markdownr 0.7.2 → 0.8.1

data/lib/markdown_server/app.rb

@@ -10,7 +10,14 @@ require "pathname"
 require "set"
 require "net/http"
 require "base64"
+require "digest"
 require_relative "plugin"
+require_relative "csv_browser/config_loader"
+require_relative "csv_browser/table_reader"
+require_relative "csv_browser/addon_registry"
+require_relative "csv_browser/row_context"
+require_relative "permitted_bases"
+require_relative "unhide"
 require_relative "helpers/path_helpers"
 require_relative "helpers/formatting_helpers"
 require_relative "helpers/markdown_helpers"
@@ -37,6 +44,8 @@ module MarkdownServer
       set :protection, false
       set :host_authorization, { permitted_hosts: [] }
       set :behind_proxy, false
+      set :admin_all, false
+      set :admin_only, false
       set :verbose, false
       set :session_secret, ENV.fetch("MARKDOWNR_SESSION_SECRET", SecureRandom.hex(64))
       set :sessions, key: "markdownr_session", same_site: :strict, httponly: true
@@ -48,6 +57,12 @@ module MarkdownServer
       set :popup_external_domains, []
       set :dictionary_url, nil
       set :plugin_dirs, []
+      set :csv_browser_config, nil
+      set :followed_links, []
+      set :unhide_rules, []
+      set :default_vim, false
+      set :allow_editor, false
+      set :allow_csv_editor, false
     end
 
     def self.load_plugins!
@@ -78,12 +93,21 @@ module MarkdownServer
     end
 
     before do
-      cache_control :public, max_age: 14400
-
       if settings.verbose
         $stdout.puts "#{Time.now.strftime("%Y-%m-%d %H:%M:%S")} #{client_ip} #{request.request_method} #{request.fullpath}"
         $stdout.flush
       end
+
+      if admin_only_mode? && !admin_only_public_route?(request.path_info) && !admin?
+        cache_control :no_cache, :no_store, :must_revalidate
+        redirect "/admin/login?return_to=#{CGI.escape(request.fullpath)}"
+      end
+
+      if request.path_info.start_with?("/browser", "/csv-browser", "/__markdownr/api")
+        cache_control :no_cache, :no_store, :must_revalidate
+      else
+        cache_control :public, max_age: 14400
+      end
     end
 
     get "/" do
@@ -96,6 +120,180 @@ module MarkdownServer
       JSON.dump({ version: MarkdownServer::VERSION, plugins: plugins })
     end
 
