maxibase 1.3.0 → 1.5.0

package/layers/base/app/components/AuthCheck.vue

@@ -1,4 +1,6 @@
 <script setup lang="ts">
+import { WebAuthnAbortService } from '@simplewebauthn/browser'
+
 const emits = defineEmits(['authenticated', 'cancel'])
 const appStore = useAppStore()
 const { $t } = useI18n()
@@ -133,17 +135,23 @@ function signIn() {
   }, 100)
 }
 
-const { authenticate } = useWebAuthn({
+const webAuthnEndpoints = {
   registerEndpoint: '/api/auth/webauthn/register',
   authenticateEndpoint: '/api/auth/webauthn/authenticate',
+}
+const { authenticate } = useWebAuthn(webAuthnEndpoints)
+const { authenticate: authenticateWithAutofill, isAutofillSupported } = useWebAuthn({
+  ...webAuthnEndpoints,
+  useBrowserAutofill: true,
 })
 
-async function signInWithPasskey() {
+async function signInWithPasskey(userName?: string, autofill = false) {
   try {
-    await authenticate(email.value)
+    await (autofill ? authenticateWithAutofill() : authenticate(userName))
     await refreshSession()
   } catch (e: any) {
-    if (!e.message.startsWith('The operation either timed out')) {
+    // any other passkey prompt aborts the pending autofill request
+    if (e.name !== 'AbortError' && !e.message.startsWith('The operation either timed out')) {
       handleError(e)
     }
   }
@@ -160,7 +168,7 @@ async function getSignInOptions(email: string) {
       password.value = route.query.token as string
       if (!options.value.hasTOTP) await signInWithOtp()
     } else if (options.value.hasPasskey) {
-      await signInWithPasskey()
+      await signInWithPasskey(email)
     } else if (!options.value.hasPassword) {
       await requestOtp()
     }
@@ -187,8 +195,12 @@ onMounted(async () => {
   email.value = user.value?.email || (route.query.email as string) || ''
   if (email.value) {
     await getSignInOptions(email.value)
+  } else if (await isAutofillSupported()) {
+    signInWithPasskey(undefined, true)
   }
 })
+
+onBeforeUnmount(() => WebAuthnAbortService.cancelCeremony())
 </script>
 
 <template>
@@ -286,8 +298,9 @@ onMounted(async () => {
           type="button"
           :disabled="isLoading"
           class="flex-center g1 w mt1 bg bg-border"
-          @click="signInWithPasskey"
+          @click="signInWithPasskey(email)"
         >
+          <Icon name="lucide:key-round" />
           {{ $t('authCheck.passkey') }}
         </button>
         <button
@@ -319,7 +332,7 @@ onMounted(async () => {
             type="email"
             required
             :disabled="isLoading"
-            autocomplete="username"
+            autocomplete="username webauthn"
           />
         </label>
         <button
@@ -329,10 +342,23 @@ onMounted(async () => {
           {{ $t('continue') }}
         </button>
       </form>
-      <slot
+      <div
         v-if="!optionsFetched"
-        name="footer"
-      ></slot>
+        class="flex-column"
+      >
+        <span class="text-center muted-text my1">{{ $t('or') }}</span>
+        <button
+          type="button"
+          :disabled="isLoading"
+          class="provider flex-center g2 w mb1 fg b"
+          style="font-weight: normal"
+          @click="signInWithPasskey()"
+        >
+          <Icon name="lucide:key-round" />
+          {{ $t('authCheck.passkey') }}
+        </button>
+        <slot name="footer"></slot>
+      </div>
       <button
         v-if="appStore.authPromise"
         type="button"
@@ -352,4 +378,18 @@ onMounted(async () => {
   box-sizing: border-box;
   width: min(400px, 100vw - (var(--g-padding-l) + var(--g-padding-r)) * var(--g-padding-ratio2));
 }
+
+.provider,
+:slotted(.provider) {
+  height: 40px;
+  border-radius: var(--g-border-radius);
+  font-size: 14px;
+  color: inherit;
+}
+
+.provider > :is(img, .iconify),
+:slotted(.provider) > :is(img, .iconify) {
+  width: 20px;
+  height: 20px;
+}
 </style>

