mbkbucket 1.3.0 → 1.4.0

package/lib/bucket.js

@@ -1,20 +1,71 @@
 import express from "express";
 import { validateSessionAndRole, renderPage, mbkautheVar } from "mbkauthe";
-import { listfiles, uploadFile, deleteFile, deleteFiles, deleteFolder, downloadFile, getFileMetadata, fileExists, ensureKeyHasAppPrefix, ensurePrefix, getAppName, getBucketConfig } from "./s3.js";
+import { listfiles, uploadFile, deleteFile, deleteFiles, deleteFolder, downloadFile, getFileMetadata, fileExists, ensureKeyHasAppPrefix, ensurePrefix, getAppName, getBucketConfig, generateSignedUrl, createMultipartUpload, uploadPart, completeMultipartUpload, abortMultipartUpload, listIncompleteMultipartUploads, cleanupIncompleteMultipartUploads } from "./s3.js";
 import multer from "multer";
-import path from "path";
-import fs from 'fs';
-import os from 'os';
-import crypto from 'crypto';
+import { mbkbucketVar } from "./config/index.js";
+import rateLimit from "express-rate-limit";
 import { appVersion, getLatestVersion } from "./config/index.js";
 
+// ---------------------------------------------------------------------------
+// p_view security: rate limiter + basic bot/security middleware
+// ---------------------------------------------------------------------------
+const pviewRateLimit = rateLimit({
+  windowMs: 60 * 1000,          // 1-minute window
+  max: 10,                       // max 10 requests per IP per minute
+  standardHeaders: 'draft-7',
+  legacyHeaders: false,
+  keyGenerator: (req) => req.headers['x-forwarded-for']?.split(',')[0].trim() || req.socket.remoteAddress || 'unknown',
+  handler: (_req, res) => {
+    res.status(429).json({ message: 'Too many requests. Please slow down and try again later.' });
+  }
+});
+
+// Blocks obviously headless/scraper User-Agents and missing UAs
+const BLOCKED_UA_PATTERNS = /curl|wget|python-requests|python-urllib|go-http|scrapy|libwww|java\/|bot|crawl|spider|headless|phantom|selenium|puppeteer|playwright|postman|insomnia|httpie/i;
+
+// Suspicious header patterns that indicate automated access
+const SUSPICIOUS_HEADERS = [
+  'x-devtools-emulate-network-conditions-client-id',
+  'x-chromedriver-clientid',
+  'x-automated-tool'
+];
+
+function pviewSecurity(req, res, next) {
+  const ua = req.headers['user-agent'] || '';
+
+  // Block empty or obviously automated UAs
+  if (!ua || BLOCKED_UA_PATTERNS.test(ua)) {
+    return res.status(403).json({ message: 'Forbidden' });
+  }
+  
+  // Block suspicious headers that indicate automation
+  const hasSuspiciousHeaders = SUSPICIOUS_HEADERS.some(header => header in req.headers);
+  if (hasSuspiciousHeaders) {
+    return res.status(403).json({ message: 'Forbidden' });
+  }
+  
+  // Rate limit check - ensure unique fingerprint per request
+  const fingerprint = `${req.headers['x-forwarded-for']?.split(',')[0].trim() || req.socket.remoteAddress}:${ua}`;
+  
+  // Verify Accept header is present (legitimate browsers always send this)
+  if (!req.headers['accept']) {
+    return res.status(403).json({ message: 'Forbidden' });
+  }
+
+  // Set security headers for the public view response
+  res.setHeader('X-Content-Type-Options', 'nosniff');
+  res.setHeader('X-Frame-Options', 'SAMEORIGIN');
+  res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
+  // Fix CORS - either allow all (public files) or restrict to specific origins
+  // Using 'null' is invalid; we'll disable CORS entirely for public view since it's auth-restricted
+  res.removeHeader('Access-Control-Allow-Origin');
+
+  next();
+}
+
 const router = express.Router();
 const upload = multer({ storage: multer.memoryStorage() });
 
-// Temp folder for chunked uploads
-const CHUNKS_DIR = path.join(os.tmpdir(), 'mbkbucket-chunks');
-fs.mkdirSync(CHUNKS_DIR, { recursive: true });
-
 // Key/prefix helpers are provided by `s3.js`: `ensurePrefix`, `ensureKeyHasAppPrefix`, `getAppName`.
 
 router.get('/mbkbucket', validateSessionAndRole('SuperAdmin'), async (req, res) => {
@@ -28,7 +79,71 @@ router.get(['/mbkbucket/info', "/mbkbucket/i"], validateSessionAndRole('SuperAdm
   } catch (err) {
     console.error("[mbkauthe] Error fetching package-lock.json:", err);
   }
-  renderPage(req, res, "info.handlebars", false, { page: "MBK Bucket Info", appVersion, latestVersion, APP_NAME: mbkautheVar?.APP_NAME });
+  renderPage(req, res, "mbkbucket_info.handlebars", false, { page: "MBK Bucket Info", CurrentVersion: appVersion, latestVersion, APP_NAME: mbkautheVar?.APP_NAME });
+});
+
+
+router.get(['/mbkbucket/info.json', "/mbkbucket/i.json"], validateSessionAndRole('SuperAdmin'), async (req, res) => {
+  let latestVersion = 'unknown';
+  try {
+    latestVersion = await getLatestVersion();
+  } catch (err) {
+    console.error("[mbkauthe] Error fetching package-lock.json:", err);
+  }
+  res.json({CurrentVersion:appVersion, latestVersion, APP_NAME: mbkautheVar?.APP_NAME });
+});
+
+// API endpoint for multipart upload cleanup
+router.post('/mbkbucket/api/cleanup-uploads', validateSessionAndRole('SuperAdmin'), async (req, res) => {
+  try {
+    const { olderThanDays = 7, prefix = '' } = req.body;
+    
+    // Validate olderThanDays
+    const days = parseInt(olderThanDays, 10);
+    if (isNaN(days) || days < 1) {
+      return res.status(400).json({ success: false, error: 'olderThanDays must be a positive integer' });
+    }
+    
+    console.log(`[mbkbucket] Starting cleanup of incomplete uploads older than ${days} days`);
+    const result = await cleanupIncompleteMultipartUploads(days, prefix);
+    
+    res.json({
+      success: true,
+      message: `Cleaned up ${result.abortedCount} incomplete multipart upload(s)`,
+      ...result
+    });
+  } catch (error) {
+    console.error('[mbkbucket] Cleanup failed:', error);
+    res.status(500).json({
+      success: false,
+      error: error.message
+    });
+  }
+});
+
+// API endpoint to list incomplete multipart uploads
+router.get('/mbkbucket/api/incomplete-uploads', validateSessionAndRole('SuperAdmin'), async (req, res) => {
+  try {
+    const { prefix = '' } = req.query;
+    const uploads = await listIncompleteMultipartUploads(prefix);
+    
+    res.json({
+      success: true,
+      count: uploads.length,
+      uploads: uploads.map(u => ({
+        key: u.Key,
+        uploadId: u.UploadId,
+        initiated: u.Initiated,
+        initiator: u.Initiator?.DisplayName
+      }))
+    });
+  } catch (error) {
+    console.error('[mbkbucket] Failed to list incomplete uploads:', error);
+    res.status(500).json({
+      success: false,
+      error: error.message
+    });
+  }
 });
 
