8:16.
 	mountinfo := "" +
@@ -14,11 +33,11 @@ func TestDistinctMountPathsNestedDisk(t *testing.T) {
 		"45 22 8:16 /data /srv/data rw - btrfs /dev/sdb1 rw\n" +
 		"50 22 0:47 / /proc rw - proc proc rw\n"
 
-	paths, err := distinctMountPathsFromMountinfo(mountinfo, "/srv")
+	groups, err := mountGroupsFromMountinfo(mountinfo, "/srv")
 	if err != nil {
 		t.Fatal(err)
 	}
-	sort.Strings(paths)
+	paths := allGroupPaths(groups)
 	want := []string{"/srv", "/srv/data"}
 	if len(paths) != len(want) {
 		t.Fatalf("paths = %v, want %v", paths, want)
@@ -37,11 +56,11 @@ func TestDistinctMountPathsOvermountSamePathDeduped(t *testing.T) {
 		"45 40 8:16 / /srv/data rw - btrfs /dev/sdb1 rw\n" +
 		"46 45 0:47 / /srv/data rw - tmpfs tmpfs rw\n"
 
-	paths, err := distinctMountPathsFromMountinfo(mountinfo, "/srv")
+	groups, err := mountGroupsFromMountinfo(mountinfo, "/srv")
 	if err != nil {
 		t.Fatal(err)
 	}
-	sort.Strings(paths)
+	paths := allGroupPaths(groups)
 	want := []string{"/srv", "/srv/data"}
 	if len(paths) != len(want) {
 		t.Fatalf("paths = %v, want %v (no duplicate probe paths)", paths, want)
@@ -56,15 +75,15 @@ func TestDistinctMountPathsOvermountSamePathDeduped(t *testing.T) {
 func TestDistinctMountPathsBindSameDeviceNotDuplicated(t *testing.T) {
 	mountinfo := "" +
 		"22 1 8:1 / / rw - ext4 /dev/sda1 rw\n" +
-		"45 22 8:16 / /srv/data rw - btrfs /dev/sdb1 rw\n" +
-		"46 22 8:16 / /srv/data/bind rw,bind - btrfs /dev/sdb1 rw\n"
+		"45 22 8:16 / /srv/data rw - ext4 /dev/sdb1 rw\n" +
+		"46 22 8:16 / /srv/data/bind rw,bind - ext4 /dev/sdb1 rw\n"
 
-	paths, err := distinctMountPathsFromMountinfo(mountinfo, "/srv")
+	groups, err := mountGroupsFromMountinfo(mountinfo, "/srv")
 	if err != nil {
 		t.Fatal(err)
 	}
-	if len(paths) != 2 {
-		t.Fatalf("expected 2 distinct devices, got %v", paths)
+	if len(groups) != 2 {
+		t.Fatalf("expected 2 distinct capacity groups, got %v", groups)
 	}
 }
 
@@ -74,11 +93,11 @@ func TestDistinctMountPathsSourceIsOwnMount(t *testing.T) {
 		"40 22 8:2 / /srv rw - ext4 /dev/sda2 rw\n" +
 		"45 40 8:16 / /srv/data rw - btrfs /dev/sdb1 rw\n"
 
-	paths, err := distinctMountPathsFromMountinfo(mountinfo, "/srv")
+	groups, err := mountGroupsFromMountinfo(mountinfo, "/srv")
 	if err != nil {
 		t.Fatal(err)
 	}
-	sort.Strings(paths)
+	paths := allGroupPaths(groups)
 	want := []string{"/srv", "/srv/data"}
 	if len(paths) != 2 || paths[0] != want[0] || paths[1] != want[1] {
 		t.Fatalf("paths = %v, want %v", paths, want)
@@ -90,10 +109,11 @@ func TestDistinctMountPathsIgnoresUnrelated(t *testing.T) {
 		"22 1 8:1 / / rw - ext4 /dev/sda1 rw\n" +
 		"30 22 8:3 / /home rw - ext4 /dev/sda3 rw\n"
 
-	paths, err := distinctMountPathsFromMountinfo(mountinfo, "/srv")
+	groups, err := mountGroupsFromMountinfo(mountinfo, "/srv")
 	if err != nil {
 		t.Fatal(err)
 	}
+	paths := allGroupPaths(groups)
 	if len(paths) != 1 || paths[0] != "/srv" {
 		t.Fatalf("paths = %v, want [/srv]", paths)
 	}
@@ -110,4 +130,124 @@ func TestParseMountinfoEscapedSpace(t *testing.T) {
 	if entry.deviceID != "98:0" {
 		t.Fatalf("deviceID = %q, want 98:0", entry.deviceID)
 	}
+	if entry.fstype != "ext3" {
+		t.Fatalf("fstype = %q, want ext3", entry.fstype)
+	}
+	if entry.source != "/dev/root" {
+		t.Fatalf("source = %q, want /dev/root", entry.source)
+	}
+}
+
+// TestMountGroupsZFSPoolDatasetsGrouped reproduces issue #3025: every ZFS
+// dataset gets its own device ID, so major:minor dedup counts pool capacity
+// once per dataset. They must share one capacity group.
+func TestMountGroupsZFSPoolDatasetsGrouped(t *testing.T) {
+	mountinfo := "" +
+		"22 1 8:1 / / rw - ext4 /dev/sda1 rw\n" +
+		"40 22 0:55 / /srv/pool rw - zfs pool rw\n" +
+		"41 40 0:56 / /srv/pool/ds01 rw - zfs pool/ds01 rw\n" +
+		"42 41 0:57 / /srv/pool/ds01/a rw - zfs pool/ds01/a rw\n" +
+		"43 40 0:58 / /srv/pool/ds02 rw - zfs pool/ds02 rw\n" +
+		"44 22 0:59 / /other/pool2 rw - zfs pool2 rw\n"
+
+	groups, err := mountGroupsFromMountinfo(mountinfo, "/srv/pool")
+	if err != nil {
+		t.Fatal(err)
+	}
+	g := findGroup(groups, "zfs:pool")
+	if g == nil || g.key != "zfs:pool" {
+		t.Fatalf("expected one zfs:pool group, got %v", groups)
+	}
+	want := []string{"/srv/pool", "/srv/pool/ds01", "/srv/pool/ds01/a", "/srv/pool/ds02"}
+	got := append([]string{}, g.paths...)
+	sort.Strings(got)
+	sort.Strings(want)
+	if len(got) != len(want) {
+		t.Fatalf("zfs group paths = %v, want %v", got, want)
+	}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Fatalf("zfs group paths = %v, want %v", got, want)
+		}
+	}
+	// The unrelated second pool must not join the group.
+	if g2 := findGroup(groups, "zfs:pool2"); g2 != nil {
+		t.Fatalf("unrelated pool2 should not be included: %v", groups)
+	}
+}
+
+func TestMountGroupsZFSSnapshotsSkipped(t *testing.T) {
+	mountinfo := "" +
+		"22 1 8:1 / / rw - ext4 /dev/sda1 rw\n" +
+		"40 22 0:55 / /srv/pool rw - zfs pool rw\n" +
+		"41 40 0:56 / /srv/pool/ds01 rw - zfs pool/ds01 rw\n" +
+		"42 41 0:57 / /srv/pool/ds01/.zfs/snapshot/snap1 rw - zfs pool/ds01@snap1 rw\n"
+
+	groups, err := mountGroupsFromMountinfo(mountinfo, "/srv/pool")
+	if err != nil {
+		t.Fatal(err)
+	}
+	paths := allGroupPaths(groups)
+	for _, p := range paths {
+		if p == "/srv/pool/ds01/.zfs/snapshot/snap1" {
+			t.Fatalf("snapshot mount should be skipped: %v", paths)
+		}
+	}
+	if len(paths) != 2 {
+		t.Fatalf("paths = %v, want 2 live datasets", paths)
+	}
+}
+
+func TestMountGroupsBtrfsSubvolumesDeduped(t *testing.T) {
+	// Each btrfs subvolume mount has a distinct anonymous device but reports
+	// whole-filesystem statfs; they must collapse into one group.
+	mountinfo := "" +
+		"22 1 8:1 / / rw - ext4 /dev/sda1 rw\n" +
+		"40 22 0:33 /@ /srv rw - btrfs /dev/sdb1 rw\n" +
+		"41 40 0:34 /@home /srv/home rw - btrfs /dev/sdb1 rw\n" +
+		"42 40 0:35 /@data /srv/data rw - btrfs /dev/sdb1 rw\n"
+
+	groups, err := mountGroupsFromMountinfo(mountinfo, "/srv")
+	if err != nil {
+		t.Fatal(err)
+	}
+	g := findGroup(groups, "btrfs:")
+	if g == nil || g.key != "btrfs:/dev/sdb1" {
+		t.Fatalf("expected one btrfs group, got %v", groups)
+	}
+	// Subvolume mounts report identical fs-wide statfs; one probe path suffices.
+	if len(g.paths) != 1 || g.paths[0] != "/srv" {
+		t.Fatalf("btrfs group paths = %v, want [/srv]", g.paths)
+	}
+	if len(groups) != 1 {
+		t.Fatalf("expected exactly 1 group for /srv, got %v", groups)
+	}
+}
+
+// TestCombineGroupUsageZFSPool verifies the arithmetic from #3025: 26 datasets
+// each reporting ~19.7T avail must yield used+19.7T total, not 26*19.7T+used.
+func TestCombineGroupUsageZFSPool(t *testing.T) {
+	const avail = uint64(19_700_000_000_000)                       // ~19.7 TiB pool free
+	stats := []rawUsage{{total: 20_000_000_000_000, avail: avail}} // root ds: 0.3T used
+	for i := 0; i < 25; i++ {
+		stats = append(stats, rawUsage{total: avail + 100_000_000_000, avail: avail})
+	}
+	// One quota'd child: reports a smaller avail; must not shrink the pool.
+	stats = append(stats, rawUsage{total: 1_000_000_000_000, avail: 500_000_000_000})
+
+	u := combineGroupUsage(stats)
+	wantUsed := uint64(300_000_000_000) + 25*uint64(100_000_000_000) + 500_000_000_000
+	if u.Used != wantUsed {
+		t.Fatalf("used = %d, want %d", u.Used, wantUsed)
+	}
+	if u.Total != wantUsed+avail {
+		t.Fatalf("total = %d, want %d (used+single pool avail)", u.Total, wantUsed+avail)
+	}
+}
+
+func TestCombineGroupUsageSingleMountIdentity(t *testing.T) {
+	u := combineGroupUsage([]rawUsage{{total: 1000, avail: 400}})
+	if u.Total != 1000 || u.Used != 600 {
+		t.Fatalf("single mount = %+v, want total 1000 used 600", u)
+	}
 }

backend/internal/adapters/fs/fileutils/partition_aggregate_other.go

@@ -1,17 +1,14 @@
-//go:build !linux
+//go:build !linux && !freebsd
 
 package fileutils
 
-// GetAggregatedPartitionUsage returns total and used bytes for the filesystem
-// that owns root. Non-Linux builds use a single statfs/GetDiskFreeSpaceEx path.
-func GetAggregatedPartitionUsage(root string) (total, used uint64, err error) {
-	total, err = GetPartitionSize(root)
+// GetPartitionUsageVariants returns the aggregate and root-only capacity views
+// of root. Without mount info only a single statfs of the source path is
+// available, so both variants are identical.
+func GetPartitionUsageVariants(root string) (aggregate, rootOnly PartitionUsage, err error) {
+	u, err := singlePathPartitionUsage(root)
 	if err != nil {
-		return 0, 0, err
+		return aggregate, rootOnly, err
 	}
-	used, err = GetPartitionUsed(root)
-	if err != nil {
-		return 0, 0, err
-	}
-	return total, used, nil
+	return u, u, nil
 }

backend/internal/adapters/fs/fileutils/partition_aggregate_shared.go

@@ -0,0 +1,50 @@
+//go:build linux || freebsd
+
+package fileutils
+
+import "strings"
+
+// rawUsage is a single filesystem measurement in bytes.
+type rawUsage struct {
+	total uint64
+	avail uint64
+}
+
+// combineGroupUsage folds statfs results for mounts that share one capacity pool
+// into a single total/used pair. Per-mount used (total-avail) is summed, while
+// shared free space is counted once via the largest reported avail. This keeps
+// ZFS datasets or btrfs subvolumes from multiplying the pool's capacity by the
+// number of mounts under a source.
+func combineGroupUsage(stats []rawUsage) PartitionUsage {
+	var used, avail uint64
+	for _, s := range stats {
+		if s.total > s.avail {
+			used += s.total - s.avail
+		}
+		if s.avail > avail {
+			avail = s.avail
+		}
+	}
+	return PartitionUsage{Total: used + avail, Used: used}
+}
+
+// isZFSType reports whether fstype is a ZFS variant whose datasets share pool
+// capacity across mounts (kernel zfs or zfsfuse).
+func isZFSType(fstype string) bool {
+	return fstype == "zfs" || fstype == "zfsfuse"
+}
+
+// zfsPoolName returns the pool component of a ZFS mount source ("pool/ds@snap" -> "pool").
+func zfsPoolName(source string) string {
+	if i := strings.IndexAny(source, "/@"); i >= 0 {
+		return source[:i]
+	}
+	return source
+}
+
+// isZFSSnapshotMount reports whether a ZFS mount is a snapshot (.zfs snapdir or
+// an "@snapshot" source). Snapshots share pool space with the live datasets and
+// are excluded from capacity aggregation.
+func isZFSSnapshotMount(source, mountpoint string) bool {
+	return strings.Contains(source, "@") || strings.Contains(mountpoint, "/.zfs/")
+}

backend/internal/auth/auth.go

@@ -6,9 +6,10 @@ import (
 	"time"
 
 	"github.com/golang-jwt/jwt/v4"
-	"github.com/gtsteffaniak/filebrowser/backend/pkg/settings"
 	"github.com/gtsteffaniak/filebrowser/backend/internal/database/access"
 	"github.com/gtsteffaniak/filebrowser/backend/internal/database/users"
+	"github.com/gtsteffaniak/filebrowser/backend/internal/utils"
+	"github.com/gtsteffaniak/filebrowser/backend/pkg/settings"
 )
 
 // Auther is the authentication interface.
@@ -39,18 +40,24 @@ func MakeSignedTokenAPI(user *users.User, name string, duration time.Duration, p
 	if _, ok := user.Tokens[name]; ok {
 		return "", users.AuthToken{}, fmt.Errorf("key already exists with same name %v ", name)
 	}
+	id, err := utils.RandomHex(16)
+	if err != nil {
+		return "", users.AuthToken{}, fmt.Errorf("generate token id: %w", err)
+	}
 	now := time.Now()
 	expires := now.Add(duration)
 	// Create minimal token with only JWT standard claims
 	claim := users.AuthToken{
 		MinimalAuthToken: users.MinimalAuthToken{
 			RegisteredClaims: jwt.RegisteredClaims{
+				ID:        id,
 				IssuedAt:  jwt.NewNumericDate(now),
 				ExpiresAt: jwt.NewNumericDate(expires),
 				Issuer:    FB_ISSUER,
 			},
 		},
 	}
+	claim.Minimal = &minimal
 	if !minimal {
 		claim.Permissions = users.SanitizeTokenPermissions(perms)
 	}

backend/internal/auth/json.go

@@ -14,5 +14,5 @@ type JSONAuth struct {
 
 // Auth authenticates the user via a json in content body (legacy method for compatibility).
 func (auther JSONAuth) Auth(r *http.Request, _ *users.Storage) (*users.User, error) {
-	return AuthenticatePassword(r, auther.ReCaptcha)
+	return AuthenticatePassword(r, auther.ReCaptcha, false)
 }

backend/internal/auth/service.go

@@ -30,7 +30,8 @@ func SetDefault(s *Service) {
 }
 
 // AuthenticatePassword authenticates the user via password in request headers.
-func (s *Service) AuthenticatePassword(r *http.Request, disableOtp bool) (*users.User, error) {
+// When skipRequirePasswordChange is true, a valid password is accepted even if RequirePasswordChange is set (change-required flow).
+func (s *Service) AuthenticatePassword(r *http.Request, disableOtp bool, skipRequirePasswordChange bool) (*users.User, error) {
 	if s == nil || s.users == nil {
 		return nil, fmt.Errorf("auth service not configured")
 	}
@@ -63,6 +64,9 @@ func (s *Service) AuthenticatePassword(r *http.Request, disableOtp bool) (*users
 	if getErr != nil {
 		return nil, fmt.Errorf("unable to get user from store: %v", err)
 	}
+	if user.RequirePasswordChange && user.LoginMethod == users.LoginMethodPassword && !skipRequirePasswordChange {
+		return nil, errors.ErrPasswordChangeRequired
+	}
 	if user.TOTPSecret != "" && !disableOtp {
 		if totpCode == "" {
 			return nil, errors.ErrNoTotpProvided
@@ -80,9 +84,9 @@ func (s *Service) AuthenticatePassword(r *http.Request, disableOtp bool) (*users
 }
 
 // AuthenticatePassword authenticates via the default service.
-func AuthenticatePassword(r *http.Request, disableOtp bool) (*users.User, error) {
+func AuthenticatePassword(r *http.Request, disableOtp bool, skipRequirePasswordChange bool) (*users.User, error) {
 	if defaultService != nil {
-		return defaultService.AuthenticatePassword(r, disableOtp)
+		return defaultService.AuthenticatePassword(r, disableOtp, skipRequirePasswordChange)
 	}
 	return nil, fmt.Errorf("auth service not configured")
 }

backend/internal/auth/token_uniqueness_test.go

@@ -0,0 +1,56 @@
+package auth
+
+import (
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"github.com/golang-jwt/jwt/v4"
+	"github.com/gtsteffaniak/filebrowser/backend/internal/database/users"
+	"github.com/gtsteffaniak/filebrowser/backend/pkg/settings"
+)
+
+func TestSignedTokensAreUniqueAtSameTime(t *testing.T) {
+	origKey := settings.Config.Auth.Key
+	settings.Config.Auth.Key = "test-signing-key-for-token-uniqueness"
+	t.Cleanup(func() { settings.Config.Auth.Key = origKey })
+
+	// Freeze the clock so every token has identical issue and expiry times.
+	synctest.Test(t, func(t *testing.T) {
+		now := time.Now()
+		tokens := make(map[string]users.AuthToken)
+		for _, userID := range []uint64{1, 2} {
+			user := &users.User{ID: userID}
+			for _, minimal := range []bool{true, false} {
+				for range 2 {
+					tokenString, claim, err := MakeSignedTokenAPI(user, "test-token", time.Hour, users.Permissions{Api: true}, minimal)
+					if err != nil {
+						t.Fatal(err)
+					}
+					if _, exists := tokens[tokenString]; exists {
+						t.Fatalf("token collision for user %d with minimal=%v", userID, minimal)
+					}
+					tokens[tokenString] = claim
+				}
+			}
+		}
+		ids := make(map[string]bool)
+		for tokenString, claim := range tokens {
+			var parsed users.MinimalAuthToken
+			if _, err := jwt.ParseWithClaims(tokenString, &parsed, JWTSigningKeyFunc()); err != nil {
+				t.Fatalf("parse signed token: %v", err)
+			}
+			if parsed.ID == "" || ids[parsed.ID] {
+				t.Fatal("each signed token must have a unique nonempty id")
+			}
+			ids[parsed.ID] = true
+			if parsed.ID != claim.ID {
+				t.Fatal("signed token id must match returned metadata")
+			}
+			if parsed.IssuedAt == nil || !parsed.IssuedAt.Equal(now) || parsed.ExpiresAt == nil || !parsed.ExpiresAt.Equal(now.Add(time.Hour)) {
+				t.Fatal("token uniqueness must not depend on changing timestamps")
+			}
+			assertMinimalJWTClaims(t, tokenString)
+		}
+	})
+}

backend/internal/database/access/access.go

@@ -10,10 +10,11 @@ import (
 	"sync"
 	"time"
 
-	"github.com/gtsteffaniak/filebrowser/backend/internal/errors"
-	"github.com/gtsteffaniak/filebrowser/backend/pkg/settings"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/utils"
+	"github.com/golang-jwt/jwt/v4"
 	"github.com/gtsteffaniak/filebrowser/backend/internal/database/users"
+	"github.com/gtsteffaniak/filebrowser/backend/internal/errors"
+	"github.com/gtsteffaniak/filebrowser/backend/internal/utils"
+	"github.com/gtsteffaniak/filebrowser/backend/pkg/settings"
 	"github.com/gtsteffaniak/go-cache/cache"
 	"github.com/gtsteffaniak/go-logger/logger"
 )
@@ -65,11 +66,37 @@ type GroupMap map[string]StringSet
 type HashedTokenInfo struct {
 	UserID    uint64
 	IsSession bool
+	// ExpiresAt is the token's exp claim as unix time; 0 means no expiry (e.g.
+	// non-JWT strings or rows persisted before expiry tracking).
+	ExpiresAt int64
 }
 
-// sessionTokenRetireGrace is how long a rotated session token stays usable after
-// renewal. In-flight requests still carrying the previous cookie must not 401.
-const sessionTokenRetireGrace = 2 * time.Minute
+// BearerTokenGrace is how long a bearer token may still resolve after session
+// rotation or after its JWT exp (e.g. share-ACL identity). In-flight requests
+// still carrying the previous cookie must not 401 during rotation.
+const BearerTokenGrace = 2 * time.Minute
+
+// TokenExpiryUnix extracts the exp claim of a bearer JWT without verifying the
+// signature; the value is only used for expiry bookkeeping and tokens are
+// verified on the auth path. Returns 0 for non-JWT strings or tokens without
+// an expiry claim.
+func TokenExpiryUnix(tokenString string) int64 {
+	claims := jwt.MapClaims{}
+	if _, _, err := jwt.NewParser().ParseUnverified(tokenString, claims); err != nil {
+		return 0
+	}
+	exp, ok := claims["exp"].(float64)
+	if !ok {
+		return 0
+	}
+	return int64(exp)
+}
+
+// TokenExpiredPastGrace reports whether a token expiry is older than the
+// resolution grace window. expiresAt == 0 (unknown/none) never expires.
+func TokenExpiredPastGrace(expiresAt int64, now time.Time) bool {
+	return expiresAt != 0 && now.After(time.Unix(expiresAt, 0).Add(BearerTokenGrace))
+}
 
 // Storage manages access rules and group membership.
 type Storage struct {
@@ -92,7 +119,7 @@ type SQLPersister interface {
 	PersistImmediateTokenRevocation(tokenHash string) error
 	PersistTokenRetirement(tokenHash string, revokedAt int64, pruned []string) error
 	DeleteRevokedToken(tokenHash string) error
-	SaveHashedToken(tokenHash string, userID uint64, isSession bool) error
+	SaveHashedToken(tokenHash string, userID uint64, isSession bool, expiresAt int64) error
 	DeleteHashedToken(tokenHash string) error
 	DeleteHashedTokensByUserID(userID uint64) error
 }
@@ -1338,7 +1365,7 @@ func (s *Storage) RevokeToken(tokenString string) error {
 }
 
 // RetireToken schedules a rotated session token for revocation after
-// sessionTokenRetireGrace. The owner mapping is kept during the grace window so
+// BearerTokenGrace. The owner mapping is kept during the grace window so
 // in-flight requests still carrying the previous cookie stay authenticated.
 func (s *Storage) RetireToken(tokenString string) error {
 	tokenHash := utils.HashSHA256(tokenString)
@@ -1415,7 +1442,7 @@ func (rb *tokenRetireRollback) capture(s *Storage, tokenHash string, now time.Ti
 	rb.prunedRevoked = make(map[string]int64)
 	rb.prunedHashed = make(map[string]HashedTokenInfo)
 	for hash, revokedAt := range revokedAfter {
-		if revokedAt != 0 && now.Sub(time.Unix(revokedAt, 0)) < sessionTokenRetireGrace {
+		if revokedAt != 0 && now.Sub(time.Unix(revokedAt, 0)) < BearerTokenGrace {
 			continue
 		}
 		if at, ok := s.RevokedTokens[hash]; ok {
@@ -1448,7 +1475,7 @@ func (rb *tokenRetireRollback) apply(s *Storage) {
 func (s *Storage) pruneRevocationsNL(now time.Time) []string {
 	var pruned []string
 	for hash, revokedAt := range s.RevokedTokens {
-		if revokedAt == 0 || now.Sub(time.Unix(revokedAt, 0)) >= sessionTokenRetireGrace {
+		if revokedAt == 0 || now.Sub(time.Unix(revokedAt, 0)) >= BearerTokenGrace {
 			delete(s.RevokedTokens, hash)
 			delete(s.HashedTokens, hash)
 			pruned = append(pruned, hash)
@@ -1470,7 +1497,7 @@ func (s *Storage) IsTokenRevoked(tokenString string) bool {
 	if revokedAt == 0 {
 		return true
 	}
-	return time.Since(time.Unix(revokedAt, 0)) >= sessionTokenRetireGrace
+	return time.Since(time.Unix(revokedAt, 0)) >= BearerTokenGrace
 }
 
 // AddApiToken maps a named API token string hash to an owner user id.
@@ -1484,13 +1511,19 @@ func (s *Storage) AddSessionToken(tokenString string, userID uint64) error {
 }
 
 func (s *Storage) addHashedToken(tokenString string, userID uint64, isSession bool) error {
+	expiresAt := TokenExpiryUnix(tokenString)
+	// Tokens already past the expiry grace window are never registered; expired
+	// mappings are pruned at startup load instead of on each registration.
+	if TokenExpiredPastGrace(expiresAt, time.Now()) {
+		return nil
+	}
 	tokenHash := utils.HashSHA256(tokenString)
 	s.mux.Lock()
-	s.HashedTokens[tokenHash] = HashedTokenInfo{UserID: userID, IsSession: isSession}
+	s.HashedTokens[tokenHash] = HashedTokenInfo{UserID: userID, IsSession: isSession, ExpiresAt: expiresAt}
 	sqlStore := s.sqlStore
 	s.mux.Unlock()
 	if sqlStore != nil {
-		return sqlStore.SaveHashedToken(tokenHash, userID, isSession)
+		return sqlStore.SaveHashedToken(tokenHash, userID, isSession, expiresAt)
 	}
 	return nil
 }
@@ -1502,12 +1535,19 @@ func (s *Storage) GetUserIDFromToken(tokenString string) (uint64, bool) {
 }
 