package/layers/base/app/components/files/FilesUpload.vue

@@ -9,6 +9,7 @@ const props = defineProps({
     type: Boolean,
     default: true,
   },
+  maxAge: Number,
   imageFormat: {
     type: Object as PropType<{
       maxHeight?: number
@@ -57,9 +58,15 @@ async function uploadFile(event: Event) {
       files = files.filter((file) => !tooLarge.includes(file))
     }
     if (files.length) {
-      let response = await uploadFiles(files, props.path, props.isPrivate, (p) => {
-        progress.value = p
-      })
+      let response = await uploadFiles(
+        files,
+        props.path,
+        props.isPrivate,
+        (p) => {
+          progress.value = p
+        },
+        props.maxAge,
+      )
       emits('uploaded', response)
       appStore.notify('saved', 'success')
     }

package/layers/base/app/pages/signin.vue

@@ -71,7 +71,6 @@ async function signInAnonymously() {
         v-if="config.public.oauth.microsoft || config.public.anonymousSignup"
         class="flex-column"
       >
-        <span class="text-center muted-text my1">{{ $t('or') }}</span>
         <a
           v-if="config.public.oauth.microsoft"
           href="/auth/microsoft"
@@ -80,8 +79,6 @@ async function signInAnonymously() {
           <img
             src="/images/auth/microsoft.svg"
             alt=""
-            width="21"
-            height="21"
           />
           {{ $t('signinWith') }} Microsoft
         </a>
@@ -111,11 +108,4 @@ async function signInAnonymously() {
   box-shadow: inset 0 0 40vh var(--g-fg);
   height: 100dvh;
 }
-
-.provider {
-  height: 40px;
-  border-radius: var(--g-border-radius);
-  font-size: 14px;
-  color: inherit;
-}
 </style>

package/layers/base/app/pages/user/auth.vue

@@ -388,7 +388,7 @@ onMounted(getAuth)
                   required
                 />
                 <button
-                  class="flex fg"
+                  class="flex-center fg"
                   type="button"
                   @click="showPassword2 = !showPassword2"
                 >

package/layers/base/app/utils/files.ts

@@ -3,6 +3,7 @@ export async function uploadFiles(
   path: string,
   isPrivate: boolean,
   onProgress?: (progress: number) => void,
+  maxAge?: number, // seconds the browser and CDN may cache the file, 0 disables caching
 ) {
   let totalSize = files.reduce((sum, f) => sum + f.size, 0)
 
@@ -13,6 +14,7 @@ export async function uploadFiles(
     files.forEach((file) => formData.append('file', file))
     formData.append('path', path)
     formData.append('isPrivate', String(isPrivate))
+    if (maxAge !== undefined) formData.append('maxAge', String(maxAge))
     urls = await postFiles(formData)
   } else {
     let uploadedSize = 0
@@ -22,6 +24,7 @@ export async function uploadFiles(
         formData.append('file', file)
         formData.append('path', path)
         formData.append('isPrivate', String(isPrivate))
+        if (maxAge !== undefined) formData.append('maxAge', String(maxAge))
         urls.push(...(await postFiles(formData)))
         uploadedSize += file.size
         const progress = (uploadedSize / totalSize) * 100
@@ -32,7 +35,7 @@ export async function uploadFiles(
           const progress = (uploadedSize / totalSize) * 100
           onProgress?.(Math.round(progress))
         }
-        const url = await uploadInChunks(file, path, isPrivate, onChunkProgress)
+        const url = await uploadInChunks(file, path, isPrivate, onChunkProgress, maxAge)
         if (url) urls.push(url)
       }
     }
@@ -51,6 +54,7 @@ export async function uploadInChunks(
   path: string,
   isPrivate: boolean,
   onProgress?: (progress: number) => void,
+  maxAge?: number,
 ) {
   let uploadId
   let parts: any[] = []
@@ -70,6 +74,7 @@ export async function uploadInChunks(
     formData.append('filename', file.name)
     formData.append('path', path)
     formData.append('isPrivate', String(isPrivate))
+    if (maxAge !== undefined) formData.append('maxAge', String(maxAge))
 
     result = await $fetch('/api/files/chunk', { method: 'POST', body: formData })
     if (i + 1 < totalChunks) {

package/layers/base/server/api/files/[...path].get.ts

@@ -6,8 +6,6 @@ const querySchema = z.object({
     .transform((v) => v === 'true')
     .optional(),
   maxAge: z.coerce.number().int().min(0).optional(),
-  // only-if-cached is left out, fetch throws on it outside same-origin mode
-  serverCache: z.enum(['default', 'no-store', 'reload', 'no-cache', 'force-cache']).optional(),
   // S3 refuses to presign a URL for longer than 7 days
   expireIn: z.coerce.number().int().positive().max(604800).optional(),
   redirect: z
@@ -17,23 +15,16 @@ const querySchema = z.object({
 })
 
 export default defineEventHandler(async (event) => {
-  const path = event.context.params?.path || ''
+  const path = getRouterParam(event, 'path') || ''
   const {
     isPrivate = false,
     maxAge,
-    serverCache,
     expireIn,
     redirect,
   } = await getValidatedQuery(event, querySchema.parse)
 