 // API endpoint for fetching files
@@ -46,7 +161,7 @@ router.get('/mbkbucket/api/files', validateSessionAndRole('SuperAdmin'), async (
   const isSearch = search && search.trim().length > 0;
   // If recursive is explicitly 'false', we respect it. Default to true if missing (though frontend should send it)
   // Logic: Optimization works only if NOT recursive and NOT searching.
-  const isRecursive = recursive === 'true'; 
+  const isRecursive = recursive === 'true';
   const useOptimizedListing = !isSearch && !isRecursive;
 
   try {
@@ -59,7 +174,7 @@ router.get('/mbkbucket/api/files', validateSessionAndRole('SuperAdmin'), async (
     if (useOptimizedListing) {
       // --- OPTIMIZED PATH: S3 Delimiter (Folder View) ---
       // We process only one page from S3. This reduces API calls significantly.
-      
+
       // FIX: Ensure root listing uses trailing slash to prevent "app-name" matching "app-name-backup"
       // and ensure directory browsing works correctly if ensurePrefix didn't append slash (which it now does if present in input).
       // But for root, input is empty, ensurePrefix returns "app", so we force "app/" here.
@@ -68,15 +183,17 @@ router.get('/mbkbucket/api/files', validateSessionAndRole('SuperAdmin'), async (
         listPrefix += '/';
       }
 
-      const result = await listfiles(listPrefix, { 
+      const result = await listfiles(listPrefix, {
         continuationToken: token || undefined, // Use token from query if provided
-        delimiter: '/', 
+        delimiter: '/',
         maxKeys: 1000 // Fetch a healthy batch.
       });
-      
+
       files = result.Contents || [];
+      // Filter out folder marker objects (zero-byte files ending with /)
+      files = files.filter(f => !f.Key.endsWith('/'));
       // S3 returns CommonPrefixes for folders when delimiter is used
-      folders = (result.CommonPrefixes || []).map(p => p.Prefix).filter(p => p !== effectivePrefix); 
+      folders = (result.CommonPrefixes || []).map(p => p.Prefix).filter(p => p !== effectivePrefix);
       nextContinuationToken = result.NextContinuationToken;
 
       // Note: In optimized mode, totalFiles is unknown without scanning everything.
@@ -88,7 +205,9 @@ router.get('/mbkbucket/api/files', validateSessionAndRole('SuperAdmin'), async (
       do {
         const result = await listfiles(effectivePrefix, { continuationToken });
         if (result.Contents) {
-          files = files.concat(result.Contents);
+          // Filter out folder marker objects (zero-byte files ending with /)
+          const actualFiles = result.Contents.filter(f => !f.Key.endsWith('/'));
+          files = files.concat(actualFiles);
         }
         continuationToken = result.nextToken;
       } while (continuationToken);
@@ -106,7 +225,7 @@ router.get('/mbkbucket/api/files', validateSessionAndRole('SuperAdmin'), async (
           console.warn('Fallback root listing failed:', fallbackErr.message);
         }
       }
-      
+
       // Apply search filter if provided
       if (isSearch) {
         const searchLower = search.toLowerCase();
@@ -118,43 +237,45 @@ router.get('/mbkbucket/api/files', validateSessionAndRole('SuperAdmin'), async (
 
     // Response Construction
     if (useOptimizedListing) {
-       res.json({
-         success: true,
-         files: files,
-         folders: folders, 
-         prefix: effectivePrefix,
-         search: search,
-         // In optimized mode, we don't support random access "Page X". We support "Next".
-         currentPage: 1, 
-         totalPages: nextContinuationToken ? 9999 : 1, 
-         hasNextPage: !!nextContinuationToken,
-         nextContinuationToken: nextContinuationToken,
-         mode: 'optimized',
-         totalFiles: -1 
-       });
-       
+      res.json({
+        success: true,
+        files: files,
+        folders: folders,
+        prefix: effectivePrefix,
+        search: search,
+        // In optimized mode, we use token-based pagination, not page numbers
+        currentPage: 1,
+        totalPages: 1, // Always 1 since we use continuation tokens instead
+        hasNextPage: !!nextContinuationToken,
+        hasPrevPage: false, // Token-based pagination doesn't support backwards navigation
+        nextContinuationToken: nextContinuationToken,
+        mode: 'optimized',
+        totalFiles: -1, // Unknown in optimized mode without full scan
+        paginationType: 'continuation-token' // Indicate the type of pagination
+      });
+
     } else {
-       // Legacy Pagination Logic (In-Memory)
-       const totalFiles = files.length;
-       const totalPages = Math.max(1, Math.ceil(totalFiles / pageSize));
-       const currentPage = Math.max(1, parseInt(page, 10) || 1);
-       const startIndex = (currentPage - 1) * pageSize;
-       const paginatedFiles = files.slice(startIndex, startIndex + pageSize);
-
-       res.json({
-         success: true,
-         files: paginatedFiles,
-         folders: [], // In recursive mode, frontend calculates folders from file paths
-         prefix: effectivePrefix,
-         search: search,
-         currentPage: currentPage,
-         totalPages,
-         hasNextPage: currentPage < totalPages,
-         hasPrevPage: currentPage > 1,
-         nextPage: currentPage + 1,
-         prevPage: Math.max(1, currentPage - 1),
-         totalFiles
-       });
+      // Legacy Pagination Logic (In-Memory)
+      const totalFiles = files.length;
+      const totalPages = Math.max(1, Math.ceil(totalFiles / pageSize));
+      const currentPage = Math.max(1, parseInt(page, 10) || 1);
+      const startIndex = (currentPage - 1) * pageSize;
+      const paginatedFiles = files.slice(startIndex, startIndex + pageSize);
+
+      res.json({
+        success: true,
+        files: paginatedFiles,
+        folders: [], // In recursive mode, frontend calculates folders from file paths
+        prefix: effectivePrefix,
+        search: search,
+        currentPage: currentPage,
+        totalPages,
+        hasNextPage: currentPage < totalPages,
+        hasPrevPage: currentPage > 1,
+        nextPage: currentPage + 1,
+        prevPage: Math.max(1, currentPage - 1),
+        totalFiles
+      });
     }
 