 // GetHashedTokenInfo retrieves owner/type metadata for a given token string.
+// Tokens past their expiry grace window resolve as unknown.
 func (s *Storage) GetHashedTokenInfo(tokenString string) (HashedTokenInfo, bool) {
 	s.mux.RLock()
 	defer s.mux.RUnlock()
 	tokenHash := utils.HashSHA256(tokenString)
 	info, exists := s.HashedTokens[tokenHash]
-	return info, exists
+	if !exists {
+		return info, false
+	}
+	if TokenExpiredPastGrace(info.ExpiresAt, time.Now()) {
+		return HashedTokenInfo{}, false
+	}
+	return info, true
 }
 
 // GetRevokedTokens returns a copy of the revocation map (hash → revocation unix time).

backend/internal/database/access/tokens_test.go

@@ -5,6 +5,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/golang-jwt/jwt/v4"
 	"github.com/gtsteffaniak/filebrowser/backend/internal/database/access"
 	"github.com/gtsteffaniak/filebrowser/backend/internal/utils"
 )
@@ -20,11 +21,13 @@ func (failingRevokePersister) PersistImmediateTokenRevocation(string) error {
 	return errors.New("simulated revocation persistence failure")
 }
 func (failingRevokePersister) PersistTokenRetirement(string, int64, []string) error {
-	return errors.New("simulated retirement persistence failure")
+	return nil
 }
-func (failingRevokePersister) DeleteRevokedToken(string) error      { return nil }
-func (failingRevokePersister) SaveHashedToken(string, uint64, bool) error { return nil }
-func (failingRevokePersister) DeleteHashedToken(string) error         { return nil }
+func (failingRevokePersister) DeleteRevokedToken(string) error { return nil }
+func (failingRevokePersister) SaveHashedToken(string, uint64, bool, int64) error {
+	return nil
+}
+func (failingRevokePersister) DeleteHashedToken(string) error          { return nil }
 func (failingRevokePersister) DeleteHashedTokensByUserID(uint64) error { return nil }
 
 func TestSessionAndApiTokenMetadata(t *testing.T) {
@@ -71,24 +74,6 @@ func TestRevokeTokenRollsBackMemoryOnPersistenceFailure(t *testing.T) {
 	}
 }
 
-func TestRetireTokenRollsBackMemoryOnPersistenceFailure(t *testing.T) {
-	store, _ := createTestStorage(t)
-	store.SetSQLStore(failingRevokePersister{})
-
-	if err := store.AddSessionToken("tok", 1); err != nil {
-		t.Fatal(err)
-	}
-	if err := store.RetireToken("tok"); err == nil {
-		t.Fatal("expected RetireToken to propagate persistence failure")
-	}
-	if store.IsTokenRevoked("tok") {
-		t.Fatal("failed retirement must not leave in-memory revoked state")
-	}
-	if _, ok := store.GetHashedTokenInfo("tok"); !ok {
-		t.Fatal("failed retirement must keep owner mapping")
-	}
-}
-
 func TestRevokeTokenIsImmediate(t *testing.T) {
 	store, _ := createTestStorage(t)
 
@@ -109,25 +94,43 @@ func TestRevokeTokenIsImmediate(t *testing.T) {
 	}
 }
 
-func TestRetireTokenHonorsGraceWindow(t *testing.T) {
+// signedTestJWT mints a bare HS256 JWT carrying only an exp claim. The registry
+// only reads claims unverified, so any key works.
+func signedTestJWT(t *testing.T, exp time.Time) string {
+	t.Helper()
+	token := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims{"exp": exp.Unix()})
+	tokenString, err := token.SignedString([]byte("test-key"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	return tokenString
+}
+
+func TestExpiredTokenResolvesWithinGrace(t *testing.T) {
 	store, _ := createTestStorage(t)
-
-	if err := store.AddSessionToken("tok", 1); err != nil {
+	token := signedTestJWT(t, time.Now().Add(-time.Minute))
+	if err := store.AddSessionToken(token, 7); err != nil {
 		t.Fatal(err)
 	}
-	if err := store.RetireToken("tok"); err != nil {
-		t.Fatal(err)
+	info, ok := store.GetHashedTokenInfo(token)
+	if !ok || info.UserID != 7 || !info.IsSession {
+		t.Fatalf("recently expired token must still resolve within grace, got %+v ok=%v", info, ok)
 	}
-	if store.IsTokenRevoked("tok") {
-		t.Fatal("retired token must remain valid during the grace window")
-	}
-	if _, ok := store.GetHashedTokenInfo("tok"); !ok {
-		t.Fatal("retired token mapping must remain during the grace window")
-	}
-
-	// Simulate the grace window elapsing.
-	store.RevokedTokens[utils.HashSHA256("tok")] = time.Now().Add(-3 * time.Minute).Unix()
-	if !store.IsTokenRevoked("tok") {
-		t.Fatal("retired token must be revoked once the grace window elapses")
+	if info.ExpiresAt == 0 {
+		t.Fatal("expiry must be recorded from the token's exp claim")
+	}
+}
+
+func TestExpiredTokenPastGraceNeverRegistered(t *testing.T) {
+	store, _ := createTestStorage(t)
+	token := signedTestJWT(t, time.Now().Add(-access.BearerTokenGrace-time.Minute))
+	if err := store.AddSessionToken(token, 7); err != nil {
+		t.Fatal(err)
+	}
+	if _, ok := store.GetHashedTokenInfo(token); ok {
+		t.Fatal("token expired past grace must not resolve")
+	}
+	if _, ok := store.HashedTokens[utils.HashSHA256(token)]; ok {
+		t.Fatal("token expired past grace must not be registered")
 	}
 }

backend/internal/database/dbindex/indexing.go

@@ -21,6 +21,9 @@ type IndexInfo struct {
 	UsedAsIndexed uint64 `json:"used"`
 	UsedDisk      uint64 `json:"usedAlt"`
 	DiskTotal     uint64 `json:"total"`
+	// Root-filesystem-only view (no nested mount aggregation)
+	UsedDiskRoot  uint64 `json:"usedAltRoot"`
+	DiskTotalRoot uint64 `json:"totalRoot"`
 
 	// Scanner information - map of scanner path to scanner stats
 	Scanners map[string]*PersistedScannerInfo `json:"scanners"`

backend/internal/database/share/storage.go

@@ -4,13 +4,12 @@ import (
 	stderrors "errors"
 	"fmt"
 	"net/http"
-	"strings"
 	"time"
 
-	"github.com/gtsteffaniak/filebrowser/backend/internal/errors"
-	"github.com/gtsteffaniak/filebrowser/backend/internal/utils"
 	"github.com/gtsteffaniak/filebrowser/backend/internal/database/crud"
 	"github.com/gtsteffaniak/filebrowser/backend/internal/database/users"
+	"github.com/gtsteffaniak/filebrowser/backend/internal/errors"
+	"github.com/gtsteffaniak/filebrowser/backend/internal/utils"
 	"github.com/gtsteffaniak/go-logger/logger"
 )
 
@@ -137,23 +136,18 @@ func (s *Storage) UpdateShares(oldSource, oldPath, newSource, newPath string) (i
 		return 0, err
 	}
 
-	oldPath = utils.AddTrailingSlashIfNotExists(oldPath)
-	newPath = utils.AddTrailingSlashIfNotExists(newPath)
-
 	updated := 0
 	for _, l := range links {
 		if l == nil || l.SourcePath != oldSource {
 			continue
 		}
-		l.Path = utils.AddTrailingSlashIfNotExists(l.Path)
-
-		pos := strings.Index(l.Path, oldPath)
-		if pos < 0 {
+		rewrittenPath, matches := utils.RewritePathPrefix(l.Path, oldPath, newPath)
+		if !matches {
 			continue
 		}
 
 		l.SourcePath = newSource
-		l.Path = newPath
+		l.Path = rewrittenPath
 
 		if err := s.back.Save(l); err != nil {
 			logger.Error("failed to save updated share", "hash", l.Hash, "error", err)

backend/internal/database/sql/index.go

@@ -9,6 +9,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/gtsteffaniak/filebrowser/backend/internal/database/sqlitebusy"
 	"github.com/gtsteffaniak/filebrowser/backend/pkg/settings"
 	"github.com/gtsteffaniak/filebrowser/backend/pkg/indexing/iteminfo"
 	"github.com/gtsteffaniak/go-logger/logger"
@@ -291,11 +292,12 @@ func (db *IndexDB) InsertItem(source, path string, info *iteminfo.FileInfo) erro
 		time.Now().Unix(),
 	)
 	if err != nil {
-		if !isBusyError(err) && !isTransactionError(err) {
+		if !sqlitebusy.IsBusyOrLocked(err) {
 			logger.Errorf("InsertItem failed for source=%s path=%s: %v", source, path, err)
 		}
+		return sqlitebusy.Wrap(err)
 	}
-	return err
+	return nil
 }
 
 // dbTransientOpAttempts is how many times to run a bulk DB op that may hit SQLITE_BUSY before giving up.
@@ -304,9 +306,7 @@ const dbTransientOpAttempts = 2
 const dbTransientRetryBackoff = 50 * time.Millisecond
 
 // BulkInsertItems inserts multiple items in a single transaction for a specific source.
-// Database errors (busy/locked) are treated as soft failures - the filesystem is the source of truth.
-// Returns nil on success or soft failure (busy/locked), error only on hard failures.
-// Transient busy/locked errors retry once before giving up (see dbTransientOpAttempts).
+// Transient busy/locked errors retry before giving up (see dbTransientOpAttempts); persistent busy returns an error.
 func (db *IndexDB) BulkInsertItems(source string, items []*iteminfo.FileInfo) error {
 	if len(items) == 0 {
 		return nil
@@ -332,8 +332,10 @@ func (db *IndexDB) BulkInsertItems(source string, items []*iteminfo.FileInfo) er
 			continue
 		}
 		if transient {
-			logger.Warningf("[DB_TX] BulkInsertItems: still failing after %d attempts (%d items, %v) — batch dropped",
+			logger.Warningf("[DB_TX] BulkInsertItems: still failing after %d attempts (%d items, %v)",
 				dbTransientOpAttempts, len(items), time.Since(startTime))
+			return fmt.Errorf("bulk insert failed after %d attempts (%d items): %w",
+				dbTransientOpAttempts, len(items), sqlitebusy.ErrBusy)
 		}
 		return nil
 	}
@@ -345,7 +347,7 @@ func (db *IndexDB) BulkInsertItems(source string, items []*iteminfo.FileInfo) er
 func (db *IndexDB) attemptBulkInsert(source string, items []*iteminfo.FileInfo) (success bool, transient bool, err error) {
 	tx, err := db.BeginTransaction()
 	if err != nil {
-		if isBusyError(err) || isTransactionError(err) {
+		if sqlitebusy.IsBusyOrLocked(err) {
 			db.mu.Unlock()
 			logger.Debugf("[DB_TX] BulkInsertItems: BeginTransaction failed (DB busy/locked): %v", err)
 			return false, true, nil
@@ -377,7 +379,7 @@ func (db *IndexDB) attemptBulkInsert(source string, items []*iteminfo.FileInfo)
 		last_updated = excluded.last_updated
 	`)
 	if err != nil {
-		if isBusyError(err) || isTransactionError(err) {
+		if sqlitebusy.IsBusyOrLocked(err) {
 			logger.Debugf("[DB_TX] BulkInsertItems: Prepare busy/locked: %v", err)
 			return false, true, nil
 		}
@@ -402,7 +404,7 @@ func (db *IndexDB) attemptBulkInsert(source string, items []*iteminfo.FileInfo)
 			nowUnix,
 		)
 		if err != nil {
-			if isBusyError(err) || isTransactionError(err) {
+			if sqlitebusy.IsBusyOrLocked(err) {
 				logger.Debugf("[DB_TX] BulkInsertItems: Exec busy/locked during insert: %v", err)
 				return false, true, nil
 			}
@@ -412,7 +414,7 @@ func (db *IndexDB) attemptBulkInsert(source string, items []*iteminfo.FileInfo)
 	}
 
 	if err := tx.Commit(); err != nil {
-		if isBusyError(err) || isTransactionError(err) {
+		if sqlitebusy.IsBusyOrLocked(err) {
 			logger.Debugf("[DB_TX] BulkInsertItems: Commit busy/locked: %v", err)
 			return false, true, nil
 		}
@@ -422,30 +424,8 @@ func (db *IndexDB) attemptBulkInsert(source string, items []*iteminfo.FileInfo)
 	return true, false, nil
 }
 
-// isBusyError checks if an error is SQLITE_BUSY (error code 5)
-func isBusyError(err error) bool {
-	if err == nil {
-		return false
-	}
-	errStr := err.Error()
-	// SQLITE_BUSY is error code 5, and modernc.org/sqlite returns it as "database is locked (5)"
-	return strings.Contains(errStr, "database is locked") || strings.Contains(errStr, "SQLITE_BUSY") || strings.Contains(errStr, "(5)")
-}
-
-// isTransactionError checks if an error is related to nested transactions (error code 1)
-func isTransactionError(err error) bool {
-	if err == nil {
-		return false
-	}
-	errStr := err.Error()
-	// SQLITE_ERROR for transaction issues is error code 1
-	return strings.Contains(errStr, "cannot start a transaction within a transaction") ||
-		strings.Contains(errStr, "cannot commit") ||
-		strings.Contains(errStr, "(1)")
-}
-
 // GetItem retrieves a single item by path for a specific source.
-// Returns nil on database busy/lock errors (non-fatal).
+// Busy/locked errors are returned so callers can fall back to the filesystem.
 func (db *IndexDB) GetItem(source, path string) (*iteminfo.FileInfo, error) {
 	query := `
 	SELECT path, name, size, mod_time, type, is_dir, is_hidden, has_preview
@@ -454,19 +434,13 @@ func (db *IndexDB) GetItem(source, path string) (*iteminfo.FileInfo, error) {
 	row := db.QueryRow(query, source, path)
 	item, err := scanItem(row)
 	if err != nil {
-		// Soft failure: DB is busy or locked, return nil
-		// Caller will handle missing data by fetching from filesystem
-		if isBusyError(err) || isTransactionError(err) {
-			return nil, nil
-		}
-		return nil, err
+		return nil, sqlitebusy.Wrap(err)
 	}
 	return item, nil
 }
 
 // GetItemsByPaths retrieves multiple items by their paths in a single query for a specific source.
 // This is more efficient than calling GetItem multiple times.
-// Returns empty map on database busy/lock errors (non-fatal).
 func (db *IndexDB) GetItemsByPaths(source string, paths []string) (map[string]*iteminfo.FileInfo, error) {
 	if len(paths) == 0 {
 		return make(map[string]*iteminfo.FileInfo), nil
@@ -488,12 +462,7 @@ func (db *IndexDB) GetItemsByPaths(source string, paths []string) (map[string]*i
 
 	rows, err := db.Query(query, args...)
 	if err != nil {
-		// Soft failure: DB is busy or locked, return empty map
-		// Caller will handle missing data (e.g., skip size updates, fetch from filesystem)
-		if isBusyError(err) || isTransactionError(err) {
-			return make(map[string]*iteminfo.FileInfo), nil
-		}
-		return nil, err
+		return nil, sqlitebusy.Wrap(err)
 	}
 	defer rows.Close()
 
@@ -519,9 +488,9 @@ func (db *IndexDB) GetDirectoryChildren(source, dirPath string) ([]*iteminfo.Fil
 
 	rows, err := db.Query(query, source, dirPath)
 	if err != nil {
-		if isBusyError(err) || isTransactionError(err) {
-			logger.Warningf("[DB_TX] GetDirectoryChildren: DB busy/locked, skipping query")
-			return []*iteminfo.FileInfo{}, nil
+		if sqlitebusy.IsBusyOrLocked(err) {
+			logger.Warningf("[DB_TX] GetDirectoryChildren: DB busy/locked: %v", err)
+			return nil, sqlitebusy.Wrap(err)
 		}
 		logger.Errorf("GetDirectoryChildren: Query failed for source=%s, parent_path=%s, error=%v", source, dirPath, err)
 		return nil, err
@@ -671,9 +640,9 @@ func (db *IndexDB) DeleteStaleFolders(source string, pathPrefix string, scanStar
 		}
 
 		if err != nil {
-			if isBusyError(err) || isTransactionError(err) {
-				logger.Debugf("[DB_MAINTENANCE] DeleteStaleEntriesQuick Phase 1: DB busy, skipping cleanup")
-				return totalDeleted, nil
+			if sqlitebusy.IsBusyOrLocked(err) {
+				logger.Debugf("[DB_MAINTENANCE] DeleteStaleEntriesQuick Phase 1: DB busy: %v", err)
+				return totalDeleted, sqlitebusy.Wrap(err)
 			}
 			return totalDeleted, err
 		}
@@ -738,9 +707,9 @@ func (db *IndexDB) DeleteStaleFilesInDirs(source string, updatedDirs []string, s
 
 			result, err := db.Exec(query, queryArgs...)
 			if err != nil {
-				if isBusyError(err) || isTransactionError(err) {
-					logger.Debugf("[DB_MAINTENANCE] DeleteStaleFilesInDirs: DB busy, skipping batch")
-					break // Skip this batch and continue with next
+				if sqlitebusy.IsBusyOrLocked(err) {
+					logger.Debugf("[DB_MAINTENANCE] DeleteStaleFilesInDirs: DB busy: %v", err)
+					return totalDeleted, sqlitebusy.Wrap(err)
 				}
 				return totalDeleted, err
 			}
@@ -802,9 +771,9 @@ func (db *IndexDB) DeleteStaleEntries(source string, pathPrefix string, scanStar
 		}
 
 		if err != nil {
-			if isBusyError(err) || isTransactionError(err) {
-				logger.Debugf("[DB_MAINTENANCE] DeleteStaleEntries: DB busy, skipping cleanup")
-				return totalDeleted, nil
+			if sqlitebusy.IsBusyOrLocked(err) {
+				logger.Debugf("[DB_MAINTENANCE] DeleteStaleEntries: DB busy: %v", err)
+				return totalDeleted, sqlitebusy.Wrap(err)
 			}
 			return totalDeleted, err
 		}
@@ -832,9 +801,9 @@ func (db *IndexDB) DeleteStaleItemsOlderThan(olderThan time.Duration) (int, erro
 
 	result, err := db.Exec(query, cutoffTime)
 	if err != nil {
-		if isBusyError(err) || isTransactionError(err) {
-			logger.Debugf("[DB_MAINTENANCE] DeleteStaleItemsOlderThan: DB busy, skipping cleanup")
-			return 0, nil
+		if sqlitebusy.IsBusyOrLocked(err) {
+			logger.Debugf("[DB_MAINTENANCE] DeleteStaleItemsOlderThan: DB busy: %v", err)
+			return 0, sqlitebusy.Wrap(err)
 		}
 		return 0, err
 	}
@@ -859,8 +828,8 @@ func (db *IndexDB) GetRecursiveCount(source string, pathPrefix string) (dirs uin
 	var dirCount, fileCount sql.NullInt64
 	err = db.QueryRow(query, source, pathPrefix, nextPrefix).Scan(&dirCount, &fileCount)
 	if err != nil {
-		if isBusyError(err) || isTransactionError(err) {
-			return 0, 0, nil
+		if sqlitebusy.IsBusyOrLocked(err) {
+			return 0, 0, sqlitebusy.Wrap(err)
 		}
 		return 0, 0, err
 	}
@@ -883,8 +852,8 @@ func (db *IndexDB) GetDirectFileCount(source string, pathPrefix string) (files u
 	var fileCount sql.NullInt64
 	err = db.QueryRow(query, source, pathPrefix).Scan(&fileCount)
 	if err != nil {
-		if isBusyError(err) || isTransactionError(err) {
-			return 0, nil
+		if sqlitebusy.IsBusyOrLocked(err) {
+			return 0, sqlitebusy.Wrap(err)
 		}
 		return 0, err
 	}
@@ -920,9 +889,8 @@ func (db *IndexDB) GetTypeGroupsForSize(source string, size int64, pathPrefix st
 
 	rows, err := db.Query(query, args...)
 	if err != nil {
-		// Soft failure: DB is busy or locked, return empty results
-		if isBusyError(err) || isTransactionError(err) {
-			return []string{}, nil
+		if sqlitebusy.IsBusyOrLocked(err) {
+			return nil, sqlitebusy.Wrap(err)
 		}
 		return nil, err
 	}
@@ -976,9 +944,8 @@ func (db *IndexDB) GetFilesForMultipleSizes(source string, sizes []int64, pathPr
 
 	rows, err := db.Query(query, args...)
 	if err != nil {
-		// Soft failure: DB is busy or locked, return empty results
-		if isBusyError(err) || isTransactionError(err) {
-			return make(map[int64][]*iteminfo.FileInfo), nil
+		if sqlitebusy.IsBusyOrLocked(err) {
+			return nil, sqlitebusy.Wrap(err)
 		}
 		return nil, err
 	}
@@ -1008,10 +975,7 @@ func (db *IndexDB) GetAllDirectories(source string) ([]string, error) {
 
 	rows, err := db.Query(query, source)
 	if err != nil {
-		if isBusyError(err) || isTransactionError(err) {
-			return []string{}, nil
-		}
-		return nil, err
+		return nil, sqlitebusy.Wrap(err)
 	}
 	defer rows.Close()
 
@@ -1071,16 +1035,17 @@ func (db *IndexDB) UpdateFolderSizesIfChanged(source string, pathSizes map[strin
 	for attempt := 1; attempt <= dbTransientOpAttempts; attempt++ {
 		result, err := db.Exec(query, args...)
 		if err != nil {
-			if isBusyError(err) || isTransactionError(err) {
+			if sqlitebusy.IsBusyOrLocked(err) {
 				if attempt < dbTransientOpAttempts {
 					logger.Warningf("[DB_TX] UpdateFolderSizesIfChanged: busy/locked (attempt %d/%d), retrying after %v: %v",
 						attempt, dbTransientOpAttempts, dbTransientRetryBackoff, err)
 					time.Sleep(dbTransientRetryBackoff)
 					continue
 				}
-				logger.Warningf("[DB_TX] UpdateFolderSizesIfChanged: still busy after %d attempts (%d paths, %v) — skipped",
+				logger.Warningf("[DB_TX] UpdateFolderSizesIfChanged: still busy after %d attempts (%d paths, %v)",
 					dbTransientOpAttempts, len(pathSizes), time.Since(startTime))
-				return 0, nil
+				return 0, fmt.Errorf("update folder sizes failed after %d attempts (%d paths): %w",
+					dbTransientOpAttempts, len(pathSizes), sqlitebusy.ErrBusy)
 			}
 			return 0, err
 		}
@@ -1148,11 +1113,7 @@ func (db *IndexDB) GetFilesBySizeAndType(source string, size int64, fileType str
 
 	rows, err := db.Query(query, args...)
 	if err != nil {
-		// Soft failure: DB is busy or locked, return empty results
-		if isBusyError(err) || isTransactionError(err) {
-			return []*iteminfo.FileInfo{}, nil
-		}
-		return nil, err
+		return nil, sqlitebusy.Wrap(err)
 	}
 	defer rows.Close()
 
@@ -1194,11 +1155,7 @@ func (db *IndexDB) GetFilesBySize(source string, size int64, pathPrefix string)
 
 	rows, err := db.Query(query, args...)
 	if err != nil {
-		// Soft failure: DB is busy or locked, return empty slice
-		if isBusyError(err) || isTransactionError(err) {
-			return []*iteminfo.FileInfo{}, nil
-		}
-		return nil, err
+		return nil, sqlitebusy.Wrap(err)
 	}
 	defer rows.Close()
 
@@ -1244,11 +1201,7 @@ func (db *IndexDB) GetSizeGroupsForDuplicates(source string, minSize int64, path
 
 	rows, err := db.Query(query, args...)
 	if err != nil {
-		// Soft failure: DB is busy or locked, return empty results
-		if isBusyError(err) || isTransactionError(err) {
-			return []int64{}, make(map[int64]int), nil
-		}
-		return nil, nil, err
+		return nil, nil, sqlitebusy.Wrap(err)
 	}
 	defer rows.Close()
 

backend/internal/database/sql/tempdb.go

@@ -9,6 +9,7 @@ import (
 	"time"
 
 	"github.com/gtsteffaniak/filebrowser/backend/internal/adapters/fs/fileutils"
+	"github.com/gtsteffaniak/filebrowser/backend/internal/database/sqlitebusy"
 	"github.com/gtsteffaniak/filebrowser/backend/pkg/settings"
 	"github.com/gtsteffaniak/go-logger/logger"
 	// SQLite driver is imported in driver_cgo.go or driver_nocgo.go based on build tags
@@ -225,9 +226,10 @@ func NewTempDB(id string, config ...*TempDBConfig) (*TempDB, error) {
 		tmpFile.Close()
 	}
 
-	// Open SQLite database with basic connection string
-	// Driver is selected at compile time: "sqlite3" (CGO) or "sqlite" (pure Go)
-	db, err := sql.Open(SqliteDriver, tmpPath)
+	// Open SQLite database with basic connection string.
+	// Driver is selected at compile time: "sqlite3" (CGO) or "sqlite" (pure Go).
+	// busy_timeout is set in the DSN so every pooled connection honors it.
+	db, err := sql.Open(SqliteDriver, sqlitebusy.WithBusyTimeout(tmpPath))
 	if err != nil {
 		os.Remove(tmpPath)
 		return nil, fmt.Errorf("failed to open SQLite database: %w", err)

backend/internal/database/sqldb/migrations.go

@@ -6,7 +6,7 @@ import (
 )
 
 // currentSchemaVersion is the SQLite schema marker for this codebase.
-const currentSchemaVersion = 3
+const currentSchemaVersion = 4
 
