Commit Graph

915 Commits

Author SHA1 Message Date
Edouard Vanbelle 73f0b0fa47 refactor(lifecycle hooks): simplify integration of new services
* make more coherent lifecycles
  * remove specific implementation on different handlers (they do not need to know existence of ThumbnailSerice nor AudioMetadataService)
  * reduce risk of orphean objects
  * ensure additional services are correctly wired (ex: Thumbnail generation was not covering all upload cases)
  * more details on docs/architecture/file-and-blob-lifecycle.md :

```rust
// application/ports/file_lifecycle.rs
pub trait FileLifecycleHook {

    fn on_file_created(file_id, blob_hash, content_type, is_new_blob);
    fn on_file_updated(file_id, blob_hash, content_type);
    fn on_file_copied(file_id, blob_hash, content_type, source_id)
    fn on_file_deleted(file_id);
}

// application/ports/blob_lifecycle.rs
pub trait BlobLifecycleHook {

    fn on_blob_created(blob_hash, content_type);
    fn on_blob_deleted(blob_hash);
}
```
2026-05-22 13:40:58 +02:00
Dionisio Pozo 9206669ee6 Merge pull request #387 from EdouardVanbelle/feat/trash-item-with-thumbnail-and-path 2026-05-22 08:12:39 +02:00
Edouard Vanbelle 191f725199 feat(ui/trash): show original file path in tooltip on mouse over + display thumbnails
* fix: permission also check elements trashed elements
 * tested manually
 * all automated tests ok
2026-05-22 02:26:11 +02:00
Dionisio Pozo 0cd2f24b7f Merge pull request #383 from EdouardVanbelle/permissions 2026-05-22 00:43:43 +02:00
Edouard Vanbelle 76a85949e7 fix(trash)+refactor(file life cycle)
* fix issue with the empty trash (wasn't calling thumbnail clean up)
 * refactor file service life cycle (TrashService don't call directly ThumbnailService, but call the on_file_deleted() hook
 * remove unused mehod: _validate_user_ownership()
2026-05-22 00:28:39 +02:00
Edouard Vanbelle dd68d783e0 fix(authz): permit policiy: a user with Delete permission can delete a file/folder. Only the owner can permanently delete or restore a trashed item 2026-05-21 22:45:49 +02:00
Edouard Vanbelle a1c21ce446 refactor(authz): permet require_permission() as has_permission(), more explicit 2026-05-21 21:50:42 +02:00
Edouard Vanbelle cb35775f77 fix(dedub): correct ref count on hashes, many thanks to you api tests... 2026-05-21 21:12:38 +02:00
Edouard Vanbelle eb95567a7d feat(authz): test & cover batch cases
┌────────────────────────────────┬─────────────────────────────────┬───────────────────────┬─────────────────┬──────────────────────────────┐
  │            Endpoint            │        Phase 3A no-grant        │    Phase 3B Viewer    │ Phase 3C Editor │        Phase 3D Admin        │
  ├────────────────────────────────┼─────────────────────────────────┼───────────────────────┼─────────────────┼──────────────────────────────┤
  │ POST /api/batch/files/get      │ 400 (all failed)                │ 200 (2 successful)    │ —               │ —                            │
  ├────────────────────────────────┼─────────────────────────────────┼───────────────────────┼─────────────────┼──────────────────────────────┤
  │ POST /api/batch/files/move     │ 400                             │ 400 (no Update)       │ 200             │ —                            │
  ├────────────────────────────────┼─────────────────────────────────┼───────────────────────┼─────────────────┼──────────────────────────────┤
  │ POST /api/batch/files/copy     │ 400                             │ —                     │ 200             │ —                            │
  ├────────────────────────────────┼─────────────────────────────────┼───────────────────────┼─────────────────┼──────────────────────────────┤
  │ POST /api/batch/files/delete   │ 400                             │ 400                   │ 400 (no Delete) │ —                            │
  ├────────────────────────────────┼─────────────────────────────────┼───────────────────────┼─────────────────┼──────────────────────────────┤
  │ POST /api/batch/folders/get    │ 400                             │ 200                   │ —               │ —                            │
  ├────────────────────────────────┼─────────────────────────────────┼───────────────────────┼─────────────────┼──────────────────────────────┤
