- checkAdmin: return 'admin' when admin auth not configured
- checkUser: return 'user' when authCode not configured
- directoryTree: use authType !== 'admin' to gate user-only checks
- Remove Basic Auth (verifyBasicAuth, parseBasicAuth) from authCore.js
- Add /api/auth/adminLogin POST endpoint for admin login via JSON body
- Delete legacy /api/manage/check, login, logout (no longer referenced)
- Fix adminConfigured to consider password-only config
- Extract shared authentication logic into utils/auth/authCore.js
- Replace enableBasicAuth/enableAuthCode flags with clear authScope enum (ADMIN/USER/EITHER)
- Move all auth-related files into utils/auth/ subdirectory
- Eliminate duplicated admin auth logic between _middleware.js and dualAuth.js
- Fix: user session no longer grants access to admin-only endpoints
- Fix: dualAuth no longer bypasses authCode when admin is not configured
- Update all 17 import references across the codebase
- Preserve original function signatures (userAuthCheck, dualAuthCheck) for zero caller changes
- Replace single-round SHA-256 with PBKDF2 (100k iterations) via Web Crypto API
- Auto-rehash old SHA-256/plaintext passwords to PBKDF2 on successful login
- Add timing-safe comparison to prevent timing attacks
- Replace Math.random() with crypto.getRandomValues() for API token and token ID generation
- Maintain full backward compatibility with existing SHA-256 hashes and plaintext passwords
- Add frontend direct upload to HuggingFace S3, bypassing CF Workers limits
- Add /api/huggingface/getUploadUrl endpoint to get LFS upload URLs
- Add /api/huggingface/commitUpload endpoint to commit file references
- Support multipart upload for very large files
- SHA256 computed in frontend to avoid CF Workers CPU timeout
- Small files (<20MB) still use proxy upload through CF Workers
- Add HuggingFace API wrapper class (huggingfaceAPI.js)
- Support upload, download, delete operations via HuggingFace Hub API
- Support public repos (unlimited storage) and private repos (100GB limit)
- Private repos: server proxies requests with Authorization header
- Auto-create repo if not exists (with write token)
- Add HuggingFace to auto-retry channel list
- Environment variables: HF_TOKEN, HF_REPO, HF_PRIVATE
- Support load balancing for multiple HuggingFace channels
- Add quota counter tracking (usedMB, fileCount) per channel
- Filter channels by quota threshold in fetchUploadConfig()
- Update quota on upload (endUpload) and delete
- Add /api/manage/quota API for stats and recalculation
- Fix null check in delete when file record not found
- Fix R2 channel name from hardcoded to actual channel.name
- Add tag CRUD APIs (single file and batch operations)
- Add tag autocomplete endpoint
- Add tag search support in file listing
- Update database schema with tags column
- Add tag validation and normalization utilities
- Initialize Tags:[] for all new uploads
MarSeventh