 // Schema creates all tables for the SQLite database
 func createSchema(db *sql.DB) error {
@@ -78,7 +78,8 @@ func createSchema(db *sql.DB) error {
 	CREATE TABLE IF NOT EXISTS hashed_tokens (
 		token_hash TEXT PRIMARY KEY,
 		user_id TEXT NOT NULL,
-		is_session INTEGER NOT NULL DEFAULT 0
+		is_session INTEGER NOT NULL DEFAULT 0,
+		expires_at INTEGER NOT NULL DEFAULT 0
 	);
 	CREATE INDEX IF NOT EXISTS idx_hashed_tokens_user_id ON hashed_tokens(user_id);
 
@@ -190,6 +191,10 @@ func runMigrations(db *sql.DB, fromVersion int) error {
 			if err := addHashedTokenSessionColumn(db); err != nil {
 				return err
 			}
+		case 4:
+			if err := addHashedTokenExpiryColumn(db); err != nil {
+				return err
+			}
 		default:
 			return fmt.Errorf("unknown schema version: %d", v)
 		}
@@ -220,6 +225,23 @@ func addHashedTokenSessionColumn(db *sql.DB) error {
 	return nil
 }
 
+// addHashedTokenExpiryColumn adds the expires_at timestamp to pre-existing
+// hashed_tokens tables. Existing rows get 0 (unknown expiry) and are left
+// untouched; expiry is recorded for newly registered tokens.
+func addHashedTokenExpiryColumn(db *sql.DB) error {
+	hasColumn, err := tableHasColumn(db, "hashed_tokens", "expires_at")
+	if err != nil {
+		return err
+	}
+	if hasColumn {
+		return nil
+	}
+	if _, err := db.Exec(`ALTER TABLE hashed_tokens ADD COLUMN expires_at INTEGER NOT NULL DEFAULT 0`); err != nil {
+		return fmt.Errorf("failed to add hashed_tokens.expires_at: %w", err)
+	}
+	return nil
+}
+
 // tableHasColumn reports whether table/column exists in the current schema.
 func tableHasColumn(db *sql.DB, table, column string) (bool, error) {
 	rows, err := db.Query(fmt.Sprintf("PRAGMA table_info(%s)", table))

backend/internal/database/sqldb/sqldb.go

@@ -7,6 +7,7 @@ import (
 	"path/filepath"
 	"time"
 
+	"github.com/gtsteffaniak/filebrowser/backend/internal/database/sqlitebusy"
 	"github.com/gtsteffaniak/go-logger/logger"
 	// SQLite driver is imported in driver_cgo.go or driver_nocgo.go based on build tags
 )
@@ -38,8 +39,13 @@ func NewSQLStoreWithOptions(dbPath string, opts NewSQLStoreOpts) (*SQLStore, boo
 		return nil, existingDb, fmt.Errorf("failed to create database directory: %w", err)
 	}
 
-	// Open SQLite database with the appropriate driver
-	db, err := sql.Open(SqliteDriver, fmt.Sprintf("file:%s?cache=shared&mode=rwc&_journal_mode=WAL", dbPath))
+	// Open SQLite database with the appropriate driver.
+	// busy_timeout is set in the DSN so every pooled connection honors it.
+	// Shared cache is intentionally not used: its table-lock conflicts surface as
+	// SQLITE_LOCKED_SHAREDCACHE, which busy_timeout does not wait on, and SQLite
+	// discourages the mode. WAL already provides concurrent readers.
+	dsn := fmt.Sprintf("file:%s?mode=rwc&_journal_mode=WAL", dbPath)
+	db, err := sql.Open(SqliteDriver, sqlitebusy.WithBusyTimeout(dsn))
 	if err != nil {
 		return nil, existingDb, fmt.Errorf("failed to open database: %w", err)
 	}

backend/internal/database/sqldb/tokens.go

@@ -41,6 +41,7 @@ type sqlExecutor interface {
 type HashedTokenRecord struct {
 	UserID    uint64
 	IsSession bool
+	ExpiresAt int64 // unix expiry from the token's exp claim; 0 = unknown/none
 }
 
 // PersistImmediateTokenRevocation records an immediate revocation and removes the
@@ -145,9 +146,10 @@ func (s *SQLStore) DeleteRevokedToken(tokenHash string) error {
 // SaveHashedToken saves a token hash to owner user_id mapping (decimal text).
 // isSession records that the bearer token is a FileBrowser session token rather
 // than a named API token, so auth can reject non-session tokens without caps.
-func (s *SQLStore) SaveHashedToken(tokenHash string, userID uint64, isSession bool) error {
-	query := `INSERT OR REPLACE INTO hashed_tokens (token_hash, user_id, is_session) VALUES (?, ?, ?)`
-	_, err := s.db.Exec(query, tokenHash, strconv.FormatUint(userID, 10), isSession)
+// expiresAt is the token's exp claim as unix time; 0 means no expiry.
+func (s *SQLStore) SaveHashedToken(tokenHash string, userID uint64, isSession bool, expiresAt int64) error {
+	query := `INSERT OR REPLACE INTO hashed_tokens (token_hash, user_id, is_session, expires_at) VALUES (?, ?, ?, ?)`
+	_, err := s.db.Exec(query, tokenHash, strconv.FormatUint(userID, 10), isSession, expiresAt)
 	if err != nil {
 		return fmt.Errorf("failed to save hashed token: %w", err)
 	}
@@ -170,7 +172,7 @@ func (s *SQLStore) GetUserIDByTokenHash(tokenHash string) (uint64, error) {
 
 // GetAllHashedTokens retrieves all token hash → owner mappings.
 func (s *SQLStore) GetAllHashedTokens() (map[string]HashedTokenRecord, error) {
-	query := `SELECT token_hash, user_id, is_session FROM hashed_tokens`
+	query := `SELECT token_hash, user_id, is_session, expires_at FROM hashed_tokens`
 	rows, err := s.db.Query(query)
 	if err != nil {
 		return nil, fmt.Errorf("failed to get hashed tokens: %w", err)
@@ -181,14 +183,15 @@ func (s *SQLStore) GetAllHashedTokens() (map[string]HashedTokenRecord, error) {
 	for rows.Next() {
 		var tokenHash, idStr string
 		var isSession bool
-		if err := rows.Scan(&tokenHash, &idStr, &isSession); err != nil {
+		var expiresAt int64
+		if err := rows.Scan(&tokenHash, &idStr, &isSession, &expiresAt); err != nil {
 			return nil, fmt.Errorf("failed to scan hashed token: %w", err)
 		}
 		uid, err := strconv.ParseUint(idStr, 10, 64)
 		if err != nil {
 			return nil, fmt.Errorf("invalid user_id in hashed_tokens: %w", err)
 		}
-		hashedTokens[tokenHash] = HashedTokenRecord{UserID: uid, IsSession: isSession}
+		hashedTokens[tokenHash] = HashedTokenRecord{UserID: uid, IsSession: isSession, ExpiresAt: expiresAt}
 	}
 
 	if err := rows.Err(); err != nil {

backend/internal/database/sqldb/tokens_migration_test.go

@@ -32,7 +32,7 @@ func TestMigrationAddsHashedTokenSessionColumn(t *testing.T) {
 		t.Fatalf("runMigrations: %v", err)
 	}
 
-	if err = store.SaveHashedToken("new-hash", 8, true); err != nil {
+	if err = store.SaveHashedToken("new-hash", 8, true, 12345); err != nil {
 		t.Fatalf("SaveHashedToken after migration: %v", err)
 	}
 	records, err := store.GetAllHashedTokens()
@@ -46,9 +46,15 @@ func TestMigrationAddsHashedTokenSessionColumn(t *testing.T) {
 	if legacy.IsSession {
 		t.Fatal("legacy rows must migrate as non-session tokens")
 	}
+	if legacy.ExpiresAt != 0 {
+		t.Fatalf("legacy rows must migrate with no expiry, got %d", legacy.ExpiresAt)
+	}
 	if !records["new-hash"].IsSession {
 		t.Fatal("session flag was not persisted")
 	}
+	if records["new-hash"].ExpiresAt != 12345 {
+		t.Fatalf("expires_at not persisted, got %d", records["new-hash"].ExpiresAt)
+	}
 }
 
 func TestGetSettingMissingReturnsSentinel(t *testing.T) {

backend/internal/database/sqlitebusy/busy.go

@@ -0,0 +1,42 @@
+package sqlitebusy
+
+import (
+	"errors"
+	"fmt"
+	"strings"
+)
+
+// DefaultBusyTimeoutMs is how long SQLite waits on SQLITE_BUSY before failing an operation.
+const DefaultBusyTimeoutMs = 5000
+
+// ErrBusy is returned when an operation could not complete because the database was busy or locked.
+var ErrBusy = errors.New("sqlite database is busy or locked")
+
+// WithBusyTimeout appends the busy_timeout connection parameter to dsn so that
+// every connection in the pool honors the timeout. Both supported drivers
+// (mattn/go-sqlite3 and modernc.org/sqlite) apply the parameter at
+// connection-open time, unlike a one-off PRAGMA which only configures the
+// single connection that database/sql happens to pick.
+func WithBusyTimeout(dsn string) string {
+	separator := "?"
+	if strings.Contains(dsn, "?") {
+		separator = "&"
+	}
+	return fmt.Sprintf("%s%s_busy_timeout=%d", dsn, separator, DefaultBusyTimeoutMs)
+}
+
+// IsBusyOrLocked reports whether err is SQLITE_BUSY or SQLITE_LOCKED from the
+// configured SQLite driver, classified by the driver's result code rather than
+// error text.
+func IsBusyOrLocked(err error) bool {
+	return err != nil && isBusyOrLocked(err)
+}
+
+// Wrap returns err wrapped with ErrBusy when the underlying error is busy/locked.
+// The original error is retained so callers can still inspect the driver result code.
+func Wrap(err error) error {
+	if err == nil || !IsBusyOrLocked(err) {
+		return err
+	}
+	return fmt.Errorf("%w: %w", ErrBusy, err)
+}

backend/internal/database/sqlitebusy/busy_test.go

@@ -0,0 +1,199 @@
+package sqlitebusy
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"path/filepath"
+	"testing"
+)
+
+// sqliteBusySnapshot is the extended result code returned when a WAL read
+// transaction tries to upgrade to a write on a stale snapshot.
+const sqliteBusySnapshot = 517
+
+func TestIsBusyOrLocked(t *testing.T) {
+	if IsBusyOrLocked(nil) {
+		t.Fatal("expected nil not to be busy")
+	}
+	if IsBusyOrLocked(newGenericError(t)) {
+		t.Fatal("expected non-busy SQLITE_ERROR not to be classified as busy")
+	}
+	if !IsBusyOrLocked(newBusyError(t)) {
+		t.Fatal("expected SQLITE_BUSY to be classified as busy")
+	}
+	if !IsBusyOrLocked(newBusySnapshotError(t)) {
+		t.Fatal("expected SQLITE_BUSY_SNAPSHOT to be classified as busy")
+	}
+}
+
+func TestWrap(t *testing.T) {
+	for name, makeErr := range map[string]func(*testing.T) error{
+		"SQLITE_BUSY":          newBusyError,
+		"SQLITE_BUSY_SNAPSHOT": newBusySnapshotError,
+	} {
+		t.Run(name, func(t *testing.T) {
+			wrapped := Wrap(makeErr(t))
+			if !errors.Is(wrapped, ErrBusy) {
+				t.Fatalf("expected ErrBusy, got %v", wrapped)
+			}
+		})
+	}
+
+	generic := newGenericError(t)
+	if err := Wrap(generic); errors.Is(err, ErrBusy) {
+		t.Fatalf("expected generic error to pass through unwrapped, got %v", err)
+	}
+	if err := Wrap(nil); err != nil {
+		t.Fatalf("expected nil, got %v", err)
+	}
+}
+
+// TestWithBusyTimeoutAppliesToEveryConnection verifies the DSN parameter is
+// applied at connection-open time, so a second pooled connection does not
+// bypass the timeout like a one-off PRAGMA would.
+func TestWithBusyTimeoutAppliesToEveryConnection(t *testing.T) {
+	dbPath := filepath.Join(t.TempDir(), "pool.db")
+	db, err := sql.Open(testDriver, WithBusyTimeout("file:"+dbPath))
+	if err != nil {
+		t.Fatalf("open: %v", err)
+	}
+	defer db.Close()
+	db.SetMaxOpenConns(2)
+
+	ctx := context.Background()
+	conn1, err := db.Conn(ctx)
+	if err != nil {
+		t.Fatalf("conn1: %v", err)
+	}
+	defer conn1.Close()
+	conn2, err := db.Conn(ctx)
+	if err != nil {
+		t.Fatalf("conn2: %v", err)
+	}
+	defer conn2.Close()
+
+	for i, conn := range []*sql.Conn{conn1, conn2} {
+		var timeout int
+		if err := conn.QueryRowContext(ctx, "PRAGMA busy_timeout").Scan(&timeout); err != nil {
+			t.Fatalf("conn %d: read busy_timeout: %v", i+1, err)
+		}
+		if timeout != DefaultBusyTimeoutMs {
+			t.Fatalf("conn %d: busy_timeout = %d, want %d", i+1, timeout, DefaultBusyTimeoutMs)
+		}
+	}
+}
+
+// newGenericError returns a real SQLITE_ERROR (result code 1) from the driver.
+func newGenericError(t *testing.T) error {
+	t.Helper()
+	db, err := sql.Open(testDriver, filepath.Join(t.TempDir(), "generic.db"))
+	if err != nil {
+		t.Fatalf("open: %v", err)
+	}
+	defer db.Close()
+	_, err = db.Exec("SELECT * FROM table_that_does_not_exist")
+	if err == nil {
+		t.Fatal("expected error from invalid query")
+	}
+	return err
+}
+
+// newBusyError returns a real SQLITE_BUSY (result code 5) from the driver by
+// holding a write lock on one connection and writing from a second with a zero
+// busy timeout.
+func newBusyError(t *testing.T) error {
+	t.Helper()
+	dbPath := filepath.Join(t.TempDir(), "busy.db")
+
+	holder, err := sql.Open(testDriver, WithBusyTimeout("file:"+dbPath))
+	if err != nil {
+		t.Fatalf("open holder: %v", err)
+	}
+	defer holder.Close()
+	holder.SetMaxOpenConns(1)
+
+	if _, err = holder.Exec("CREATE TABLE t (id INTEGER)"); err != nil {
+		t.Fatalf("create table: %v", err)
+	}
+	tx, err := holder.Begin()
+	if err != nil {
+		t.Fatalf("begin: %v", err)
+	}
+	defer func() { _ = tx.Rollback() }()
+	if _, err = tx.Exec("INSERT INTO t VALUES (1)"); err != nil {
+		t.Fatalf("holder insert: %v", err)
+	}
+
+	contender, err := sql.Open(testDriver, "file:"+dbPath+"?_busy_timeout=0")
+	if err != nil {
+		t.Fatalf("open contender: %v", err)
+	}
+	defer contender.Close()
+
+	_, err = contender.Exec("INSERT INTO t VALUES (2)")
+	if err == nil {
+		t.Fatal("expected SQLITE_BUSY from contended write")
+	}
+	return err
+}
+
+// newBusySnapshotError returns a real extended-busy error (SQLITE_BUSY_SNAPSHOT)
+// from the driver. In WAL mode, a transaction that has already taken a read
+// snapshot cannot upgrade to a write after another connection committed —
+// SQLite returns SQLITE_BUSY_SNAPSHOT instead of waiting on busy_timeout.
+func newBusySnapshotError(t *testing.T) error {
+	t.Helper()
+	dbPath := filepath.Join(t.TempDir(), "snapshot.db")
+	dsn := "file:" + dbPath + "?_journal_mode=WAL&_busy_timeout=0"
+
+	db, err := sql.Open(testDriver, dsn)
+	if err != nil {
+		t.Fatalf("open: %v", err)
+	}
+	defer db.Close()
+	db.SetMaxOpenConns(2)
+
+	if _, err = db.Exec("CREATE TABLE t (id INTEGER); INSERT INTO t VALUES (1)"); err != nil {
+		t.Fatalf("setup: %v", err)
+	}
+
+	ctx := context.Background()
+	reader, err := db.Conn(ctx)
+	if err != nil {
+		t.Fatalf("reader conn: %v", err)
+	}
+	defer reader.Close()
+
+	tx, err := reader.BeginTx(ctx, nil)
+	if err != nil {
+		t.Fatalf("begin: %v", err)
+	}
+	defer func() { _ = tx.Rollback() }()
+
+	// Establish the read snapshot.
+	var count int
+	if err = tx.QueryRow("SELECT COUNT(*) FROM t").Scan(&count); err != nil {
+		t.Fatalf("snapshot read: %v", err)
+	}
+
+	// Commit a write from a different connection, invalidating the snapshot.
+	writer, err := db.Conn(ctx)
+	if err != nil {
+		t.Fatalf("writer conn: %v", err)
+	}
+	defer writer.Close()
+	if _, err = writer.ExecContext(ctx, "INSERT INTO t VALUES (2)"); err != nil {
+		t.Fatalf("writer insert: %v", err)
+	}
+
+	// Upgrading the stale snapshot to a write must fail with SQLITE_BUSY_SNAPSHOT.
+	_, err = tx.Exec("INSERT INTO t VALUES (3)")
+	if err == nil {
+		t.Fatal("expected SQLITE_BUSY_SNAPSHOT from write on stale snapshot")
+	}
+	if code := driverErrorCode(err); code != sqliteBusySnapshot {
+		t.Fatalf("expected extended code %d (SQLITE_BUSY_SNAPSHOT), got %d", sqliteBusySnapshot, code)
+	}
+	return err
+}

backend/internal/database/sqlitebusy/driver_cgo_test.go

@@ -0,0 +1,23 @@
+//go:build cgosql
+// +build cgosql
+
+package sqlitebusy
+
+import (
+	"errors"
+
+	sqlite3 "github.com/mattn/go-sqlite3"
+)
+
+const testDriver = "sqlite3"
+
+// driverErrorCode returns the driver's extended result code for err, so tests
+// can assert which busy/locked variant was produced. mattn reports the
+// extended code in Error.ExtendedCode.
+func driverErrorCode(err error) int {
+	var sqliteErr sqlite3.Error
+	if errors.As(err, &sqliteErr) {
+		return int(sqliteErr.ExtendedCode)
+	}
+	return -1
+}

backend/internal/database/sqlitebusy/driver_nocgo_test.go

@@ -0,0 +1,23 @@
+//go:build !cgosql
+// +build !cgosql
+
+package sqlitebusy
+
+import (
+	"errors"
+
+	sqlite "modernc.org/sqlite"
+)
+
+const testDriver = "sqlite"
+
+// driverErrorCode returns the driver's extended result code for err, so tests
+// can assert which busy/locked variant was produced. modernc reports the
+// (possibly extended) code via Error.Code.
+func driverErrorCode(err error) int {
+	var sqliteErr *sqlite.Error
+	if errors.As(err, &sqliteErr) {
+		return sqliteErr.Code()
+	}
+	return -1
+}

backend/internal/database/sqlitebusy/resultcode_cgo.go

@@ -0,0 +1,21 @@
+//go:build cgosql
+// +build cgosql
+
+package sqlitebusy
+
+import (
+	"errors"
+
+	sqlite3 "github.com/mattn/go-sqlite3"
+)
+
+// isBusyOrLocked reports whether err is a SQLITE_BUSY or SQLITE_LOCKED error
+// from the CGO (mattn/go-sqlite3) driver. Error.Code is already the primary
+// result code; extended codes are reported separately in Error.ExtendedCode.
+func isBusyOrLocked(err error) bool {
+	var sqliteErr sqlite3.Error
+	if !errors.As(err, &sqliteErr) {
+		return false
+	}
+	return sqliteErr.Code == sqlite3.ErrBusy || sqliteErr.Code == sqlite3.ErrLocked
+}

backend/internal/database/sqlitebusy/resultcode_nocgo.go

@@ -0,0 +1,28 @@
+//go:build !cgosql
+// +build !cgosql
+
+package sqlitebusy
+
+import (
+	"errors"
+
+	sqlite "modernc.org/sqlite"
+	sqlite3 "modernc.org/sqlite/lib"
+)
+
+// isBusyOrLocked reports whether err is a SQLITE_BUSY or SQLITE_LOCKED error
+// from the pure-Go (modernc.org/sqlite) driver. The driver enables extended
+// result codes, so Error.Code() may carry extra detail in the high bits (e.g.
+// SQLITE_BUSY_SNAPSHOT); only the lowest byte holds the primary code.
+func isBusyOrLocked(err error) bool {
+	var sqliteErr *sqlite.Error
+	if !errors.As(err, &sqliteErr) {
+		return false
+	}
+	switch sqliteErr.Code() & 0xff {
+	case sqlite3.SQLITE_BUSY, sqlite3.SQLITE_LOCKED:
+		return true
+	default:
+		return false
+	}
+}

backend/internal/database/users/sidebar_link.go

@@ -11,8 +11,14 @@ const (
 	SidebarLinkSourceAlt     SidebarLinkCategory = "source-alt"
 	SidebarLinkSourceHybrid  SidebarLinkCategory = "source-hybrid"
 	SidebarLinkSourceHybrid2 SidebarLinkCategory = "source-hybrid-2"
-	SidebarLinkTool          SidebarLinkCategory = "tool"
-	SidebarLinkCustom        SidebarLinkCategory = "custom"
+	// "-root" variants display the root-filesystem-only disk usage (no nested
+	// mount aggregation) instead of the aggregated multi-mount totals.
+	SidebarLinkSourceRoot        SidebarLinkCategory = "source-root"
+	SidebarLinkSourceAltRoot     SidebarLinkCategory = "source-alt-root"
+	SidebarLinkSourceHybridRoot  SidebarLinkCategory = "source-hybrid-root"
+	SidebarLinkSourceHybrid2Root SidebarLinkCategory = "source-hybrid-2-root"
+	SidebarLinkTool              SidebarLinkCategory = "tool"
+	SidebarLinkCustom            SidebarLinkCategory = "custom"
 )
 
 // NormalizeSidebarLinkCategory returns a known category string, preserving source-* variants.
@@ -23,7 +29,10 @@ func NormalizeSidebarLinkCategory(category string) string {
 	}
 	switch SidebarLinkCategory(c) {
 	case SidebarLinkSource, SidebarLinkSourceMinimal, SidebarLinkSourceAlt,
-		SidebarLinkSourceHybrid, SidebarLinkSourceHybrid2, SidebarLinkTool, SidebarLinkCustom:
+		SidebarLinkSourceHybrid, SidebarLinkSourceHybrid2,
+		SidebarLinkSourceRoot, SidebarLinkSourceAltRoot,
+		SidebarLinkSourceHybridRoot, SidebarLinkSourceHybrid2Root,
+		SidebarLinkTool, SidebarLinkCustom:
 		return c
 	}
 	if strings.HasPrefix(c, "source") {
@@ -36,3 +45,14 @@ func NormalizeSidebarLinkCategory(category string) string {
 func IsSourceSidebarCategory(category string) bool {
 	return strings.HasPrefix(NormalizeSidebarLinkCategory(category), "source")
 }
+
+// SidebarLinkDiskScopeRoot reports whether the category shows the
+// root-filesystem-only disk usage rather than the aggregated nested-mount usage.
+func SidebarLinkDiskScopeRoot(category string) bool {
+	return strings.HasSuffix(NormalizeSidebarLinkCategory(category), "-root")
+}
+
+// BaseSidebarLinkCategory strips the root-only "-root" suffix from a category.
+func BaseSidebarLinkCategory(category string) string {
+	return strings.TrimSuffix(NormalizeSidebarLinkCategory(category), "-root")
+}

backend/internal/database/users/token_permissions.go

@@ -24,7 +24,11 @@ func HasAnyGlobalPermission(p Permissions) bool {
 }
 
 // IsMinimalApiToken reports whether the token inherits the owner's globals at auth time
-// rather than embedding its own global permission caps in the JWT.
+// rather than applying stored global permission caps.
 func IsMinimalApiToken(t AuthToken) bool {
+	if t.Minimal != nil {
+		return *t.Minimal
+	}
+	// Legacy tokens lack minimal; empty stored global caps implied minimal (WebDAV-style).
 	return !HasAnyGlobalPermission(t.Permissions)
 }

backend/internal/database/users/token_permissions_test.go

@@ -45,6 +45,14 @@ func TestIsMinimalApiToken(t *testing.T) {
 		t.Fatal("custom token with global caps should not be minimal")
 	}
 	if !IsMinimalApiToken(AuthToken{Permissions: Permissions{Modify: true}}) {
-		t.Fatal("token without global caps should be minimal")
+		t.Fatal("legacy token without global caps should be minimal")
+	}
+	minimal := true
+	if !IsMinimalApiToken(AuthToken{Minimal: &minimal}) {
+		t.Fatal("explicit minimal token should be minimal")
+	}
+	customized := false
+	if IsMinimalApiToken(AuthToken{Minimal: &customized}) {
+		t.Fatal("explicit customized token with empty caps should not be minimal")
 	}
 }

backend/internal/database/users/username_test.go

@@ -21,3 +21,16 @@ func TestValidateUsernameAcceptsNormalName(t *testing.T) {
 		t.Fatalf("expected valid username, got %v", err)
 	}
 }
+
+func TestValidateUsernameRejectsUnsafeNames(t *testing.T) {
+	for _, username := range []string{"..", "....", ".", "-", "al..ice", "bob/", "./bob", `bob\`, "alice/docs", " alice", "alice "} {
+		if err := ValidateUsername(username); err == nil {
+			t.Fatalf("expected %q to be rejected", username)
+		}
+	}
+	for _, username := range []string{"alice", "first.last", "j.r.r", "a-b_c", "user@example.com", "José", "李雷", ".alice", "users"} {
+		if err := ValidateUsername(username); err != nil {
+			t.Fatalf("expected %q to be accepted, got %v", username, err)
+		}
+	}
+}

backend/internal/database/users/users.go

@@ -8,10 +8,27 @@ import (
 )
 
 // ProfileStorageVersion is the user version after nested profile JSON in user_data.
+// It marks a storage-shape boundary (used by the persist layer), not the newest version.
 const ProfileStorageVersion = 5
 