  │ POST /api/batch/folders/create │ 400                             │ —                     │ 201             │ —                            │
  ├────────────────────────────────┼─────────────────────────────────┼───────────────────────┼─────────────────┼──────────────────────────────┤
  │ POST /api/batch/folders/move   │ 400                             │ —                     │ 200             │ —                            │
  ├────────────────────────────────┼─────────────────────────────────┼───────────────────────┼─────────────────┼──────────────────────────────┤
  │ POST /api/batch/folders/copy   │ 400                             │ —                     │ 200             │ —                            │
  ├────────────────────────────────┼─────────────────────────────────┼───────────────────────┼─────────────────┼──────────────────────────────┤
  │ POST /api/batch/folders/delete │ 400                             │ —                     │ 400 (no Delete) │ 200                          │
  ├────────────────────────────────┼─────────────────────────────────┼───────────────────────┼─────────────────┼──────────────────────────────┤
  │ POST /api/batch/trash          │ 400                             │ —                     │ —               │ 400 (owner-only, documented) │
  ├────────────────────────────────┼─────────────────────────────────┼───────────────────────┼─────────────────┼──────────────────────────────┤
  │ POST /api/batch/download       │ 404 (NotFound)                  │ 200 + application/zip │ —               │ —                            │
  ├────────────────────────────────┼─────────────────────────────────┼───────────────────────┼─────────────────┼──────────────────────────────┤
  │ GET /api/batch/download?...    │ 404                             │ 200 + zip             │ —               │ —                            │
  ├────────────────────────────────┼─────────────────────────────────┼───────────────────────┼─────────────────┼──────────────────────────────┤
  │ Phase 3E lifecycle cleanup     │ grants table empty after delete │                       │                 │                              │
  └────────────────────────────────┴─────────────────────────────────┴───────────────────────┴─────────────────┴──────────────────────────────┘
2026-05-21 20:30:58 +02:00
Edouard Vanbelle a53c09f361 feat(authz): covert and test chunked upload with permissions 2026-05-21 20:30:58 +02:00
Edouard Vanbelle bd1b17b589 test(grants): full coverate of /api/files and /api/folders 2026-05-21 20:30:58 +02:00
Edouard Vanbelle 3362e277ab feat(authz): check permission on read handlers + check create permission on folder 2026-05-21 20:30:53 +02:00
Edouard Vanbelle cba9be8c21 feat(rebac): first pass 2026-05-20 22:56:00 +02:00
Edouard Vanbelle 2c53f99089 ai: save ReBAC Permission, Grants, Cascading plan 2026-05-20 21:49:25 +02:00
Edouard Vanbelle dfb082fdf4 refactor(server): file_management_service: move all method without owner check into private, add folder_ports 2026-05-20 15:39:53 +02:00
Edouard Vanbelle ac42a6d3cc test(api): check right management for folder creation and folder move + check also webdsav MKCOL protection
│ Steps 1-6 │ Setup: admin's resources + create bob + bob's home folder                                                           │
  │ Step 7    │ REST: bob can't create a folder inside admin's home → 404                                                           │
  │ Step 8    │ REST: bob can't create inside admin's private folder → 404                                                          │
  │ Step 9    │ REST: parent_id: null auto-resolves to bob's home (documents the convenience)                                       │
  │ Step 10   │ REST: positive control — bob creates in his own home → 201                                                          │
  │ Step 12   │ REST: bob can't move his file into admin's folder → 404                                                             │
  │ Step 13   │ REST: bob moves file to root (null) → 200 (legitimate root state)                                                   │
  │ Step 14   │ REST: bob can't read admin's file → 404                                                                             │
  │ Step 15   │ REST: admin's tree integrity preserved                                                                              │