   } catch (error) {
@@ -185,89 +306,149 @@ router.post('/mbkbucket/upload', validateSessionAndRole('SuperAdmin'), upload.si
 
     const key = `${effectivePrefix.replace(/\/+$/, '')}/${req.file.originalname}`;
 
-    // Check if file already exists
-    const exists = await fileExists(key);
-    if (exists) {
-      return res.status(409).json({ success: false, error: `File already exists: ${req.file.originalname}` });
-    }
-
     const uploadOptions = {
       metadata: {
         'original-name': req.file.originalname,
         'upload-source': 'web-portal',
         'user-agent': req.headers['user-agent'] || 'unknown'
-      }
+      },
+      preventOverwrite: true // Use atomic operation to prevent race conditions
     };
 
-    await uploadFile(key, req.file.buffer, req.file.mimetype, uploadOptions);
-    res.json({ success: true, message: 'File uploaded successfully', key: key });
+    try {
+      await uploadFile(key, req.file.buffer, req.file.mimetype, uploadOptions);
+      
+      // Clean up folder marker if it exists in the parent directory
+      // This happens when a file is uploaded to a folder that was previously empty
+      const folderPath = key.substring(0, key.lastIndexOf('/') + 1);
+      if (folderPath) {
+        const folderMarkerKey = folderPath; // Already ends with /
+        try {
+          const markerExists = await fileExists(folderMarkerKey);
+          if (markerExists) {
+            // Check if this is actually a folder marker (zero-byte file)
+            const metadata = await getFileMetadata(folderMarkerKey);
+            if (metadata.ContentLength === 0 || metadata.Metadata?.marker === 'true') {
+              await deleteFile(folderMarkerKey);
+              console.log(`[mbkbucket] Cleaned up folder marker: ${folderMarkerKey}`);
+            }
+          }
+        } catch (cleanupErr) {
+          // Non-critical error, just log it
+          console.warn('[mbkbucket] Failed to clean up folder marker:', cleanupErr.message);
+        }
+      }
+      
+      res.json({ success: true, message: 'File uploaded successfully', key: key });
+    } catch (uploadError) {
+      // Handle file already exists error from atomic operation
+      if (uploadError.message.includes('already exists')) {
+        return res.status(409).json({ success: false, error: `File already exists: ${req.file.originalname}` });
+      }
+      throw uploadError;
+    }
   } catch (error) {
     console.error("Error uploading file:", error);
     res.status(500).json({ success: false, error: `Upload failed: ${error.message}` });
   }
 });
 
-// Chunk upload receiver - accepts a single chunk (FormData: chunk file under field 'chunk')
-router.post('/mbkbucket/upload-chunk', validateSessionAndRole('SuperAdmin'), upload.single('chunk'), async (req, res) => {
+// S3 Multipart Upload — Step 1: Initiate
+// Body: { fileName, prefix?, contentType? }
+// Returns: { uploadId, key }
+router.post('/mbkbucket/upload-init', validateSessionAndRole('SuperAdmin'), async (req, res) => {
   try {
-    const { uploadId, fileName, chunkIndex, totalChunks } = req.body;
-    if (!req.file || !fileName || typeof chunkIndex === 'undefined' || typeof totalChunks === 'undefined') {
-      return res.status(400).json({ success: false, error: 'Missing required parameters' });
-    }
+    const { fileName, prefix = '', contentType = 'application/octet-stream' } = req.body;
+    if (!fileName) return res.status(400).json({ success: false, error: 'fileName is required' });
 
-    const id = uploadId || crypto.randomBytes(12).toString('hex');
-    const dir = path.join(CHUNKS_DIR, id);
-    await fs.promises.mkdir(dir, { recursive: true });
+    let effectivePrefix;
+    try { effectivePrefix = ensurePrefix(prefix); } catch (e) { return res.status(400).json({ success: false, error: e.message }); }
+    const key = `${effectivePrefix.replace(/\/+$/, '')}/${fileName}`;
 
-    const partName = path.join(dir, `part-${String(chunkIndex).padStart(6, '0')}`);
-    await fs.promises.writeFile(partName, req.file.buffer);
+    // Check if file exists before initiating multipart upload
+    // Note: This is still slightly racy, but multipart uploads take time so collision risk is lower
+    // A complete solution would require server-side locking or unique upload IDs
+    const exists = await fileExists(key);
+    if (exists) return res.status(409).json({ success: false, error: `File already exists: ${fileName}` });
 
-    return res.json({ success: true, uploadId: id, chunkIndex: Number(chunkIndex) });
+    const result = await createMultipartUpload(key, contentType);
+    return res.json({ success: true, uploadId: result.uploadId, key: result.key });
   } catch (err) {
-    console.error('Chunk upload failed:', err);
+    console.error('[mbkbucket] upload-init failed:', err);
     return res.status(500).json({ success: false, error: err.message });
   }
 });
 