+// NewestUserVersion is the single reference for the latest user version.
+// Per-migration watermarks below keep their historical values; only this moves forward.
+const NewestUserVersion = 6
+
+// PermMigrationVersion is the user version after the legacy perm-key to permissions migration.
+const PermMigrationVersion = 1
+
+// TokenMigrationVersion is the user version after the legacy apiKeys to tokens migration.
+const TokenMigrationVersion = 2
+
+// TokenHashBackfillVersion is the user version that guarantees every stored API
+// token (Tokens and legacy ApiKeys) has a SHA256(raw) → owner row in
+// hashed_tokens. Strict server-side auth ignores BelongsTo and rejects any
+// bearer JWT without a hash mapping, so this migration must run on startup.
+const TokenHashBackfillVersion = 6
+
 // CurrentUserMigrationVersion is persisted for newly created accounts and after legacy migrations finish.
-const CurrentUserMigrationVersion = ProfileStorageVersion
+const CurrentUserMigrationVersion = NewestUserVersion
 
 type LoginMethod string
 
@@ -30,8 +47,10 @@ var reservedUsernames = map[string]struct{}{
 	strings.ToLower(AnonymousUserName): {},
 }
 
-// ValidateUsername rejects empty and reserved login names.
+// ValidateUsername rejects empty and reserved login names, and names that do not map to their
+// own createUserDir home directory.
 func ValidateUsername(username string) error {
+	raw := username
 	username = strings.TrimSpace(username)
 	if username == "" {
 		return fmt.Errorf("username is empty")
@@ -39,6 +58,11 @@ func ValidateUsername(username string) error {
 	if _, reserved := reservedUsernames[strings.ToLower(username)]; reserved {
 		return fmt.Errorf("username %q is reserved", username)
 	}
+	// The per-user home directory is derived from CleanUsername(username), so reject names
+	// that it would rewrite, the names "." and "-", and names containing path separators.
+	if CleanUsername(raw) != raw || raw == "." || raw == "-" || strings.ContainsAny(raw, `/\`) {
+		return fmt.Errorf("username %q contains characters that are not allowed", raw)
+	}
 	return nil
 }
 
@@ -77,9 +101,11 @@ type AuthToken struct {
 	Token       string      `json:"token,omitempty"`
 	Name        string      `json:"name,omitempty"`
 	Username    string      `json:"username,omitempty"`
-	BelongsTo   uint64      `json:"belongsTo,omitempty"` // legacy stored metadata only; identity is hashed_tokens lookup
+	BelongsTo   uint64      `json:"belongsTo,omitempty"` // legacy stored metadata only, never trusted for auth; identity is always the hashed_tokens lookup
 	IssuedAt    int64       `json:"issuedAt,omitempty"`
 	ExpiresAt   int64       `json:"expiresAt,omitempty"`
+	// Minimal distinguishes owner-inheriting tokens from customized caps. Nil means legacy (infer from stored permissions).
+	Minimal     *bool       `json:"minimal,omitempty"`
 	Permissions Permissions `json:"Permissions,omitempty"`
 }
 
@@ -89,11 +115,11 @@ type MinimalAuthToken struct {
 }
 
 type Permissions struct {
-	Api      bool `json:"api"`      // allow api access
-	Admin    bool `json:"admin"`    // allow admin access
+	Api      bool `json:"api"`                // allow api access
+	Admin    bool `json:"admin"`              // allow admin access
 	Modify   bool `json:"modify,omitempty"`   // deprecated: legacy user migration only; not used for API tokens
-	Share    bool `json:"share"`    // allow sharing files
-	Realtime bool `json:"realtime"` // allow realtime updates
+	Share    bool `json:"share"`              // allow sharing files
+	Realtime bool `json:"realtime"`           // allow realtime updates
 	Delete   bool `json:"delete,omitempty"`   // deprecated: legacy user migration only; not used for API tokens
 	Create   bool `json:"create,omitempty"`   // deprecated: legacy user migration only; not used for API tokens
 	Download bool `json:"download,omitempty"` // deprecated: legacy user migration only; not used for API tokens
@@ -102,12 +128,12 @@ type Permissions struct {
 
 // SourceFilePermissions holds per-source file operation permissions (v4+).
 type SourceFilePermissions struct {
-	View        bool `json:"view"`
-	Download    bool `json:"download"`
-	Modify      bool `json:"modify"`
-	Delete      bool `json:"delete"`
-	Create      bool `json:"create"`
-	Configured  bool `json:"configured,omitempty"` // true when explicitly set (allows intentional deny-all)
+	View       bool `json:"view"`
+	Download   bool `json:"download"`
+	Modify     bool `json:"modify"`
+	Delete     bool `json:"delete"`
+	Create     bool `json:"create"`
+	Configured bool `json:"configured,omitempty"` // true when explicitly set (allows intentional deny-all)
 }
 
 // MarkSourceFilePermissionsConfigured marks permissions as explicitly set (including deny-all).
@@ -156,16 +182,17 @@ type Preview struct {
 // FrontendUser holds fields safe to return from user APIs (embedded on User).
 type FrontendUser struct {
 	NonAdminEditable
-	DisableSettings   bool                             `json:"disableSettings"`
-	Username          string                           `json:"username"`
-	FrontendScopes    []FrontendScope                  `json:"scopes"`
-	LockPassword      bool                             `json:"lockPassword"`
-	Permissions       Permissions                      `json:"permissions"` // global: admin, api, share, realtime
-	SourcePermissions map[string]SourceFilePermissions `json:"sourcePermissions,omitempty"` // deprecated: use scopes[].permissions
-	LoginMethod       LoginMethod                      `json:"loginMethod"`
-	OtpEnabled        bool                             `json:"otpEnabled"`
-	ShowFirstLogin       bool             `json:"showFirstLogin"`
-	Perm                 Permissions      `json:"perm,omitzero"`
+	DisableSettings       bool                             `json:"disableSettings"`
+	Username              string                           `json:"username"`
+	FrontendScopes        []FrontendScope                  `json:"scopes"`
+	LockPassword          bool                             `json:"lockPassword"`
+	RequirePasswordChange bool                             `json:"requirePasswordChange"`
+	Permissions           Permissions                      `json:"permissions"`                 // global: admin, api, share, realtime
+	SourcePermissions     map[string]SourceFilePermissions `json:"sourcePermissions,omitempty"` // deprecated: use scopes[].permissions
+	LoginMethod           LoginMethod                      `json:"loginMethod"`
+	OtpEnabled            bool                             `json:"otpEnabled"`
+	ShowFirstLogin        bool                             `json:"showFirstLogin"`
+	Perm                  Permissions                      `json:"perm,omitzero"`
 }
 
 // PinnedItems maps source filesystem path -> index directory path -> pinned item names.
@@ -194,14 +221,14 @@ type User struct {
 }
 
 type FrontendScope struct {
-	Name        string                `json:"name"`  // Bolt: filesystem path; JSON API: display name after prepForFrontend
-	Scope       string                `json:"scope"` // index path within that source
+	Name        string                 `json:"name"`  // Bolt: filesystem path; JSON API: display name after prepForFrontend
+	Scope       string                 `json:"scope"` // index path within that source
 	Permissions *SourceFilePermissions `json:"permissions,omitempty"`
 }
 
 type BackendScope struct {
-	Path        string               `json:"path"`  // real path for the source
-	Scope       string               `json:"scope"` // index path within that source
+	Path        string                `json:"path"`  // real path for the source
+	Scope       string                `json:"scope"` // index path within that source
 	Permissions SourceFilePermissions `json:"permissions,omitempty"`
 }
 

backend/internal/errors/errors.go

@@ -18,7 +18,8 @@ var (
 	ErrAccessDenied         = errors.New("access denied")
 	ErrInvalidRequestParams = errors.New("invalid request params")
 	ErrSourceIsParent       = errors.New("source is parent")
-	ErrNoTotpProvided       = errors.New("OTP code is required for user")
+	ErrNoTotpProvided          = errors.New("OTP code is required for user")
+	ErrPasswordChangeRequired  = errors.New("password change is required for user")
 	ErrNoTotpConfigured     = errors.New("OTP is enforced, but user is not configured")
 	ErrUnauthorized         = errors.New("user unauthorized")
 	ErrNotIndexed           = errors.New("directory or item excluded from indexing")

backend/internal/events/eventRouter.go

@@ -41,15 +41,13 @@ func handleUserEvents() {
 	for ue := range userEventChan {
 		for _, user := range ue.users {
 			userClientsMu.RLock()
-			conns := userClients[user]
-			userClientsMu.RUnlock()
-
-			for _, ch := range conns {
+			for _, ch := range userClients[user] {
 				select {
 				case ch <- ue.event:
 				default:
 				}
 			}
+			userClientsMu.RUnlock()
 		}
 	}
 }
@@ -135,28 +133,14 @@ func DebouncedBroadcast(eventType, message string) {
 func handleSourceUpdates() {
 	for update := range sourceUpdateChan {
 		sourceClientsMu.RLock()
-		clients := sourceClients[update.source]
-		clientCount := len(clients)
-		sourceClientsMu.RUnlock()
-
-		if clientCount == 0 {
-			// No clients registered for this source - this is normal if no one is connected
-			continue
-		}
-
-		sentCount := 0
-		for ch := range clients {
+		for ch := range sourceClients[update.source] {
 			select {
 			case ch <- update.event:
-				sentCount++
 			default:
 				// Channel full, message dropped
 			}
 		}
-		// Log if we have clients but couldn't send to all
-		//if sentCount < clientCount {
-		//	// Some messages were dropped due to full channels
-		//}
+		sourceClientsMu.RUnlock()
 	}
 }
 

backend/internal/events/eventRouter_test.go

@@ -0,0 +1,74 @@
+package events
+
+import (
+	"sync"
+	"testing"
+	"time"
+)
+
+func TestConcurrentRegisterUnregisterSourceUpdates(t *testing.T) {
+	stop := make(chan struct{})
+	go func() {
+		for {
+			select {
+			case <-stop:
+				return
+			default:
+				ch := Register("stress-user", []string{"stress-source"})
+				Unregister("stress-user", ch)
+			}
+		}
+	}()
+
+	for i := 0; i < 200; i++ {
+		SendSourceUpdate("stress-source", "tick")
+	}
+	close(stop)
+	time.Sleep(50 * time.Millisecond)
+}
+
+func TestConcurrentSSEClientLifecycleRace(t *testing.T) {
+	stop := make(chan struct{})
+	var wg sync.WaitGroup
+
+	for i := 0; i < 4; i++ {
+		wg.Add(1)
+		go func(id int) {
+			defer wg.Done()
+			user := "race-user-" + string(rune('a'+id))
+			source := "race-source-" + string(rune('a'+id%2))
+			for {
+				select {
+				case <-stop:
+					return
+				default:
+					ch := Register(user, []string{source, "shared-source"})
+					SendSourceUpdate(source, "tick")
+					SendSourceUpdate("shared-source", "tick")
+					SendToUsers("ping", "msg", []string{user})
+					Unregister(user, ch)
+				}
+			}
+		}(i)
+	}
+
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		for {
+			select {
+			case <-stop:
+				return
+			default:
+				SendSourceUpdate("shared-source", "broadcast")
+				SendToUsers("broadcast", "all", []string{"race-user-a", "race-user-b"})
+			}
+		}
+	}()
+
+	time.Sleep(100 * time.Millisecond)
+	Shutdown()
+	close(stop)
+	wg.Wait()
+	time.Sleep(50 * time.Millisecond)
+}

backend/internal/imagemeta/embedded.go

@@ -78,12 +78,10 @@ func extractTIFFEmbeddedPreview(f *os.File) ([]byte, error) {
 		return nil, err
 	}
 
-	ex, err := extimagemeta.Decode(f)
-	if err != nil {
-		return nil, err
+	var candidates []previewCandidate
+	if ex, err := extimagemeta.Decode(f); err == nil {
+		candidates = previewCandidates(ex)
 	}
-
-	candidates := previewCandidates(ex)
 	if scanCandidates, scanErr := collectTIFFPreviewCandidates(f); scanErr == nil {
 		candidates = append(candidates, scanCandidates...)
 	}
@@ -115,6 +113,9 @@ func previewCandidates(ex exif.Exif) []previewCandidate {
 			out = append(out, previewCandidate{offset: ifd.ImageOffset, length: ifd.ImageLength})
 		}
 	}
+	for _, sub := range ex.SubIFDs {
+		appendIFD(sub)
+	}
 	appendIFD(ex.IFD1)
 	appendIFD(ex.IFD2)
 

backend/internal/imagemeta/orientation.go

@@ -47,15 +47,16 @@ func GetOrientation(ctx context.Context, path string) string {
 	default:
 		ex, err = extimagemeta.Decode(f)
 	}
-	if err != nil {
-		return ""
-	}
 	if ctx.Err() != nil {
 		return ""
 	}
-
-	if ex.IFD0.Orientation == 0 {
-		return ""
+	if err == nil && ex.IFD0.Orientation != 0 {
+		return tag.ValueNameFor(tag.IFD0, tag.TagOrientation, uint32(ex.IFD0.Orientation))
 	}
-	return tag.ValueNameFor(tag.IFD0, tag.TagOrientation, uint32(ex.IFD0.Orientation))
+	if !isHEICExtension(ext) {
+		if orient := extractTIFFOrientation(f); orient != 0 {
+			return tag.ValueNameFor(tag.IFD0, tag.TagOrientation, uint32(orient))
+		}
+	}
+	return ""
 }

backend/internal/imagemeta/tiff_preview.go

@@ -9,15 +9,23 @@ import (
 )
 
 const (
+	tiffTagStripOffsets       = 0x0111
+	tiffTagOrientation        = 0x0112
+	tiffTagStripByteCounts    = 0x0117
 	tiffTagSubIFDs            = 0x014a
 	tiffTagJpgFromRaw         = 0x002e
 	tiffTagJPEGInterchange    = 0x0201
 	tiffTagJPEGInterchangeLen = 0x0202
 	tiffIFDScanLimit          = 4 * 1024 * 1024
+	tiffMagicStandard         = 42
+	tiffMagicPanasonicRW2     = 0x0055
+	tiffMagicOlympusORF1      = 0x4f52
+	tiffMagicOlympusORF2      = 0x5352
 	tiffTypeByte              = 1
 	tiffTypeASCII             = 2
 	tiffTypeShort             = 3
 	tiffTypeLong              = 4
+	tiffTypeIFD               = 13
 	tiffTypeUndefined         = 7
 	maxTIFFIFDsVisited        = 128
 	maxTIFFIFDQueueLen        = 128
@@ -96,6 +104,7 @@ func collectTIFFPreviewCandidates(f *os.File) ([]previewCandidate, error) {
 	for _, ifd := range ifds {
 		out = appendPreviewCandidates(out, jpgFromRawCandidates(ifd))
 		out = appendPreviewCandidates(out, jpegInterchangeCandidates(ifd))
+		out = appendPreviewCandidates(out, stripPreviewCandidates(ifd, order))
 		if len(out) >= maxTIFFPreviewCandidates {
 			break
 		}
@@ -103,6 +112,42 @@ func collectTIFFPreviewCandidates(f *os.File) ([]previewCandidate, error) {
 	return out, nil
 }
 
+// extractTIFFOrientation reads standard TIFF IFD0 Orientation (0x0112) as a fallback
+// when full EXIF decoding fails.
+func extractTIFFOrientation(f *os.File) uint16 {
+	info, err := f.Stat()
+	if err != nil {
+		return 0
+	}
+	scanSize := info.Size()
+	if scanSize > tiffIFDScanLimit {
+		scanSize = tiffIFDScanLimit
+	}
+	if scanSize < 8 {
+		return 0
+	}
+	header := make([]byte, scanSize)
+	n, err := f.ReadAt(header, 0)
+	if err != nil && err != io.EOF {
+		return 0
+	}
+	header = header[:n]
+
+	order, ifd0, ok := tiffHeaderIFD0(header)
+	if !ok || ifd0 == 0 {
+		return 0
+	}
+	ifd, _, _, err := parseTIFFIFD(header, order, ifd0)
+	if err != nil {
+		return 0
+	}
+	tag, ok := ifd.tags[tiffTagOrientation]
+	if !ok || tag.count == 0 {
+		return 0
+	}
+	return tiffTagFirstUint16(tag, order)
+}
+
 func appendPreviewCandidates(dst, src []previewCandidate) []previewCandidate {
 	remaining := maxTIFFPreviewCandidates - len(dst)
 	if remaining <= 0 {
@@ -143,6 +188,48 @@ func jpegInterchangeCandidates(ifd tiffIFD) []previewCandidate {
 	return []previewCandidate{{offset: offset, length: length}}
 }
 
+func stripPreviewCandidates(ifd tiffIFD, order binary.ByteOrder) []previewCandidate {
+	offTag, okOff := ifd.tags[tiffTagStripOffsets]
+	lenTag, okLen := ifd.tags[tiffTagStripByteCounts]
+	if !okOff || !okLen || offTag.count != 1 || lenTag.count != 1 {
+		return nil
+	}
+	offset := tiffTagScalarUint32(offTag, order)
+	length := tiffTagScalarUint32(lenTag, order)
+	if offset == 0 || length <= 4 || length > maxPreviewReadSize {
+		return nil
+	}
+	return []previewCandidate{{offset: offset, length: length}}
+}
+
+func tiffTagScalarUint32(t tiffTag, order binary.ByteOrder) uint32 {
+	switch t.typ {
+	case tiffTypeLong, tiffTypeIFD:
+		return t.valueOffset
+	case tiffTypeShort:
+		return uint32(tiffTagFirstUint16(t, order))
+	default:
+		return 0
+	}
+}
+
+func tiffTagFirstUint16(t tiffTag, order binary.ByteOrder) uint16 {
+	switch t.typ {
+	case tiffTypeShort:
+		if order == binary.BigEndian {
+			return uint16(t.valueOffset >> 16)
+		}
+		return uint16(t.valueOffset & 0xffff)
+	case tiffTypeLong:
+		if t.valueOffset > 0xffff {
+			return 0
+		}
+		return uint16(t.valueOffset)
+	default:
+		return 0
+	}
+}
+
 func tiffHeaderIFD0(data []byte) (binary.ByteOrder, uint32, bool) {
 	if len(data) < 8 {
 		return nil, 0, false
@@ -156,7 +243,9 @@ func tiffHeaderIFD0(data []byte) (binary.ByteOrder, uint32, bool) {
 	default:
 		return nil, 0, false
 	}
-	if order.Uint16(data[2:4]) != 42 {
+	switch order.Uint16(data[2:4]) {
+	case tiffMagicStandard, tiffMagicPanasonicRW2, tiffMagicOlympusORF1, tiffMagicOlympusORF2:
+	default:
 		return nil, 0, false
 	}
 	return order, order.Uint32(data[4:8]), true
@@ -205,19 +294,23 @@ func tiffTagUint32s(data []byte, order binary.ByteOrder, typ uint16, count uint3
 	if count > maxTIFFSubIFDsPerEntry {
 		count = maxTIFFSubIFDsPerEntry
 	}
+	elemSize := tiffTagByteSize(typ)
+	if elemSize <= 0 {
+		return nil
+	}
 	var raw []byte
 	switch {
 	case typ == tiffTypeLong && count == 1:
 		var b [4]byte
 		order.PutUint32(b[:], valueOffset)
 		raw = b[:]
-	case tiffTagByteSize(typ)*int(count) <= 4:
+	case elemSize*int(count) <= 4:
 		var b [4]byte
 		order.PutUint32(b[:], valueOffset)
-		raw = b[:count*uint32(tiffTagByteSize(typ))]
+		raw = b[:count*uint32(elemSize)]
 	default:
 		off := int(valueOffset)
-		n := int(count) * tiffTagByteSize(typ)
+		n := int(count) * elemSize
 		if off < 0 || off+n > len(data) {
 			return nil
 		}
@@ -225,11 +318,18 @@ func tiffTagUint32s(data []byte, order binary.ByteOrder, typ uint16, count uint3
 	}
 	out := make([]uint32, 0, count)
 	for i := 0; i < int(count); i++ {
-		pos := i * 4
-		if pos+4 > len(raw) {
+		pos := i * elemSize
+		if pos+elemSize > len(raw) {
 			break
 		}
-		out = append(out, order.Uint32(raw[pos:pos+4]))
+		switch typ {
+		case tiffTypeShort:
+			out = append(out, uint32(order.Uint16(raw[pos:pos+2])))
+		case tiffTypeLong, tiffTypeIFD:
+			out = append(out, order.Uint32(raw[pos:pos+4]))
+		default:
+			return nil
+		}
 	}
 	return out
 }
@@ -240,9 +340,9 @@ func tiffTagByteSize(typ uint16) int {
 		return 1
 	case tiffTypeShort:
 		return 2
-	case tiffTypeLong:
+	case tiffTypeLong, tiffTypeIFD:
 		return 4
 	default:
-		return 1
+		return 0
 	}
 }

backend/internal/imagemeta/tiff_preview_test.go

@@ -62,7 +62,7 @@ func TestCollectTIFFPreviewCandidatesIgnoresMalformedOffsets(t *testing.T) {
 func TestCollectTIFFPreviewCandidatesIgnoresMalformedSubIFDOffset(t *testing.T) {
 	data := buildSyntheticTIFF(tiffFixture{
 		thumbnailJPEG: smallJPEG,
-		subIFDJPEG:  largeJPEG,
+		subIFDJPEG:    largeJPEG,
 		badJpgFromRaw: true,
 	})
 	f := openBytesFile(t, data)
@@ -93,9 +93,163 @@ func TestCollectTIFFPreviewCandidatesBoundsIFDTraversal(t *testing.T) {
 	}
 }
 
+func TestTiffTagUint32sSupportsIFDType(t *testing.T) {
+	data := buildSyntheticTIFF(tiffFixture{
+		thumbnailJPEG: smallJPEG,
+		subIFDJPEG:    largeJPEG,
+		subIFDType:    tiffTypeIFD,
+	})
+	f := openBytesFile(t, data)
+
+	candidates, err := collectTIFFPreviewCandidates(f)
+	if err != nil {
+		t.Fatal(err)
+	}
+	preview, err := readLargestJPEGPreview(f, candidates)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(preview) != len(largeJPEG) {
+		t.Fatalf("preview size = %d, want %d (SubIFD type IFD)", len(preview), len(largeJPEG))
+	}
+}
+
+func TestExtractEmbeddedPreviewFallbackWhenDecodeFails(t *testing.T) {
+	// Synthetic ARW where SubIFD offset is placed after IFD2, and a SubIFD tag
+	// points past EOF so extimagemeta.Decode fails with EOF, while IFD2 holds a
+	// valid JPEGInterchangeFormat preview.
+	order := binary.LittleEndian
+	buf := make([]byte, 32*1024)
+	copy(buf[0:2], []byte("II"))
+	order.PutUint16(buf[2:4], tiffMagicStandard)
+	ifd0Off := uint32(8)
+	order.PutUint32(buf[4:8], ifd0Off)
+
+	thumbOff := uint32(4096)
+	copy(buf[thumbOff:], smallJPEG)
+	largeOff := uint32(8192)
+	copy(buf[largeOff:], largeJPEG)
+
+	ifd1Off := uint32(256)
+	ifd2Off := uint32(512)
+	subIFDOff := uint32(768)
+
+	writeIFD := func(offset uint32, entries []tiffEntry, next uint32) {
+		off := int(offset)
+		order.PutUint16(buf[off:off+2], uint16(len(entries)))
+		entryBase := off + 2
+		for i, entry := range entries {
+			pos := entryBase + i*12
+			order.PutUint16(buf[pos:pos+2], entry.tag)
+			order.PutUint16(buf[pos+2:pos+4], entry.typ)
+			order.PutUint32(buf[pos+4:pos+8], entry.count)
+			order.PutUint32(buf[pos+8:pos+12], entry.value)
+		}
+		order.PutUint32(buf[entryBase+len(entries)*12:entryBase+len(entries)*12+4], next)
+	}
+
+	writeIFD(ifd0Off, []tiffEntry{
+		{tag: tiffTagOrientation, typ: tiffTypeShort, count: 1, value: 6},
+		{tag: tiffTagSubIFDs, typ: tiffTypeLong, count: 1, value: subIFDOff},
+		{tag: tiffTagJPEGInterchange, typ: tiffTypeLong, count: 1, value: thumbOff},
+		{tag: tiffTagJPEGInterchangeLen, typ: tiffTypeLong, count: 1, value: uint32(len(smallJPEG))},
+	}, ifd1Off)
+
+	writeIFD(ifd1Off, []tiffEntry{
+		{tag: tiffTagJPEGInterchange, typ: tiffTypeLong, count: 1, value: thumbOff},
+		{tag: tiffTagJPEGInterchangeLen, typ: tiffTypeLong, count: 1, value: uint32(len(smallJPEG))},
+	}, ifd2Off)
+
+	writeIFD(ifd2Off, []tiffEntry{
+		{tag: tiffTagJPEGInterchange, typ: tiffTypeLong, count: 1, value: largeOff},
+		{tag: tiffTagJPEGInterchangeLen, typ: tiffTypeLong, count: 1, value: uint32(len(largeJPEG))},
+	}, 0)
+
+	// SubIFD has a StripOffsets tag with count=2 pointing beyond file end so Decode fails with EOF.
+	writeIFD(subIFDOff, []tiffEntry{
+		{tag: tiffTagStripOffsets, typ: tiffTypeLong, count: 2, value: uint32(len(buf) + 4096)},
+	}, 0)
+
+	path := filepath.Join(t.TempDir(), "sample.arw")
+	if err := os.WriteFile(path, buf[:int(largeOff)+len(largeJPEG)], 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	preview, err := ExtractEmbeddedPreview(t.Context(), path)
+	if err != nil {
+		t.Fatalf("ExtractEmbeddedPreview() err = %v", err)
+	}
+	if len(preview) != len(largeJPEG) {
+		t.Fatalf("ExtractEmbeddedPreview() len = %d, want %d", len(preview), len(largeJPEG))
+	}
+	if got := GetOrientation(t.Context(), path); got != "Rotate 90 CW" {
+		t.Fatalf("GetOrientation() = %q, want %q", got, "Rotate 90 CW")
+	}
+}
+
+func TestExtractEmbeddedPreviewSupportsRW2AndStripPreview(t *testing.T) {
+	order := binary.LittleEndian
+	buf := make([]byte, 16*1024)
+	copy(buf[0:2], []byte("II"))
+	order.PutUint16(buf[2:4], tiffMagicPanasonicRW2)
+	ifd0Off := uint32(8)
+	order.PutUint32(buf[4:8], ifd0Off)
+
+	largeOff := uint32(4096)
+	copy(buf[largeOff:], largeJPEG)
+
+	entries := []tiffEntry{
+		{tag: tiffTagStripOffsets, typ: tiffTypeLong, count: 1, value: largeOff},
+		{tag: tiffTagStripByteCounts, typ: tiffTypeLong, count: 1, value: uint32(len(largeJPEG))},
+	}
+	order.PutUint16(buf[ifd0Off:ifd0Off+2], uint16(len(entries)))
+	for i, entry := range entries {
+		pos := int(ifd0Off) + 2 + i*12
+		order.PutUint16(buf[pos:pos+2], entry.tag)
+		order.PutUint16(buf[pos+2:pos+4], entry.typ)
+		order.PutUint32(buf[pos+4:pos+8], entry.count)
+		order.PutUint32(buf[pos+8:pos+12], entry.value)
+	}
+
+	path := filepath.Join(t.TempDir(), "sample.rw2")
+	if err := os.WriteFile(path, buf[:int(largeOff)+len(largeJPEG)], 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	preview, err := ExtractEmbeddedPreview(t.Context(), path)
+	if err != nil {
+		t.Fatalf("ExtractEmbeddedPreview() err = %v", err)
+	}
+	if len(preview) != len(largeJPEG) {
+		t.Fatalf("ExtractEmbeddedPreview() len = %d, want %d", len(preview), len(largeJPEG))
+	}
+}
+
+func TestExtractEmbeddedPreviewDSC02672(t *testing.T) {
+	path := "/Users/steffag/Downloads/DSC02672-first-4MB.ARW"
+	if _, err := os.Stat(path); err != nil {
+		t.Skip(path)
+	}
+
+	got, err := ExtractEmbeddedPreview(t.Context(), path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !IsJPEG(got) {
+		t.Fatalf("expected JPEG preview, got %d bytes", len(got))
+	}
+	if len(got) != 2954147 {
+		t.Fatalf("preview size = %d, want 2954147", len(got))
+	}
+	if orient := GetOrientation(t.Context(), path); orient != "Horizontal (normal)" {
+		t.Fatalf("GetOrientation() = %q, want Horizontal (normal)", orient)
+	}
+}
+
 type tiffFixture struct {
 	thumbnailJPEG   []byte
 	subIFDJPEG      []byte
+	subIFDType      uint16
 	badJpgFromRaw   bool
 	badJPEGInterchg bool
 }
@@ -116,6 +270,9 @@ func openBytesFile(t *testing.T, data []byte) *os.File {
 