  │ Step 16   │ WebDAV: path-prefix isolation rewrites cross-user paths into caller's tree                                          │
  │ Step 17   │ WebDAV: positive control MKCOL in bob's own tree → 201                                                              │
  │ Step 18   │ WebDAV: bob's home contains the rewritten "My Folder - admin" sub-folder, proving the isolation rerouted the attack │
  │ Step 19   │ WebDAV: admin's tree never sees bob's WebDAV traffic                                                                │
2026-05-20 13:04:15 +02:00
Edouard Vanbelle f8b30e78a6 refactor(create_folder): add an ownership check while creating a folder + refactor code 2026-05-20 12:59:04 +02:00
Dionisio Pozo 91ff3df35f Merge pull request #381 from EdouardVanbelle/fix/253-scrolldown-on-shares 2026-05-19 23:25:36 +02:00
Edouard Vanbelle 3c3be9b930 feat(share): permit scrolldown+ keep header sticky on the top
this solve issue raised on #253
2026-05-19 22:52:46 +02:00
Dionisio Pozo 032e283867 Merge pull request #375 from dscso/patch-1 2026-05-19 18:22:04 +02:00
Dionisio Pozo 6734bbbd09 Merge pull request #374 from EdouardVanbelle/style/type 2026-05-19 18:21:20 +02:00
Dionisio Pozo 3d105d76fe Merge pull request #380 from EdouardVanbelle/front/logo 2026-05-19 18:15:03 +02:00
Dionisio Pozo 6396270167 Merge pull request #379 from EdouardVanbelle/fix/front-duplicate-declaration 2026-05-19 18:14:48 +02:00
Edouard Vanbelle 623773f5e3 feat(ui): increase logo by reducing viewbox 2026-05-19 17:52:00 +02:00
Edouard Vanbelle e2e9aedd80 remove trailing new line according biome notification 2026-05-19 17:37:30 +02:00
Edouard Vanbelle 95aab1f3a7 fix(logo): specify localisation of oxicloud logo for browsers 2026-05-19 17:28:12 +02:00
Edouard Vanbelle 3557bc596a fix(front:pathTooltip): correct importation of pathTooltip.css 2026-05-19 14:55:37 +02:00
Edouard Vanbelle 7edc30978a fix(bundle): permits use of JS 'import * as' + ensure no duplicated importation
example: here it fixes issue with `static/js/features/library/recent.js` and `static/js/features/library/favorites.js`
    ithat are both imporing:
    ```javascript
        import * as pathTooltip from '../pathTooltip.js'
    ```
2026-05-19 14:16:37 +02:00
Edouard Vanbelle 872abd4d27 test: add front end folder management test (creation, renaming, etc)
note: firefox test remove due to idempotence issue
2026-05-19 13:31:20 +02:00
Edouard Vanbelle 126251a184 fix(ui/modal): ensure modal is reusable (confirm button was disabled on previous use) 2026-05-19 11:17:32 +02:00
Edouard Vanbelle 0fba4ce7bc fix(ui): clear empty state on folder creation 2026-05-19 11:16:27 +02:00
Edouard Vanbelle 73114acf39 ia: add directive to claude code regarding the frontend checks 2026-05-19 10:18:40 +02:00
Edouard Vanbelle 09b8550067 fix(publicShare): correct load of icons.js + correct grid button (icon was missing) 2026-05-19 10:18:40 +02:00
Edouard Vanbelle a181d4081e ci: add typescript check (no emit, check only types are fully declared) 2026-05-19 10:18:40 +02:00
Edouard Vanbelle 82561a2b90 fix(ui): add RecentItem type + ad protection while building items 2026-05-19 10:18:40 +02:00
Edouard Vanbelle 79a12018b1 fix(folder_service): propagate 409 error if folder aleady exists 2026-05-19 10:18:40 +02:00
Edouard Vanbelle fac184ccfe style(front/js): apply types on all objects
- reduce amount of warnings in IDE
    - maximize API type mapping with static/js/core/types.js
2026-05-19 10:18:33 +02:00
Edouard Vanbelle a38475bd2c style(server): align text 2026-05-19 09:42:44 +02:00
Edouard Vanbelle edbfe2848c fix(front): fix issue with already declared constants on release mode
- ensure not loading twice the same variables, namespace to ensure it in the future
 - end to end tests where successfull, need to check it is not reusing a previous release (in cache from build CI)
 - fix: #377 #378
2026-05-19 09:36:24 +02:00
Jurek ffcbbf99c1 Adding OXICLOUD_DISABLE_REGISTRATION in documentation 2026-05-18 10:45:25 +02:00
Dionisio Pozo 740b73bc8a Merge pull request #373 from TW199501/feat/i18n-zh-tw 2026-05-17 21:51:18 +02:00
tw199501 a142d52d05 feat(i18n): add Traditional Chinese (zh-TW) locale
Adds full Traditional Chinese translation (628 keys, 100% parity with
en.json) and the registration plumbing to make it pickable in the UI.