+    post "/ping" do
+      content_type :json
+      { ok: true }.to_json
+    end
+
+    EDITOR_FILE_MAX_BYTES = 5 * 1024 * 1024
+
+    def editor_loader_path
+      @@editor_loader_path ||= File.expand_path("assets/editor-loader.js", __dir__)
+    end
+
+    def editor_loader_version
+      path = editor_loader_path
+      content = File.read(path) + editor_import_map_json
+      Digest::SHA256.hexdigest(content)[0, 10]
+    end
+
+    EDITOR_PKGS = {
+      "@codemirror/state"           => "6.6.0",
+      "@codemirror/view"            => "6.41.1",
+      "@codemirror/commands"        => "6.10.3",
+      "@codemirror/language"        => "6.12.3",
+      "@codemirror/search"          => "6.7.0",
+      "@codemirror/autocomplete"    => "6.20.1",
+      "@codemirror/theme-one-dark"  => "6.1.3",
+      "@codemirror/lang-markdown"   => "6.5.0",
+      "@codemirror/lang-javascript" => "6.2.5",
+      "@codemirror/lang-json"       => "6.0.2",
+      "@codemirror/lang-yaml"       => "6.1.3",
+      "@codemirror/lang-html"       => "6.4.11",
+      "@codemirror/lang-css"        => "6.3.1",
+      "@codemirror/lang-python"     => "6.2.1",
+      "@codemirror/legacy-modes"    => "6.5.2",
+      "@replit/codemirror-vim"      => "6.3.0"
+    }.freeze
+
+    EDITOR_SHARED_DEPS = %w[
+      @codemirror/state
+      @codemirror/view
+      @codemirror/language
+      @codemirror/commands
+    ].freeze
+
+    def editor_import_map_json
+      @@editor_import_map_json ||= begin
+        imports = {}
+        EDITOR_PKGS.each do |pkg, ver|
+          deps = EDITOR_SHARED_DEPS.reject { |d| d == pkg }
+          imports[pkg] = "https://esm.sh/#{pkg}@#{ver}?external=#{deps.join(",")}"
+        end
+        EDITOR_PKGS.each do |pkg, ver|
+          next unless pkg == "@codemirror/legacy-modes"
+          %w[ruby shell].each do |mode|
+            deps = EDITOR_SHARED_DEPS.reject { |d| d == pkg }
+            imports["#{pkg}/mode/#{mode}"] =
+              "https://esm.sh/#{pkg}@#{ver}/mode/#{mode}.js?external=#{deps.join(",")}"
+          end
+        end
+        JSON.dump({ imports: imports })
+      end
+    end
+
+    get "/__markdownr/editor-loader.js" do
+      halt 404, "editor disabled" unless settings.allow_editor
+      cache_control :public, max_age: 14400
+      send_file File.expand_path("assets/editor-loader.js", __dir__),
+                type: "application/javascript"
+    end
+
+    get "/__markdownr/api/file/source/?*" do
+      halt 404, '{"error":"editor disabled"}' unless settings.allow_editor
+      requested = params["splat"].first.to_s.chomp("/")
+      halt 400, '{"error":"missing path"}' if requested.empty?
+
+      real_path = safe_path(requested)
+      halt 404, '{"error":"not a file"}' unless File.file?(real_path)
+
+      size = File.size(real_path)
+      halt 413, { error: "file too large", max: EDITOR_FILE_MAX_BYTES, size: size }.to_json if size > EDITOR_FILE_MAX_BYTES
+
+      content = File.read(real_path, encoding: "utf-8")
+      etag = Digest::SHA256.hexdigest(content)
+      headers "ETag" => %("#{etag}")
+      headers "Last-Modified" => File.mtime(real_path).httpdate
+      content_type "text/plain; charset=utf-8"
+      cache_control :no_cache, :no_store, :must_revalidate
+      content
+    end
+
+    put "/__markdownr/api/file/?*" do
+      content_type :json
+      cache_control :no_cache, :no_store, :must_revalidate
+      unless settings.allow_editor
+        halt 403, { error: "File editor disabled on this server. Restart with --allow-editor to enable." }.to_json
+      end
+      unless admin?
+        halt 403, { error: "Admin login required to save changes.",
+                    admin_url: "https://github.com/brianmd/markdown-server#admin-access",
+                    client_ip: client_ip }.to_json
+      end
+
+      requested = params["splat"].first.to_s.chomp("/")
+      halt 400, { error: "missing path" }.to_json if requested.empty?
+
+      real_path = safe_path(requested)
+      halt 404, { error: "not a file" }.to_json unless File.file?(real_path)
+
+      body = request.body.read
+      halt 413, { error: "file too large", max: EDITOR_FILE_MAX_BYTES, size: body.bytesize }.to_json if body.bytesize > EDITOR_FILE_MAX_BYTES
+
+      body = body.force_encoding("utf-8")
+      halt 400, { error: "body is not valid UTF-8" }.to_json unless body.valid_encoding?
+
+      if_match = request.env["HTTP_IF_MATCH"].to_s.strip
+      force = if_match.empty? || if_match == "*"
+
+      unless force
+        current = File.read(real_path, encoding: "utf-8")
+        current_etag = Digest::SHA256.hexdigest(current)
+        provided = if_match.gsub(/\A"|"\z/, "")
+        if provided != current_etag
+          halt 409, { error: "stale", current_etag: current_etag }.to_json
+        end
+      end
+
+      tmp_path = "#{real_path}.tmp.#{Process.pid}.#{Thread.current.object_id}"
+      File.write(tmp_path, body)
+      File.rename(tmp_path, real_path)
+
+      logger.info("file edit: #{client_ip} #{requested} #{body.bytesize}b") if respond_to?(:logger) && logger
+      new_etag = Digest::SHA256.hexdigest(body)
+      { etag: new_etag, mtime: File.mtime(real_path).iso8601, bytes: body.bytesize }.to_json
+    end
+
+    post "/__markdownr/api/render/preview" do
+      content_type :json
+      cache_control :no_cache, :no_store, :must_revalidate
+      unless settings.allow_editor
+        halt 403, { error: "File editor disabled on this server. Restart with --allow-editor to enable." }.to_json
+      end
+      unless admin?
+        halt 403, { error: "Admin login required to preview edits.",
+                    admin_url: "https://github.com/brianmd/markdown-server#admin-access",
+                    client_ip: client_ip }.to_json
+      end
+
+      payload = JSON.parse(request.body.read) rescue {}
+      content = payload["content"].to_s
+      halt 413, { error: "content too large" }.to_json if content.bytesize > EDITOR_FILE_MAX_BYTES
+
+      wiki_dir = payload["current_wiki_dir"].to_s
+      base_real = File.realpath(root_dir)
+      if wiki_dir.empty?
+        @current_wiki_dir = base_real
+      else
+        candidate = File.expand_path(wiki_dir, base_real)
+        @current_wiki_dir = (candidate == base_real || candidate.start_with?("#{base_real}/")) ? candidate : base_real
+      end
+
+      meta, body = parse_frontmatter(content)
+      html = render_markdown(body)
+      settings.plugins.each { |p| html = p.post_render(html, meta, self) }
+
+      frontmatter_html = ""
+      if meta && !meta.empty?
+        rows = meta.map { |key, value|
+          "<tr><th>#{h(key)}</th><td>#{render_frontmatter_value(value)}</td></tr>"
+        }.join
+        frontmatter_html = %(<div class="frontmatter"><div class="frontmatter-heading">Frontmatter</div><table class="meta-table">#{rows}</table></div>)
+      end
+
+      { html: html, frontmatter_html: frontmatter_html }.to_json
+    end
+
     get "/setup-info" do
       @title = "Setup Info"
       @client_ip = client_ip
@@ -131,6 +329,461 @@ module MarkdownServer
       redirect "/"
     end
 
