umputun / weblist / 35489394070

85%

Build Type

push

github

Committed by web-flow

Commit Message

add --auth.public-read for public browsing with authenticated uploads (#60)

* feat(auth): add --auth.public-read for public browsing with authenticated uploads

`--auth` protects everything today, so a public download site can either have no uploads or open ones. The new flag drops the auth middleware from the read group and leaves `POST /upload` behind it. With `--auth` set and the flag absent, browsing and downloads still require a login exactly as before. It refuses to start without `--auth`, since there would be no password to require and uploads would take anonymous writes.

upload controls are keyed on whether the request could actually upload, not on `--upload.enabled` alone: uploads are open when no password is set, so gating them on authentication would break anonymous-upload setups. The header gains a Login link, unnecessary before because an authenticated server never showed a page to an anonymous visitor. `checkBasicAuth` splits out of `tryBasicAuth` so the render path can validate credentials without issuing a cookie, otherwise a Basic Auth client renders as anonymous on its first request.

two changes apply with or without the flag. Unauthenticated `POST /upload` answers a JSON 401 instead of a 303, because `fetch` follows the redirect and reports the login page as "unexpected response". The multi-select handlers now check `EnableMultiSelect` themselves and bound the archive at 1000 entries counted before any ZIP header; opening the read group also exposes `POST /download-selected`, which ignored `--multi` entirely.

Fixed #59

* chore: drop the vendored go-flags fork

the preceding commit switches the flag tests to the parser the binary uses, leaving `github.com/umputun/go-flags` with no importer.

* fix: scope the download cap, keep upload.js loaded, correct the public-read warning

the 1000-entry cap on `handleDownloadSelected` applied to every deployment, so a server running `--multi` behind `--auth` lost a working flow the moment a... (continued)

Coverage Stats

94 of 117 new or added lines in 5 files covered. (80.34%)

1 existing line in 1 file now uncovered.

2182 of 2581 relevant lines covered (84.54%)

84.71 hits per line