7fd444259f
fix(breadcrumb): simplify breadcrumb logic and fix issue with shared items
2026-05-25 22:47:36 +02:00
60d53ea779
feat(ui): add section 'Shared with me'
2026-05-25 22:47:32 +02:00
143b13d7bc
security(authz): a shared item must not return it's full path
2026-05-25 22:47:01 +02:00
093c1ad3a5
feat(grants): add /api/grants/incoming/resources with a cursor for pagination
2026-05-25 22:47:01 +02:00
50d13943fc
fix(grants): show /grants on openapi
2026-05-25 22:47:01 +02:00
1dbd56e9cc
tests(load): prepare a load repository to test response time under load in the future
2026-05-25 22:47:01 +02:00
80425aed03
chore(justfile): add 'front-check' for lazy devs
2026-05-25 22:47:01 +02:00
7cc57db262
Merge pull request #391 from TW199501/refactor/i18n-rename-safet
...
refactor(i18n): rename safeT to t, drop export alias
2026-05-24 18:10:48 +02:00
32ad2a4f0e
refactor(i18n): rename safeT to t, drop export alias
...
Follow-up to PR #373 review feedback (thanks @EdouardVanbelle): with the
local t() removed in that PR, the safeT defensive name no longer earns
its purpose. There is no global t() left to shadow it, so the wrapper-
style name just creates confusion against callers writing i18n.t().
- function safeT -> function t
- export { t: safeT, ... } -> { t, ... }
- Remove stale comments in translateElement and above the definition
that explained the safeT/admin.js shadowing history
No call-site changes - every external caller already uses i18n.t(...),
which now points directly at the function of the same name.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com >
2026-05-24 21:17:58 +08:00
daf25b5830
Merge pull request #388 from EdouardVanbelle/refactor/file_life_cycle
2026-05-22 22:17:27 +02:00
73f0b0fa47
refactor(lifecycle hooks): simplify integration of new services
...
* make more coherent lifecycles
* remove specific implementation on different handlers (they do not need to know existence of ThumbnailSerice nor AudioMetadataService)
* reduce risk of orphean objects
* ensure additional services are correctly wired (ex: Thumbnail generation was not covering all upload cases)
* more details on docs/architecture/file-and-blob-lifecycle.md :
```rust
// application/ports/file_lifecycle.rs
pub trait FileLifecycleHook {
fn on_file_created(file_id, blob_hash, content_type, is_new_blob);
fn on_file_updated(file_id, blob_hash, content_type);
fn on_file_copied(file_id, blob_hash, content_type, source_id)
fn on_file_deleted(file_id);
}
// application/ports/blob_lifecycle.rs
pub trait BlobLifecycleHook {
fn on_blob_created(blob_hash, content_type);
fn on_blob_deleted(blob_hash);
}
```
2026-05-22 13:40:58 +02:00
9206669ee6
Merge pull request #387 from EdouardVanbelle/feat/trash-item-with-thumbnail-and-path
2026-05-22 08:12:39 +02:00
191f725199
feat(ui/trash): show original file path in tooltip on mouse over + display thumbnails
...
* fix: permission also check elements trashed elements
* tested manually
* all automated tests ok
2026-05-22 02:26:11 +02:00
0cd2f24b7f
Merge pull request #383 from EdouardVanbelle/permissions
2026-05-22 00:43:43 +02:00
76a85949e7
fix(trash)+refactor(file life cycle)
...
* fix issue with the empty trash (wasn't calling thumbnail clean up)
* refactor file service life cycle (TrashService don't call directly ThumbnailService, but call the on_file_deleted() hook
* remove unused mehod: _validate_user_ownership()
2026-05-22 00:28:39 +02:00
dd68d783e0
fix(authz): permit policiy: a user with Delete permission can delete a file/folder. Only the owner can permanently delete or restore a trashed item
2026-05-21 22:45:49 +02:00
a1c21ce446
refactor(authz): permet require_permission() as has_permission(), more explicit
2026-05-21 21:50:42 +02:00
cb35775f77
fix(dedub): correct ref count on hashes, many thanks to you api tests...
2026-05-21 21:12:38 +02:00
eb95567a7d
feat(authz): test & cover batch cases
...