 func buildSyntheticTIFF(fix tiffFixture) []byte {
 	order := binary.LittleEndian
+	if fix.subIFDType == 0 {
+		fix.subIFDType = tiffTypeLong
+	}
 	buf := make([]byte, 64*1024)
 
 	thumbOff := uint32(4096)
@@ -149,7 +306,7 @@ func buildSyntheticTIFF(fix tiffFixture) []byte {
 	writeIFD(ifd1Off, ifd1Entries, 0)
 
 	ifd0Entries := []tiffEntry{
-		{tag: tiffTagSubIFDs, typ: tiffTypeLong, count: 1, value: ifd1Off},
+		{tag: tiffTagSubIFDs, typ: fix.subIFDType, count: 1, value: ifd1Off},
 		{tag: tiffTagJPEGInterchange, typ: tiffTypeLong, count: 1, value: thumbOff},
 		{tag: tiffTagJPEGInterchangeLen, typ: tiffTypeLong, count: 1, value: uint32(len(fix.thumbnailJPEG))},
 	}
@@ -170,8 +327,8 @@ func buildSyntheticTIFF(fix tiffFixture) []byte {
 }
 
 type tiffEntry struct {
-	tag, typ       uint16
-	count, value   uint32
+	tag, typ     uint16
+	count, value uint32
 }
 
 func buildChainedTIFF(chainLen int) []byte {

backend/internal/preview/image.go

@@ -76,6 +76,18 @@ func (x Format) toImaging() imaging.Format {
 	}
 }
 
+// encodable reports whether imaging can encode this format.
+// imaging only encodes JPEG, PNG, GIF, TIFF and BMP; webp and the netpbm
+// formats are decode-only, so previews for them must be written as JPEG.
+func (x Format) encodable() bool {
+	switch x {
+	case FormatJpeg, FormatPng, FormatGif, FormatTiff, FormatBmp:
+		return true
+	default:
+		return false
+	}
+}
+
 /*
 ENUM(
 high
@@ -203,7 +215,9 @@ func (s *Service) resizeWithSize(in io.Reader, out io.Writer, fileSize int64, op
 	var wrappedReader = in
 	var err error
 
-	if opts.Format == FormatHeic {
+	// HEIC has no encoder and webp/netpbm are decode-only in imaging; fall back
+	// to JPEG so preview generation does not fail with ErrUnsupportedFormat.
+	if !opts.Format.encodable() {
 		opts.Format = FormatJpeg
 	}
 	// Ensure JPEG quality is set based on quality setting

backend/internal/preview/image_test.go

@@ -159,6 +159,14 @@ func TestService_Resize(t *testing.T) {
 			},
 			matcher: sizeMatcher(100, 100),
 		},
+		"resize webp falls back to jpeg": {
+			options: ResizeOptions{Width: 100, Height: 100, ResizeMode: ResizeModeFill, Format: FormatWebp},
+			source: func(t *testing.T) afero.File {
+				t.Helper()
+				return openFile(t, "testdata/gray-sample.webp")
+			},
+			matcher: formatMatcher(FormatJpeg),
+		},
 		"resize with high quality": {
 			options: ResizeOptions{Width: 100, Height: 100, ResizeMode: ResizeModeFill, Quality: QualityHigh},
 			source: func(t *testing.T) afero.File {

backend/internal/preview/preview.go

@@ -272,15 +272,6 @@ func (s *Service) generateRawPreview(ctx context.Context, file iteminfo.Extended
 	case previewTypeImage:
 		ext := strings.ToLower(filepath.Ext(file.Name))
 		if iteminfo.IsRawImage(ext) {
-			if s.ffmpegService != nil {
-				previewBytes, err := s.convertImageWithFFmpeg(ctx, file.RealPath, previewSize)
-				if err == nil && len(previewBytes) >= minPreviewSize {
-					return previewBytes, nil
-				}
-				if ctx.Err() != nil {
-					return nil, ctx.Err()
-				}
-			}
 			return nil, ErrUnsupportedFormat
 		}
 		return s.generateImagePreview(ctx, file, previewSize)

backend/internal/state/access.go

@@ -111,9 +111,16 @@ func RemoveRuleByPathKey(sourcePath, pathKey string) {
 }
 
 func AddApiToken(tokenString string, userID uint64) error {
+	if accessDb == nil {
+		return fmt.Errorf("access storage not available")
+	}
 	return accessDb.AddApiToken(tokenString, userID)
 }
 
+// BearerTokenGrace re-exports access.BearerTokenGrace for callers that should
+// not depend on the access package directly.
+const BearerTokenGrace = access.BearerTokenGrace
+
 // RegisterSessionToken maps a session bearer JWT to its owner user id.
 func RegisterSessionToken(tokenString string, userID uint64) error {
 	if accessDb == nil {

backend/internal/state/auth_signing_key.go

@@ -35,19 +35,17 @@ func InitAuthSigningKey() error {
 
 // resolveAuthSigningKey returns the key to use without mutating config until the
 // key is known to be valid. Only a missing persisted row counts as absence; a
-// malformed row or an unreadable legacy database is a hard error so an existing
-// key is never silently replaced (which would invalidate all issued JWTs).
+// malformed row, an unreadable legacy database, or a configured key that differs
+// from the persisted one are hard errors so nodes in the same deployment can
+// never mint and verify with divergent keys.
 func resolveAuthSigningKey(explicitKey string) (string, error) {
 	storedKey, storedErr := loadPersistedAuthSigningKey()
 	switch {
 	case storedErr == nil && storedKey != "":
-		if explicitKey == "" {
+		if explicitKey == "" || explicitKey == storedKey {
 			return storedKey, nil
 		}
-		if explicitKey != storedKey {
-			logger.Warning("auth signing key from config/env differs from value stored in the application database; using config/env for this process")
-		}
-		return explicitKey, nil
+		return "", fmt.Errorf("auth signing key from config/env differs from the persisted database key; remove the configured key to use the stored key")
 	case errors.Is(storedErr, errAuthSigningKeyAbsent):
 		// No persisted key yet: persist the configured key or fall back below.
 	default:

backend/internal/state/auth_signing_key_test.go

@@ -56,6 +56,39 @@ func TestInitAuthSigningKeyPersistsAndReloads(t *testing.T) {
 	}
 }
 
+func TestInitAuthSigningKeyRejectsMismatchedConfiguredKey(t *testing.T) {
+	newAuthSigningKeyTestStore(t)
+	preserveAuthKey(t)
+
+	settings.Config.Auth.Key = ""
+	if err := InitAuthSigningKey(); err != nil {
+		t.Fatal(err)
+	}
+	stored := settings.Config.Auth.Key
+	if stored == "" {
+		t.Fatal("expected generated key")
+	}
+
+	// A config/env key that disagrees with the persisted key must abort startup
+	// rather than silently minting tokens other nodes cannot verify.
+	settings.Config.Auth.Key = "different-config-key"
+	if err := InitAuthSigningKey(); err == nil {
+		t.Fatal("expected error for config/env key mismatch with persisted key")
+	}
+	if settings.Config.Auth.Key != "different-config-key" {
+		t.Fatalf("config key was mutated on failure: %q", settings.Config.Auth.Key)
+	}
+
+	// The persisted key remains authoritative: with no explicit key it loads.
+	settings.Config.Auth.Key = ""
+	if err := InitAuthSigningKey(); err != nil {
+		t.Fatal(err)
+	}
+	if settings.Config.Auth.Key != stored {
+		t.Fatalf("expected persisted key %q after reload, got %q", stored, settings.Config.Auth.Key)
+	}
+}
+
 func TestInitAuthSigningKeyRejectsMalformedPersistedRow(t *testing.T) {
 	store := newAuthSigningKeyTestStore(t)
 	preserveAuthKey(t)

backend/internal/state/bootstrap_admin_password.go

@@ -0,0 +1,64 @@
+package state
+
+import (
+	"crypto/rand"
+	"fmt"
+	"math/big"
+
+	"github.com/gtsteffaniak/filebrowser/backend/pkg/settings"
+	"github.com/gtsteffaniak/go-logger/logger"
+)
+
+// bootstrapDefaultAdminPassword returns the plaintext password for initial admin creation.
+// When config adminPassword is blank or "admin", a random speakable password is generated and logged once.
+func bootstrapDefaultAdminPassword(username string) (plaintext string, generated bool, err error) {
+	cfg := settings.Config.Auth.AdminPassword
+	if cfg != "" && cfg != "admin" {
+		return cfg, false, nil
+	}
+
+	plaintext, err = generateSpeakableBootstrapPassword()
+	if err != nil {
+		return "", false, fmt.Errorf("generate bootstrap admin password: %w", err)
+	}
+	logger.Infof(
+		"Generated initial admin password for user %q (set auth.adminPassword in config to override on future resets): %s",
+		username,
+		plaintext,
+	)
+	return plaintext, true, nil
+}
+
+func generateSpeakableBootstrapPassword() (string, error) {
+	if len(bootstrapWords) == 0 {
+		return "", fmt.Errorf("bootstrap word list is empty")
+	}
+	wordIdx, err := rand.Int(rand.Reader, big.NewInt(int64(len(bootstrapWords))))
+	if err != nil {
+		return "", err
+	}
+	word := bootstrapWords[wordIdx.Int64()]
+
+	primary, err := randomSpeakableCode(bootstrapSpeakablePrimaryCodeLen)
+	if err != nil {
+		return "", err
+	}
+	secondary, err := randomSpeakableCode(bootstrapSpeakableSecondaryCodeLen)
+	if err != nil {
+		return "", err
+	}
+	return fmt.Sprintf("%s-%s-%s", word, string(primary), string(secondary)), nil
+}
+
+func randomSpeakableCode(n int) ([]byte, error) {
+	codeRunes := make([]byte, n)
+	charsetLen := big.NewInt(int64(len(bootstrapSpeakableCharset)))
+	for i := range codeRunes {
+		idx, err := rand.Int(rand.Reader, charsetLen)
+		if err != nil {
+			return nil, err
+		}
+		codeRunes[i] = bootstrapSpeakableCharset[idx.Int64()]
+	}
+	return codeRunes, nil
+}

backend/internal/state/bootstrap_admin_password_test.go

@@ -0,0 +1,79 @@
+package state
+
+import (
+	"regexp"
+	"strings"
+	"testing"
+
+	"github.com/gtsteffaniak/filebrowser/backend/pkg/settings"
+)
+
+func TestBootstrapWordsCount(t *testing.T) {
+	if len(bootstrapWords) != 100 {
+		t.Fatalf("bootstrapWords len = %d, want 100", len(bootstrapWords))
+	}
+}
+
+func TestBootstrapDefaultAdminPasswordUsesConfigWhenSet(t *testing.T) {
+	orig := settings.Config.Auth.AdminPassword
+	defer func() { settings.Config.Auth.AdminPassword = orig }()
+
+	settings.Config.Auth.AdminPassword = "from-config"
+	plain, generated, err := bootstrapDefaultAdminPassword("admin")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if generated {
+		t.Fatal("expected generated=false when config password is set")
+	}
+	if plain != "from-config" {
+		t.Fatalf("password = %q, want from-config", plain)
+	}
+}
+
+var speakableBootstrapPasswordPattern = regexp.MustCompile(`^[a-z]+-[abcdefghjkmnpqrstuvwxyz23456789]{5}-[abcdefghjkmnpqrstuvwxyz23456789]{2}$`)
+
+func TestBootstrapDefaultAdminPasswordGeneratesWhenDefault(t *testing.T) {
+	orig := settings.Config.Auth.AdminPassword
+	defer func() { settings.Config.Auth.AdminPassword = orig }()
+
+	for _, cfg := range []string{"", "admin"} {
+		settings.Config.Auth.AdminPassword = cfg
+		plain, generated, err := bootstrapDefaultAdminPassword("bootstrap-user")
+		if err != nil {
+			t.Fatalf("cfg=%q: %v", cfg, err)
+		}
+		if !generated {
+			t.Fatalf("cfg=%q: expected generated password", cfg)
+		}
+		if plain == "" || plain == "admin" {
+			t.Fatalf("cfg=%q: unexpected password %q", cfg, plain)
+		}
+		if !speakableBootstrapPasswordPattern.MatchString(plain) {
+			t.Fatalf("cfg=%q: password %q does not match speakable pattern", cfg, plain)
+		}
+		word := strings.Split(plain, "-")[0]
+		found := false
+		for _, w := range bootstrapWords {
+			if w == word {
+				found = true
+				break
+			}
+		}
+		if !found {
+			t.Fatalf("cfg=%q: word %q not in bootstrap word list", cfg, word)
+		}
+	}
+}
+
+func TestGenerateSpeakableBootstrapPassword(t *testing.T) {
+	for i := 0; i < 20; i++ {
+		plain, err := generateSpeakableBootstrapPassword()
+		if err != nil {
+			t.Fatal(err)
+		}
+		if !speakableBootstrapPasswordPattern.MatchString(plain) {
+			t.Fatalf("password %q does not match speakable pattern", plain)
+		}
+	}
+}

backend/internal/state/bootstrap_wordlist.go

@@ -0,0 +1,23 @@
+package state
+
+// bootstrapWords is a fixed list of short, common English nouns for one-time bootstrap passwords.
+// Words are chosen to be easy to say, spell, and type (including for non-native English speakers).
+var bootstrapWords = []string{
+	"apple", "ball", "barn", "bean", "bed", "belt", "bike", "bird", "boat", "book",
+	"boot", "bowl", "box", "bus", "cake", "camp", "cart", "cat", "clock", "cloud",
+	"coat", "coin", "corn", "cup", "desk", "dog", "door", "duck", "egg", "farm",
+	"fish", "flag", "food", "foot", "game", "gift", "goat", "gold", "grass", "hand",
+	"hat", "hill", "home", "horse", "house", "ice", "jar", "key", "kid", "lake",
+	"lamp", "land", "leaf", "leg", "light", "line", "lion", "list", "mail", "map",
+	"milk", "moon", "mouse", "nest", "net", "night", "nose", "note", "page", "park",
+	"path", "pen", "pet", "pie", "pig", "pin", "pipe", "plan", "plant", "pot",
+	"rain", "red", "ring", "road", "rock", "room", "rope", "rose", "sand", "sea",
+	"ship", "shoe", "shop", "sky", "snow", "sock", "star", "stone", "sun", "tree",
+}
+
+// bootstrapSpeakableCharset excludes ambiguous characters for read-aloud (no 0/o, 1/i/l).
+const bootstrapSpeakableCharset = "abcdefghjkmnpqrstuvwxyz23456789"
+
+// bootstrapSpeakablePrimaryCodeLen and bootstrapSpeakableSecondaryCodeLen form the code after the word (e.g. word-xxxxx-xx).
+const bootstrapSpeakablePrimaryCodeLen = 5
+const bootstrapSpeakableSecondaryCodeLen = 2

backend/internal/state/hashed_tokens_backfill.go

@@ -2,7 +2,9 @@ package state
 
 import (
 	"fmt"
+	"time"
 
+	"github.com/gtsteffaniak/filebrowser/backend/internal/database/access"
 	"github.com/gtsteffaniak/filebrowser/backend/internal/database/sqldb"
 	"github.com/gtsteffaniak/filebrowser/backend/internal/database/users"
 	"github.com/gtsteffaniak/filebrowser/backend/internal/utils"
@@ -36,42 +38,84 @@ func BackfillHashedTokensFromUserRecords() error {
 }
 
 // BackfillUserTokenHashesOnStore writes hash mappings for a user's stored token strings (migration helper).
+// It scans both Tokens and legacy ApiKeys so pre-2.0.8 tokens issued before the
+// minimal-JWT cutover regain a hashed_tokens row. Strict auth ignores BelongsTo.
 func BackfillUserTokenHashesOnStore(store *sqldb.SQLStore, user *users.User) error {
 	if store == nil || user == nil || user.ID == 0 {
 		return nil
 	}
-	for _, tok := range user.Tokens {
-		raw := tok.Token
-		if raw == "" {
-			raw = tok.Key
-		}
-		if raw == "" {
+	now := time.Now()
+	for _, raw := range CollectStoredRawTokens(user) {
+		expiresAt := access.TokenExpiryUnix(raw)
+		if access.TokenExpiredPastGrace(expiresAt, now) {
+			// The token is dead past the grace window: drop any lingering
+			// mapping (e.g. a row migrated with expires_at=0).
+			if err := store.DeleteHashedToken(utils.HashSHA256(raw)); err != nil {
+				return err
+			}
 			continue
 		}
-		if err := store.SaveHashedToken(utils.HashSHA256(raw), user.ID, false); err != nil {
+		if err := store.SaveHashedToken(utils.HashSHA256(raw), user.ID, false, expiresAt); err != nil {
 			return err
 		}
 	}
 	return nil
 }
 
+// CollectStoredRawTokens returns deduplicated raw JWT strings from Tokens (Token
+// field, falling back to legacy Key) and legacy ApiKeys.
+func CollectStoredRawTokens(user *users.User) []string {
+	seen := make(map[string]struct{})
+	var out []string
+	add := func(raw string) {
+		if raw == "" {
+			return
+		}
+		if _, ok := seen[raw]; ok {
+			return
+		}
+		seen[raw] = struct{}{}
+		out = append(out, raw)
+	}
+	for _, tok := range user.Tokens {
+		add(tok.Token)
+		if tok.Token == "" {
+			add(tok.Key)
+		}
+	}
+	for _, tok := range user.ApiKeys {
+		add(tok.Token)
+		if tok.Token == "" {
+			add(tok.Key)
+		}
+	}
+	return out
+}
+
 // backfillUserTokenHashes maps each stored named API token to its owner. A
 // persistence failure is returned so initialization aborts instead of leaving a
-// mapping that silently stops working after restart.
+// mapping that silently stops working after restart. Legacy ApiKeys are
+// included so pre-2.0.8 tokens without a hashed_tokens row work again.
+// Existing rows are reconciled: tokens dead past the grace window have their
+// mapping removed, and live tokens re-register so rows migrated before expiry
+// tracking (expires_at=0) pick up the token's real expiry.
 func backfillUserTokenHashes(user *users.User) (int, error) {
 	if accessDb == nil || user == nil || user.ID == 0 {
 		return 0, nil
 	}
 	added := 0
-	for _, tok := range user.Tokens {
-		raw := tok.Token
-		if raw == "" {
-			raw = tok.Key
-		}
-		if raw == "" {
+	now := time.Now()
+	for _, raw := range CollectStoredRawTokens(user) {
+		expiresAt := access.TokenExpiryUnix(raw)
+		if access.TokenExpiredPastGrace(expiresAt, now) {
+			if err := RemoveApiToken(raw); err != nil {
+				return added, err
+			}
 			continue
 		}
-		if _, ok := accessDb.GetUserIDFromToken(raw); ok {
+		if info, ok := accessDb.GetHashedTokenInfo(raw); ok && (expiresAt == 0 || info.ExpiresAt != 0) {
+			// Already registered and either the token carries no expiry or the
+			// stored expiry is already populated.
 			continue
 		}
 		if err := AddApiToken(raw, user.ID); err != nil {

backend/internal/state/hashed_tokens_backfill_test.go

@@ -4,9 +4,12 @@ import (
 	"errors"
 	"path/filepath"
 	"testing"
+	"time"
 
+	"github.com/golang-jwt/jwt/v4"
 	"github.com/gtsteffaniak/filebrowser/backend/internal/database/access"
 	"github.com/gtsteffaniak/filebrowser/backend/internal/database/users"
+	"github.com/gtsteffaniak/filebrowser/backend/internal/utils"
 	"github.com/gtsteffaniak/filebrowser/backend/pkg/settings"
 )
 
@@ -16,7 +19,7 @@ type failingTokenPersister struct {
 	access.SQLPersister
 }
 
-func (failingTokenPersister) SaveHashedToken(string, uint64, bool) error {
+func (failingTokenPersister) SaveHashedToken(string, uint64, bool, int64) error {
 	return errors.New("simulated hashed token persistence failure")
 }
 
@@ -47,3 +50,144 @@ func TestBackfillHashedTokensPropagatesPersistenceFailure(t *testing.T) {
 		t.Fatal("expected backfill to propagate hashed token persistence failure")
 	}
 }
+
+// Legacy ApiKeys entries (pre-2.0.8 token format) must also gain a
+// hashed_tokens row so strict server-side auth accepts them.
+func TestBackfillHashedTokensCoversLegacyApiKeys(t *testing.T) {
+	t.Setenv("FILEBROWSER_ONLYOFFICE_SECRET", "")
+	settings.Initialize("../../../_docker/src/noauth/backend/config.yaml")
+	settings.Env.IsPlaywright = true
+
+	dbPath := filepath.Join(t.TempDir(), "filebrowser.sqlite")
+	if _, err := Initialize(dbPath); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = Close() })
+
+	const username = "backfill-legacy-user"
+	user := &users.User{FrontendUser: users.FrontendUser{Username: username}}
+	if err := CreateUser(user, "password"); err != nil {
+		t.Fatal(err)
+	}
+	stored, err := GetUserByUsername(username)
+	if err != nil {
+		t.Fatal(err)
+	}
+	legacy := stored
+	legacy.ApiKeys = map[string]users.AuthToken{
+		"legacy-key": {Name: "legacy-key", Key: "raw-legacy-jwt", Token: "raw-legacy-jwt"},
+	}
+
+	added, err := backfillUserTokenHashes(&legacy)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if added != 1 {
+		t.Fatalf("expected 1 backfilled mapping, got %d", added)
+	}
+	if _, _, ok := HashedTokenOwner("raw-legacy-jwt"); !ok {
+		t.Fatal("legacy ApiKeys token must resolve an owner after backfill")
+	}
+
+	// Backfill is idempotent: a second run adds nothing.
+	added, err = backfillUserTokenHashes(&legacy)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if added != 0 {
+		t.Fatalf("expected idempotent backfill, added %d", added)
+	}
+}
+
+// Rows migrated before expiry tracking carry expires_at=0 ("never expires").
+// Backfill must reconcile them: live tokens get their real expiry recorded and
+// tokens dead past the grace window have their mapping removed entirely.
+func TestBackfillReconcilesLegacyTokenExpiry(t *testing.T) {
+	t.Setenv("FILEBROWSER_ONLYOFFICE_SECRET", "")
+	settings.Initialize("../../../_docker/src/noauth/backend/config.yaml")
+	settings.Env.IsPlaywright = true
+
+	dbPath := filepath.Join(t.TempDir(), "filebrowser.sqlite")
+	if _, err := Initialize(dbPath); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = Close() })
+
+	const username = "backfill-expiry-user"
+	user := &users.User{FrontendUser: users.FrontendUser{Username: username}}
+	if err := CreateUser(user, "password"); err != nil {
+		t.Fatal(err)
+	}
+	stored, err := GetUserByUsername(username)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	mint := func(exp time.Time) string {
+		t.Helper()
+		tokenString, signErr := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims{
+			"exp": exp.Unix(),
+		}).SignedString([]byte("test-key"))
+		if signErr != nil {
+			t.Fatal(signErr)
+		}
+		return tokenString
+	}
+	liveExp := time.Now().Add(time.Hour).Unix()
+	liveRaw := mint(time.Unix(liveExp, 0))
+	deadRaw := mint(time.Now().Add(-BearerTokenGrace - time.Minute))
+
+	// Simulate mappings migrated before expiry tracking (expires_at=0).
+	for _, raw := range []string{liveRaw, deadRaw} {
+		hash := utils.HashSHA256(raw)
+		accessDb.HashedTokens[hash] = access.HashedTokenInfo{UserID: stored.ID}
+		if saveErr := sqlDb.SaveHashedToken(hash, stored.ID, false, 0); saveErr != nil {
+			t.Fatal(saveErr)
+		}
+	}
+
+	legacy := stored
+	legacy.Tokens = map[string]users.AuthToken{
+		"live": {Name: "live", Token: liveRaw},
+		"dead": {Name: "dead", Token: deadRaw},
+	}
+
+	added, err := backfillUserTokenHashes(&legacy)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if added != 1 {
+		t.Fatalf("expected 1 reconciled mapping, got %d", added)
+	}
+
+	// Live token: expiry refreshed from the JWT claim, in memory and in SQL.
+	info, ok := accessDb.GetHashedTokenInfo(liveRaw)
+	if !ok || info.ExpiresAt != liveExp {
+		t.Fatalf("live token info = %+v ok=%v, want expires_at=%d", info, ok, liveExp)
+	}
+	records, err := sqlDb.GetAllHashedTokens()
+	if err != nil {
+		t.Fatal(err)
+	}
+	rec, ok := records[utils.HashSHA256(liveRaw)]
+	if !ok || rec.ExpiresAt != liveExp {
+		t.Fatalf("persisted live token = %+v ok=%v, want expires_at=%d", rec, ok, liveExp)
+	}
+
+	// Dead token: mapping removed from memory and SQL.
+	if _, _, ok := HashedTokenOwner(deadRaw); ok {
+		t.Fatal("expired-past-grace token mapping must be removed")
+	}
+	if _, ok := records[utils.HashSHA256(deadRaw)]; ok {
+		t.Fatal("expired-past-grace token row must be deleted from sql")
+	}
+
+	// Idempotent: a second run changes nothing.
+	added, err = backfillUserTokenHashes(&legacy)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if added != 0 {
+		t.Fatalf("expected idempotent backfill, added %d", added)
+	}
+}

backend/internal/state/quick_setup.go

@@ -32,10 +32,6 @@ func QuickSetup() error {
 		user.Username = "admin"
 	}
 
-	if settings.Config.Auth.AdminPassword == "" {
-		settings.Config.Auth.AdminPassword = "admin"
-	}
-
 	user.Permissions.Admin = true
 	user.LoginMethod = users.LoginMethodPassword
 