-  let cache = `public, max-age=${maxAge || 31536000}`
-  if (maxAge === 0) {
-    cache = 'no-store, no-cache'
-  } else if (isPrivate) {
-    cache = `private, max-age=${maxAge || 3600}`
-  }
-  setHeader(event, 'Cache-Control', cache)
-  return getFile(event, decodePath(path), isPrivate, serverCache, expireIn, redirect)
+  setHeader(event, 'Cache-Control', getCacheControl(isPrivate, maxAge))
+  return getFile(event, decodePath(path), isPrivate, expireIn, redirect)
 })
 
 // h3 decodes the path but keeps %25 encoded, so a % in a name needs this second pass

package/layers/base/server/api/files/chunk.post.ts

@@ -23,11 +23,10 @@ export default defineEventHandler(async (event) => {
   const body = await readUploadBody(event, Number(useRuntimeConfig().public.files.chunkSize) || 1)
   if (!body) throw createError({ status: 400, message: 'No data' })
 
-  const get = (name: string) =>
-    body
-      .find((p) => p.name === name)
-      ?.data.toString()
-      .trim()
+  const get = (name: string) => {
+    const value = body.get(name)
+    return typeof value === 'string' ? value.trim() : undefined
+  }
 
   const uploadId = get('uploadId')
   const chunkIndex = Number(get('chunkIndex'))
@@ -37,9 +36,15 @@ export default defineEventHandler(async (event) => {
   const path = get('path') || 'files'
   const isPrivate = get('isPrivate') !== 'false'
   const parts = parseParts(get('parts'))
-  const chunkPart = body.find((p) => p.name === 'chunk')
-
-  if (!Number.isInteger(chunkIndex) || !Number.isInteger(totalChunks) || !filename || !chunkPart) {
+  const maxAge = parseMaxAge(get('maxAge'))
+  const chunkPart = body.get('chunk')
+
+  if (
+    !Number.isInteger(chunkIndex) ||
+    !Number.isInteger(totalChunks) ||
+    !filename ||
+    !(chunkPart instanceof File)
+  ) {
     throw invalidChunkUpload()
   }
 
@@ -49,9 +54,10 @@ export default defineEventHandler(async (event) => {
     totalChunks,
     filename,
     type,
-    chunk: chunkPart.data,
+    chunk: Buffer.from(await chunkPart.arrayBuffer()),
     path,
     isPrivate,
     parts,
+    maxAge,
   })
 })

package/layers/base/server/api/files/copy.post.ts

@@ -5,18 +5,10 @@ const bodySchema = z.object({
   dest: z.string().min(1),
   isPrivate: z.boolean().optional(),
   deleteSrc: z.boolean().optional(),
-  isFolder: z.boolean().optional(),
 })
 
 export default defineEventHandler(async (event) => {
-  const {
-    src,
-    dest,
-    isPrivate,
-    deleteSrc,
-    isFolder = !src.includes('.'),
-  } = await readValidatedBody(event, bodySchema.parse)
-  if (isFolder) await copyFiles(event, src, dest, isPrivate, deleteSrc)
-  else await copyFile(event, src, dest, isPrivate, deleteSrc)
+  const { src, dest, isPrivate, deleteSrc } = await readValidatedBody(event, bodySchema.parse)
+  await copyFiles(event, src, dest, isPrivate, deleteSrc)
   return { success: true }
 })

package/layers/base/server/api/files/index.get.ts

@@ -1,10 +1,7 @@
 import { z } from 'zod'
 
 const querySchema = z.object({
-  path: z
-    .string()
-    .min(1)
-    .refine((p) => !p.includes('.')),
+  path: z.string().min(1),
   isPrivate: z
     .enum(['true', 'false'])
     .transform((v) => v === 'true')

package/layers/base/server/api/files/index.post.ts

@@ -4,12 +4,19 @@ export default defineEventHandler(async (event) => {
     throw createError({ status: 400, message: 'No file uploaded' })
   }
 
