* fix(webdav): correct COPY/MOVE semantics with named copy support
Signed-off-by: Lythen <intro-iu@outlook.com>
* feat(webdav): persist dead properties with MOVE migration
Signed-off-by: Lythen <intro-iu@outlook.com>
* fix(webdav): enforce locks on resolved paths, support shared locks
Signed-off-by: Lythen <intro-iu@outlook.com>
* fix(fs): fall back to transfer task for same-dir copy
Signed-off-by: Lythen <intro-iu@outlook.com>
* fix(webdav): escape LIKE patterns, check dstDir is dir, bound PROPFIND body
Signed-off-by: Lythen <intro-iu@outlook.com>
* fix(webdav): escape backslash in LIKE, reduce dead prop retry
Signed-off-by: Lythen <intro-iu@outlook.com>
* fix(webdav): isolate shared lock instances
- Track each lock token with independent details and expiry state.\n- Keep resource nodes for path conflict accounting only.\n- Cover independent shared-lock expiration in memLS tests.
* fix(webdav): preserve dead property lifecycle
- Copy and replace dead properties with COPY destinations.\n- Remove dead-property subtrees after successful DELETE.\n- Stage MOVE properties before clearing the destination subtree.\n- Add database-backed regression coverage for copy and delete.
* fix(webdav): protect overwrite copy and move
- Validate source objects before touching overwrite destinations.\n- Stage COPY content under a collision-free name and restore destinations on failure.\n- Preserve MOVE destinations with a backup until the resource operation succeeds.\n- Route named same-storage copies through the direct destination-name transfer path.
* fix(webdav): harden overwrite staging
- Skip NoOverwriteUpload backup handling for collision-free internal COPY staging.\n- Treat post-commit overwrite backup cleanup failures as warnings.
* test(webdav): update lock lookup expectations
- Compare lookup results with independent lock instances.\n- Keep invalid token expectations nil after the lock state split.
* fix(webdav): complete litmus compliance
- Preserve named same-storage collection copies with isolated native staging.\n- Evaluate WebDAV ETag conditions and distinguish 412 from 423 lock failures.\n- Return 201 for lock-null resources and cover the new condition behavior.
* fix(fs): harden named copy staging
- retry staging cleanup from the deferred path and report residual directories
- document hook context semantics and wrap staging operation errors
Signed-off-by: Lythen <intro-iu@outlook.com>
* fix(core): support Go 1.27 checks
- Replace dynamic format strings with explicit format verbs and guard optional network configuration.
- Stabilize multipart cleanup, proxy, search, and MCP tests.
Co-authored-by: Codex <267193182+codex@users.noreply.github.com>
* fix(webdav): coordinate file and property transactions
- Keep MOVE, COPY, and DELETE file changes coordinated with dead-property transactions.
- Compensate filesystem changes when file operations or database commits fail.
- Add WebDAV coverage for transaction and recovery failures.
Co-authored-by: Codex <267193182+codex@users.noreply.github.com>
* fix(webdav): reject writes without parent collections
- Require an existing parent collection for PUT.
- Reject MKCOL when its parent is missing or not a collection.
Co-authored-by: Codex <267193182+codex@users.noreply.github.com>
* fix(webdav): refresh parent before delete checks
- Refresh the parent listing before checking whether a DELETE target exists.
- Return 404 for missing resources, including storage-not-found errors.
Co-authored-by: Codex <267193182+codex@users.noreply.github.com>
---------
Signed-off-by: Lythen <intro-iu@outlook.com>
Co-authored-by: Intro <Intro-iu@outlook.com>
Co-authored-by: Codex <267193182+codex@users.noreply.github.com>
* fix(s3): sign content type for direct uploads
- Include the inferred MIME type in presigned PutObject requests
- Return the signed Content-Type header for frontend uploads
Co-authored-by: Codex <267193182+codex@users.noreply.github.com>
* fix(drivers/s3): use client content type for direct uploads
- Accept and validate the client-provided direct upload media type
- Pass the type to the S3 signer through a typed context key
- Default missing types to application/octet-stream
Co-authored-by: Codex <267193182+codex@users.noreply.github.com>
---------
Co-authored-by: Codex <267193182+codex@users.noreply.github.com>
ListObjects with a delimiter returned directories as common prefixes
without the trailing delimiter ("base/20261009T020008" instead of
"base/20261009T020008/"). S3 always includes it, and clients such as
barman-cloud (used by CloudNativePG) ignore prefixes without it, so
backups stored through the S3 gateway could not be listed.