-// Upload complete - assemble chunks and upload final file
-router.post('/mbkbucket/upload-complete', validateSessionAndRole('SuperAdmin'), async (req, res) => {
+// S3 Multipart Upload — Step 2: Upload a part
+// FormData: chunk (file), partNumber (1-based integer), uploadId, key
+// Returns: { partNumber, ETag }
+router.post('/mbkbucket/upload-chunk', validateSessionAndRole('SuperAdmin'), upload.single('chunk'), async (req, res) => {
   try {
-    const { uploadId, fileName, prefix = '', contentType = 'application/octet-stream' } = req.body;
-    if (!uploadId || !fileName) return res.status(400).json({ success: false, error: 'uploadId and fileName are required' });
-
-    const dir = path.join(CHUNKS_DIR, uploadId);
-    const files = await fs.promises.readdir(dir);
-    // Sort by part name
-    files.sort();
-
-    const buffers = [];
-    for (const f of files) {
-      const b = await fs.promises.readFile(path.join(dir, f));
-      buffers.push(b);
+    const { uploadId, key, partNumber } = req.body;
+    if (!req.file || !uploadId || !key || !partNumber) {
+      return res.status(400).json({ success: false, error: 'chunk file, uploadId, key, and partNumber are required' });
+    }
+    const part = parseInt(partNumber, 10);
+    if (isNaN(part) || part < 1 || part > 10000) {
+      return res.status(400).json({ success: false, error: 'partNumber must be an integer between 1 and 10000' });
     }
 
-    const assembled = Buffer.concat(buffers);
-
-    // Upload to bucket
-    let effectivePrefix;
-    try { effectivePrefix = ensurePrefix(prefix); } catch (e) { return res.status(400).json({ success: false, error: e.message }); }
-    const key = `${effectivePrefix.replace(/\/+$/, '')}/${fileName}`;
-
-    // Check existence
-    const exists = await fileExists(key);
-    if (exists) return res.status(409).json({ success: false, error: 'File already exists' });
+    const result = await uploadPart(key, uploadId, part, req.file.buffer);
+    return res.json({ success: true, partNumber: result.partNumber, ETag: result.ETag });
+  } catch (err) {
+    console.error('[mbkbucket] upload-chunk failed:', err);
+    return res.status(500).json({ success: false, error: err.message });
+  }
+});
 
-    await uploadFile(key, assembled, contentType, { metadata: { 'chunked-upload': 'true', 'upload-id': uploadId } });
+// S3 Multipart Upload — Step 3: Complete
+// Body: { uploadId, key, parts: [{ partNumber, ETag }] }
+// Returns: { key }
+router.post('/mbkbucket/upload-complete', validateSessionAndRole('SuperAdmin'), async (req, res) => {
+  try {
+    const { uploadId, key, parts } = req.body;
+    if (!uploadId || !key || !Array.isArray(parts) || !parts.length) {
+      return res.status(400).json({ success: false, error: 'uploadId, key, and parts array are required' });
+    }
 
-    // Cleanup chunks
-    for (const f of files) {
-      await fs.promises.unlink(path.join(dir, f)).catch(() => { });
+    const result = await completeMultipartUpload(key, uploadId, parts);
+    
+    // Clean up folder marker if it exists in the parent directory
+    const folderPath = result.key.substring(0, result.key.lastIndexOf('/') + 1);
+    if (folderPath) {
+      const folderMarkerKey = folderPath;
+      try {
+        const markerExists = await fileExists(folderMarkerKey);
+        if (markerExists) {
+          const metadata = await getFileMetadata(folderMarkerKey);
+          if (metadata.ContentLength === 0 || metadata.Metadata?.marker === 'true') {
+            await deleteFile(folderMarkerKey);
+            console.log(`[mbkbucket] Cleaned up folder marker: ${folderMarkerKey}`);
+          }
+        }
+      } catch (cleanupErr) {
+        console.warn('[mbkbucket] Failed to clean up folder marker:', cleanupErr.message);
+      }
     }
-    await fs.promises.rmdir(dir).catch(() => { });
+    
+    return res.json({ success: true, message: 'File uploaded successfully', key: result.key });
+  } catch (err) {
+    console.error('[mbkbucket] upload-complete failed:', err);
+    return res.status(500).json({ success: false, error: err.message });
+  }
+});
 
-    return res.json({ success: true, message: 'File uploaded successfully (assembled)', key });
+// S3 Multipart Upload — Abort (cleanup on client cancel/error)
+// Body: { uploadId, key }
+router.post('/mbkbucket/upload-abort', validateSessionAndRole('SuperAdmin'), async (req, res) => {
+  try {
+    const { uploadId, key } = req.body;
+    if (!uploadId || !key) return res.status(400).json({ success: false, error: 'uploadId and key are required' });
+
+    await abortMultipartUpload(key, uploadId);
+    return res.json({ success: true, message: 'Multipart upload aborted' });
   } catch (err) {
-    console.error('Assemble/upload failed:', err);
+    console.error('[mbkbucket] upload-abort failed:', err);
     return res.status(500).json({ success: false, error: err.message });
   }
 });
@@ -283,12 +464,28 @@ router.post('/mbkbucket/create-folder', validateSessionAndRole('SuperAdmin'), as
 
     const folderKey = `${effectivePrefix.replace(/\/+$/, '')}/${folderName}/`;
 
-    // Check if exists
-    const exists = await fileExists(folderKey);
-    if (exists) return res.status(409).json({ success: false, error: 'Folder already exists' });
+    // Check if folder marker already exists
+    const markerExists = await fileExists(folderKey);
+    if (markerExists) return res.status(409).json({ success: false, error: 'Folder already exists' });
+
+    // Check if any files already exist under this prefix (folder already has content)
+    const existingFiles = await listfiles(folderKey, { maxKeys: 1 });
+    const hasContent = existingFiles.Contents && existingFiles.Contents.length > 0;
+
+    if (hasContent) {
+      // Folder already exists with content, no need to create marker
+      return res.json({ 
+        success: true, 
+        message: 'Folder already exists with content', 
+        key: folderKey,
+        skipMarker: true 
+      });
+    }
 