-  const pathPart = body.find((p) => p.name === 'path')
-  const isPrivatePart = body.find((p) => p.name === 'isPrivate')
-  const isPrivate = isPrivatePart ? isPrivatePart.data.toString() === 'true' : true
-  const path = pathPart?.data.toString().trim()
+  const get = (name: string) => {
+    const value = body.get(name)
+    return typeof value === 'string' ? value.trim() : undefined
+  }
+
+  const isPrivate = body.has('isPrivate') ? get('isPrivate') === 'true' : true
+  const path = get('path')
+  const maxAge = parseMaxAge(get('maxAge'))
 
   return await Promise.all(
-    body.filter((p) => p.name === 'file').map((file) => uploadFile(event, file, path, isPrivate)),
+    body
+      .getAll('file')
+      .filter((file) => file instanceof File)
+      .map((file) => uploadFile(event, file, path, isPrivate, maxAge)),
   )
 })

package/layers/base/server/database/defaults/access.ts

@@ -3,12 +3,12 @@ import type { H3Event } from 'h3'
 // Users reach their own folder u/{id}, admins every folder
 export async function checkFileAccess(event: H3Event, path: string) {
   const { user } = await requireUserSession(event)
-  if (!user) throw createError({ statusCode: 401, message: 'Unauthorized' })
+  if (!user) throw createError({ status: 401, message: 'Unauthorized' })
   const root = `u/${user.id}`
   if (path.startsWith(root) && (path[root.length] === '/' || path.length === root.length)) {
     return true
   }
   if (user.role === 'admin') return true
 
-  throw createError({ statusCode: 403, message: 'Insufficient permissions' })
+  throw createError({ status: 403, message: 'Insufficient permissions' })
 }

package/layers/base/server/middleware/2.mfa.ts

@@ -28,7 +28,7 @@ export default defineEventHandler(async (event) => {
 
   const path = event.path.split('?')[0]!
   if (path.startsWith('/api/auth/otp/') || path === '/api/auth/password') return // re-authentication
-  if (ENROLLMENT_ROUTES.includes(path) && !(path === '/api/auth' && event.method !== 'GET')) return
+  if (ENROLLMENT_ROUTES.includes(path) && !(path === '/api/auth' && !isMethod(event, 'GET'))) return
 
   throw createError({ status: 403, message: 'MFA setup required' })
 })

package/layers/base/server/routes/dev/email/[template].ts

@@ -1,12 +1,12 @@
 export default defineEventHandler(async (event) => {
   if (process.env.NODE_ENV === 'production') {
     throw createError({
-      statusCode: 404,
+      status: 404,
       message: 'Not found',
     })
   }
 
-  const templateId = event.context.params?.template || ''
+  const templateId = getRouterParam(event, 'template') || ''
   const query = getQuery(event)
   const locale = (query.locale as string) || 'en'
 

package/layers/base/server/utils/access.ts

@@ -4,5 +4,5 @@ export async function isAdmin(event: H3Event) {
   const { user } = await requireUserSession(event)
   if (user.role === 'admin') return true
 
-  throw createError({ statusCode: 403, message: 'Insufficient permissions' })
+  throw createError({ status: 403, message: 'Insufficient permissions' })
 }

package/layers/base/server/utils/auth.ts

@@ -133,7 +133,7 @@ export async function requireRecentAuth(event: H3Event) {
   if (!session.authenticatedAt || Date.now() - session.authenticatedAt > maxAge) {
     throw createError({
       status: 403,
-      statusMessage: 'reauth_required',
+      statusText: 'reauth_required',
       message: 'Please verify your identity again to continue.',
     })
   }

package/layers/base/server/utils/files.ts

@@ -29,50 +29,52 @@ import type { CompletedPart } from '@aws-sdk/client-s3'
 import { checkFileAccess } from '#database/access'
 import { createReadStream, createWriteStream } from 'fs'
 import { pipeline } from 'stream/promises'
-import type { Readable } from 'stream'
-import type { H3Event, MultiPartData } from 'h3'
+import { Readable } from 'stream'
+import type { H3Event } from 'h3'
 import { createHash } from 'crypto'
+import mime from 'mime'
 