Append "/" to common prefixes, as rclone serve s3 did in a3f3fc61e.
Also sort directory entries as if directories carried their trailing
slash, as rclone did in 04697cc02, so keys are emitted in S3 order
("b.txt" before "b/"). The marker-based paging added in #2968 relies on
that order; without it a listing resumed from a marker skips keys when
a directory "b" sits next to a file "b.txt". This already affected
recursive listings and would affect delimited ones once prefixes end
with "/".
Signed-off-by: zeroornull <18650317+zeroornull@users.noreply.github.com>
Co-authored-by: zeroornull <18650317+zeroornull@users.noreply.github.com>
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* fix(aliyundrive): limit callback concurrency
- Share proxy callback admission by Aliyun user identity and hold permits for complete response-body lifetimes.
- Retry only verified callback-capacity rejections while preserving direct redirects and server download limiting.
- Map exhausted temporary capacity to S3 SlowDown through the merged OpenListTeam gofakes3 module.
- Cover shared limits, lifecycle release, cancellation, retry classification, and the S3 HTTP response.
Co-authored-by: Codex <267193182+codex@users.noreply.github.com>
# Conflicts:
# go.mod
# go.sum
# server/s3/pager.go
* fix(op): separate redirect and proxy link cache entries
- Include redirect mode in the link cache key for all drivers.
- Cover both redirect-to-proxy and proxy-to-redirect cache reuse.
Co-authored-by: Codex <267193182+codex@users.noreply.github.com>
* fix(proxy): close range bodies before opening next
- make ServeHTTP own each range body and preserve cleanup failures
- remove the aggregate range closer and pass range readers directly
- replace the obsolete callback transport test with focused lifecycle coverage
Co-authored-by: Codex <267193182+codex@users.noreply.github.com>
---------
Co-authored-by: nostalume <nostalucent@gmail.com>
Co-authored-by: Codex <267193182+codex@users.noreply.github.com>
test(s3): encode multipart fixture paths
- Serialize the Local storage addition instead of interpolating filesystem paths into JSON.
- Keep multipart fixture behavior portable across Windows and Linux.
Co-authored-by: nostalume <nostalucent@gmail.com>
Co-authored-by: Codex <267193182+codex@users.noreply.github.com>
- Resolve and authorize the canonical destination from the request payload
- Reject upload capabilities that cross virtual storage mount boundaries
- Remove the unrelated File-Path middleware authorization check
Co-authored-by: Codex <267193182+codex@users.noreply.github.com>
Signed-off-by: jyxjjj <16695261+jyxjjj@users.noreply.github.com>
* feat(multipart): add chunk reassembly window
- Reassemble concurrently uploaded chunks into a sequential stream through a ring file, bounding disk usage to slots*chunkSize per session
- Park writers up to a deadline when their slot is busy instead of rejecting instantly, so flow control does not surface as connection errors in browsers
- Record a per-chunk CRC32 table for re-fill verification and keep it readable after close
- Propagate cancellation to blocked readers via CloseWithError so drivers treat aborts like canceled requests
- Cover ordering, backpressure, idempotent resends and close/abort wake-ups with race-enabled tests
* feat(multipart): add pipelined upload session manager
- Start the driver upload at session init over a sequential stream backed by the window, so client-to-server and server-to-storage transfers run concurrently
- Attach client-provided hashes to the stream so drivers can attempt rapid upload before any chunk arrives, and absorb chunks racing pipeline completion idempotently
- Keep only metadata and chunk CRCs after a failed attempt: re-sending chunk 0 re-fills a fresh window, and content changes between attempts are rejected
- Resume receiving sessions only when client hashes prove the same file; failed_retriable sessions resume unconditionally
- Reclaim sessions with a sliding-TTL GC and sweep orphaned ring files at startup