┌────────────────────────────────┬─────────────────────────────────┬───────────────────────┬─────────────────┬──────────────────────────────┐
│ Endpoint │ Phase 3A no-grant │ Phase 3B Viewer │ Phase 3C Editor │ Phase 3D Admin │
├────────────────────────────────┼─────────────────────────────────┼───────────────────────┼─────────────────┼──────────────────────────────┤
│ POST /api/batch/files/get │ 400 (all failed) │ 200 (2 successful) │ — │ — │
├────────────────────────────────┼─────────────────────────────────┼───────────────────────┼─────────────────┼──────────────────────────────┤
│ POST /api/batch/files/move │ 400 │ 400 (no Update) │ 200 │ — │
├────────────────────────────────┼─────────────────────────────────┼───────────────────────┼─────────────────┼──────────────────────────────┤
│ POST /api/batch/files/copy │ 400 │ — │ 200 │ — │
├────────────────────────────────┼─────────────────────────────────┼───────────────────────┼─────────────────┼──────────────────────────────┤
│ POST /api/batch/files/delete │ 400 │ 400 │ 400 (no Delete) │ — │
├────────────────────────────────┼─────────────────────────────────┼───────────────────────┼─────────────────┼──────────────────────────────┤
│ POST /api/batch/folders/get │ 400 │ 200 │ — │ — │
├────────────────────────────────┼─────────────────────────────────┼───────────────────────┼─────────────────┼──────────────────────────────┤
│ POST /api/batch/folders/create │ 400 │ — │ 201 │ — │
├────────────────────────────────┼─────────────────────────────────┼───────────────────────┼─────────────────┼──────────────────────────────┤
│ POST /api/batch/folders/move │ 400 │ — │ 200 │ — │
├────────────────────────────────┼─────────────────────────────────┼───────────────────────┼─────────────────┼──────────────────────────────┤
│ POST /api/batch/folders/copy │ 400 │ — │ 200 │ — │
├────────────────────────────────┼─────────────────────────────────┼───────────────────────┼─────────────────┼──────────────────────────────┤
│ POST /api/batch/folders/delete │ 400 │ — │ 400 (no Delete) │ 200 │
├────────────────────────────────┼─────────────────────────────────┼───────────────────────┼─────────────────┼──────────────────────────────┤
│ POST /api/batch/trash │ 400 │ — │ — │ 400 (owner-only, documented) │
├────────────────────────────────┼─────────────────────────────────┼───────────────────────┼─────────────────┼──────────────────────────────┤
│ POST /api/batch/download │ 404 (NotFound) │ 200 + application/zip │ — │ — │
├────────────────────────────────┼─────────────────────────────────┼───────────────────────┼─────────────────┼──────────────────────────────┤
│ GET /api/batch/download?... │ 404 │ 200 + zip │ — │ — │
├────────────────────────────────┼─────────────────────────────────┼───────────────────────┼─────────────────┼──────────────────────────────┤
│ Phase 3E lifecycle cleanup │ grants table empty after delete │ │ │ │
└────────────────────────────────┴─────────────────────────────────┴───────────────────────┴─────────────────┴──────────────────────────────┘
2026-05-21 20:30:58 +02:00
a53c09f361
feat(authz): covert and test chunked upload with permissions
2026-05-21 20:30:58 +02:00
bd1b17b589
test(grants): full coverate of /api/files and /api/folders
2026-05-21 20:30:58 +02:00
3362e277ab
feat(authz): check permission on read handlers + check create permission on folder
2026-05-21 20:30:53 +02:00
cba9be8c21
feat(rebac): first pass
2026-05-20 22:56:00 +02:00
2c53f99089
ai: save ReBAC Permission, Grants, Cascading plan
2026-05-20 21:49:25 +02:00
dfb082fdf4
refactor(server): file_management_service: move all method without owner check into private, add folder_ports
2026-05-20 15:39:53 +02:00
ac42a6d3cc
test(api): check right management for folder creation and folder move + check also webdsav MKCOL protection
...