-    // Create zero-byte object to represent folder
-    await uploadFile(folderKey, Buffer.alloc(0), 'application/x-empty', { metadata: { 'folder': 'true' } });
+    // Create zero-byte object to represent empty folder
+    await uploadFile(folderKey, Buffer.alloc(0), 'application/x-empty', { 
+      metadata: { 'folder': 'true', 'marker': 'true' } 
+    });
 
     return res.json({ success: true, message: 'Folder created', key: folderKey });
   } catch (err) {
@@ -327,6 +524,7 @@ router.post('/mbkbucket/delete', validateSessionAndRole('SuperAdmin'), async (re
 });
 
 router.get('/mbkbucket/download/:key(*)', validateSessionAndRole('SuperAdmin'), async (req, res) => {
+  let stream = null;
   try {
     const key = req.params.key;
     let keyToUse;
@@ -336,8 +534,9 @@ router.get('/mbkbucket/download/:key(*)', validateSessionAndRole('SuperAdmin'),
       return res.status(400).json({ success: false, error: e.message });
     }
     const result = await downloadFile(keyToUse);
+    stream = result.Body;
 
-    res.setHeader('Content-Disposition', `attachment; filename="${keyToUse.split('/').pop()}"`);
+    res.setHeader('Content-Disposition', `attachment; filename="${keyToUse.split('/').pop()}"`); 
     res.setHeader('Content-Type', result.ContentType || 'application/octet-stream');
 
     // Set Content-Length header for proper download progress indication
@@ -348,10 +547,33 @@ router.get('/mbkbucket/download/:key(*)', validateSessionAndRole('SuperAdmin'),
     // Add cache headers for downloads
     res.setHeader('Cache-Control', 'private, max-age=3600');
 
-    result.Body.pipe(res);
+    // Proper stream error handling
+    stream.on('error', (err) => {
+      console.error('Download stream error:', err);
+      if (!res.headersSent) {
+        res.status(500).json({ message: 'Error streaming file', error: err.message });
+      }
+      if (stream && typeof stream.destroy === 'function') stream.destroy();
+    });
+
+    // Clean up on client disconnect
+    req.on('close', () => {
+      if (stream && typeof stream.destroy === 'function') stream.destroy();
+    });
+
+    // Handle request timeout
+    const timeoutDuration = result.ContentLength > 50 * 1024 * 1024 ? 300000 : 120000;
+    req.setTimeout(timeoutDuration, () => {
+      console.error(`Download timeout (${timeoutDuration}ms) for: ${keyToUse}`);
+      if (stream && typeof stream.destroy === 'function') stream.destroy();
+    });
+
+    stream.pipe(res);
   } catch (error) {
     console.error("Error downloading file:", error);
-
+    
+    // Clean up stream on error
+    if (stream && typeof stream.destroy === 'function') stream.destroy();
     if (error.message.includes('File not found')) {
       res.status(404).json({ message: "File not found", key: req.params.key });
     } else if (error.message.includes('Access denied')) {
@@ -376,28 +598,28 @@ router.get('/mbkbucket/player/:key(*)', validateSessionAndRole('SuperAdmin'), as
     const fileName = keyToUse.split('/').pop();
 
     const html = `<!doctype html>
-<html lang="en">
-<head>
-  <meta charset="utf-8">
-  <meta name="viewport" content="width=device-width,initial-scale=1">
-  <title>Preview: ${fileName}</title>
-  <style>
-    * { margin: 0; padding: 0; box-sizing: border-box; }
-    body { margin: 0; display: flex; align-items: center; justify-content: center; min-height: 100vh; background: #000; color: #fff; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif; }
-    .player-container { width: 100%; max-width: 100vw; max-height: 100vh; display: flex; align-items: center; justify-content: center; padding: 20px; }
-    video { width: 100%; height: auto; max-width: 100%; max-height: calc(100vh - 40px); object-fit: contain; background: #000; }
-    .file-name { position: fixed; top: 10px; left: 10px; background: rgba(0, 0, 0, 0.8); padding: 8px 16px; border-radius: 4px; font-size: 14px; z-index: 10; }
-  </style>
-</head>
-<body>
-  <div class="file-name">${fileName}</div>
-  <div class="player-container">
-    <video controls preload="metadata" src="/mbkbucket/view/${encoded}">
-      Your browser does not support the video tag.
-    </video>
-  </div>
-</body>
-</html>`;
+      <html lang="en">
+      <head>
+        <meta charset="utf-8">
+        <meta name="viewport" content="width=device-width,initial-scale=1">
+        <title>Preview: ${fileName}</title>
+        <style>
+          * { margin: 0; padding: 0; box-sizing: border-box; }
+          body { margin: 0; display: flex; align-items: center; justify-content: center; min-height: 100vh; background: #000; color: #fff; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif; }
+          .player-container { width: 100%; max-width: 100vw; max-height: 100vh; display: flex; align-items: center; justify-content: center; padding: 20px; }
+          video { width: 100%; height: auto; max-width: 100%; max-height: calc(100vh - 40px); object-fit: contain; background: #000; }
+          .file-name { position: fixed; top: 10px; left: 10px; background: rgba(0, 0, 0, 0.8); padding: 8px 16px; border-radius: 4px; font-size: 14px; z-index: 10; }
+        </style>
+      </head>
+      <body>
+        <div class="file-name">${fileName}</div>
+        <div class="player-container">
+          <video controls preload="metadata" src="/mbkbucket/view/${encoded}">
+            Your browser does not support the video tag.
+          </video>
+        </div>
+      </body>
+      </html>`;
 
     res.setHeader('Content-Type', 'text/html; charset=utf-8');
     res.setHeader('X-Content-Type-Options', 'nosniff');
@@ -408,311 +630,301 @@ router.get('/mbkbucket/player/:key(*)', validateSessionAndRole('SuperAdmin'), as
   }
 });
 