- Cover the state machine with race-enabled tests over a stubbed storage layer
* feat(setting): add multipart upload settings
- Add multipart_enabled and multipart_chunk_size (MB) as public traffic settings
- Validate the chunk size on save (integer within 1-90) via the setting item hook
* feat(server): add multipart upload API
- Add /api/fs/multipart init/chunk/complete/status/abort endpoints with headers aligned with /fs/put
- Gate init behind the FsUp permission checks and reuse the client upload rate limiter for chunk uploads
- Drain the request body before answering chunk requests on every path, so browsers do not see early responses as network errors
- Start the multipart session GC when the router is initialized to reclaim ring files orphaned by a previous run
* refactor(multipart): remove unused overwrite session field
- The overwrite flag was stored on the session but never read: the handler
performs the pre-check and op.Put owns the overwrite semantics
* feat(setting): allow any positive multipart chunk size
- Validate the setting as a positive integer only; self-hosted admins decide
the ceiling themselves instead of an arbitrary 90MB cap
- Keep clamping the client-suggested X-Chunk-Size to the admin value: the
server buffers a window of 8 chunks per session, so an unbounded client
suggestion would translate directly into server-side disk usage
* refactor(server): simplify multipart chunk size clamp
- Fold the two-step clamp into one branch: the ceiling is already floored,
so a client suggestion just lowers the size with a 1MB floor
Set `WithResidentKeyRequirement` option during registration to enable discoverable keys.
Existing keys do not require migration. They won't appear without entering username, but work normally after username input, legacy flows remain unaffected.
Redirect S3 GET object requests to direct links when the underlying storage can provide one and proxying is not required.
Redirect eligible S3 PUT object requests to HttpDirect single PUT upload URLs with 307, while falling back to the existing gofakes3 stream path for unsupported uploads.
Allow OneDrive Sharelink direct upload info to use simple content PUT URLs for files within Microsoft's single-upload limit.
Co-authored-by: syscc <syscc@users.noreply.github.com>
Co-authored-by: Codex <codex@openai.com>
Add end-to-end offline download support for torrent files, magnet links, and ed2k links, including torrent parse and generate APIs, CAS-based rapid upload for Cloud189, and protocol-aware tool routing with transfer flow improvements.
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: j2rong4cn <36783515+j2rong4cn@users.noreply.github.com>
Co-authored-by: j2rong4cn <j2rong@qq.com>
Co-authored-by: Suyunjing <suyunmeng@oplist.org.cn>
* refactor(permission): rename permission check functions for clarity
- User.CanWrite() → User.CanCreateFilesOrFolders()
- common.CanWrite() → common.CanWriteContentBypassUserPerms()
- common.IsApply() → common.MetaCoversPath()
Improves code readability by making function names more descriptive.
The new MetaCoversPath name clearly indicates it checks if a meta rule
covers a specific path. It better conveys that it's a query function
rather than an action, and the applyToSubFolder parameter is more
explicit than applySub.
Also adds comprehensive test coverage:
- 10 tests for MetaCoversPath core logic
- 6 tests for CanWriteContent
UserPerms
- 7 tests for getReadme
- 5 tests for getHeader
- 6 tests for isEncrypt
- 9 tests for whetherHide
Total: 43 test scenarios covering all path matching and permission
inheritance logic. Tests verify both normal behavior and bug fixes
for Readme/Header information leakage and write permission bypass.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
* feat(permission): implement fine-grained user permissions for read/write operations
Add per-user read and write permission controls at the meta level to enable
more granular access control beyond the existing permission flags.