+    get "/browser" do
+      @title = dir_title
+      @root_title = dir_title
+      @start_mode = "directory"
+      @csv_databases = csv_databases_json
+      @initial_path = ""
+      @is_admin = admin?
+      @default_vim = settings.default_vim
+      @allow_editor = settings.allow_editor
+      @allow_csv_editor = settings.allow_csv_editor
+      erb :browser, layout: false
+    end
+
+    get "/csv-browser" do
+      @title = dir_title
+      @root_title = dir_title
+      @start_mode = "csv"
+      @csv_databases = csv_databases_json
+      @initial_path = ""
+      @is_admin = admin?
+      @default_vim = settings.default_vim
+      @allow_editor = settings.allow_editor
+      @allow_csv_editor = settings.allow_csv_editor
+      erb :browser, layout: false
+    end
+
+    get "/browser/api/render/?*" do
+      content_type :json
+      requested = params["splat"].first.to_s.chomp("/")
+
+      if requested.empty?
+        real_path = File.realpath(root_dir)
+      else
+        real_path = safe_path(requested)
+      end
+
+      if File.directory?(real_path)
+        JSON.dump(browser_render_directory(real_path, requested))
+      else
+        JSON.dump(browser_render_file(real_path, requested, raw: params["raw"] == "1"))
+      end
+    end
+
+    get "/browser/api/csv/databases" do
+      content_type :json
+      csv_databases_json
+    end
+
+    post "/browser/api/csv/reload" do
+      content_type :json
+      loader = settings.csv_browser_config
+      halt 404, '{"error":"not configured"}' unless loader
+      loader.reload!
+      csv_databases_json
+    end
+
+    get "/browser/api/csv/databases/:db/tables/:table" do
+      content_type :json
+      loader = settings.csv_browser_config
+      halt 404, '{"error":"not configured"}' unless loader
+
+      db = loader.database(params[:db])
+      halt 404, { error: "Database not found" }.to_json unless db
+
+      table = db.tables.find { |t| t.key == params[:table] }
+      halt 404, { error: "Table not found" }.to_json unless table
+
+      view_key = params[:view] || "all"
+      reader = CsvBrowser::TableReader.new(table)
+      data = reader.read(view_key)
+      lookups = loader.resolve_references(db, table)
+
+      # Enrich column references with the referenced table's color
+      data[:columns].each do |col|
+        next unless col[:references]
+        ref_table = db.tables.find { |t| t.key == col[:references][:table] }
+        col[:references] = col[:references].merge(color: ref_table.color) if ref_table&.color
+      end
+
+      reverse_refs = loader.resolve_reverse_references(db, table)
+
+      result = {
+        database: db.key,
+        table: table.key,
+        view: view_key,
+        views: table.views.map { |v| { key: v.key, title: v.title } },
+        columns: data[:columns],
+        rows: data[:rows]
+      }
+      result[:color] = table.color if table.color
+      result[:required] = table.required unless table.required.empty?
+      result[:references] = lookups unless lookups.empty?
+      result[:reverse_references] = reverse_refs unless reverse_refs.empty?
+      result.to_json
+    end
+
+    get "/browser/api/csv/databases/:db/search" do
+      content_type :json
+      loader = settings.csv_browser_config
+      halt 404, '{"error":"not configured"}' unless loader
+
+      db = loader.database(params[:db])
+      halt 404, { error: "Database not found" }.to_json unless db
+
+      query = (params[:q] || "").strip
+      halt 400, { error: "No query" }.to_json if query.empty?
+
+      terms = query.split(/\s+/).map { |t| parse_filter_term(t) }
+
+      results = db.tables.filter_map do |table|
+        next unless File.exist?(table.csv_path)
+
+        count = 0
+        CSV.foreach(table.csv_path, headers: true) do |row|
+          values = row.fields.map { |v| v.to_s }
+          match = terms.all? do |term|
+            values.any? { |v| filter_term_matches?(term, v) }
+          end
+          count += 1 if match
+        end
+        next if count == 0
+
+        entry = { table: table.key, title: table.title, count: count }
+        entry[:color] = table.color if table.color
+        entry[:views] = table.views.map { |v| { key: v.key, title: v.title } }
+        entry
+      end
+
+      { database: db.key, query: query, results: results }.to_json
+    end
+
+    get "/browser/api/csv/databases/:db/tables/:table/schema" do
+      content_type "text/plain"
+      loader = settings.csv_browser_config
+      halt 404, "not configured" unless loader
+
+      db = loader.database(params[:db])
+      halt 404, "Database not found" unless db
+
+      table = db.tables.find { |t| t.key == params[:table] }
+      halt 404, "Table not found" unless table
+
+      schema = { "title" => table.title }
+      schema["csv"] = File.basename(table.csv_path)
+      schema["color"] = table.color if table.color
+
+      props = {}
+      table.columns.each do |col|
+        col_def = {}
+        col_def["type"] = col.type
+        col_def["title"] = col.title if col.title != col.key.capitalize
+        col.constraints.each { |k, v| col_def[k] = v } if col.constraints
+        if col.references
+          col_def["references"] = {
+            "table" => col.references[:table],
+            "column" => col.references[:column],
+            "display" => col.references[:display]
+          }
+        end
+        props[col.key] = col_def
+      end
+      schema["properties"] = props
+      schema["required"] = table.required unless table.required.empty?
+
+      if table.views.length > 1 || (table.views.length == 1 && table.views.first.key != "all")
+        views = {}
+        table.views.each do |v|
+          view_def = { "title" => v.title }
+          view_def["columns"] = v.columns if v.columns
+          views[v.key] = view_def
+        end
+        schema["views"] = views
+      end
+
+      yaml = Psych.dump(schema, indentation: 4).sub(/\A---\n/, "")
+      yaml.gsub(/^(\s*)- /, '\1    - ')
+    end
+
+    get "/browser/api/csv/databases/:db/tables/:table/validate" do
+      content_type :json
+      loader = settings.csv_browser_config
+      halt 404, '{"error":"not configured"}' unless loader
+
+      db = loader.database(params[:db])
+      halt 404, { error: "Database not found" }.to_json unless db
+
+      table = db.tables.find { |t| t.key == params[:table] }
+      halt 404, { error: "Table not found" }.to_json unless table
+
+      reader = CsvBrowser::TableReader.new(table)
+      errors = reader.validate_all
+
+      { errors: errors }.to_json
+    end
+
+    get "/browser/api/csv/databases/:db/tables/:table/rows/:row/validate" do
+      content_type :json
+      loader = settings.csv_browser_config
+      halt 404, '{"error":"not configured"}' unless loader
+
+      db = loader.database(params[:db])
+      halt 404, { error: "Database not found" }.to_json unless db
+
+      table = db.tables.find { |t| t.key == params[:table] }
+      halt 404, { error: "Table not found" }.to_json unless table
+
+      row_index = Integer(params[:row]) rescue nil
+      halt 400, { error: "Invalid row index" }.to_json unless row_index
+
+      reader = CsvBrowser::TableReader.new(table)
+      result = reader.validate_cells(row_index, {})
+      result.to_json
+    end
+
+    put "/browser/api/csv/databases/:db/tables/:table/rows/:row" do
+      content_type :json
+      unless settings.allow_csv_editor
+        halt 403, { error: "CSV editor disabled on this server. Restart with --allow-csv-editor to enable." }.to_json
+      end
+      unless admin?
+        halt 403, { error: "Admin login required to save changes.",
+                    admin_url: "https://github.com/brianmd/markdown-server#admin-access",
+                    client_ip: client_ip }.to_json
+      end
+      loader = settings.csv_browser_config
+      halt 404, '{"error":"not configured"}' unless loader
+
+      db = loader.database(params[:db])
+      halt 404, { error: "Database not found" }.to_json unless db
+
+      table = db.tables.find { |t| t.key == params[:table] }
+      halt 404, { error: "Table not found" }.to_json unless table
+
+      row_index = Integer(params[:row]) rescue nil
+      halt 400, { error: "Invalid row index" }.to_json unless row_index
+