@@ -59,7 +55,15 @@ func QuickSetup() error {
 
 	logger.Debugf("Creating user as admin: %v", user.Username)
 
-	hashedPassword, hashErr := utils.HashPwd(settings.Config.Auth.AdminPassword)
+	plainPassword, generated, err := bootstrapDefaultAdminPassword(user.Username)
+	if err != nil {
+		return err
+	}
+	if generated {
+		user.RequirePasswordChange = true
+	}
+
+	hashedPassword, hashErr := utils.HashPwd(plainPassword)
 	if hashErr != nil {
 		return fmt.Errorf("failed to hash admin password: %w", hashErr)
 	}

backend/internal/state/shares.go

@@ -6,9 +6,9 @@ import (
 	"strings"
 	"time"
 
-	"github.com/gtsteffaniak/filebrowser/backend/internal/utils"
 	"github.com/gtsteffaniak/filebrowser/backend/internal/database/share"
 	"github.com/gtsteffaniak/filebrowser/backend/internal/database/users"
+	"github.com/gtsteffaniak/filebrowser/backend/internal/utils"
 	"github.com/gtsteffaniak/go-logger/logger"
 )
 
@@ -312,23 +312,20 @@ func UpdateSharesForMovedResource(oldSource, oldPath, newSource, newPath string)
 	sharesMux.Lock()
 	defer sharesMux.Unlock()
 
-	oldPath = utils.AddTrailingSlashIfNotExists(oldPath)
-	newPath = utils.AddTrailingSlashIfNotExists(newPath)
-
 	var updatedHashes []string
 	for _, l := range sharesByHash {
 		if l == nil || l.SourcePath != oldSource {
 			continue
 		}
-		norm := utils.AddTrailingSlashIfNotExists(l.Path)
-		if !strings.Contains(norm, oldPath) {
+		rewrittenPath, matches := utils.RewritePathPrefix(l.Path, oldPath, newPath)
+		if !matches {
 			continue
 		}
 
 		removeShareFromPathIndexLocked(l.SourcePath, l.Path, l.Hash)
 
 		l.SourcePath = newSource
-		l.Path = newPath
+		l.Path = rewrittenPath
 
 		if err := sqlDb.SaveShare(l); err != nil {
 			logger.Error("failed to save updated share after resource move", "hash", l.Hash, "error", err)

backend/internal/state/shares_move_test.go

@@ -0,0 +1,140 @@
+package state
+
+import (
+	"path/filepath"
+	"testing"
+
+	"github.com/gtsteffaniak/filebrowser/backend/internal/database/share"
+	"github.com/gtsteffaniak/filebrowser/backend/internal/database/sqldb"
+	"github.com/gtsteffaniak/filebrowser/backend/internal/utils"
+)
+
+// newShareMoveTestStore opens an isolated SQLite store, points the package-level
+// sqlDb at it, and resets the share caches so shares can be seeded via CreateShare.
+func newShareMoveTestStore(t *testing.T) *sqldb.SQLStore {
+	t.Helper()
+	dbPath := filepath.Join(t.TempDir(), "test.sqlite")
+	store, _, err := sqldb.NewSQLStoreWithOptions(dbPath, sqldb.NewSQLStoreOpts{SkipQuickSetup: true})
+	if err != nil {
+		t.Fatal(err)
+	}
+	prevDB := sqlDb
+	prevByHash := sharesByHash
+	prevByPath := sharesByPath
+	sqlDb = store
+	sharesByHash = make(map[string]*share.Share)
+	sharesByPath = make(map[string][]string)
+	t.Cleanup(func() {
+		_ = store.Close()
+		sqlDb = prevDB
+		sharesByHash = prevByHash
+		sharesByPath = prevByPath
+	})
+	return store
+}
+
+func TestRewritePathPrefix(t *testing.T) {
+	cases := []struct {
+		name      string
+		sharePath string
+		want      string
+		matches   bool
+	}{
+		{"file under moved dir", "/photos/2024/one.jpg", "/archive/photos/2024/one.jpg", true},
+		{"directory keeps trailing slash", "/photos/2024/", "/archive/photos/2024/", true},
+		{"exact dir match", "/photos/", "/archive/photos/", true},
+		{"exact file-form match", "/photos", "/archive/photos", true},
+		{"substring sibling does not match", "/backup/photos/", "/backup/photos/", false},
+	}
+	for _, tc := range cases {
+		got, matches := utils.RewritePathPrefix(tc.sharePath, "/photos/", "/archive/photos/")
+		if matches != tc.matches || got != tc.want {
+			t.Errorf("%s: RewritePathPrefix(%q) = (%q, %v), want (%q, %v)",
+				tc.name, tc.sharePath, got, matches, tc.want, tc.matches)
+		}
+	}
+}
+
+// TestUpdateSharesForMovedResource exercises the production updater end to end:
+// seeded shares are rewritten in the cache, the path index, and SQL.
+func TestUpdateSharesForMovedResource(t *testing.T) {
+	store := newShareMoveTestStore(t)
+
+	const oldSource = "/srv/photos"
+	const newSource = "/srv/archive"
+	seed := []share.Share{
+		{ShareColumns: share.ShareColumns{Hash: "file", Path: "/photos/2024/one.jpg"}, SourcePath: oldSource},
+		{ShareColumns: share.ShareColumns{Hash: "dir", Path: "/photos/2024/"}, SourcePath: oldSource},
+		{ShareColumns: share.ShareColumns{Hash: "exact", Path: "/photos/"}, SourcePath: oldSource},
+		{ShareColumns: share.ShareColumns{Hash: "sibling", Path: "/backup/photos/"}, SourcePath: oldSource},
+		{ShareColumns: share.ShareColumns{Hash: "othersrc", Path: "/photos/2024/"}, SourcePath: "/srv/other"},
+	}
+	for i := range seed {
+		s := seed[i]
+		if err := CreateShare(&s); err != nil {
+			t.Fatalf("seed share %s: %v", s.Hash, err)
+		}
+	}
+
+	updated, err := UpdateSharesForMovedResource(oldSource, "/photos", newSource, "/archive/photos/")
+	if err != nil {
+		t.Fatal(err)
+	}
+	updatedSet := make(map[string]bool, len(updated))
+	for _, h := range updated {
+		updatedSet[h] = true
+	}
+	for _, want := range []string{"file", "dir", "exact"} {
+		if !updatedSet[want] {
+			t.Fatalf("expected share %s in updated hashes %v", want, updated)
+		}
+	}
+	if len(updated) != 3 {
+		t.Fatalf("expected 3 updated shares, got %v", updated)
+	}
+
+	check := func(hash, wantPath, wantSource string) {
+		t.Helper()
+		s, getErr := GetShare(hash)
+		if getErr != nil {
+			t.Fatalf("GetShare(%s): %v", hash, getErr)
+		}
+		if s.Path != wantPath || s.SourcePath != wantSource {
+			t.Fatalf("share %s = (path %q, source %q), want (path %q, source %q)",
+				hash, s.Path, s.SourcePath, wantPath, wantSource)
+		}
+	}
+	check("file", "/archive/photos/2024/one.jpg", newSource)
+	check("dir", "/archive/photos/2024/", newSource)
+	check("exact", "/archive/photos/", newSource)
+	check("sibling", "/backup/photos/", oldSource)
+	check("othersrc", "/photos/2024/", "/srv/other")
+
+	// Writes went through to SQL, not just the cache.
+	persisted, err := store.ListAllShares()
+	if err != nil {
+		t.Fatal(err)
+	}
+	persistedPaths := make(map[string]string, len(persisted))
+	for _, l := range persisted {
+		persistedPaths[l.Hash] = l.Path
+	}
+	for hash, want := range map[string]string{
+		"file":  "/archive/photos/2024/one.jpg",
+		"dir":   "/archive/photos/2024/",
+		"exact": "/archive/photos/",
+	} {
+		if persistedPaths[hash] != want {
+			t.Fatalf("persisted share %s path = %q, want %q", hash, persistedPaths[hash], want)
+		}
+	}
+
+	// The path index tracks the new location.
+	moved, err := GetSharesByPath(newSource+"/", "/archive/photos/2024/")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(moved) != 1 || moved[0].Hash != "dir" {
+		t.Fatalf("GetSharesByPath(new dir) = %+v, want dir share", moved)
+	}
+}

backend/internal/state/state.go

@@ -3,6 +3,7 @@ package state
 import (
 	"fmt"
 	"sync"
+	"time"
 
 	"github.com/gtsteffaniak/filebrowser/backend/internal/auth"
 	"github.com/gtsteffaniak/filebrowser/backend/internal/database/access"
@@ -146,13 +147,23 @@ func initialize(dbPath string) (bool, error) {
 		return existingDb, fmt.Errorf("failed to load hashed tokens: %w", err)
 	}
 	accessDb.HashedTokens = make(map[string]access.HashedTokenInfo, len(hashedTokens))
+	now := time.Now()
+	expired := 0
 	for hash, record := range hashedTokens {
+		if access.TokenExpiredPastGrace(record.ExpiresAt, now) {
+			expired++
+			if err = sqlDb.DeleteHashedToken(hash); err != nil {
+				logger.Errorf("failed to delete expired token hash from sql: %v", err)
+			}
+			continue
+		}
 		accessDb.HashedTokens[hash] = access.HashedTokenInfo{
 			UserID:    record.UserID,
 			IsSession: record.IsSession,
+			ExpiresAt: record.ExpiresAt,
 		}
 	}
-	logger.Debugf("Loaded %d hashed tokens", len(hashedTokens))
+	logger.Debugf("Loaded %d hashed tokens (%d expired dropped)", len(hashedTokens)-expired, expired)
 
 	accessDb.SetSQLStore(sqlDb)
 

backend/internal/state/testmain_test.go

@@ -0,0 +1,14 @@
+package state
+
+import (
+	"os"
+	"testing"
+
+	"github.com/gtsteffaniak/filebrowser/backend/internal/utils"
+	"golang.org/x/crypto/bcrypt"
+)
+
+func TestMain(m *testing.M) {
+	utils.BcryptCost = bcrypt.MinCost
+	os.Exit(m.Run())
+}

backend/internal/state/users.go

@@ -189,6 +189,9 @@ func CreateUser(user *users.User, plaintextPassword string) error {
 	}
 	// Hash password if provided
 	if plaintextPassword != "" {
+		if err := settings.ValidatePasswordPolicy(plaintextPassword); err != nil {
+			return err
+		}
 		hashedPassword, err := utils.HashPwd(plaintextPassword)
 		if err != nil {
 			return fmt.Errorf("failed to hash password: %w", err)
@@ -202,7 +205,11 @@ func CreateUser(user *users.User, plaintextPassword string) error {
 	}
 
 	// If still no BackendScopes (omitted or invalid API names), same defaults as ApplyUserDefaults.
+	preserveRequirePasswordChange := user.RequirePasswordChange
 	ApplyUserDefaults(user)
+	if preserveRequirePasswordChange {
+		user.RequirePasswordChange = true
+	}
 	defaults := EffectiveUserDefaults()
 	enforced := EffectiveEnforced()
 	settings.ApplyEnforcedDefaultsFrom(user, defaults, enforced)
@@ -289,6 +296,9 @@ func UpdateUser(user *users.User, plaintextPassword string, fields ...string) er
 			if plaintextPassword == "" {
 				return fmt.Errorf("password field requires a non-empty plaintext password")
 			}
+			if err := settings.ValidatePasswordPolicy(plaintextPassword); err != nil {
+				return err
+			}
 			hashedPassword, hashErr := utils.HashPwd(plaintextPassword)
 			if hashErr != nil {
 				return fmt.Errorf("failed to hash password: %w", hashErr)

backend/internal/usersidebar/links.go

@@ -23,8 +23,13 @@ func FrontendLinks(links []users.SidebarLink, showToolsInSidebar bool) []users.S
 			}
 			if full, ok := settings.Config.Server.SourceMap[source.Path]; ok {
 				category := users.NormalizeSidebarLinkCategory(link.Category)
-				if full.Config.ResolvedRules.IndexingDisabled && category == string(users.SidebarLinkSource) {
-					link.Category = string(users.SidebarLinkSourceAlt)
+				if full.Config.ResolvedRules.IndexingDisabled &&
+					users.BaseSidebarLinkCategory(category) == string(users.SidebarLinkSource) {
+					if users.SidebarLinkDiskScopeRoot(category) {
+						link.Category = string(users.SidebarLinkSourceAltRoot)
+					} else {
+						link.Category = string(users.SidebarLinkSourceAlt)
+					}
 				}
 			}
 			link.SourceName = source.Name

backend/internal/utils/crypto.go

@@ -113,14 +113,19 @@ func GenerateKey() string {
 	return string(b)
 }
 
-// CSPNonce returns a base64-encoded random value suitable for Content-Security-Policy nonces
-// and matching HTML nonce="" attributes (cryptographically random, URL/header safe characters).
+// CSPNonce returns a random value suitable for Content-Security-Policy nonces
+// and matching HTML nonce="" attributes: 16 cryptographically random bytes
+// encoded with unpadded URL-safe base64 (22 chars from A-Za-z0-9-_).
+// URL-safe encoding is required because html/template HTML-escapes '+' as
+// "+" inside quoted attributes, so a StdEncoding nonce containing '+'
+// would not byte-match the 'nonce-...' source in the CSP response header
+// and the browser would block the inline script.
 func CSPNonce() (string, error) {
 	b, err := randomBytes(16)
 	if err != nil {
 		return "", err
 	}
-	return base64.StdEncoding.EncodeToString(b), nil
+	return base64.RawURLEncoding.EncodeToString(b), nil
 }
 
 // CSPNonceFromData returns an existing cspNonce from map template data, or generates

backend/internal/utils/crypto_test.go

@@ -0,0 +1,52 @@
+package utils
+
+import (
+	"encoding/base64"
+	"strings"
+	"testing"
+)
+
+func TestCSPNonceIsURLSafeUnpadded(t *testing.T) {
+	for i := 0; i < 200; i++ {
+		nonce, err := CSPNonce()
+		if err != nil {
+			t.Fatalf("CSPNonce: %v", err)
+		}
+		if len(nonce) != 22 {
+			t.Fatalf("expected 22-char nonce for 16 random bytes, got %q (%d chars)", nonce, len(nonce))
+		}
+		if strings.ContainsAny(nonce, "+/=") {
+			t.Fatalf("nonce %q must not contain '+', '/' or '=' (html/template escapes '+' as &#43;)", nonce)
+		}
+		raw, err := base64.RawURLEncoding.DecodeString(nonce)
+		if err != nil {
+			t.Fatalf("nonce %q is not valid RawURLEncoding: %v", nonce, err)
+		}
+		if len(raw) != 16 {
+			t.Fatalf("expected 16 decoded bytes, got %d", len(raw))
+		}
+	}
+}
+
+func TestCSPNonceFromDataReusesExisting(t *testing.T) {
+	data := map[string]interface{}{"cspNonce": "existing-nonce"}
+	nonce, err := CSPNonceFromData(data)
+	if err != nil {
+		t.Fatalf("CSPNonceFromData: %v", err)
+	}
+	if nonce != "existing-nonce" {
+		t.Fatalf("expected existing nonce to be reused, got %q", nonce)
+	}
+
+	fresh := map[string]interface{}{}
+	nonce, err = CSPNonceFromData(fresh)
+	if err != nil {
+		t.Fatalf("CSPNonceFromData: %v", err)
+	}
+	if nonce == "" {
+		t.Fatal("expected a generated nonce")
+	}
+	if stored, ok := fresh["cspNonce"].(string); !ok || stored != nonce {
+		t.Fatalf("expected generated nonce to be stored back, got %v", fresh["cspNonce"])
+	}
+}

backend/internal/utils/path.go

@@ -84,3 +84,23 @@ func AddTrailingSlashIfNotExists(indexPath string) string {
 	}
 	return indexPath
 }
+
+// RewritePathPrefix rewrites sharePath when it is exactly oldPrefix or beneath it, swapping the
+// prefix for newPrefix. Comparison is slash-aware (trailing slashes normalized), so a sibling path
+// that merely shares a leading substring ("/backup/photos/" vs oldPrefix "/photos") does not match.
+// A trailing slash on sharePath (directory convention) is preserved. Returns matches=false with the
+// input unchanged on no match.
+func RewritePathPrefix(sharePath, oldPrefix, newPrefix string) (rewritten string, matches bool) {
+	oldPrefix = AddTrailingSlashIfNotExists(oldPrefix)
+	newPrefix = AddTrailingSlashIfNotExists(newPrefix)
+	norm := AddTrailingSlashIfNotExists(sharePath)
+	if !strings.HasPrefix(norm, oldPrefix) {
+		return sharePath, false
+	}
+	suffix := strings.TrimPrefix(norm, oldPrefix)
+	rewritten = strings.TrimSuffix(newPrefix+suffix, "/")
+	if strings.HasSuffix(sharePath, "/") {
+		rewritten = AddTrailingSlashIfNotExists(rewritten)
+	}
+	return rewritten, true
+}

backend/internal/web/archive.go

@@ -1073,6 +1073,22 @@ func extractArchivedDir(destPath string, mode fs.FileMode, modTime time.Time) er
 	return applyArchivedTimesAndPerm(destPath, mode, modTime)
 }
 
+// removeSymlinkDestination removes destPath when it is a symlink so a regular-file
+// write creates the entry at destPath instead of following the link.
+func removeSymlinkDestination(destPath string) error {
+	info, err := os.Lstat(destPath)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil
+		}
+		return err
+	}
+	if info.Mode()&fs.ModeSymlink == 0 {
+		return nil
+	}
+	return os.Remove(destPath)
+}
+
 // extractArchivedRegularFile writes one regular file from src (closed by this function) and reapplies mode and mtime.
 func extractArchivedRegularFile(destPath string, mode fs.FileMode, modTime time.Time, src io.ReadCloser) error {
 	defer func() { _ = src.Close() }()
@@ -1080,6 +1096,9 @@ func extractArchivedRegularFile(destPath string, mode fs.FileMode, modTime time.
 	if err := os.MkdirAll(parent, fileutils.EffectiveDirPerm()); err != nil {
 		return fmt.Errorf("mkdir %q: %w", parent, err)
 	}
+	if err := removeSymlinkDestination(destPath); err != nil {
+		return err
+	}
 	perm := mode.Perm()
 	if perm == 0 {
 		perm = fileutils.EffectiveFilePerm()
@@ -1118,6 +1137,47 @@ func extractArchivedSymlink(destRoot, destPath, target string, modTime time.Time
 	return applyArchivedTimesAndPerm(destPath, fs.ModeSymlink, modTime)
 }
 
+// extractArchivedHardLink writes a copy of a regular file extracted earlier from the same
+// archive, which is what a tar hard link entry stands for.
+func extractArchivedHardLink(destRoot, destPath string, h *tar.Header, extracted map[string]os.FileInfo) error {
+	targetPath, err := safeExtractPath(destRoot, h.Linkname)
+	if err != nil {
+		return err
+	}
+	notExtracted := fmt.Errorf("hard link %q points to %q, which is not a file earlier in the archive", h.Name, h.Linkname)
+	written, ok := extracted[targetPath]
+	if !ok {
+		return notExtracted
+	}
+	src, err := os.Open(targetPath)
+	if err != nil {
+		logger.Debugf("unarchive: open hard link target: %v", err)
+		return fmt.Errorf("failed to write file from archive entry")
+	}
+	// A later entry may have replaced the target, e.g. with a symlink to another file.
+	info, err := src.Stat()
+	if err != nil || !info.Mode().IsRegular() || !os.SameFile(info, written) {
+		_ = src.Close()
+		return notExtracted
+	}
+	// The entry may name its own target, directly (GNU tar does this for a file archived
+	// twice). Writing it would truncate the file it copies from. Symlinks at destPath
+	// are replaced by extractArchivedRegularFile instead of being left in place.
+	if dest, err := os.Lstat(destPath); err == nil && dest.Mode().IsRegular() && os.SameFile(dest, info) {
+		return src.Close()
+	}
+	return extractArchivedRegularFile(destPath, h.FileInfo().Mode(), h.ModTime, src)
+}
+
+// recordExtractedFile remembers the regular file written at destPath for later hard links.
+func recordExtractedFile(extracted map[string]os.FileInfo, destPath string) {
+	if info, err := os.Lstat(destPath); err == nil && info.Mode().IsRegular() {
+		extracted[destPath] = info
+	} else {
+		delete(extracted, destPath)
+	}
+}
+
 func extractZip(archivePath, destDir string) error {
 	r, err := zip.OpenReader(archivePath)
 	if err != nil {
@@ -1221,6 +1281,8 @@ func extractTarGz(archivePath, destDir string) error {
 	defer gz.Close()
 
 	tr := tar.NewReader(gz)
+	// Regular files written so far, for hard links to point at.
+	extracted := make(map[string]os.FileInfo)
 	for {
 		h, err := tr.Next()
 		if err == io.EOF {
@@ -1246,6 +1308,12 @@ func extractTarGz(archivePath, destDir string) error {
 			if err = extractArchivedRegularFile(destPath, mode, h.ModTime, io.NopCloser(tr)); err != nil {
 				return err
 			}
+			recordExtractedFile(extracted, destPath)
+		case tar.TypeLink:
+			if err = extractArchivedHardLink(destDir, destPath, h, extracted); err != nil {
+				return err
+			}
+			recordExtractedFile(extracted, destPath)
 		case tar.TypeSymlink:
 			if err = extractArchivedSymlink(destDir, destPath, h.Linkname, h.ModTime); err != nil {
 				return err

backend/internal/web/archive_test.go

@@ -1,13 +1,38 @@
 package web
 
 import (
+	"archive/tar"
 	"archive/zip"
+	"compress/gzip"
+	"io"
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"
 )
 
+func writeTestTarGz(t *testing.T, path string, write func(tw *tar.Writer) error) {
+	t.Helper()
+	f, err := os.Create(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	gz := gzip.NewWriter(f)
+	tw := tar.NewWriter(gz)
+	if err := write(tw); err != nil {
+		t.Fatal(err)
+	}
+	if err := tw.Close(); err != nil {
+		t.Fatal(err)
+	}
+	if err := gz.Close(); err != nil {
+		t.Fatal(err)
+	}
+	if err := f.Close(); err != nil {
+		t.Fatal(err)
+	}
+}
+
 func TestNormalizeArchiveEntryName(t *testing.T) {
 	t.Parallel()
 
@@ -279,6 +304,228 @@ func TestExtractZip_nestedBackslashes(t *testing.T) {
 	}
 }
 