-router.get('/mbkbucket/view/:key(*)', validateSessionAndRole('SuperAdmin'), async (req, res) => {
-  try {
-    const key = req.params.key;
-    let keyToUse;
-    try {
-      keyToUse = ensureKeyHasAppPrefix(key);
-    } catch (e) {
-      return res.status(400).json({ message: e.message });
-    }
-    const fileName = keyToUse.split('/').pop();
-    const fileExtension = keyToUse.split('.').pop().toLowerCase();
-
-    // Check if file type is viewable before downloading
-    const viewableTypes = new Set([
-      'jpg', 'jpeg', 'png', 'gif', 'webp', 'svg', 'bmp', 'ico',
-      'mp4', 'webm', 'ogg', 'avi', 'mov',
-      'mp3', 'wav', 'flac', 'aac', 'm4a',
-      'txt', 'md', 'json', 'xml', 'csv', 'log',
-      'js', 'ts', 'html', 'htm', 'css', 'php', 'py', 'java', 'cpp', 'c', 'h',
-      'cs', 'rb', 'go', 'rs', 'sql', 'sh', 'bat', 'ps1', 'yaml', 'yml',
-      'toml', 'ini', 'conf', 'pdf'
-    ]);
-
-    if (!viewableTypes.has(fileExtension)) {
-      return res.status(415).json({
-        message: "File type not supported for viewing",
-        supportedTypes: Array.from(viewableTypes).sort()
-      });
-    }
-
-    // Set conditional request headers check
-    const ifNoneMatch = req.headers['if-none-match'];
-    const ifModifiedSince = req.headers['if-modified-since'];
-    const range = req.headers.range;
+// ---------------------------------------------------------------------------
+// Shared constants
+// ---------------------------------------------------------------------------
+const VIEWABLE_TYPES = new Set([
+  'jpg', 'jpeg', 'png', 'gif', 'webp', 'svg', 'bmp', 'ico',
+  'mp4', 'webm', 'ogg', 'avi', 'mov',
+  'mp3', 'wav', 'flac', 'aac', 'm4a',
+  'txt', 'md', 'json', 'xml', 'csv', 'log',
+  'js', 'ts', 'html', 'htm', 'css', 'php', 'py', 'java', 'cpp', 'c', 'h',
+  'cs', 'rb', 'go', 'rs', 'sql', 'sh', 'bat', 'ps1', 'yaml', 'yml',
+  'toml', 'ini', 'conf', 'pdf'
+]);
+// Pre-sorted for 415 error responses (avoids re-sorting on every error)
+const VIEWABLE_TYPES_SORTED = Array.from(VIEWABLE_TYPES).sort();
+
+const MIME_TYPES = {
+  // Images
+  'jpg': 'image/jpeg', 'jpeg': 'image/jpeg', 'png': 'image/png',
+  'gif': 'image/gif', 'webp': 'image/webp', 'svg': 'image/svg+xml',
+  'bmp': 'image/bmp', 'ico': 'image/x-icon',
+  // Videos
+  'mp4': 'video/mp4', 'webm': 'video/webm', 'ogg': 'video/ogg',
+  'avi': 'video/x-msvideo', 'mov': 'video/quicktime',
+  // Audio
+  'mp3': 'audio/mpeg', 'wav': 'audio/wav', 'flac': 'audio/flac',
+  'aac': 'audio/aac', 'm4a': 'audio/mp4',
+  // Text / Code
+  'txt': 'text/plain; charset=utf-8', 'md': 'text/markdown; charset=utf-8',
+  'json': 'application/json; charset=utf-8', 'xml': 'application/xml; charset=utf-8',
+  'csv': 'text/csv; charset=utf-8', 'log': 'text/plain; charset=utf-8',
+  'js': 'text/javascript; charset=utf-8', 'ts': 'text/typescript; charset=utf-8',
+  'html': 'text/html; charset=utf-8', 'htm': 'text/html; charset=utf-8',
+  'css': 'text/css; charset=utf-8', 'php': 'text/x-php; charset=utf-8',
+  'py': 'text/x-python; charset=utf-8', 'java': 'text/x-java-source; charset=utf-8',
+  'cpp': 'text/x-c++src; charset=utf-8', 'c': 'text/x-csrc; charset=utf-8',
+  'h': 'text/x-chdr; charset=utf-8', 'cs': 'text/x-csharp; charset=utf-8',
+  'rb': 'text/x-ruby; charset=utf-8', 'go': 'text/x-go; charset=utf-8',
+  'rs': 'text/x-rust; charset=utf-8', 'sql': 'text/x-sql; charset=utf-8',
+  'sh': 'text/x-shellscript; charset=utf-8', 'bat': 'text/x-msdos-batch; charset=utf-8',
+  'ps1': 'text/x-powershell; charset=utf-8', 'yaml': 'text/x-yaml; charset=utf-8',
+  'yml': 'text/x-yaml; charset=utf-8', 'toml': 'text/x-toml; charset=utf-8',
+  'ini': 'text/x-ini; charset=utf-8', 'conf': 'text/x-conf; charset=utf-8',
+  // Documents
+  'pdf': 'application/pdf'
+};
+
+// ---------------------------------------------------------------------------
+// Shared inline-serve helper
+// Options:
+//   noindex {boolean} – adds X-Robots-Tag: noindex, nofollow (default false)
+// ---------------------------------------------------------------------------
+async function serveFileInline(req, res, keyToUse, { noindex = true } = {}) {
+  const fileName = keyToUse.split('/').pop();
+  const fileExtension = fileName.includes('.') ? fileName.split('.').pop().toLowerCase() : '';
+
+  console.log(`[mbkbucket] 📥 Request for ${fileName} (type: ${fileExtension}, range: ${req.headers.range || 'none'})`);
+
+  if (!VIEWABLE_TYPES.has(fileExtension)) {
+    return res.status(415).json({
+      message: 'File type not supported for viewing',
+      supportedTypes: VIEWABLE_TYPES_SORTED
+    });
+  }
 
-    // Resolve configured bucket name if possible
-    let bucket;
+  const ifNoneMatch = req.headers['if-none-match'];
+  const ifModifiedSince = req.headers['if-modified-since'];
+  const rangeHeader = req.headers.range;
+
+  const isStaticAsset = ['jpg', 'jpeg', 'png', 'gif', 'webp', 'svg', 'bmp', 'ico', 'css', 'js'].includes(fileExtension);
+  const isVideo = ['mp4', 'webm', 'ogg', 'avi', 'mov'].includes(fileExtension);
+  const isAudio = ['mp3', 'wav', 'flac', 'aac', 'm4a'].includes(fileExtension);
+  const isPdf = fileExtension === 'pdf';
+  const supportsRanges = isVideo || isAudio || isPdf;
+  const contentType = MIME_TYPES[fileExtension] || 'application/octet-stream';
+
+  // ---------------------------------------------------------------------------
+  // Fast path for range requests (video / audio / PDF streaming)
+  // Use a cheap HEAD (getFileMetadata) to get size + ETag, then fetch ONLY the
+  // requested byte range — avoids downloading the full file first.
+  // ---------------------------------------------------------------------------
+  if (supportsRanges && rangeHeader) {
+    console.log(`[mbkbucket] Processing range request: ${rangeHeader} for ${fileName}`);
+    let meta;
     try {
-      bucket = getBucketConfig()?.BUCKET_NAME;
+      meta = await getFileMetadata(keyToUse);
     } catch (err) {
-      console.warn('Could not resolve bucket config for view route:', err.message);
-      bucket = undefined;
+      console.error('[mbkbucket] serveFileInline metadata error:', err);
+      return res.status(500).json({ message: 'Failed to fetch file metadata', error: err.message });
     }
 