+      body = JSON.parse(request.body.read) rescue {}
+      changes = body["changes"] || {}
+      halt 400, { error: "No changes provided" }.to_json if changes.empty?
+
+      reader = CsvBrowser::TableReader.new(table)
+      result = reader.update_row(row_index, changes)
+
+      if result[:valid]
+        result.to_json
+      else
+        status 422
+        result.to_json
+      end
+    end
+
+    post "/browser/api/csv/databases/:db/tables/:table/rows/:row/duplicate" do
+      content_type :json
+      unless settings.allow_csv_editor
+        halt 403, { error: "CSV editor disabled on this server. Restart with --allow-csv-editor to enable." }.to_json
+      end
+      unless admin?
+        halt 403, { error: "Admin login required to duplicate rows.",
+                    admin_url: "https://github.com/brianmd/markdown-server#admin-access",
+                    client_ip: client_ip }.to_json
+      end
+      loader = settings.csv_browser_config
+      halt 404, '{"error":"not configured"}' unless loader
+
+      db = loader.database(params[:db])
+      halt 404, { error: "Database not found" }.to_json unless db
+
+      table = db.tables.find { |t| t.key == params[:table] }
+      halt 404, { error: "Table not found" }.to_json unless table
+
+      row_index = Integer(params[:row]) rescue nil
+      halt 400, { error: "Invalid row index" }.to_json unless row_index
+
+      reader = CsvBrowser::TableReader.new(table)
+      result = reader.duplicate_row(row_index)
+
+      if result[:duplicated]
+        result.to_json
+      else
+        status 400
+        result.to_json
+      end
+    end
+
+    delete "/browser/api/csv/databases/:db/tables/:table/rows/:row" do
+      content_type :json
+      unless settings.allow_csv_editor
+        halt 403, { error: "CSV editor disabled on this server. Restart with --allow-csv-editor to enable." }.to_json
+      end
+      unless admin?
+        halt 403, { error: "Admin login required to delete rows.",
+                    admin_url: "https://github.com/brianmd/markdown-server#admin-access",
+                    client_ip: client_ip }.to_json
+      end
+      loader = settings.csv_browser_config
+      halt 404, '{"error":"not configured"}' unless loader
+
+      db = loader.database(params[:db])
+      halt 404, { error: "Database not found" }.to_json unless db
+
+      table = db.tables.find { |t| t.key == params[:table] }
+      halt 404, { error: "Table not found" }.to_json unless table
+
+      row_index = Integer(params[:row]) rescue nil
+      halt 400, { error: "Invalid row index" }.to_json unless row_index
+
+      reader = CsvBrowser::TableReader.new(table)
+      result = reader.delete_row(row_index)
+
+      if result[:deleted]
+        result.to_json
+      else
+        status 400
+        result.to_json
+      end
+    end
+
+    # List add-on actions available for a row on a given table.
+    get "/browser/api/csv/databases/:db/tables/:table/addons" do
+      content_type :json
+      loader = settings.csv_browser_config
+      halt 404, '{"error":"not configured"}' unless loader
+
+      db = loader.database(params[:db])
+      halt 404, { error: "Database not found" }.to_json unless db
+
+      table = db.tables.find { |t| t.key == params[:table] }
+      halt 404, { error: "Table not found" }.to_json unless table
+
+      row_index = Integer(params[:row]) rescue nil
+      halt 400, { error: "Invalid row index" }.to_json unless row_index
+
+      row_hash = read_row_hash(table, row_index)
+      halt 404, { error: "Row not found" }.to_json unless row_hash
+
+      attachments = CsvBrowser::CsvAddonRegistry.for_table(db, table)
+      actions = attachments.flat_map do |att|
+        ctx = CsvBrowser::RowContext.new(
+          database: db, table: table, row_index: row_index, row: row_hash,
+          options: att[:options]
+        )
+        att[:definition].actions_for(ctx).map do |a|
+          {
+            addon: att[:definition].name.to_s,
+            id: a[:id].to_s,
+            label: a[:label] || a[:id].to_s,
+            enabled: a[:enabled]
+          }.tap { |h| h[:icon] = a[:icon] if a[:icon] }
+        end
+      end
+      { actions: actions }.to_json
+    end
+
+    # Invoke an add-on action (initial call or prompt continuation).
+    post "/browser/api/csv/databases/:db/tables/:table/addons/:addon/:action" do
+      content_type :json
+      unless settings.allow_csv_editor
+        halt 403, { error: "CSV editor disabled on this server. Restart with --allow-csv-editor to enable." }.to_json
+      end
+      unless admin?
+        halt 403, { error: "Admin login required to run add-on actions.",
+                    admin_url: "https://github.com/brianmd/markdown-server#admin-access",
+                    client_ip: client_ip }.to_json
+      end
+      loader = settings.csv_browser_config
+      halt 404, '{"error":"not configured"}' unless loader
+
+      db = loader.database(params[:db])
+      halt 404, { error: "Database not found" }.to_json unless db
+
+      table = db.tables.find { |t| t.key == params[:table] }
+      halt 404, { error: "Table not found" }.to_json unless table
+
+      attachments = CsvBrowser::CsvAddonRegistry.for_table(db, table)
+      attachment = attachments.find { |a| a[:definition].name.to_s == params[:addon] }
+      halt 404, { error: "Add-on not found" }.to_json unless attachment
+
+      handler = attachment[:definition].handler_for(params[:action])
+      halt 404, { error: "Action not found" }.to_json unless handler
+
+      body = JSON.parse(request.body.read) rescue {}
+      row_index = Integer(body["row_index"]) rescue nil
+      halt 400, { error: "Invalid row index" }.to_json unless row_index
+
+      row_hash = read_row_hash(table, row_index)
+      halt 404, { error: "Row not found" }.to_json unless row_hash
+
+      ctx = CsvBrowser::RowContext.new(
+        database: db, table: table, row_index: row_index, row: row_hash,
+        options: attachment[:options], input: body["input"], state: body["state"]
+      )
+
+      result = handler.call(ctx)
+      result = { kind: "done", reload: true } unless result.is_a?(Hash)
+      result.to_json
+    end
+
+    get "/browser/api/csv/unmapped/*" do
+      content_type :json
+      relative = params["splat"].first.to_s
+      real_path = safe_path(relative)
+      halt 404, '{"error":"not found"}' unless real_path && File.exist?(real_path) && real_path.end_with?(".csv")
+
+      # Verify this is actually an unmapped file
+      loader = settings.csv_browser_config
+      if loader&.find_table_by_csv_path(File.realpath(real_path))
+        halt 400, '{"error":"file belongs to a configured database"}'
+      end
+
+      rows = CSV.read(real_path, headers: true)
+      headers = rows.headers.compact
+      columns = headers.map { |h| { key: h, title: h, type: "string" } }
+      data_rows = rows.each_with_index.map do |row, idx|
+        [idx] + headers.map { |h| row[h] }
+      end
+
+      {
+        database: "_unmapped",
+        table: relative,
+        view: "all",
+        views: [{ key: "all", title: "All" }],
+        columns: columns,
+        rows: data_rows,
+        readonly: true
+      }.to_json
+    end
+
+    get "/browser/*" do
+      splat = params["splat"].first.to_s
+      pass if splat.start_with?("api/")
+      @title = dir_title
+      @root_title = dir_title
+      @start_mode = "directory"
+      @csv_databases = csv_databases_json
+      @initial_path = splat.chomp("/")
+      @is_admin = admin?
+      @default_vim = settings.default_vim
+      @allow_editor = settings.allow_editor
+      @allow_csv_editor = settings.allow_csv_editor
+      erb :browser, layout: false
+    end
+
+    get "/csv-browser/*" do
+      @title = dir_title
+      @root_title = dir_title
+      @start_mode = "csv"
+      @csv_databases = csv_databases_json
+      @initial_path = params["splat"].first.to_s.chomp("/")
+      @is_admin = admin?
+      @default_vim = settings.default_vim
+      @allow_editor = settings.allow_editor
+      @allow_csv_editor = settings.allow_csv_editor
+      erb :browser, layout: false
+    end
+
     get "/browse/?*" do
       requested = params["splat"].first.to_s
       requested = requested.chomp("/")
@@ -155,88 +808,6 @@ module MarkdownServer
       end
     end
 
