- File size: prefer FileSizeBytes, fall back to FileSize (MB) * 1024^2
for files uploaded before FileSizeBytes was added
- Timestamps: use TimeStamp from metadata instead of current time,
so clients show the actual upload date, not the PROPFIND request time
Read FileType from metadata to populate D:getcontenttype (e.g.
image/jpeg), enabling WebDAV clients like Alist to identify file
types and show image previews.
- Read FileSizeBytes instead of non-existent File-Size metadata field,
so getcontentlength reports actual bytes instead of always 0
- Add /dav prefix to file href so WebDAV clients can GET files at the
correct path
Fixes files showing as 0B and being unopenable in RaiDrive, Cyberduck,
and Windows mapped drives.
- Add 'internal' token type to API Token system, hidden from the
security settings token list
- When WebDAV is enabled, auto-create an internal API Token with
list/upload/delete permissions, stored in WebDAV config
- When WebDAV is disabled, auto-delete the internal token
- WebDAV handler reads the internal token from config and sends it
as Bearer auth; if missing, creates one on-the-fly as fallback
- Works across both Docker and Cloudflare deployments since the
token is persisted in KV/D1, not in process memory
The loop in findFunctionFile started from parts.length - 1, which
skipped the directory-level [[path]].js match when the request path
had exactly one segment (e.g. /dav/, /file/). Changed to start from
parts.length so these root paths correctly resolve to their handlers.
Fixes /dav/ returning 404 and /file/ similarly affected.
- Change SESSION_PREFIX from 'session@' to 'manage@session@' to prevent
sessions from appearing in file index and backups
- Add KV expirationTtl for automatic session cleanup on expiry
- Fix D1 adapter: route all manage@ keys to settings table instead of
files table (fixes blockipList and session storage in wrong table)
- Fix D1 list({ prefix: 'manage@' }) not matching settings table
(fixes backup not containing settings data)
- Exclude manage@session@ keys from settings backup export
- Rename to worker/wrangler.toml
- Update all paths (main, assets directory) to be relative to worker/
- Update package.json, workflow, generate-toml.js, .dockerignore
- Fix .gitignore to only ignore root wrangler.toml
- Move better-sqlite3, hono, @hono/node-server to optionalDependencies
- Worker workflow uses --omit=optional instead of --ignore-scripts
- Docker/Pages install still gets all packages as before
Replace all new Response calls in commitUpload.js and getUploadUrl.js with
createResponse from uploadTools so that responses include Access-Control-Allow-Origin
and other CORS headers, fixing cross-origin requests.
- checkAdmin: return 'admin' when admin auth not configured
- checkUser: return 'user' when authCode not configured
- directoryTree: use authType !== 'admin' to gate user-only checks
- Remove Basic Auth (verifyBasicAuth, parseBasicAuth) from authCore.js
- Add /api/auth/adminLogin POST endpoint for admin login via JSON body
- Delete legacy /api/manage/check, login, logout (no longer referenced)
- Fix adminConfigured to consider password-only config
- Extract shared authentication logic into utils/auth/authCore.js
- Replace enableBasicAuth/enableAuthCode flags with clear authScope enum (ADMIN/USER/EITHER)
- Move all auth-related files into utils/auth/ subdirectory
- Eliminate duplicated admin auth logic between _middleware.js and dualAuth.js
- Fix: user session no longer grants access to admin-only endpoints
- Fix: dualAuth no longer bypasses authCode when admin is not configured
- Update all 17 import references across the codebase
- Preserve original function signatures (userAuthCheck, dualAuthCheck) for zero caller changes
- Replace single-round SHA-256 with PBKDF2 (100k iterations) via Web Crypto API
- Auto-rehash old SHA-256/plaintext passwords to PBKDF2 on successful login
- Add timing-safe comparison to prevent timing attacks
- Replace Math.random() with crypto.getRandomValues() for API token and token ID generation
- Maintain full backward compatibility with existing SHA-256 hashes and plaintext passwords
Allows resetting all auth config when locked out:
- Requires RESET_KEY environment variable to be set
- GET /api/resetAuth?key=YOUR_RESET_KEY
- Clears security config from database (falls back to env vars)
- Destroys all active sessions
- Fix getSecurityConfig: use ?? instead of || so empty string is preserved
- Handle _clear flag to explicitly remove passwords
- Clear adminUsername together with adminPassword on _clear
- sessionCheck now returns adminRequired/userRequired fields
- Return 200 instead of 401 from sessionCheck for frontend to decide
MarSeventh