-    // Download file with conditional headers
-    const downloadOptions = {
-      ...(ifNoneMatch && { ifNoneMatch }),
-      ...(ifModifiedSince && { ifModifiedSince: new Date(ifModifiedSince) }),
-      ...(bucket && { bucketName: bucket })
-    };
-
-    let result = await downloadFile(keyToUse, downloadOptions);
-
-    // If the underlying storage reported Not Modified, forward 304 to the client
-    if (result && result.notModified) {
-      return res.status(304).end();
-    }
-
-    // Generate ETag based on file metadata
-    const etag = `"${result.LastModified?.getTime() || Date.now()}-${result.ContentLength || 0}"`;
-
-    // Check if client has cached version
-    if (ifNoneMatch === etag) {
-      return res.status(304).end();
+    if (!meta || !meta.exists) {
+      return res.status(404).json({ message: 'File not found', key: keyToUse });
     }
 
-    // Optimized MIME type mapping
-    const mimeTypes = {
-      // Images
-      'jpg': 'image/jpeg', 'jpeg': 'image/jpeg', 'png': 'image/png',
-      'gif': 'image/gif', 'webp': 'image/webp', 'svg': 'image/svg+xml',
-      'bmp': 'image/bmp', 'ico': 'image/x-icon',
-
-      // Videos
-      'mp4': 'video/mp4', 'webm': 'video/webm', 'ogg': 'video/ogg',
-      'avi': 'video/x-msvideo', 'mov': 'video/quicktime',
-
-      // Audio
-      'mp3': 'audio/mpeg', 'wav': 'audio/wav', 'flac': 'audio/flac',
-      'aac': 'audio/aac', 'm4a': 'audio/mp4',
-
-      // Text/Code files
-      'txt': 'text/plain; charset=utf-8', 'md': 'text/markdown; charset=utf-8',
-      'json': 'application/json; charset=utf-8', 'xml': 'application/xml; charset=utf-8',
-      'csv': 'text/csv; charset=utf-8', 'log': 'text/plain; charset=utf-8',
-      'js': 'text/javascript; charset=utf-8', 'ts': 'text/typescript; charset=utf-8',
-      'html': 'text/html; charset=utf-8', 'htm': 'text/html; charset=utf-8',
-      'css': 'text/css; charset=utf-8', 'php': 'text/x-php; charset=utf-8',
-      'py': 'text/x-python; charset=utf-8', 'java': 'text/x-java-source; charset=utf-8',
-      'cpp': 'text/x-c++src; charset=utf-8', 'c': 'text/x-csrc; charset=utf-8',
-      'h': 'text/x-chdr; charset=utf-8', 'cs': 'text/x-csharp; charset=utf-8',
-      'rb': 'text/x-ruby; charset=utf-8', 'go': 'text/x-go; charset=utf-8',
-      'rs': 'text/x-rust; charset=utf-8', 'sql': 'text/x-sql; charset=utf-8',
-      'sh': 'text/x-shellscript; charset=utf-8', 'bat': 'text/x-msdos-batch; charset=utf-8',
-      'ps1': 'text/x-powershell; charset=utf-8', 'yaml': 'text/x-yaml; charset=utf-8',
-      'yml': 'text/x-yaml; charset=utf-8', 'toml': 'text/x-toml; charset=utf-8',
-      'ini': 'text/x-ini; charset=utf-8', 'conf': 'text/x-conf; charset=utf-8',
-
-      // Documents
-      'pdf': 'application/pdf'
-    };
-
-    const contentType = mimeTypes[fileExtension] || result.ContentType || 'application/octet-stream';
-
-    // Set optimized headers
-    res.setHeader('Content-Type', contentType);
-    res.setHeader('Content-Disposition', `inline; filename="${fileName}"`);
-
-    // Performance and caching headers
-    if (result.ContentLength) {
-      res.setHeader('Content-Length', result.ContentLength);
-    }
+    const etag = `"${meta.LastModified?.getTime() || Date.now()}-${meta.ContentLength || 0}"`;
+    if (ifNoneMatch === etag) return res.status(304).end();
 
-    // Cache control based on file type
-    const isStaticAsset = ['jpg', 'jpeg', 'png', 'gif', 'webp', 'svg', 'bmp', 'ico', 'css', 'js'].includes(fileExtension);
-    const isVideo = ['mp4', 'webm', 'ogg', 'avi', 'mov'].includes(fileExtension);
-    const isAudio = ['mp3', 'wav', 'flac', 'aac', 'm4a'].includes(fileExtension);
-
-    if (isStaticAsset) {
-      // Cache static assets for 1 hour
-      res.setHeader('Cache-Control', 'public, max-age=3600, immutable');
-    } else if (isVideo || isAudio) {
-      // Cache media files for 24 hours but allow revalidation
-      res.setHeader('Cache-Control', 'public, max-age=86400, must-revalidate');
+    const total = Number(meta.ContentLength);
+    if (!total) {
+      // No content-length — fall through to full-file path
     } else {
-      // Cache dynamic content for 5 minutes
-      res.setHeader('Cache-Control', 'public, max-age=300');
-    }
-
-    res.setHeader('ETag', etag);
-
-    // Set last modified if available
-    if (result.LastModified) {
-      res.setHeader('Last-Modified', result.LastModified.toUTCString());
-    }
-
-    // Security headers
-    res.setHeader('X-Content-Type-Options', 'nosniff');
-    res.setHeader('X-Frame-Options', 'SAMEORIGIN');
+      const CHUNK_SIZE = 8 * 1024 * 1024; // 8 MB
+      const match = /^bytes=(\d*)-(\d*)$/.exec(rangeHeader.trim());
+      if (!match) {
+        res.status(416).setHeader('Content-Range', `bytes */${total}`);
+        return res.end();
+      }
 