-    get "/debug/raw-fetch" do
-      halt 404, "not available" unless respond_to?(:blueletterbible_html)
-      url = params[:url].to_s.strip
-      halt 400, "missing ?url=" if url.empty?
-      html = fetch_external_page(url)
-      halt 502, "fetch failed" unless html
-      content_type :text
-      # Show processing steps for first verse
-      chunk = html.split(/<div\s[^>]*id="bVerse_\d+"[^>]*>/).drop(1).first
-      return "no bVerse chunks found" unless chunk
-
-      cite = chunk[/tablet-order-2[^>]*>[\s\S]{0,400}?<a[^>]*>(.*?)<\/a>/im, 1]
-               &.gsub(/<[^>]+>/, "")&.strip || "?"
-      raw_html = chunk[/class="EngBibleText[^"]*"[^>]*>([\s\S]*?)<\/div>/im, 1] || "(no EngBibleText found)"
-
-      lines = ["=== cite: #{cite} ===",
-               "=== EngBibleText raw (#{raw_html.length} chars) ===",
-               raw_html, ""]
-
-      # Simulate the processing steps
-      rh = raw_html.dup
-      rh.gsub!(/<img[^>]*>/, "")
-      rh.gsub!(/<a[^>]*class="hide-for-tablet"[^>]*>[\s\S]*?<\/a>/im, "")
-      rh.gsub!(/<span[^>]*class="hide-for-tablet"[^>]*>[\s\S]*?<\/span>/im, "")
-
-      wp_matches = rh.scan(/<span\s[^>]*class="word-phrase"[^>]*>([\s\S]*?)<\/span>/im)
-      lines << "=== word-phrase matches (#{wp_matches.length}) ==="
-      wp_matches.each_with_index do |(inner), i|
-        is_criteria = inner.match?(/<sup[^>]*class="[^"]*strongs criteria[^"]*"/i)
-        word = inner.sub(/<sup[\s\S]*/im, "").gsub(/<[^>]+>/, "").gsub(/&nbsp;/i, " ").strip
-        lines << "  [#{i}] criteria=#{is_criteria} word=#{word.inspect}"
-      end
-
-      # Now simulate the full processing pipeline
-      verse_html = rh.gsub(/<span\s[^>]*class="word-phrase"[^>]*>([\s\S]*?)<\/span>/im) do
-        inner = $1
-        word = inner.sub(/<sup[\s\S]*/im, "").gsub(/<[^>]+>/, "").gsub(/&nbsp;/i, " ").strip
-        inner.match?(/<sup[^>]*class="[^"]*strongs criteria[^"]*"/i) ? "\x02#{word}\x03" : word
-      end
-      lines << "\n=== after word-phrase gsub (placeholder check) ==="
-      lines << "  contains \\x02: #{verse_html.include?("\x02")}"
-      lines << "  contains \\x03: #{verse_html.include?("\x03")}"
-      ph = verse_html[/\x02[^\x03]*\x03/]
-      lines << "  placeholder found: #{ph.inspect}"
-
-      verse_html.gsub!(/<sup[^>]*>[\s\S]*?<\/sup>/im, "")
-      verse_html.gsub!(/<[^>]+>/, "")
-      verse_html.gsub!(/&nbsp;/i, " ")
-      verse_html.gsub!(/&#(\d+);/)         { [$1.to_i].pack("U") rescue " " }
-      verse_html.gsub!(/&#x([\da-f]+);/i)  { [$1.to_i(16)].pack("U") rescue " " }
-      verse_html.gsub!(/&amp;/, "&")
-      verse_html.gsub!(/&lt;/, "<")
-      verse_html.gsub!(/&gt;/, ">")
-      verse_html.gsub!(/\s+/, " ")
-      verse_html.strip!
-
-      lines << "=== after tag-strip (placeholder check) ==="
-      lines << "  contains \\x02: #{verse_html.include?("\x02")}"
-      ph2 = verse_html[/\x02[^\x03]*\x03/]
-      lines << "  placeholder found: #{ph2.inspect}"
-      lines << "  verse_html snippet: #{verse_html[0, 200].inspect}"
-
-      # Apply the final restore
-      restored = verse_html.gsub(/\x02([^\x03]*)\x03/) { "<span class=\"blb-match\">#{$1.strip}</span>" }
-      lines << "\n=== after placeholder restore ==="
-      lines << "  restored snippet: #{restored[0, 300].inspect}"
-
-      # Now compare with actual blueletterbible_html output
-      full_output = blueletterbible_html(html, url)
-      conc_match = full_output[/blb-match[^<]*<\/span>/]
-      lines << "\n=== blueletterbible_html output (blb-match check) ==="
-      lines << "  contains blb-match: #{full_output.include?("blb-match")}"
-      lines << "  blb-match context: #{conc_match.inspect}"
-      # Show the concordance section
-      conc_start = full_output.index("blb-heading") ? full_output.rindex("<h4", full_output.index("Concordance") || 0) : nil
-      if conc_start
-        lines << "  concordance html (first 500 chars): #{full_output[conc_start, 500].inspect}"
-      end
-
-      lines.join("\n")
-    end
-
     get "/debug/fetch" do
       halt 404, "not available" unless respond_to?(:blueletterbible_html)
       url = params[:url].to_s.strip
@@ -269,11 +840,7 @@ module MarkdownServer
         halt 404, '{"error":"not found"}'
       end
 