 const MB = 1024 * 1024
 
 function fileTooLarge() {
   const { maxSize } = useRuntimeConfig().public.files
-  return createError({ statusCode: 413, message: `File too large, max ${maxSize} MB` })
+  return createError({ status: 413, message: `File too large, max ${maxSize} MB` })
 }
 
 export async function readUploadBody(event: H3Event, maxMB: number) {
   await requireUserSession(event)
   const length = getRequestHeader(event, 'content-length')
-  if (!length) throw createError({ statusCode: 411, message: 'Content-Length required' })
+  if (!length) throw createError({ status: 411, message: 'Content-Length required' })
   if (Number(length) > (maxMB + 1) * MB) throw fileTooLarge()
-  return readMultipartFormData(event)
+  return readFormData(event).catch(() => undefined)
 }
 
 export async function uploadFile(
   event: H3Event,
-  file: MultiPartData,
+  file: File,
   path = 'files',
   isPrivate = true,
+  maxAge?: number, // only stored on S3 objects, local files get their headers from nginx
 ) {
   await checkFileAccess(event, path)
-  path = getSecurePath(path, isPrivate)
-  path = appendFilename(path, file.filename)
+  path = getUploadPath(path, isPrivate, file.name)
+  const data = Buffer.from(await file.arrayBuffer())
 
   let url
   if (useS3()) {
     const s3Key = getS3Key(path)
     url = await uploadToS3(
       s3Key,
-      file.data,
+      data,
       file.type || 'application/octet-stream',
-      undefined,
+      getCacheControl(isPrivate, maxAge),
       isPrivate,
     )
   } else {
     const filePath = join(process.cwd(), path)
     const folderPath = filePath.replace(/\/[^/]*$/, '')
     await mkdir(folderPath, { recursive: true })
-    await writeFile(filePath, file.data)
+    await writeFile(filePath, data)
 
     url = getFileURL(path, isPrivate)
   }
@@ -85,17 +87,17 @@ export async function uploadStream(
   file: { stream: Readable; filename?: string; type?: string },
   path = 'files',
   isPrivate = true,
+  maxAge?: number,
 ) {
   await checkFileAccess(event, path)
-  path = getSecurePath(path, isPrivate)
-  path = appendFilename(path, file.filename)
+  path = getUploadPath(path, isPrivate, file.filename)
 
   if (useS3()) {
     return uploadStreamToS3(
       getS3Key(path),
       file.stream,
       file.type || 'application/octet-stream',
-      undefined,
+      getCacheControl(isPrivate, maxAge),
       isPrivate,
     )
   }
@@ -133,6 +135,7 @@ export async function uploadChunk(
     path,
     isPrivate,
     parts,
+    maxAge,
   }: {
     uploadId?: string
     chunkIndex: number
@@ -143,10 +146,11 @@ export async function uploadChunk(
     path: string
     isPrivate: boolean
     parts: CompletedPart[]
+    maxAge?: number // only read on the first chunk, when the S3 upload starts
   },
 ) {
   if (chunkIndex < 0 || chunkIndex >= totalChunks || totalChunks < 1) {
-    throw createError({ statusCode: 400, message: 'Invalid chunk index' })
+    throw createError({ status: 400, message: 'Invalid chunk index' })
   }
   const { chunkSize, maxSize } = useRuntimeConfig().public.files
   const chunkBytes = (Number(chunkSize) || 1) * MB
@@ -155,12 +159,16 @@ export async function uploadChunk(
   }
 
   await checkFileAccess(event, path)
-  path = getSecurePath(path, isPrivate)
-  path = appendFilename(path, filename)
+  path = getUploadPath(path, isPrivate, filename)
 
   if (useS3()) {
     if (!uploadId) {
-      uploadId = (await initMultipartUploadToS3(getS3Key(path), type, isPrivate))!
+      uploadId = (await initMultipartUploadToS3(
+        getS3Key(path),
+        type,
+        isPrivate,
+        getCacheControl(isPrivate, maxAge),
+      ))!
       parts = []
     }
 