+func TestExtractTarGz_hardLinks(t *testing.T) {
+	archivePath := filepath.Join(t.TempDir(), "links.tar.gz")
+	writeTestTarGz(t, archivePath, func(tw *tar.Writer) error {
+		if err := tw.WriteHeader(&tar.Header{Name: "proj/a.txt", Mode: 0o644, Size: 4, Typeflag: tar.TypeReg}); err != nil {
+			return err
+		}
+		if _, err := io.WriteString(tw, "same"); err != nil {
+			return err
+		}
+		return tw.WriteHeader(&tar.Header{Name: "proj/sub/b.txt", Mode: 0o644, Typeflag: tar.TypeLink, Linkname: "proj/a.txt"})
+	})
+	destDir := t.TempDir()
+	if err := extractTarGz(archivePath, destDir); err != nil {
+		t.Fatalf("extract: %v", err)
+	}
+	got, err := os.ReadFile(filepath.Join(destDir, "proj", "sub", "b.txt"))
+	if err != nil || string(got) != "same" {
+		t.Fatalf("hard link entry: got %q, %v", got, err)
+	}
+
+	missing := filepath.Join(t.TempDir(), "missing.tar.gz")
+	writeTestTarGz(t, missing, func(tw *tar.Writer) error {
+		return tw.WriteHeader(&tar.Header{Name: "b.txt", Mode: 0o644, Typeflag: tar.TypeLink, Linkname: "a.txt"})
+	})
+	if err := extractTarGz(missing, t.TempDir()); err == nil {
+		t.Fatal("expected an error for a hard link to a file that is not in the archive")
+	}
+
+	// A symlink entry replaces the extracted file before the hard link names it.
+	replaced := filepath.Join(t.TempDir(), "replaced.tar.gz")
+	writeTestTarGz(t, replaced, func(tw *tar.Writer) error {
+		if err := tw.WriteHeader(&tar.Header{Name: "a.txt", Mode: 0o644, Size: 4, Typeflag: tar.TypeReg}); err != nil {
+			return err
+		}
+		if _, err := io.WriteString(tw, "mine"); err != nil {
+			return err
+		}
+		if err := tw.WriteHeader(&tar.Header{Name: "a.txt", Mode: 0o777, Typeflag: tar.TypeSymlink, Linkname: "private/secret.txt"}); err != nil {
+			return err
+		}
+		return tw.WriteHeader(&tar.Header{Name: "b.txt", Mode: 0o644, Typeflag: tar.TypeLink, Linkname: "a.txt"})
+	})
+	replacedDest := t.TempDir()
+	if err := os.MkdirAll(filepath.Join(replacedDest, "private"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(replacedDest, "private", "secret.txt"), []byte("secret"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := extractTarGz(replaced, replacedDest); err == nil {
+		t.Fatal("expected an error for a hard link whose target was replaced by a symlink")
+	}
+	if got, err := os.ReadFile(filepath.Join(replacedDest, "b.txt")); err == nil {
+		t.Fatalf("hard link entry copied the symlink target: %q", got)
+	}
+
+	// A hard link names its own target, as GNU tar writes for a file archived twice,
+	// or names it through a symlink.
+	self := filepath.Join(t.TempDir(), "self.tar.gz")
+	writeTestTarGz(t, self, func(tw *tar.Writer) error {
+		if err := tw.WriteHeader(&tar.Header{Name: "a.txt", Mode: 0o644, Size: 4, Typeflag: tar.TypeReg}); err != nil {
+			return err
+		}
+		if _, err := io.WriteString(tw, "same"); err != nil {
+			return err
+		}
+		if err := tw.WriteHeader(&tar.Header{Name: "c.txt", Mode: 0o777, Typeflag: tar.TypeSymlink, Linkname: "a.txt"}); err != nil {
+			return err
+		}
+		if err := tw.WriteHeader(&tar.Header{Name: "a.txt", Mode: 0o644, Typeflag: tar.TypeLink, Linkname: "a.txt"}); err != nil {
+			return err
+		}
+		return tw.WriteHeader(&tar.Header{Name: "c.txt", Mode: 0o644, Typeflag: tar.TypeLink, Linkname: "a.txt"})
+	})
+	selfDest := t.TempDir()
+	if err := extractTarGz(self, selfDest); err != nil {
+		t.Fatalf("extract: %v", err)
+	}
+	if got, err := os.ReadFile(filepath.Join(selfDest, "a.txt")); err != nil || string(got) != "same" {
+		t.Fatalf("hard link to itself: got %q, %v", got, err)
+	}
+}
+
+func TestExtractTarGz_symlinkDestination(t *testing.T) {
+	t.Run("pre-existing symlink at destination", func(t *testing.T) {
+		destDir := t.TempDir()
+		victim := filepath.Join(destDir, "victim.txt")
+		if err := os.WriteFile(victim, []byte("untouched"), 0o644); err != nil {
+			t.Fatal(err)
+		}
+		outPath := filepath.Join(destDir, "out.txt")
+		if err := os.Symlink("victim.txt", outPath); err != nil {
+			t.Fatal(err)
+		}
+		archivePath := filepath.Join(t.TempDir(), "out.tar.gz")
+		writeTestTarGz(t, archivePath, func(tw *tar.Writer) error {
+			if err := tw.WriteHeader(&tar.Header{Name: "out.txt", Mode: 0o644, Size: 7, Typeflag: tar.TypeReg}); err != nil {
+				return err
+			}
+			_, err := io.WriteString(tw, "payload")
+			return err
+		})
+		if err := extractTarGz(archivePath, destDir); err != nil {
+			t.Fatalf("extract: %v", err)
+		}
+		got, err := os.ReadFile(outPath)
+		if err != nil || string(got) != "payload" {
+			t.Fatalf("out.txt: got %q, %v", got, err)
+		}
+		victimData, err := os.ReadFile(victim)
+		if err != nil || string(victimData) != "untouched" {
+			t.Fatalf("victim.txt should be unchanged: %q, %v", victimData, err)
+		}
+		info, err := os.Lstat(outPath)
+		if err != nil || info.Mode()&os.ModeSymlink != 0 {
+			t.Fatalf("out.txt should be a regular file, mode=%v err=%v", info.Mode(), err)
+		}
+	})
+
+	t.Run("symlink entry then regular file at same path", func(t *testing.T) {
+		destDir := t.TempDir()
+		other := filepath.Join(destDir, "other.txt")
+		if err := os.WriteFile(other, []byte("keep"), 0o644); err != nil {
+			t.Fatal(err)
+		}
+		archivePath := filepath.Join(t.TempDir(), "link_then_reg.tar.gz")
+		writeTestTarGz(t, archivePath, func(tw *tar.Writer) error {
+			if err := tw.WriteHeader(&tar.Header{Name: "link", Mode: 0o777, Typeflag: tar.TypeSymlink, Linkname: "other.txt"}); err != nil {
+				return err
+			}
+			if err := tw.WriteHeader(&tar.Header{Name: "link", Mode: 0o644, Size: 7, Typeflag: tar.TypeReg}); err != nil {
+				return err
+			}
+			_, err := io.WriteString(tw, "written")
+			return err
+		})
+		if err := extractTarGz(archivePath, destDir); err != nil {
+			t.Fatalf("extract: %v", err)
+		}
+		linkPath := filepath.Join(destDir, "link")
+		got, err := os.ReadFile(linkPath)
+		if err != nil || string(got) != "written" {
+			t.Fatalf("link: got %q, %v", got, err)
+		}
+		otherData, err := os.ReadFile(other)
+		if err != nil || string(otherData) != "keep" {
+			t.Fatalf("other.txt should be unchanged: %q, %v", otherData, err)
+		}
+	})
+
+	t.Run("hard link onto symlink to source", func(t *testing.T) {
+		destDir := t.TempDir()
+		archivePath := filepath.Join(t.TempDir(), "hardlink_symlink_dest.tar.gz")
+		writeTestTarGz(t, archivePath, func(tw *tar.Writer) error {
+			if err := tw.WriteHeader(&tar.Header{Name: "a.txt", Mode: 0o644, Size: 4, Typeflag: tar.TypeReg}); err != nil {
+				return err
+			}
+			if _, err := io.WriteString(tw, "same"); err != nil {
+				return err
+			}
+			if err := tw.WriteHeader(&tar.Header{Name: "b.txt", Mode: 0o777, Typeflag: tar.TypeSymlink, Linkname: "a.txt"}); err != nil {
+				return err
+			}
+			return tw.WriteHeader(&tar.Header{Name: "c.txt", Mode: 0o644, Typeflag: tar.TypeLink, Linkname: "a.txt"})
+		})
+		if err := extractTarGz(archivePath, destDir); err != nil {
+			t.Fatalf("extract: %v", err)
+		}
+		cPath := filepath.Join(destDir, "c.txt")
+		got, err := os.ReadFile(cPath)
+		if err != nil || string(got) != "same" {
+			t.Fatalf("c.txt: got %q, %v", got, err)
+		}
+		info, err := os.Lstat(cPath)
+		if err != nil || info.Mode()&os.ModeSymlink != 0 {
+			t.Fatalf("c.txt should be a regular file")
+		}
+	})
+}
+
+func TestExtractZip_symlinkDestination(t *testing.T) {
+	destDir := t.TempDir()
+	victim := filepath.Join(destDir, "victim.txt")
+	if err := os.WriteFile(victim, []byte("untouched"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	outPath := filepath.Join(destDir, "out.txt")
+	if err := os.Symlink("victim.txt", outPath); err != nil {
+		t.Fatal(err)
+	}
+	zipPath := filepath.Join(t.TempDir(), "out.zip")
+	f, err := os.Create(zipPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	zw := zip.NewWriter(f)
+	w, err := zw.Create("out.txt")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err = w.Write([]byte("payload")); err != nil {
+		t.Fatal(err)
+	}
+	if err = zw.Close(); err != nil {
+		t.Fatal(err)
+	}
+	if err = f.Close(); err != nil {
+		t.Fatal(err)
+	}
+	if err = extractZip(zipPath, destDir); err != nil {
+		t.Fatalf("extract: %v", err)
+	}
+	got, err := os.ReadFile(outPath)
+	if err != nil || string(got) != "payload" {
+		t.Fatalf("out.txt: got %q, %v", got, err)
+	}
+	victimData, err := os.ReadFile(victim)
+	if err != nil || string(victimData) != "untouched" {
+		t.Fatalf("victim.txt should be unchanged: %q, %v", victimData, err)
+	}
+}
+
 // Benchmarks (optional, keep small)
 func BenchmarkNormalizeArchiveEntryName(b *testing.B) {
 	const name = `PRO1000\Winx64\NDIS65\e1c65x64.cat`

backend/internal/web/auth.go

@@ -4,11 +4,14 @@ import (
 	"encoding/json"
 	libError "errors"
 	"fmt"
+	"io"
+	"mime"
 	"net/http"
 	"net/url"
 	"strings"
 	"time"
 
+	jwt "github.com/golang-jwt/jwt/v4"
 	"github.com/golang-jwt/jwt/v4/request"
 	"golang.org/x/crypto/bcrypt"
 
@@ -78,6 +81,10 @@ func ExtractToken(r *http.Request) (string, error) {
 // getOrCreateAuthenticatedUser is a common helper for retrieving or auto-creating users
 // across different authentication methods (proxy, JWT, LDAP, OIDC)
 func getOrCreateAuthenticatedUser(username string, loginMethod users.LoginMethod, isAdmin bool, groups []string) (*users.User, error) {
+	if err := ensureUserInAllowedGroups(loginMethod, groups); err != nil {
+		return nil, err
+	}
+
 	// Try to get existing user
 	userValue, err := state.GetUserByUsername(username)
 	if err != nil {
@@ -111,27 +118,6 @@ func getOrCreateAuthenticatedUser(username string, loginMethod users.LoginMethod
 			return nil, err
 		}
 	}
-	allowedGroups := []string{}
-	switch loginMethod {
-	case users.LoginMethodJwt:
-		allowedGroups = settings.Config.Auth.Methods.JwtAuth.UserGroups
-	case users.LoginMethodLdap:
-		allowedGroups = settings.Config.Auth.Methods.LdapAuth.UserGroups
-	case users.LoginMethodOidc:
-		allowedGroups = settings.Config.Auth.Methods.OidcAuth.UserGroups
-	}
-	allowed := len(allowedGroups) == 0
-	for _, userGroup := range groups {
-		for _, allowedGroup := range allowedGroups {
-			if userGroup == allowedGroup {
-				allowed = true
-				break
-			}
-		}
-	}
-	if !allowed {
-		return nil, fmt.Errorf("user is not in allowed groups")
-	}
 	// Sync admin status if needed (in case admin username changed)
 	if isAdmin && !userValue.Permissions.Admin {
 		userValue.Permissions.Admin = true
@@ -157,6 +143,36 @@ func getOrCreateAuthenticatedUser(username string, loginMethod users.LoginMethod
 	return &userValue, nil
 }
 
+// ensureUserInAllowedGroups rejects login when userGroups is configured and none
+// of the IdP groups are allowed. Must run before auto-create so denied users
+// leave no account behind.
+func ensureUserInAllowedGroups(loginMethod users.LoginMethod, groups []string) error {
+	allowedGroups := []string{}
+	switch loginMethod {
+	case users.LoginMethodJwt:
+		allowedGroups = settings.Config.Auth.Methods.JwtAuth.UserGroups
+	case users.LoginMethodLdap:
+		allowedGroups = settings.Config.Auth.Methods.LdapAuth.UserGroups
+	case users.LoginMethodOidc:
+		allowedGroups = settings.Config.Auth.Methods.OidcAuth.UserGroups
+	}
+	if len(allowedGroups) == 0 {
+		return nil
+	}
+	for _, userGroup := range groups {
+		for _, allowedGroup := range allowedGroups {
+			if loginMethod == users.LoginMethodLdap {
+				if ldapGroupMatches(userGroup, allowedGroup) {
+					return nil
+				}
+			} else if userGroup == allowedGroup {
+				return nil
+			}
+		}
+	}
+	return fmt.Errorf("user is not in allowed groups")
+}
+
 func SetupProxyUser(r *http.Request, data *Context, proxyUser string) (*users.User, error) {
 	// Check if username matches admin username
 	isAdmin := proxyUser == settings.Config.Auth.AdminUsername
@@ -205,6 +221,9 @@ func loginHandler(w http.ResponseWriter, r *http.Request, d *Context) (int, erro
 	if d.User.HasPasskeyMFA() && d.User.TOTPSecret == "" {
 		return http.StatusForbidden, errors.ErrPasskeyMFARequired
 	}
+	if passwordUser && d.User.RequirePasswordChange {
+		return http.StatusForbidden, errors.ErrPasswordChangeRequired
+	}
 	status, err := printToken(w, r, d.User, "")
 	if err != nil || status != 0 {
 		return status, err
@@ -296,14 +315,18 @@ func signupHandler(w http.ResponseWriter, r *http.Request, d *Context) (int, err
 		return http.StatusMethodNotAllowed, fmt.Errorf("signup is disabled")
 	}
 
-	// Get credentials from query parameters
-	username := r.URL.Query().Get("username")
-	password := r.URL.Query().Get("password")
+	username, password, credErr := parseSignupCredentials(r)
+	if credErr != nil {
+		return http.StatusBadRequest, fmt.Errorf("invalid signup request body")
+	}
 
 	// Validate that we have both username and password
 	if username == "" || password == "" {
 		return http.StatusBadRequest, fmt.Errorf("username and password are required")
 	}
+	if err := settings.ValidatePasswordPolicy(password); err != nil {
+		return http.StatusBadRequest, err
+	}
 
 	user := users.User{
 		FrontendUser: users.FrontendUser{
@@ -326,6 +349,24 @@ func signupHandler(w http.ResponseWriter, r *http.Request, d *Context) (int, err
 	return 201, nil
 }
 
+type signupCredentials struct {
+	Username string `json:"username"`
+	Password string `json:"password"`
+}
+
+func parseSignupCredentials(r *http.Request) (username, password string, err error) {
+	mediaType, _, err := mime.ParseMediaType(r.Header.Get("Content-Type"))
+	if err == nil && mediaType == "application/json" {
+		var body signupCredentials
+		dec := json.NewDecoder(io.LimitReader(r.Body, 8192))
+		if err := dec.Decode(&body); err != nil {
+			return "", "", err
+		}
+		return strings.TrimSpace(body.Username), body.Password, nil
+	}
+	return r.URL.Query().Get("username"), r.URL.Query().Get("password"), nil
+}
+
 // renewHandler refreshes the authentication token for a logged-in user.
 // @Summary Renew authentication token
 // @Description Refresh the authentication token for a logged-in user.
@@ -334,12 +375,66 @@ func signupHandler(w http.ResponseWriter, r *http.Request, d *Context) (int, err
 // @Produce json
 // @Success 200 {string} string "New JWT token generated"
 // @Failure 401 {object} map[string]string "Unauthorized - invalid token"
+// @Failure 403 {object} map[string]string "Forbidden - non-session token"
 // @Failure 500 {object} map[string]string "Internal server error"
 // @Router /api/auth/renew [post]
 func renewHandler(w http.ResponseWriter, r *http.Request, d *Context) (int, error) {
+	if settings.Config.Auth.Methods.NoAuth {
+		w.Header().Set("Content-Type", "text/plain")
+		if d.Token != "" {
+			if _, err := w.Write([]byte(d.Token)); err != nil {
+				return 401, errors.ErrUnauthorized
+			}
+		}
+		return 0, nil
+	}
+	token := d.Token
+	if token == "" {
+		extracted, err := ExtractToken(r)
+		if err != nil || extracted == "" {
+			return http.StatusUnauthorized, errors.ErrUnauthorized
+		}
+		token = extracted
+		d.Token = token
+	}
+	_, isSession, ok := state.HashedTokenOwner(token)
+	if ok && !isSession {
+		return http.StatusForbidden, fmt.Errorf("renew requires a session token")
+	}
+	if !ok {
+		return http.StatusUnauthorized, errors.ErrUnauthorized
+	}
+	// Renew is idempotent while the presented session token is still fresh:
+	// without this every page load rotates the token (the frontend tracks exp
+	// in memory only), churning token state. Rotation happens only inside the
+	// refresh window, matching the frontend's renew threshold.
+	var tk users.AuthToken
+	if _, err := jwt.ParseWithClaims(d.Token, &tk, auth.JWTSigningKeyFunc()); err == nil &&
+		tk.RegisteredClaims.ExpiresAt != nil &&
+		time.Until(tk.RegisteredClaims.ExpiresAt.Time) > sessionRenewWindow {
+		// Do not re-emit the cookie when the request already carried this token.
+		// A concurrent renew may have rotated the jar; an in-flight idempotent
+		// response would otherwise revert the browser to a retiring token.
+		if c, err := r.Cookie(sessionCookieName); err != nil || c.Value == "" || c.Value != d.Token {
+			SetSessionCookie(w, r, d.Token, tk.RegisteredClaims.ExpiresAt.Add(sessionCookieBuffer))
+		}
+		w.Header().Set("Content-Type", "text/plain")
+		if _, err := w.Write([]byte(d.Token)); err != nil {
+			return 401, errors.ErrUnauthorized
+		}
+		return 0, nil
+	}
 	return printToken(w, r, d.User, d.Token)
 }
 
+// sessionRenewWindow mirrors the frontend SESSION_REFRESH_BEFORE_MS: renews
+// arriving while the session token has more than this left return it unchanged.
+const sessionRenewWindow = 30 * time.Minute
+
+// sessionCookieBuffer keeps the browser cookie briefly past JWT expiry so an
+// in-flight renew can still authenticate against the just-expired token.
+const sessionCookieBuffer = 30 * time.Minute
+
 func printToken(w http.ResponseWriter, r *http.Request, user *users.User, priorToken string) (int, error) {
 	expires := time.Hour * time.Duration(settings.Config.Auth.TokenExpirationHours)
 	tokenString, err := replaceSessionToken(priorToken, user)
@@ -350,7 +445,7 @@ func printToken(w http.ResponseWriter, r *http.Request, user *users.User, priorT
 		return 401, errors.ErrUnauthorized
 	}
 
-	expiresTime := time.Now().Add(expires).Add(time.Minute * 30)
+	expiresTime := time.Now().Add(expires).Add(sessionCookieBuffer)
 
 	SetSessionCookie(w, r, tokenString, expiresTime)
 
@@ -492,7 +587,7 @@ func applyNamedApiTokenGlobalCaps(user *users.User, tokenName string) {
 	if !ok {
 		return
 	}
-	if !users.HasAnyGlobalPermission(stored.Permissions) {
+	if users.IsMinimalApiToken(stored) {
 		return
 	}
 	user.Permissions = users.IntersectGlobalPermissions(user.Permissions, stored.Permissions)

backend/internal/web/auth_login_method_test.go

@@ -61,6 +61,79 @@ func TestGetOrCreateAuthenticatedUserRejectsPasswordUserForOIDCAccount(t *testin
 	}
 }
 
+func TestGetOrCreateAuthenticatedUserLDAPUserGroupsCNMatch(t *testing.T) {
+	setupTestEnv(t)
+
+	orig := settings.Config.Auth.Methods.LdapAuth.UserGroups
+	settings.Config.Auth.Methods.LdapAuth.UserGroups = []string{"employees"}
+	t.Cleanup(func() {
+		settings.Config.Auth.Methods.LdapAuth.UserGroups = orig
+	})
+
+	ldapUser := &users.User{
+		FrontendUser: users.FrontendUser{
+			Username:    "ldap-user",
+			LoginMethod: users.LoginMethodLdap,
+		},
+	}
+	if err := state.CreateUser(ldapUser, ""); err != nil {
+		t.Fatalf("CreateUser: %v", err)
+	}
+
+	groups := []string{"cn=Employees,ou=groups,dc=example,dc=com"}
+	_, err := getOrCreateAuthenticatedUser("ldap-user", users.LoginMethodLdap, false, groups)
+	if err != nil {
+		t.Fatalf("getOrCreateAuthenticatedUser() with CN-only userGroups: %v", err)
+	}
+}
+
+func TestGetOrCreateAuthenticatedUserLDAPUserGroupsDenied(t *testing.T) {
+	setupTestEnv(t)
+
+	orig := settings.Config.Auth.Methods.LdapAuth.UserGroups
+	settings.Config.Auth.Methods.LdapAuth.UserGroups = []string{"employees"}
+	t.Cleanup(func() {
+		settings.Config.Auth.Methods.LdapAuth.UserGroups = orig
+	})
+
+	ldapUser := &users.User{
+		FrontendUser: users.FrontendUser{
+			Username:    "ldap-user",
+			LoginMethod: users.LoginMethodLdap,
+		},
+	}
+	if err := state.CreateUser(ldapUser, ""); err != nil {
+		t.Fatalf("CreateUser: %v", err)
+	}
+
+	groups := []string{"cn=Contractors,ou=groups,dc=example,dc=com"}
+	_, err := getOrCreateAuthenticatedUser("ldap-user", users.LoginMethodLdap, false, groups)
+	if err == nil || err.Error() != "user is not in allowed groups" {
+		t.Fatalf("getOrCreateAuthenticatedUser() err = %v, want user is not in allowed groups", err)
+	}
+}
+
+func TestGetOrCreateAuthenticatedUserLDAPDeniedFirstLoginCreatesNoAccount(t *testing.T) {
+	setupTestEnv(t)
+
+	orig := settings.Config.Auth.Methods.LdapAuth.UserGroups
+	settings.Config.Auth.Methods.LdapAuth.UserGroups = []string{"employees"}
+	t.Cleanup(func() {
+		settings.Config.Auth.Methods.LdapAuth.UserGroups = orig
+	})
+
+	groups := []string{"cn=Contractors,ou=groups,dc=example,dc=com"}
+	_, err := getOrCreateAuthenticatedUser("denied-ldap-user", users.LoginMethodLdap, false, groups)
+	if err == nil || err.Error() != "user is not in allowed groups" {
+		t.Fatalf("getOrCreateAuthenticatedUser() err = %v, want user is not in allowed groups", err)
+	}
+
+	_, getErr := state.GetUserByUsername("denied-ldap-user")
+	if !errors.Is(getErr, fberrors.ErrNotExist) {
+		t.Fatalf("GetUserByUsername after denied login: %v, want ErrNotExist", getErr)
+	}
+}
+
 func TestAuthenticatePasswordRejectsWrongLoginMethod(t *testing.T) {
 	setupTestEnv(t)
 
@@ -77,7 +150,7 @@ func TestAuthenticatePasswordRejectsWrongLoginMethod(t *testing.T) {
 	req := httptest.NewRequest(http.MethodPost, "/api/auth/login?username=graham", nil)
 	req.Header.Set("X-Password", url.QueryEscape("secret"))
 