-      halt 403, '{"error":"forbidden"}' unless real.start_with?(base)
-
-      relative = real.sub("#{base}/", "")
-      first_segment = relative.split("/").first
-      halt 403, '{"error":"forbidden"}' if EXCLUDED.include?(first_segment) || first_segment&.start_with?(".")
+      halt 403, '{"error":"forbidden"}' unless permitted_path?(real)
 
       halt 404, '{"error":"not found"}' unless File.file?(real) && File.extname(real).downcase == ".md"
 
@@ -406,23 +973,37 @@ module MarkdownServer
 
     private
 
+    def read_row_hash(table, row_index)
+      return nil unless File.exist?(table.csv_path)
+      return nil if row_index < 0
+
+      idx = 0
+      CSV.foreach(table.csv_path, headers: true) do |row|
+        return row.to_h if idx == row_index
+        idx += 1
+      end
+      nil
+    end
+
     def render_directory(real_path, relative_path)
-      entries = Dir.entries(real_path).reject do |e|
-        e.start_with?(".") || EXCLUDED.include?(e)
+      entries = Dir.entries(real_path).select do |e|
+        e != "." && e != ".." && entry_admitted?(real_path, relative_path, e)
       end
 
+      browse_prefix = relative_path.empty? ? "/browse/" : "/browse/#{relative_path}/"
+
       items = entries.map do |name|
         full = File.join(real_path, name)
         stat = File.stat(full) rescue next
+        is_dir = stat.directory?
         btime = stat.respond_to?(:birthtime) ? stat.birthtime : stat.mtime rescue stat.mtime
         {
           name: name,
-          is_dir: stat.directory?,
-          size: stat.directory? ? nil : stat.size,
+          is_dir: is_dir,
+          size: is_dir ? nil : stat.size,
           mtime: stat.mtime,
           ctime: btime,
-          href: "/browse/" + (relative_path.empty? ? "" : relative_path + "/") +
-                encode_path_component(name) + (stat.directory? ? "/" : "")
+          href: browse_prefix + encode_path_component(name) + (is_dir ? "/" : "")
         }
       end.compact
 