@@ -179,7 +187,7 @@ export async function uploadChunk(
     uploadId = crypto.randomUUID()
     parts = []
   } else if (!isUUID(uploadId)) {
-    throw createError({ statusCode: 400, message: 'Invalid upload id' })
+    throw createError({ status: 400, message: 'Invalid upload id' })
   }
 
   const tmpDir = join(process.cwd(), 'files', 'temp', uploadId)
@@ -305,7 +313,6 @@ export async function getFile(
   event: H3Event,
   path: string,
   isPrivate = false,
-  cache: RequestCache = 'no-cache',
   expireIn?: number,
   redirect?: boolean,
 ) {
@@ -324,14 +331,15 @@ export async function getFile(
       return sendRedirect(event, url, 302)
     }
 
-    const response = await fetch(url, { cache, headers: range ? { range } : undefined })
+    const response = await fetch(url, { headers: range ? { range } : undefined })
 
     if (response.status === 416) {
       const contentRange = response.headers.get('content-range')
       if (contentRange) setHeader(event, 'Content-Range', contentRange)
-      throw createError({ statusCode: 416, message: 'Range not satisfiable' })
+      throw createError({ status: 416, message: 'Range not satisfiable' })
     }
-    if (!response.ok) throw createError({ statusCode: 502, message: 'Failed to fetch file' })
+    if (response.status === 404) throw createError({ status: 404, message: 'File not found' })
+    if (!response.ok) throw createError({ status: 502, message: 'Failed to fetch file' })
 
     const passthrough = {
       'Content-Type': response.headers.get('content-type'),
@@ -351,15 +359,16 @@ export async function getFile(
 
   const stats = await stat(fullPath).catch(() => null)
   if (!stats?.isFile()) {
-    throw createError({ statusCode: 404, message: 'File not found' })
+    throw createError({ status: 404, message: 'File not found' })
   }
 
+  setHeader(event, 'Content-Type', mime.getType(fullPath) || 'application/octet-stream')
   setHeader(event, 'Accept-Ranges', 'bytes')
 
   const parsedRange = parseRangeHeader(range, stats.size)
   if (parsedRange === 'unsatisfiable') {
     setHeader(event, 'Content-Range', `bytes */${stats.size}`)
-    throw createError({ statusCode: 416, message: 'Range not satisfiable' })
+    throw createError({ status: 416, message: 'Range not satisfiable' })
   }
 
   if (parsedRange) {
@@ -367,11 +376,12 @@ export async function getFile(
     setResponseStatus(event, 206)
     setHeader(event, 'Content-Range', `bytes ${start}-${end}/${stats.size}`)
     setHeader(event, 'Content-Length', end - start + 1)
-    return createReadStream(fullPath, { start, end })
+    return Readable.toWeb(createReadStream(fullPath, { start, end }))
   }
 
   setHeader(event, 'Content-Length', stats.size)
-  return createReadStream(fullPath)
+  // h3 v2 only streams web streams
+  return Readable.toWeb(createReadStream(fullPath))
 }
 
 export async function deletePath(event: H3Event, path: string, isPrivate = true) {
@@ -417,27 +427,26 @@ export async function listFolder(
   path = getSecurePath(path, isPrivate)
 
   if (useS3()) return await listFromS3(path, isPrivate)
+  return listLocal(path, isPrivate)
+}
+
+async function listLocal(path: string, isPrivate: boolean): Promise<ListedFile[]> {
   const localPath = join(process.cwd(), path)
-  const filesStats = await readdir(localPath).catch(() => [])
-  return (
-    await Promise.all(
-      filesStats.map(async (name) => {
-        const localeFilePath = join(localPath, name)
-        const stats = await stat(localeFilePath)
-        const rootedPath = join(path, name)
-        const filePath = removeRoot(rootedPath, isPrivate)
-        return stats.isDirectory()
-          ? await listFolder(event, filePath, isPrivate)
-          : {
-              name,
-              size: stats.size,
-              updatedAt: stats.mtime,
-              path: filePath,
-              url: getFileURL(rootedPath, isPrivate),
-            }
-      }),
-    )
-  ).flat()
+  const stats = await stat(localPath).catch(() => null)
+  if (stats?.isFile()) {
+    return [
+      {
+        name: basename(path),
+        size: stats.size,
+        updatedAt: stats.mtime,
+        path: removeRoot(path, isPrivate),
+        url: getFileURL(path, isPrivate),
+      },
+    ]
+  }
+  if (!stats?.isDirectory()) return []
+  const names = await readdir(localPath)
+  return (await Promise.all(names.map((name) => listLocal(join(path, name), isPrivate)))).flat()
 }
 