Key changes:
- Add ReadUsers/WriteUsers fields to Meta model with sub-directory inheritance flags
- Implement CanRead and CanWrite permission check functions in server/common
- Filter file list results based on user read permissions
- Add permission checks across all file operations (FTP, HTTP handlers, WebDAV)
- Simplify error handling pattern for MetaNotFound errors throughout codebase
This allows administrators to restrict specific users from accessing or modifying
certain paths, providing finer control over file system permissions.
Note: Batch and recursive operations (FsMove, FsCopy, FsRemove, FsRecursiveMove,
FsBatchRename, FsRegexRename) currently check parent directory permissions only.
Individual item permission checks are not performed for performance reasons.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
* test(permission): add comprehensive tests for CanRead, CanWrite, and combined permission checks
Add TestCanRead, TestCanWrite, TestCanAccessWithReadPermissions, and
TestWritePermissionCombinations to validate the three-layer permission
system including nil user/meta, sub-path inheritance, user whitelists,
and root-level restrictions.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(webdav): use safe type assertion for MetaPassKey to prevent panic
Bearer-token and OPTIONS auth paths do not set MetaPassKey in context,
causing a panic when handlers perform a forced type assertion on nil.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(permission): treat nil user as system context in CanRead/CanWrite
Previously, CanRead/CanWrite returned false for nil user, causing
filterReadableObjs to return an empty list when fs.List is called from
internal contexts without a user (e.g. context.Background()). A nil user
represents an internal/system call and should bypass per-user restrictions,
consistent with how whetherHide already handles nil user.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(fsmanage): prevent path traversal in FsRemove
The previous check only skipped names that resolved to "/", but did not
prevent traversal to sibling directories (e.g. "../secret"), which could
bypass the CanWrite permission check that is only applied to req.Dir.
Replace with a post-join prefix check to ensure each resolved path stays
within reqPath.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(webdav): align MetaPassKey behavior with FTP auth logic
For guest users, the WebDAV password input serves as the meta folder
password (consistent with FTP anonymous/guest handling). For authenticated
users, MetaPassKey is set to empty string since their login password is
not the meta folder password.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(permission): require write auth for fs list refresh
* refactor(permission): use MetaCoversPath in CanRead/CanWrite for consistency
Replace inline `(Sub || meta.Path == path)` logic with MetaCoversPath,
consistent with CanWriteContentBypassUserPerms. Also fix a copy-paste
error in the CanWrite comment (read → write).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
Co-authored-by: Pikachu Ren <40362270+PIKACHUIM@users.noreply.github.com>
In BeginAuthnRegistration (webauthn.go), missing return statements after
error responses caused the function to continue executing with a nil
authnInstance, potentially leading to a nil pointer panic.
In OIDCLoginCallback and SSOLoginCallback (ssologin.go), missing return
statements after GenerateToken/autoRegister errors caused the handler to
send a second response, resulting in a superfluous response write.
In SetThunderBrowser (offline_download.go), the default case of the
storage type switch sent an error response but did not return, causing
SaveSettingItems and tool initialization to continue executing even when
driver type validation failed.
* fix(FsRemove): add validation for empty items in delete file list
If Req.Names contains an empty string item, the whole directory will be removed. As a result we need add a simple guard to prevent such cases.
Signed-off-by: huyuantao <huyuantao@ultrarisc.com>
* fix(FsRemove): enhance validation to prevent unintended directory deletion
1. Use `utils.FixAndCleanPath` to correctly identify and block invalid names.
2. Change error handling from `return` to `continue`.
Signed-off-by: huyuantao <huyuantao@ultrarisc.com>
---------
Signed-off-by: huyuantao <huyuantao@ultrarisc.com>
Co-authored-by: Pikachu Ren <40362270+PIKACHUIM@users.noreply.github.com>
Mingluan MuandCodex
ShenLinandCodex
ILoveScratchandPIKACHUIM
ZRHan
awaae
Pikachu RenandPIKACHUIM
MadDogOwner
ThetaPilla.
ILoveScratch
EzraRT
So
Suyunjing
Miao Zhao
Hu YuantaoandPikachu Ren
mcxiedidi