@@ -442,8 +1023,9 @@ module MarkdownServer
         effective_order == "desc" ? sorted.reverse : sorted
       end
 
-      dirs = sort_items.call(items.select { |i| i[:is_dir] })
-      files = sort_items.call(items.reject { |i| i[:is_dir] })
+      dirs, files = items.partition { |i| i[:is_dir] }
+      dirs = sort_items.call(dirs)
+      files = sort_items.call(files)
 
       @items = dirs + files
       @path = relative_path
@@ -452,6 +1034,279 @@ module MarkdownServer
       erb :directory
     end
 
+    def parse_comparable_value(s)
+      stripped = s.gsub(/[$,]/, "")
+      if stripped.match?(/\A-?\d+\.?\d*\z/)
+        return { kind: :number, value: stripped.to_f }
+      end
+      if (m = s.match(%r{\A(\d{1,2})/(\d{1,2})/(\d{4})\z}))
+        d = Date.new(m[3].to_i, m[1].to_i, m[2].to_i)
+        return { kind: :date, value: d }
+      end
+      nil
+    rescue Date::Error
+      nil
+    end
+
+    def parse_filter_term(t)
+      if (m = t.match(/\A(>=?|<=?)\s*(.+)\z/))
+        val = parse_comparable_value(m[2])
+        return { type: :compare, op: m[1], value: val } if val
+      end
+      re = Regexp.new(t, Regexp::IGNORECASE)
+      { type: :regex, re: re }
+    rescue RegexpError
+      { type: :regex, re: Regexp.new(Regexp.escape(t), Regexp::IGNORECASE) }
+    end
+
+    def filter_term_matches?(term, cell_str)
+      if term[:type] == :compare
+        cell_val = parse_comparable_value(cell_str)
+        return false unless cell_val && cell_val[:kind] == term[:value][:kind]
+        case term[:op]
+        when ">" then cell_val[:value] > term[:value][:value]
+        when ">=" then cell_val[:value] >= term[:value][:value]
+        when "<" then cell_val[:value] < term[:value][:value]
+        when "<=" then cell_val[:value] <= term[:value][:value]
+        else false
+        end
+      else
+        term[:re].match?(cell_str)
+      end
+    end
+
+    def csv_databases_json
+      loader = settings.csv_browser_config
+      return "[]" unless loader
+
+      databases = loader.databases.map do |db|
+        yaml_dir = File.dirname(db.yaml_path)
+        db_entry = {
+          key: db.key,
+          title: db.title,
+          tables: db.tables.select { |t| File.exist?(t.csv_path) }.map do |t|
+            entry = {
+              key: t.key,
+              title: t.title,
+              views: t.views.map { |v| { key: v.key, title: v.title } }
+            }
+            entry[:color] = t.color if t.color
+            if db.group_by_directory
+              rel_dir = File.dirname(t.csv_path).delete_prefix("#{yaml_dir}/")
+              rel_dir = nil if rel_dir == yaml_dir || rel_dir == "."
+              entry[:group] = rel_dir
+            end
+            entry[:record_count] = [File.foreach(t.csv_path).count - 1, 0].max if db.show_record_counts
+            entry
+          end
+        }
+        db_entry[:group_by_directory] = true if db.group_by_directory
+        base = File.realpath(root_dir)
+        db_entry[:yaml_path] = db.yaml_path.delete_prefix("#{base}/")
+        db_entry
+      end
+
+      unmapped = loader.unmapped_csv_files
+      unless unmapped.empty?
+        databases << {
+          key: "_unmapped",
+          title: "Unmapped Files",
+          virtual: true,
+          tables: unmapped.map do |entry|
+            dir = File.dirname(entry[:relative])
+            {
+              key: entry[:relative],
+              title: File.basename(entry[:relative], ".csv"),
+              group: dir == "." ? nil : dir,
+              views: [{ key: "all", title: "All" }],
+              color: "#888"
+            }
+          end
+        }
+      end
+
+      databases.to_json
+    end
+
+    def browser_render_directory(real_path, requested)
+      entries = Dir.entries(real_path).select do |e|
+        e != "." && e != ".." && entry_admitted?(real_path, requested, e)
+      end
+
+      browse_prefix = requested.empty? ? "" : "#{requested}/"
+
+      items = entries.map do |name|
+        full = File.join(real_path, name)
+        stat = File.stat(full) rescue next
+        is_dir = stat.directory?
+        btime = stat.respond_to?(:birthtime) ? stat.birthtime : stat.mtime rescue stat.mtime
+        item = {
+          name: name,
+          is_dir: is_dir,
+          path: browse_prefix + name,
+          icon: icon_for(name, is_dir),
+          mtime: format_date(stat.mtime),
+          mtime_ts: stat.mtime.to_f,
+          ctime: format_date(btime),
+          ctime_ts: btime.to_f
+        }
+        unless is_dir
+          item[:size] = format_size(stat.size)
+          item[:size_bytes] = stat.size
+        end
+        item
+      end.compact
+
+      title = if requested.empty?
+                dir_title
+              else
+                parent = File.dirname(requested)
+                parent == "." ? File.basename(requested) : "#{File.basename(requested)} (#{parent})"
+              end
+      { type: "directory", path: requested, title: title, items: items }
+    end
+
+    def browser_render_file(real_path, requested, raw: false)
+      ext = File.extname(real_path).downcase
+      title = File.basename(real_path)
+      download_href = "/download/" + requested.split("/").map { |p| encode_path_component(p) }.join("/")
+
+      # Check plugins first
+      settings.plugins.each do |p|
+        result = p.browser_render(requested, real_path, self)
+        return result if result
+      end
+
+      # Check CSV browser (skip when raw rendering requested)
+      loader = settings.csv_browser_config
+      if loader && !raw
+        if ext == ".yaml" || ext == ".yml"
+          db = loader.find_database_by_yaml_path(real_path)