Registration spans three layers that all needed updating for the locale
to actually be selectable end-to-end:
- static/locales/zh-TW.json (new) — TW vocabulary (儲存/雲端/檔案/偵測),
  uses 「」 corner brackets for in-string quoting
- core/i18n.js: add 'zh-TW' to supportedLocales — without this,
  setLocale('zh-TW') was silently rejected by the whitelist and the
  previous locale stayed active (visible as the "picked 繁中 but the
  setup step still shows 簡中" bug)
- core/languageSelector.js: add 'zh-TW' to AVAILABLE_LOCALES + fallback
- features/auth/auth.js: add 'zh-TW' to ALL_LANGUAGES (🇹🇼 繁體中文)
  and LANGUAGE_TEXTS bootstrap table (used before i18n loads)

Browser detection rewrite (i18n.js + auth.js detectBrowserLanguage):
The previous navigator.language?.substring(0, 2) truncated zh-TW → zh
and routed Traditional Chinese browsers to Simplified. Replaced with
three-tier matching: exact full-tag > Chinese script/region heuristic
(zh-Hant*, zh-{TW,HK,MO}) > primary subtag fallback.

Disambiguates the existing zh entry: "Chinese / 中文" became
"Simplified Chinese / 简体中文".

Drive-by cleanups discovered while wiring up the above:
- Remove dead t() in i18n.js (export uses safeT, no callers of bare t)
- Remove dead fetchUserData() and logout() in auth.js (userMenu.js has
  its own local logout())
- Extract errMessage(unknown→string) and inputVal(id) helpers for the
  catch sites and getElementById('x').value sites that needed TS
  narrowing under checkJs
- Type-annotate module-scope let forms/errors/panels with
  HTMLFormElement and HTMLElement so .addEventListener and .reset()
  resolve under strict
- Drop navigator.userLanguage IE legacy fallback (DOM lib has no field)
- jsconfig.json: drop exactOptionalPropertyTypes (only valid with
  strictNullChecks, which the project deliberately disables)
- .gitignore: ignore docker-compose.override.yml for local bind-mount
  dev workflow

Verified clean before commit: biome ci, tsc --noEmit, i18n key parity
(628/628), HTTP smoke test against running container.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-17 23:37:13 +08:00
Dionisio Pozo 8e6dc32baf Merge pull request #371 from kamil-alekber/feat/mobile-search-language-ui
feat(ui): improve mobile search and consolidate language selector
2026-05-17 16:17:39 +02:00
Kamil Alekberov fe0a8c7f72 feat(ui): improve mobile search and consolidate language selector
- On mobile (≤768px), replace the full search bar in the topbar with a
  search icon button; tapping it expands a full-width search overlay
  with a back arrow to collapse (Google Drive-style pattern)
- Escape key also collapses the mobile search overlay
- Hide the redundant inline search icon when the mobile search bar is
  active (submit button already has one)
- Move the language selector from the topbar into the user menu for all
  screen sizes, reducing topbar clutter; it renders as an accordion row
  matching other menu items
- Fix user menu positioning in RTL layouts (Arabic/Persian): anchor to
  left:0 instead of right:0 so the panel opens inward rather than
  off-screen
2026-05-17 18:41:34 +05:00
Dionisio Pozo 9aef9ea787 Merge pull request #370 from AtalayaLabs/claude/create-release-0.6.0-hww8o 2026-05-15 20:25:33 +02:00
Claude 70a1e19d3f chore(release): bump version to 0.6.0 2026-05-15 17:56:04 +00:00
Dionisio Pozo 4d089dc6a1 Merge pull request #367 from EdouardVanbelle/feat/ipv6 2026-05-15 07:47:01 +02:00
Edouard Vanbelle 815c9df613 feat(server): add support of IPv6 (no dual stack) 2026-05-14 20:11:12 +02:00
Dionisio Pozo 3e3551cba1 Merge pull request #365 from EdouardVanbelle/feat/openapi
feat(openapi): complete openapi with new shares routes
2026-05-14 01:35:24 +02:00
Edouard Vanbelle 059469c0cc feat(openapi): complete openapi with new shares routes
- GET /api/s/{token}/contents — list root folder of a shared folder
  - GET /api/s/{token}/contents/{folder_id} — list subfolder
  - GET /api/s/{token}/file/{file_id} — download a file within a shared folder
  - GET /api/s/{token}/zip — download root as ZIP
  - GET /api/s/{token}/zip/{folder_id} — download subfolder as ZIP

  (added from @abnvle)
2026-05-14 00:50:15 +02:00