- File size: prefer FileSizeBytes, fall back to FileSize (MB) * 1024^2
for files uploaded before FileSizeBytes was added
- Timestamps: use TimeStamp from metadata instead of current time,
so clients show the actual upload date, not the PROPFIND request time
Read FileType from metadata to populate D:getcontenttype (e.g.
image/jpeg), enabling WebDAV clients like Alist to identify file
types and show image previews.
- Read FileSizeBytes instead of non-existent File-Size metadata field,
so getcontentlength reports actual bytes instead of always 0
- Add /dav prefix to file href so WebDAV clients can GET files at the
correct path
Fixes files showing as 0B and being unopenable in RaiDrive, Cyberduck,
and Windows mapped drives.
- Add 'internal' token type to API Token system, hidden from the
security settings token list
- When WebDAV is enabled, auto-create an internal API Token with
list/upload/delete permissions, stored in WebDAV config
- When WebDAV is disabled, auto-delete the internal token
- WebDAV handler reads the internal token from config and sends it
as Bearer auth; if missing, creates one on-the-fly as fallback
- Works across both Docker and Cloudflare deployments since the
token is persisted in KV/D1, not in process memory
The loop in findFunctionFile started from parts.length - 1, which
skipped the directory-level [[path]].js match when the request path
had exactly one segment (e.g. /dav/, /file/). Changed to start from
parts.length so these root paths correctly resolve to their handlers.
Fixes /dav/ returning 404 and /file/ similarly affected.
- Change SESSION_PREFIX from 'session@' to 'manage@session@' to prevent
sessions from appearing in file index and backups
- Add KV expirationTtl for automatic session cleanup on expiry
- Fix D1 adapter: route all manage@ keys to settings table instead of
files table (fixes blockipList and session storage in wrong table)
- Fix D1 list({ prefix: 'manage@' }) not matching settings table
(fixes backup not containing settings data)
- Exclude manage@session@ keys from settings backup export
WebDAV upload records now store only the channel identity and object/public paths. Read, delete, move, and rename operations resolve credentials and headers from the current WebDAV channel config by ChannelName, with a legacy metadata fallback so already-created records remain usable.
Constraint: Preserve existing WebDAV object lifecycle behavior while reducing metadata exposure
Rejected: Keep credentials on every file record | expands exposure through metadata reads, backups, and logs
Confidence: high
Scope-risk: moderate
Directive: Keep WebDAV credentials in upload config/env; do not reintroduce per-file credential metadata
Tested: npm test; node deploy/worker/generate-routes.js; npx wrangler deploy --dry-run --config deploy/worker/wrangler.toml; git diff --check
Not-tested: Live WebDAV provider move/delete/read workflow