+          if db
+            return {
+              type: "csv_database",
+              title: db.title,
+              db_key: db.key,
+              tables: db.tables.map do |t|
+                entry = {
+                  key: t.key,
+                  title: t.title,
+                  views: t.views.map { |v| { key: v.key, title: v.title } }
+                }
+                entry[:color] = t.color if t.color
+                entry
+              end
+            }
+          end
+        end
+
+        result = loader.find_table_by_csv_path(real_path)
+        if result
+          db, table = result
+          view_key = table.views.first&.key || "all"
+          reader = CsvBrowser::TableReader.new(table)
+          data = reader.read(view_key)
+          lookups = loader.resolve_references(db, table)
+          data[:columns].each do |col|
+            next unless col[:references]
+            ref_table = db.tables.find { |t| t.key == col[:references][:table] }
+            col[:references] = col[:references].merge(color: ref_table.color) if ref_table&.color
+          end
+          reverse_refs = loader.resolve_reverse_references(db, table)
+          resp = {
+            type: "csv_table",
+            title: "#{table.title} \u2014 #{table.views.first&.title || "All"}",
+            db_key: db.key,
+            table_key: table.key,
+            view_key: view_key,
+            views: table.views.map { |v| { key: v.key, title: v.title } },
+            columns: data[:columns],
+            rows: data[:rows]
+          }
+          resp[:color] = table.color if table.color
+          resp[:references] = lookups unless lookups.empty?
+          resp[:reverse_references] = reverse_refs unless reverse_refs.empty?
+          return resp
+        end
+      end
+
+      # Standalone CSV files (not in any database) — render as table
+      if ext == ".csv" && !raw
+        return render_standalone_csv(real_path, title, requested)
+      end
+
+      # Default file rendering
+      case ext
+      when ".md"
+        content = File.read(real_path, encoding: "utf-8")
+        meta, body = parse_frontmatter(content)
+        @current_wiki_dir = File.dirname(real_path)
+        html = render_markdown(body)
+        settings.plugins.each { |p| html = p.post_render(html, meta, self) }
+
+        frontmatter_html = ""
+        if meta && !meta.empty?
+          rows = meta.map { |key, value|
+            "<tr><th>#{h(key)}</th><td>#{render_frontmatter_value(value)}</td></tr>"
+          }.join
+          frontmatter_html = %(<div class="frontmatter"><div class="frontmatter-heading">Frontmatter</div><table class="meta-table">#{rows}</table></div>)
+        end
+
+        { type: "markdown", title: title, html: html, frontmatter_html: frontmatter_html }
+
+      when ".json"
+        raw = File.read(real_path, encoding: "utf-8")
+        begin
+          data = JSON.parse(raw)
+          yaml_str = YAML.dump(data)
+          { type: "code", title: title, language: "yaml", html: syntax_highlight(yaml_str, "yaml") }
+        rescue JSON::ParserError
+          { type: "code", title: title, language: "json", html: syntax_highlight(raw, "json") }
+        end
+
+      when ".pdf"
+        size = File.size(real_path) rescue 0
+        { type: "download", title: title, href: download_href, size: format_size(size) }
+
+      when ".epub"
+        size = File.size(real_path) rescue 0
+        { type: "download", title: title, href: download_href, size: format_size(size) }
+
+      when ".html"
+        { type: "external", title: title, href: "/browse/" + requested.split("/").map { |p| encode_path_component(p) }.join("/") }
+
+      else
+        content = File.read(real_path, encoding: "utf-8") rescue nil
+        if content.nil? || content.encoding == Encoding::BINARY || !content.valid_encoding?
+          size = File.size(real_path) rescue 0
+          { type: "download", title: title, href: download_href, size: format_size(size) }
+        else
+          lang = detect_source_language(real_path, content)
+          { type: "code", title: title, language: lang, html: syntax_highlight(content, lang) }
+        end
+      end
+    end
+
+    def render_standalone_csv(real_path, title, requested)
+      rows = CSV.read(real_path, headers: true)
+      headers = rows.headers.compact
+      columns = headers.map { |h| { key: h, title: h, type: "string" } }
+      data_rows = rows.each_with_index.map do |row, idx|
+        [idx] + headers.map { |h| row[h] }
+      end
+
+      {
+        type: "csv_table",
+        title: title,
+        standalone_csv: requested,
+        view_key: "all",
+        views: [{ key: "all", title: "All" }],
+        columns: columns,
+        rows: data_rows,
+        readonly: true
+      }
+    end
+
     def render_file(real_path, relative_path)
       ext = File.extname(real_path).downcase
       @crumbs = breadcrumbs(relative_path)
@@ -512,16 +1367,7 @@ module MarkdownServer
         if content.nil? || content.encoding == Encoding::BINARY || !content.valid_encoding?
           send_file real_path, disposition: "inline"
         else
-          lang = case ext
-                 when ".py" then "python"
-                 when ".rb" then "ruby"
-                 when ".csv" then "text"
-                 when ".sh" then "bash"
-                 when ".yaml", ".yml" then "yaml"
-                 when ".html", ".erb" then "html"
-                 when ".js" then "javascript"
-                 else "text"
-                 end
+          lang = detect_source_language(real_path, content)
           @code = syntax_highlight(content, lang)
           @language = lang
           erb :raw