-	_, err := auth.AuthenticatePassword(req, true)
+	_, err := auth.AuthenticatePassword(req, true, false)
 	if !errors.Is(err, fberrors.ErrWrongLoginMethod) {
 		t.Fatalf("AuthenticatePassword() err = %v, want ErrWrongLoginMethod", err)
 	}

backend/internal/web/auth_signup_oidc_test.go

@@ -0,0 +1,85 @@
+package web
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/gtsteffaniak/filebrowser/backend/pkg/settings"
+)
+
+func TestValidateOidcCallbackState(t *testing.T) {
+	settings.Config.Http.BaseURL = "/"
+	t.Cleanup(func() { settings.Config.Http.BaseURL = "/" })
+
+	t.Run("accepts matching state and redirect cookie", func(t *testing.T) {
+		req := httptest.NewRequest("GET", "/api/auth/oidc/callback?state=goodstate&code=x", nil)
+		req.AddCookie(&http.Cookie{Name: oidcStateCookieName, Value: "goodstate"})
+		req.AddCookie(&http.Cookie{Name: oidcRedirectCookieName, Value: "/files/"})
+		rec := httptest.NewRecorder()
+
+		redirect, status, err := validateOidcCallbackState(req, rec)
+		if err != nil || status != 0 {
+			t.Fatalf("validateOidcCallbackState: status=%d err=%v", status, err)
+		}
+		if redirect != "/files/" {
+			t.Fatalf("redirect = %q, want /files/", redirect)
+		}
+		setCookie := rec.Header().Get("Set-Cookie")
+		if !strings.Contains(setCookie, oidcStateCookieName+"=;") {
+			t.Fatalf("expected state cookie cleared, got %q", setCookie)
+		}
+	})
+
+	t.Run("rejects tampered state", func(t *testing.T) {
+		req := httptest.NewRequest("GET", "/api/auth/oidc/callback?state=tampered&code=x", nil)
+		req.AddCookie(&http.Cookie{Name: oidcStateCookieName, Value: "expected"})
+		rec := httptest.NewRecorder()
+
+		_, status, err := validateOidcCallbackState(req, rec)
+		if err == nil || status != http.StatusBadRequest {
+			t.Fatalf("expected 400, got status=%d err=%v", status, err)
+		}
+	})
+}
+
+func TestParseSignupCredentialsJSON(t *testing.T) {
+	body := `{"username":"alice","password":"s3cret"}`
+	req := httptest.NewRequest("POST", "/api/auth/signup", strings.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+
+	user, pass, err := parseSignupCredentials(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if user != "alice" || pass != "s3cret" {
+		t.Fatalf("got user=%q pass=%q", user, pass)
+	}
+}
+
+func TestParseSignupCredentialsQueryFallback(t *testing.T) {
+	req := httptest.NewRequest("POST", "/api/auth/signup?username=bob&password=oldway", nil)
+	user, pass, err := parseSignupCredentials(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if user != "bob" || pass != "oldway" {
+		t.Fatalf("got user=%q pass=%q", user, pass)
+	}
+}
+
+func TestParseSignupCredentialsJSONMixedCaseContentType(t *testing.T) {
+	body := `{"username":"carol","password":"p4ss"}`
+	req := httptest.NewRequest("POST", "/api/auth/signup", strings.NewReader(body))
+	req.Header.Set("Content-Type", "Application/JSON; charset=utf-8")
+
+	user, pass, err := parseSignupCredentials(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if user != "carol" || pass != "p4ss" {
+		t.Fatalf("got user=%q pass=%q", user, pass)
+	}
+}
+

backend/internal/web/auth_test.go

@@ -197,9 +197,11 @@ func TestApplyNamedApiTokenGlobalCaps(t *testing.T) {
 
 	t.Run("custom api token caps globals", func(t *testing.T) {
 		user := *owner
+		customized := false
 		user.Tokens = map[string]users.AuthToken{
 			"customized": {
 				Name: "customized",
+				Minimal: &customized,
 				Permissions: users.Permissions{
 					Admin:  false,
 					Api:    true,
@@ -216,4 +218,20 @@ func TestApplyNamedApiTokenGlobalCaps(t *testing.T) {
 			t.Fatalf("expected api and share, got %#v", user.Permissions)
 		}
 	})
+
+	t.Run("customized zero global caps", func(t *testing.T) {
+		user := *owner
+		customized := false
+		user.Tokens = map[string]users.AuthToken{
+			"locked-down": {
+				Name:        "locked-down",
+				Minimal:     &customized,
+				Permissions: users.Permissions{},
+			},
+		}
+		applyNamedApiTokenGlobalCaps(&user, "locked-down")
+		if user.Permissions.Admin || user.Permissions.Api || user.Permissions.Share {
+			t.Fatalf("customized empty caps should clear globals, got %#v", user.Permissions)
+		}
+	})
 }

backend/internal/web/auth_test_helpers_test.go

@@ -0,0 +1,40 @@
+package web
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/gtsteffaniak/filebrowser/backend/internal/database/users"
+	"github.com/gtsteffaniak/filebrowser/backend/internal/state"
+)
+
+func createTokenAuthUser(t *testing.T, username string, perms users.Permissions) *users.User {
+	t.Helper()
+	u := &users.User{FrontendUser: users.FrontendUser{Username: username}}
+	if err := state.CreateUser(u, ""); err != nil {
+		t.Fatal(err)
+	}
+	stored, err := state.GetUserByUsername(username)
+	if err != nil {
+		t.Fatal(err)
+	}
+	stored.Permissions = perms
+	if err = state.UpdateUser(&stored, "", "permissions"); err != nil {
+		t.Fatal(err)
+	}
+	reloaded, err := state.GetUserByUsername(username)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return &reloaded
+}
+
+func cookieRequest(t *testing.T, handler http.HandlerFunc, token string) *httptest.ResponseRecorder {
+	t.Helper()
+	rec := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet, "/users", http.NoBody)
+	req.AddCookie(&http.Cookie{Name: "filebrowser_quantum_jwt", Value: token})
+	handler(rec, req)
+	return rec
+}

backend/internal/web/download.go

@@ -151,25 +151,8 @@ func downloadHandler(w http.ResponseWriter, r *http.Request, d *Context) (int, e
 // @Failure 501 {object} map[string]string "Downloads disabled for upload shares"
 // @Router /public/api/resources/download [get]
 func publicDownloadHandler(w http.ResponseWriter, r *http.Request, d *Context) (int, error) {
-	if d.Share.ShareType == "upload" {
-		return http.StatusNotImplemented, fmt.Errorf("downloads are disabled for upload shares")
-	}
-
-	if d.Share.DisableDownload {
-		return http.StatusForbidden, fmt.Errorf("downloads are not allowed for this share")
-	}
-
-	if !d.Share.PerUserDownloadLimit && d.Share.DownloadsLimit > 0 && d.Share.Downloads >= d.Share.DownloadsLimit {
-		return http.StatusForbidden, fmt.Errorf("share downloads limit reached")
-	}
-
-	if d.Share.PerUserDownloadLimit {
-		if d.User.Username == "anonymous" {
-			return http.StatusForbidden, fmt.Errorf("anonymous downloads are not allowed with per-user limits")
-		}
-		if d.Share.HasReachedUserLimit(d.User.Username) {
-			return http.StatusForbidden, fmt.Errorf("user download limit reached for this share")
-		}
+	if status, err := publicShareDownloadGate(d); err != nil {
+		return status, err
 	}
 
 	files := r.URL.Query()["file"]
@@ -213,6 +196,57 @@ func publicDownloadHandler(w http.ResponseWriter, r *http.Request, d *Context) (
 	return status, nil
 }
 
+// publicShareDownloadGate enforces upload-share, disable-download, and download-counter rules for public share byte egress.
+func publicShareDownloadGate(d *Context) (int, error) {
+	if d.Share.ShareType == "upload" {
+		return http.StatusNotImplemented, fmt.Errorf("downloads are disabled for upload shares")
+	}
+	if d.Share.DisableDownload {
+		return http.StatusForbidden, fmt.Errorf("downloads are not allowed for this share")
+	}
+	if status, err := publicShareDownloadLimits(d); err != nil {
+		return status, err
+	}
+	return 0, nil
+}
+
+func publicShareDownloadLimits(d *Context) (int, error) {
+	if !d.Share.PerUserDownloadLimit && d.Share.DownloadsLimit > 0 && d.Share.Downloads >= d.Share.DownloadsLimit {
+		return http.StatusForbidden, fmt.Errorf("share downloads limit reached")
+	}
+	if d.Share.PerUserDownloadLimit {
+		if d.User.Username == "anonymous" {
+			return http.StatusForbidden, fmt.Errorf("anonymous downloads are not allowed with per-user limits")
+		}
+		if d.Share.HasReachedUserLimit(d.User.Username) {
+			return http.StatusForbidden, fmt.Errorf("user download limit reached for this share")
+		}
+	}
+	return 0, nil
+}
+
+// publicShareMediaContentPolicy applies the same share view/download flags and download limits as other public content routes.
+func publicShareMediaContentPolicy(d *Context) (int, error) {
+	if d.Share.ShareType == "upload" {
+		return http.StatusNotImplemented, fmt.Errorf("browsing is disabled for upload shares")
+	}
+	sourceInfo, ok := settings.Config.Server.SourceMap[d.Share.SourcePath]
+	if !ok {
+		return http.StatusNotFound, fmt.Errorf("source not found")
+	}
+	filePerms, err := effectiveFilePerms(d, sourceInfo.Name)
+	if err != nil {
+		return http.StatusForbidden, err
+	}
+	if !filePerms.View {
+		return http.StatusForbidden, fmt.Errorf("user is not allowed to view files in this source")
+	}
+	if !filePerms.Download {
+		return http.StatusForbidden, fmt.Errorf("downloads are not allowed for this share")
+	}
+	return publicShareDownloadLimits(d)
+}
+
 func RawFilesHandler(w http.ResponseWriter, r *http.Request, d *Context, source string, fileList []string) (int, error) {
 	if d.Share.Hash == "" {
 		filePerms, err := effectiveFilePerms(d, source)

backend/internal/web/duplicates.go

@@ -203,7 +203,7 @@ func duplicatesHandler(w http.ResponseWriter, r *http.Request, d *Context) (int,
 
 	// Generate cache key from all input parameters that affect results
 	// Checksums are always enabled, so cache key doesn't need to include that flag
-	cacheKey := fmt.Sprintf("%s:%s:%d", index.Path, opts.combinedPath, opts.minSize)
+	cacheKey := fmt.Sprintf("%s:%s:%s:%d", index.Path, opts.combinedPath, opts.username, opts.minSize)
 
 	// Check cache first (before acquiring mutex)
 	if cachedResults, ok := duplicateResultsCache.Get(cacheKey); ok {

backend/internal/web/http.go

@@ -242,8 +242,11 @@ func GetRemoteIP(r *http.Request) string {
 
 	xff := r.Header.Get("X-Forwarded-For")
 	if cfg.Http.TrustProxyHeaders && xff != "" {
-		ips := strings.Split(xff, ",")
-		return strings.TrimSpace(ips[0])
+		// Use the rightmost hop: the trusted proxy appends the connecting client, so the
+		// leftmost value is attacker-controlled when clients send X-Forwarded-For.
+		if ip := lastForwardedValue(xff); ip != "" {
+			return ip
+		}
 	}
 
 	xri := r.Header.Get("X-Real-IP")

backend/internal/web/httpRouter.go

@@ -35,6 +35,7 @@ func configureHTTPRouter(router, api, publicRoutes, publicApi *http.ServeMux) {
 	// Auth Routes - /api/auth/
 	// ========================================
 	api.HandleFunc("POST /auth/login", withRateLimit(AuthRateLimitCredentialLockout, loginHelper(loginHandler)))
+	api.HandleFunc("POST /auth/password/change-required", withoutUser(withRateLimitChain(AuthRateLimitCredentialLockout, changeRequiredPasswordHandler)))
 	api.HandleFunc("POST /auth/logout", withOrWithoutUser(withRateLimitChain(AuthRateLimitModerate, logoutHandler)))
 	api.HandleFunc("POST /auth/signup", withoutUser(withRateLimitChain(AuthRateLimitModerate, signupHandler)))
 	api.HandleFunc("POST /auth/otp/generate", withOrWithoutUser(withRateLimitChain(AuthRateLimitModerate, generateOTPHandler)))

backend/internal/web/ldap.go

@@ -158,56 +158,68 @@ func pickUserEntry(entries []*ldap.Entry) *ldap.Entry {
 	return user
 }
 
-// ldapGroupMatchesAdmin returns true if the LDAP group DN matches the configured admin group (full DN or CN value).
-func ldapGroupMatchesAdmin(groupDN, adminGroup string) bool {
-	g := strings.TrimSpace(groupDN)
-	if g == adminGroup {
-		return true
-	}
-	dn, err := ldap.ParseDN(g)
-	if err != nil {
+// ldapGroupMatches reports whether an LDAP group membership value matches a
+// configured group. Matching is case-insensitive and accepts a full DN or a
+// CN-only value. When both sides are DNs, the complete DN must match (case-
+// insensitive); CN-only fallback applies only when one side is not a DN, so
+// groups that share a CN under different parents cannot authorize each other.
+func ldapGroupMatches(member, configured string) bool {
+	member = strings.TrimSpace(member)
+	configured = strings.TrimSpace(configured)
+	if configured == "" {
 		return false
 	}
-	for _, rdn := range dn.RDNs {
-		for _, attr := range rdn.Attributes {
-			if strings.EqualFold(attr.Type, "cn") && attr.Value == adminGroup {
-				return true
-			}
-		}
+	if strings.EqualFold(member, configured) {
+		return true
+	}
+	memberIsDN := ldapIsDN(member)
+	configuredIsDN := ldapIsDN(configured)
+	memberCN := ldapCN(member)
+	configuredCN := ldapCN(configured)
+
+	// Config CN-only vs member full DN.
+	if memberIsDN && !configuredIsDN && memberCN != "" && strings.EqualFold(memberCN, configured) {
+		return true
+	}
+	// Config full DN vs member CN-only.
+	if configuredIsDN && !memberIsDN && configuredCN != "" && strings.EqualFold(member, configuredCN) {
+		return true
 	}
 	return false
 }
 
+// ldapIsDN reports whether s parses as an LDAP distinguished name.
+func ldapIsDN(s string) bool {
+	_, err := ldap.ParseDN(s)
+	return err == nil
+}
+
+// ldapCN returns the first CN RDN value from an LDAP DN string, or "" if none.
+func ldapCN(s string) string {
+	dn, err := ldap.ParseDN(s)
+	if err != nil {
+		return ""
+	}
+	for _, rdn := range dn.RDNs {
+		for _, attr := range rdn.Attributes {
+			if strings.EqualFold(attr.Type, "cn") {
+				return attr.Value
+			}
+		}
+	}
+	return ""
+}
+
 // getOrCreateLdapUser returns the filebrowser user for an LDAP-authenticated username, creating one if configured.
+// userGroups authorization is enforced in getOrCreateAuthenticatedUser via ldapGroupMatches.
 func getOrCreateLdapUser(username string, groups []string) (*users.User, error) {
 	logger.Debugf("getting or creating ldap user %s", username)
 	ldapCfg := settings.Config.Auth.Methods.LdapAuth
 
-	// Check if user is in required groups (if userGroups is configured)
-	if len(ldapCfg.UserGroups) > 0 {
-		userInAllowedGroup := false
-		for _, allowedGroup := range ldapCfg.UserGroups {
-			for _, userGroup := range groups {
-				if ldapGroupMatchesAdmin(userGroup, allowedGroup) {
-					userInAllowedGroup = true
-					break
-				}
-			}
-			if userInAllowedGroup {
-				break
-			}
-		}
-		if !userInAllowedGroup {
-			logger.Warningf("User %s is not in any of the required groups %v. Access denied.", username, ldapCfg.UserGroups)
-			return nil, fmt.Errorf("user %s is not authorized to access this application (not in required groups)", username)
-		}
-		logger.Debugf("User %s is in required group, allowing access.", username)
-	}
-
 	isAdmin := false
 	if ldapCfg.AdminGroup != "" {
 		for _, g := range groups {
-			if ldapGroupMatchesAdmin(g, ldapCfg.AdminGroup) {
+			if ldapGroupMatches(g, ldapCfg.AdminGroup) {
 				isAdmin = true
 				break
 			}

backend/internal/web/ldap_test.go

@@ -90,61 +90,85 @@ func TestPickUserEntry(t *testing.T) {
 	}
 }
 
-func TestLdapGroupMatchesAdmin(t *testing.T) {
+func TestLdapGroupMatches(t *testing.T) {
 	tests := []struct {
 		name       string
-		groupDN    string
-		adminGroup string
+		member     string
+		configured string
 		want       bool
 	}{
 		{
 			name:       "exact DN match",
-			groupDN:    "cn=authentik Admins,ou=groups,dc=ldap,dc=goauthentik,dc=io",
-			adminGroup: "cn=authentik Admins,ou=groups,dc=ldap,dc=goauthentik,dc=io",
+			member:     "cn=authentik Admins,ou=groups,dc=ldap,dc=goauthentik,dc=io",
+			configured: "cn=authentik Admins,ou=groups,dc=ldap,dc=goauthentik,dc=io",
 			want:       true,
 		},
 		{
 			name:       "CN match",
-			groupDN:    "cn=authentik Admins,ou=groups,dc=ldap,dc=goauthentik,dc=io",
-			adminGroup: "authentik Admins",
+			member:     "cn=authentik Admins,ou=groups,dc=ldap,dc=goauthentik,dc=io",
+			configured: "authentik Admins",
+			want:       true,
+		},
+		{
+			name:       "CN match case-insensitive",
+			member:     "cn=it department,ou=groups,dc=example,dc=com",
+			configured: "IT Department",
+			want:       true,
+		},
+		{
+			name:       "full DN match case-insensitive",
+			member:     "CN=Employees,OU=Groups,DC=Example,DC=COM",
+			configured: "cn=employees,ou=groups,dc=example,dc=com",
+			want:       true,
+		},
+		{
+			name:       "config full DN vs member CN-only",
+			member:     "Employees",
+			configured: "cn=Employees,ou=groups,dc=example,dc=com",
 			want:       true,
 		},
 		{
 			name:       "CN no match",
-			groupDN:    "cn=Other Group,ou=groups,dc=test",
-			adminGroup: "authentik Admins",
+			member:     "cn=Other Group,ou=groups,dc=test",
+			configured: "authentik Admins",
 			want:       false,
 		},
 		{
 			name:       "exact no match",
-			groupDN:    "cn=admins,ou=groups,dc=test",
-			adminGroup: "cn=authentik Admins,ou=groups,dc=ldap,dc=goauthentik,dc=io",
+			member:     "cn=admins,ou=groups,dc=test",
+			configured: "cn=authentik Admins,ou=groups,dc=ldap,dc=goauthentik,dc=io",
+			want:       false,
+		},
+		{
+			name:       "same CN different parents rejected",
+			member:     "cn=Admins,ou=Other,dc=example,dc=com",
+			configured: "cn=Admins,ou=Privileged,dc=example,dc=com",
 			want:       false,
 		},
 		{
 			name:       "whitespace trimmed",
-			groupDN:    "  cn=admins,ou=groups,dc=test  ",
-			adminGroup: "cn=admins,ou=groups,dc=test",
+			member:     "  cn=admins,ou=groups,dc=test  ",
+			configured: "cn=admins,ou=groups,dc=test",
 			want:       true,
 		},
 		{
 			name:       "invalid DN returns false",
-			groupDN:    "not-a-valid-dn",
-			adminGroup: "admins",
+			member:     "not-a-valid-dn",
+			configured: "admins",
 			want:       false,
 		},
 		{
-			name:       "empty adminGroup no match",
-			groupDN:    "cn=admins,ou=groups,dc=test",
-			adminGroup: "",
+			name:       "empty configured no match",
+			member:     "cn=admins,ou=groups,dc=test",
+			configured: "",
 			want:       false,
 		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			got := ldapGroupMatchesAdmin(tt.groupDN, tt.adminGroup)
+			got := ldapGroupMatches(tt.member, tt.configured)
 			if got != tt.want {
-				t.Errorf("ldapGroupMatchesAdmin(%q, %q) = %v, want %v", tt.groupDN, tt.adminGroup, got, tt.want)
+				t.Errorf("ldapGroupMatches(%q, %q) = %v, want %v", tt.member, tt.configured, got, tt.want)
 			}
 		})
 	}

backend/internal/web/media.go

@@ -2,7 +2,6 @@ package web
 
 import (
 	"bytes"
-	"errors"
 	"fmt"
 	"net/http"
 	"path/filepath"
@@ -242,7 +241,15 @@ func publicMetadataHandler(w http.ResponseWriter, r *http.Request, d *Context) (
 func lyricsHandler(w http.ResponseWriter, r *http.Request, d *Context) (int, error) {
 	path := r.URL.Query().Get("path")
 	source := r.URL.Query().Get("source")
-	if path == "" || source == "" {
+	fileUser := d.User
+	if d.Share.Hash != "" {
+		source = d.Share.GetSourceName()
+		if source == "" {
+			return http.StatusNotFound, fmt.Errorf("source not found")
+		}
+		path = d.IndexPath
+		fileUser = d.ShareUser
+	} else if path == "" || source == "" {
 		return http.StatusBadRequest, fmt.Errorf("path and source are required")
 	}
 	filePerms, err := effectiveFilePerms(d, source)
@@ -253,17 +260,22 @@ func lyricsHandler(w http.ResponseWriter, r *http.Request, d *Context) (int, err
 		return http.StatusForbidden, fmt.Errorf("user is not allowed to view files in this source")
 	}
 
+	showHidden := d.User.ShowHidden
+	hideFileExt := d.User.HideFileExt
+	if d.Share.Hash != "" {
+		showHidden = d.Share.ShowHidden
+	}
 	fileInfo, err := files.FileInfoFaster(utils.FileOptions{
-		FollowSymlinks:    true,
+		FollowSymlinks:    d.Share.Hash == "",
 		Path:              path,
 		Source:            source,
 		Expand:            true,
 		Content:           false,
 		Metadata:          false,
-		ShowHidden:        d.User.ShowHidden,
-		HideFileExt:       d.User.HideFileExt,
+		ShowHidden:        showHidden,
+		HideFileExt:       hideFileExt,
 		SkipExtendedAttrs: false,
-	}, d.User)
+	}, fileUser)
 	if err != nil {
 		return ErrToStatus(err), err
 	}
@@ -289,34 +301,10 @@ func lyricsHandler(w http.ResponseWriter, r *http.Request, d *Context) (int, err
 // @Failure 404 {object} map[string]string "Not found"
 // @Router /public/api/media/lyrics [get]
 func publicLyricsHandler(w http.ResponseWriter, r *http.Request, d *Context) (int, error) {
-	sourceCfg, ok := settings.Config.Server.SourceMap[d.Share.SourcePath]
-	if !ok {
-		return http.StatusNotFound, fmt.Errorf("source not found")
+	if status, err := publicShareMediaContentPolicy(d); err != nil {
+		return status, err
 	}
-
-	fileInfo, err := files.FileInfoFaster(utils.FileOptions{
-		Path:              d.IndexPath,
-		Source:            sourceCfg.Name,
-		Expand:            true,
-		Content:           false,
-		Metadata:          false,
-		ShowHidden:        d.Share.ShowHidden,
-		HideFileExt:       d.User.HideFileExt,
-		FollowSymlinks:    false,
-		SkipExtendedAttrs: false,
-	}, d.ShareUser)
-	if err != nil {
-		return ErrToStatus(err), err
-	}
-	if !strings.HasPrefix(fileInfo.Type, "audio") {
-		return http.StatusNotFound, fmt.Errorf("file is not an audio file")
-	}
-
-	lyrics, err := files.ExtractLyrics(fileInfo.RealPath)
-	if err != nil {
-		return http.StatusInternalServerError, errors.New("failed to extract lyrics")
-	}
-	return RenderJSON(w, r, map[string]any{"lyrics": lyrics})
+	return lyricsHandler(w, r, d)
 }
 
 // publicSubtitlesHandler is the share-link variant of subtitlesHandler.
@@ -330,8 +318,8 @@ func publicLyricsHandler(w http.ResponseWriter, r *http.Request, d *Context) (in
 // @Success 200 {string} string "Raw subtitle content"
 // @Router /public/api/media/subtitles [get]
 func publicSubtitlesHandler(w http.ResponseWriter, r *http.Request, d *Context) (int, error) {
-	if d.Share.ShareType == "upload" {
-		return http.StatusNotImplemented, fmt.Errorf("browsing is disabled for upload shares")
+	if status, err := publicShareMediaContentPolicy(d); err != nil {
+		return status, err
 	}
 	return subtitlesHandler(w, r, d)
 }

backend/internal/web/media_share_test.go

@@ -0,0 +1,96 @@
+package web
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/gtsteffaniak/filebrowser/backend/internal/database/share"
+	"github.com/gtsteffaniak/filebrowser/backend/internal/database/users"
+)
+
+func publicMediaShareContext(owner *users.User, sourceRoot string, editable share.ShareEditable) *Context {
+	link := share.Share{
+		ShareColumns: share.ShareColumns{
+			Hash: "mediashare",
+			Path: "/shared",
+		},
+		FrontendShareInfo: editable.FrontendShareInfo,
+		ShareLimits:       editable.ShareLimits,
+		SourcePath:        sourceRoot,
+	}
+	return &Context{
+		User: &users.User{
+			FrontendUser: users.FrontendUser{Username: users.AnonymousUserName},
+		},
+		ShareUser: owner,
+		IndexPath: "/shared/song.mp3",
+		Share:     link,
+	}
+}
+
+func TestPublicLyricsHandler_BlocksWhenFileViewerDisabled(t *testing.T) {
+	sourceRoot, _, owner := setupShareArchiveDownloadTest(t)
+	d := publicMediaShareContext(owner, sourceRoot, share.ShareEditable{DisableFileViewer: true})
+	req := httptest.NewRequest(http.MethodGet, "/public/api/media/lyrics?hash=mediashare&path=/song.mp3", nil)
+	rec := httptest.NewRecorder()
+
+	status, err := publicLyricsHandler(rec, req, d)
+	if err == nil {
+		t.Fatal("expected error when file viewer is disabled")
+	}
+	if status != http.StatusForbidden {
+		t.Fatalf("expected 403, got status=%d err=%v", status, err)
+	}
+}
+
+func TestPublicLyricsHandler_BlocksWhenDownloadLimitReached(t *testing.T) {
+	sourceRoot, _, owner := setupShareArchiveDownloadTest(t)
+	d := publicMediaShareContext(owner, sourceRoot, share.ShareEditable{
+		DownloadsLimit: 1,
+	})
+	d.Share.Downloads = 1
+	req := httptest.NewRequest(http.MethodGet, "/public/api/media/lyrics?hash=mediashare&path=/song.mp3", nil)
+	rec := httptest.NewRecorder()
+
+	status, err := publicLyricsHandler(rec, req, d)
+	if err == nil {
+		t.Fatal("expected error when download limit is exhausted")
+	}
+	if status != http.StatusForbidden {
+		t.Fatalf("expected 403, got status=%d err=%v", status, err)
+	}
+}
+
+func TestPublicSubtitlesHandler_BlocksWhenDownloadLimitReached(t *testing.T) {
+	sourceRoot, _, owner := setupShareArchiveDownloadTest(t)
+	d := publicMediaShareContext(owner, sourceRoot, share.ShareEditable{
+		DownloadsLimit: 1,
+	})
+	d.Share.Downloads = 1
+	req := httptest.NewRequest(http.MethodGet, "/public/api/media/subtitles?hash=mediashare&path=/movie.mp4&name=movie.srt&embedded=false", nil)
+	rec := httptest.NewRecorder()
+
+	status, err := publicSubtitlesHandler(rec, req, d)
+	if err == nil {
+		t.Fatal("expected error when download limit is exhausted")
+	}
+	if status != http.StatusForbidden {
+		t.Fatalf("expected 403, got status=%d err=%v", status, err)
+	}
+}
+
+func TestPublicSubtitlesHandler_BlocksWhenDownloadDisabled(t *testing.T) {
+	sourceRoot, _, owner := setupShareArchiveDownloadTest(t)
+	d := publicMediaShareContext(owner, sourceRoot, share.ShareEditable{DisableDownload: true})
+	req := httptest.NewRequest(http.MethodGet, "/public/api/media/subtitles?hash=mediashare&path=/movie.mp4&name=movie.srt&embedded=false", nil)
+	rec := httptest.NewRecorder()
+
+	status, err := publicSubtitlesHandler(rec, req, d)
+	if err == nil {
+		t.Fatal("expected error when downloads are disabled")
+	}
+	if status != http.StatusForbidden {
+		t.Fatalf("expected 403, got status=%d err=%v", status, err)
+	}
+}