 export async function copyFile(
@@ -460,7 +469,7 @@ export async function copyFile(
   const destPath = join(process.cwd(), dest)
   const stats = await stat(srcPath).catch(() => null)
   if (!stats?.isFile()) {
-    throw createError({ statusCode: 404, message: 'File not found' })
+    throw createError({ status: 404, message: 'File not found' })
   }
   await mkdir(dirname(destPath), { recursive: true })
   await fsCopyFile(srcPath, destPath)
@@ -478,6 +487,7 @@ export async function copyFiles(
   deleteSrc = false,
 ) {
   const files = await listFolder(event, src, isPrivate)
+  if (!files.length) throw createError({ status: 404, message: 'File not found' })
   const normalizedSrc = removeRoot(getSecurePath(src, isPrivate), isPrivate)
   const normalizedDest = removeRoot(getSecurePath(dest, isPrivate), isPrivate)
   return Promise.all(
@@ -511,14 +521,16 @@ export function getSecurePath(path: string, isPrivate = true) {
 }
 
 function invalidPath() {
-  return createError({ statusCode: 400, message: 'Invalid path' })
+  return createError({ status: 400, message: 'Invalid path' })
 }
 
-function appendFilename(path: string, filename?: string) {
+function getUploadPath(path: string, isPrivate: boolean, filename?: string) {
+  const isFolder = path.endsWith('/')
+  path = getSecurePath(path, isPrivate)
   if (!filename) return path
   if (filename.includes('..')) throw invalidPath()
   filename = cleanFilename(filename)
-  if (/[^/]\.[^.]+$/.test(path) || basename(path) === filename) return path
+  if (!isFolder && (/[^/]\.[^.]+$/.test(path) || basename(path) === filename)) return path
   return join(path, filename)
 }
 
@@ -563,56 +575,60 @@ export const useS3 = () => {
   return s3Client
 }
 
+export function getCacheControl(isPrivate: boolean, maxAge?: number) {
+  if (maxAge === 0) return 'no-store, no-cache'
+  if (isPrivate) return `private, max-age=${maxAge || 3600}`
+  return `public, max-age=${maxAge || 31536000}`
+}
+
+export function parseMaxAge(value?: string) {
+  if (!value) return undefined
+  const maxAge = Number(value)
+  if (!Number.isInteger(maxAge) || maxAge < 0) {
+    throw createError({ status: 400, message: 'Invalid maxAge' })
+  }
+  return maxAge
+}
+
 export async function uploadToS3(
   key: string,
   body: Buffer,
   contentType: string,
-  cache = 'public, max-age=31536000',
+  cache?: string,
   isPrivate = true,
 ) {
   const client = useS3()
   if (!client) return null
 
   const config = useRuntimeConfig()
+  cache ||= getCacheControl(isPrivate)
 
-  if (isPrivate) {
-    await client.send(
-      new PutObjectCommand({
-        Bucket: config.s3.privateBucket,
-        Key: key,
-        Body: body,
-        ContentType: contentType,
-        CacheControl: cache || 'public, max-age=31536000',
-      }),
-    )
-
-    return getS3SignedUrl(key)
-  }
   await client.send(
     new PutObjectCommand({
-      Bucket: config.s3.publicBucket,
+      Bucket: isPrivate ? config.s3.privateBucket : config.s3.publicBucket,
       Key: key,
       Body: body,
       ContentType: contentType,
-      CacheControl: cache || 'public, max-age=31536000',
-      ACL: 'public-read',
+      CacheControl: cache,
+      ACL: isPrivate ? undefined : 'public-read',
     }),
   )
 
-  return getS3URL(key)
+  return isPrivate ? getFileURL(key) : getS3URL(key)
 }
 
 export async function uploadStreamToS3(
   key: string,
   body: Readable,
   contentType: string,
-  cache = 'public, max-age=31536000',
+  cache?: string,
   isPrivate = true,
 ) {
   const client = useS3()
   if (!client) return null
 
   const config = useRuntimeConfig()
+  cache ||= getCacheControl(isPrivate)
   const partSize = 5 * 1024 * 1024 // S3 minimum, only the last part may be smaller
 
   let uploadId: string | undefined
@@ -680,7 +696,7 @@ export async function initMultipartUploadToS3(
     Bucket: isPrivate ? config.s3.privateBucket : config.s3.publicBucket,
     Key: key,
     ContentType: contentType,
-    CacheControl: cache,
+    CacheControl: cache || getCacheControl(isPrivate),
     ACL: isPrivate ? undefined : 'public-read',
   })
 