│ Steps 1-6 │ Setup: admin's resources + create bob + bob's home folder │
│ Step 7 │ REST: bob can't create a folder inside admin's home → 404 │
│ Step 8 │ REST: bob can't create inside admin's private folder → 404 │
│ Step 9 │ REST: parent_id: null auto-resolves to bob's home (documents the convenience) │
│ Step 10 │ REST: positive control — bob creates in his own home → 201 │
│ Step 12 │ REST: bob can't move his file into admin's folder → 404 │
│ Step 13 │ REST: bob moves file to root (null) → 200 (legitimate root state) │
│ Step 14 │ REST: bob can't read admin's file → 404 │
│ Step 15 │ REST: admin's tree integrity preserved │
│ Step 16 │ WebDAV: path-prefix isolation rewrites cross-user paths into caller's tree │
│ Step 17 │ WebDAV: positive control MKCOL in bob's own tree → 201 │
│ Step 18 │ WebDAV: bob's home contains the rewritten "My Folder - admin" sub-folder, proving the isolation rerouted the attack │
│ Step 19 │ WebDAV: admin's tree never sees bob's WebDAV traffic │
2026-05-20 13:04:15 +02:00
f8b30e78a6
refactor(create_folder): add an ownership check while creating a folder + refactor code
2026-05-20 12:59:04 +02:00
91ff3df35f
Merge pull request #381 from EdouardVanbelle/fix/253-scrolldown-on-shares
2026-05-19 23:25:36 +02:00
3c3be9b930
feat(share): permit scrolldown+ keep header sticky on the top
...
this solve issue raised on #253
2026-05-19 22:52:46 +02:00
032e283867
Merge pull request #375 from dscso/patch-1
2026-05-19 18:22:04 +02:00
6734bbbd09
Merge pull request #374 from EdouardVanbelle/style/type
2026-05-19 18:21:20 +02:00
3d105d76fe
Merge pull request #380 from EdouardVanbelle/front/logo
2026-05-19 18:15:03 +02:00
6396270167
Merge pull request #379 from EdouardVanbelle/fix/front-duplicate-declaration
2026-05-19 18:14:48 +02:00
623773f5e3
feat(ui): increase logo by reducing viewbox
2026-05-19 17:52:00 +02:00
e2e9aedd80
remove trailing new line according biome notification
2026-05-19 17:37:30 +02:00
95aab1f3a7
fix(logo): specify localisation of oxicloud logo for browsers
2026-05-19 17:28:12 +02:00
3557bc596a
fix(front:pathTooltip): correct importation of pathTooltip.css
2026-05-19 14:55:37 +02:00
7edc30978a
fix(bundle): permits use of JS 'import * as' + ensure no duplicated importation
...
example: here it fixes issue with `static/js/features/library/recent.js` and `static/js/features/library/favorites.js`
ithat are both imporing:
```javascript
import * as pathTooltip from '../pathTooltip.js'
```
2026-05-19 14:16:37 +02:00
872abd4d27
test: add front end folder management test (creation, renaming, etc)
...
note: firefox test remove due to idempotence issue
2026-05-19 13:31:20 +02:00
126251a184
fix(ui/modal): ensure modal is reusable (confirm button was disabled on previous use)
2026-05-19 11:17:32 +02:00
0fba4ce7bc
fix(ui): clear empty state on folder creation
2026-05-19 11:16:27 +02:00
73114acf39
ia: add directive to claude code regarding the frontend checks
2026-05-19 10:18:40 +02:00
09b8550067
fix(publicShare): correct load of icons.js + correct grid button (icon was missing)
2026-05-19 10:18:40 +02:00
a181d4081e
ci: add typescript check (no emit, check only types are fully declared)
2026-05-19 10:18:40 +02:00
82561a2b90
fix(ui): add RecentItem type + ad protection while building items
2026-05-19 10:18:40 +02:00
79a12018b1
fix(folder_service): propagate 409 error if folder aleady exists
2026-05-19 10:18:40 +02:00
fac184ccfe
style(front/js): apply types on all objects
...
- reduce amount of warnings in IDE
- maximize API type mapping with static/js/core/types.js
2026-05-19 10:18:33 +02:00
a38475bd2c
style(server): align text
2026-05-19 09:42:44 +02:00
edbfe2848c
fix(front): fix issue with already declared constants on release mode
...
- ensure not loading twice the same variables, namespace to ensure it in the future
- end to end tests where successfull, need to check it is not reusing a previous release (in cache from build CI)
- fix : #377 #378
2026-05-19 09:36:24 +02:00
ffcbbf99c1
Adding OXICLOUD_DISABLE_REGISTRATION in documentation
2026-05-18 10:45:25 +02:00
Edouard Vanbelle