@@ -734,7 +750,7 @@ export async function completeMultipartUploadToS3(
   })
 
   await client.send(command)
-  return isPrivate ? getS3SignedUrl(key) : getS3URL(key)
+  return isPrivate ? getFileURL(key) : getS3URL(key)
 }
 
 export async function deleteFromS3(path: string, isPrivate = true) {
@@ -774,7 +790,7 @@ export async function deleteFromS3(path: string, isPrivate = true) {
       const result = await client.send(command)
       if (result.Errors?.length) {
         throw createError({
-          statusCode: 502,
+          status: 502,
           message: `Failed to delete ${result.Errors.length} file(s): ${result.Errors.map((e) => `${e.Key} (${e.Code})`).join(', ')}`,
         })
       }
@@ -800,17 +816,15 @@ export async function listFromS3(path: string, isPrivate = true) {
     )
     ContinuationToken = response.NextContinuationToken
     files.push(
-      ...(await Promise.all(
-        (response.Contents || [])
-          .filter((item) => item.Key === path || item.Key?.startsWith(`${path}/`))
-          .map(async (item) => ({
-            path: removeRoot(item.Key || '', isPrivate),
-            name: item.Key?.split('/').pop() || '',
-            url: isPrivate ? await getS3SignedUrl(item.Key || '') : getS3URL(item.Key || ''),
-            updatedAt: item.LastModified ?? new Date(0),
-            size: item.Size || 0,
-          })),
-      )),
+      ...(response.Contents || [])
+        .filter((item) => item.Key === path || item.Key?.startsWith(`${path}/`))
+        .map((item) => ({
+          path: removeRoot(item.Key || '', isPrivate),
+          name: item.Key?.split('/').pop() || '',
+          url: isPrivate ? getFileURL(item.Key || '') : getS3URL(item.Key || ''),
+          updatedAt: item.LastModified ?? new Date(0),
+          size: item.Size || 0,
+        })),
     )
   } while (ContinuationToken)
 
@@ -829,6 +843,7 @@ export async function copyFromS3(src: string, dest: string, isPrivate = true, de
       Bucket: bucket,
       Key: dest,
       CopySource: copySource,
+      ACL: isPrivate ? undefined : 'public-read',
     }),
   )
   if (deleteSrc) {

package/layers/base/server/utils/ip.ts

@@ -11,5 +11,5 @@ export function getClientIP(event: H3Event): string {
     if (clientIP) return clientIP
   }
 
-  return event.node.req.socket?.remoteAddress || 'unknown'
+  return getRequestIP(event) || 'unknown'
 }

package/locales/en.json

@@ -15,6 +15,7 @@
   "fileTooLarge": "Too large, max {max} MB: {files}",
   "formatFailed": "Could not format or upload {files}",
   "language": "Language | Languages",
+  "or": "or",
   "paste": "Paste",
   "rename": "Rename",
   "retry": "Retry",

package/locales/fr.json

@@ -15,6 +15,7 @@
   "fileTooLarge": "Trop volumineux, max {max} Mo : {files}",
   "formatFailed": "Impossible de formater ou téléverser {files}",
   "language": "Langue | Langues",
+  "or": "ou",
   "paste": "Coller",
   "rename": "Renommer",
   "retry": "Réessayer",

package/locales/pages/signin/en.json

@@ -1,5 +1,4 @@
 {
   "continueAsGuest": "Continue as Guest",
-  "or": "or",
   "signinWith": "Sign in with"
 }

package/locales/pages/signin/fr.json

@@ -1,5 +1,4 @@
 {
   "continueAsGuest": "Continuer en tant qu'invité",
-  "or": "ou",
   "signinWith": "Se connecter avec"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxibase",
-  "version": "1.3.0",
+  "version": "1.5.0",
   "description": "Nuxt layer with auth, files, logs and backups",
   "keywords": [
     "nuxt",
@@ -71,6 +71,7 @@
     "@types/qrcode": "^1.5.6",
     "drizzle-orm": "1.0.0-rc.3",
     "goku-css": "^9.0.8",
+    "mime": "^4.1.1",
     "nodemailer": "^10.1.7",
     "nuxt-auth-utils": "^0.5.32",
     "nuxt-i18n-micro": "^3.30.1",