-    // Content Security Policy for better security
-    if (fileExtension === 'html' || fileExtension === 'htm') {
-      res.setHeader('Content-Security-Policy', "default-src 'self'; script-src 'none'; object-src 'none';");
-    }
+      const [, startStr, endStr] = match;
+      let start, end;
 
-    // Enable range requests for video/audio files
-    const supportsRanges = ['mp4', 'webm', 'ogg', 'avi', 'mov', 'mp3', 'wav', 'flac', 'aac', 'm4a'].includes(fileExtension);
-    if (supportsRanges) {
-      res.setHeader('Accept-Ranges', 'bytes');
-
-      // Handle range requests for video streaming
-      const rangeHeader = req.headers.range;
-      if (rangeHeader && result.ContentLength) {
-        // Support a larger default chunk for better streaming performance
-        const CHUNK_SIZE = 8 * 1024 * 1024; // 8MB
-
-        // Parse range: support forms 'bytes=start-end', 'bytes=start-', and 'bytes=-suffix'
-        const match = /^bytes=(\d*)-(\d*)$/.exec(rangeHeader.trim());
-        if (!match) {
-          res.status(416).setHeader('Content-Range', `bytes */${result.ContentLength}`);
+      if (startStr === '') {
+        const suffix = parseInt(endStr, 10);
+        if (isNaN(suffix) || suffix <= 0) {
+          res.status(416).setHeader('Content-Range', `bytes */${total}`);
           return res.end();
         }
-
-        let startStr = match[1];
-        let endStr = match[2];
-        let start, end;
-        const total = Number(result.ContentLength);
-
-        if (startStr === '') {
-          // Suffix bytes: '-500' means the last 500 bytes
-          const suffix = parseInt(endStr, 10);
-          if (isNaN(suffix) || suffix <= 0) {
-            res.status(416).setHeader('Content-Range', `bytes */${total}`);
-            return res.end();
-          }
-          start = Math.max(0, total - suffix);
-          end = total - 1;
-        } else {
-          start = parseInt(startStr, 10);
-          if (isNaN(start) || start < 0) {
-            res.status(416).setHeader('Content-Range', `bytes */${total}`);
-            return res.end();
-          }
-          if (endStr === '') {
-            end = Math.min(start + CHUNK_SIZE - 1, total - 1);
-          } else {
-            end = parseInt(endStr, 10);
-            if (isNaN(end) || end < start) {
-              res.status(416).setHeader('Content-Range', `bytes */${total}`);
-              return res.end();
-            }
-          }
+        start = Math.max(0, total - suffix);
+        end = total - 1;
+      } else {
+        start = parseInt(startStr, 10);
+        if (isNaN(start) || start < 0) {
+          res.status(416).setHeader('Content-Range', `bytes */${total}`);
+          return res.end();
         }
-
-        // Validate range bounds
-        if (start >= total || start > end || end >= total) {
+        end = endStr === '' ? Math.min(start + CHUNK_SIZE - 1, total - 1) : parseInt(endStr, 10);
+        if (isNaN(end) || end < start) {
           res.status(416).setHeader('Content-Range', `bytes */${total}`);
           return res.end();
         }
+      }
 
-        const chunksize = (end - start) + 1;
+      if (start >= total || start > end || end >= total) {
+        res.status(416).setHeader('Content-Range', `bytes */${total}`);
+        return res.end();
+      }
 
-        try {
-          console.log(`[mbkbucket] Handling range request for ${keyToUse}: ${start}-${end} (total ${total})`);
+      const chunksize = end - start + 1;
 
-          // Get the specific byte range from S3
-          const rangeResult = await downloadFile(keyToUse, { range: `bytes=${start}-${end}`, ...(bucket && { bucketName: bucket }) });
+      try {
+        const rangeResult = await downloadFile(keyToUse, { range: `bytes=${start}-${end}` });
 
-          // Diagnostics: log returned content length and available result keys
-          console.log(`[mbkbucket] Range downloaded: ${start}-${end} for ${keyToUse}. rangeResult.ContentLength=${rangeResult.ContentLength}, keys=${Object.keys(rangeResult).join(',')}`);
+        if (typeof rangeResult.ContentLength === 'number' && rangeResult.ContentLength !== chunksize) {
+          console.warn(`Range size mismatch for ${keyToUse}: expected=${chunksize} got=${rangeResult.ContentLength}`);
+        }
 
-          // Check for mismatches between expected chunk size and returned ContentLength
-          if (typeof rangeResult.ContentLength === 'number') {
-            if (rangeResult.ContentLength !== chunksize) {
-              console.warn(`Range size mismatch for ${keyToUse}: expected=${chunksize} got=${rangeResult.ContentLength} for ${start}-${end}`);
-            }
-          } else {
-            console.warn(`Missing range ContentLength for ${keyToUse} ${start}-${end}`);
+        console.log(`[mbkbucket] ✓ Serving range bytes ${start}-${end}/${total} (${chunksize} bytes) for ${fileName}`);
+
+        res.status(206);
+        res.setHeader('Content-Range', `bytes ${start}-${end}/${total}`);
+        res.setHeader('Content-Length', chunksize);
+        res.setHeader('Content-Type', contentType);
+        res.setHeader('Cache-Control', 'public, max-age=86400, must-revalidate');
+        res.setHeader('ETag', etag);
+        res.setHeader('Accept-Ranges', 'bytes');
+        if (noindex) res.setHeader('X-Robots-Tag', 'noindex, nofollow');
+        res.setHeader('X-Content-Type-Options', 'nosniff');
+        if (meta.LastModified) res.setHeader('Last-Modified', meta.LastModified.toUTCString());
+
+        // Comprehensive stream error handling and cleanup
+        const cleanupStream = () => {
+          if (rangeResult.Body && typeof rangeResult.Body.destroy === 'function') {
+            rangeResult.Body.removeAllListeners();
+            rangeResult.Body.destroy();
           }
+        };
 
-          res.status(206);
-          res.setHeader('Content-Range', `bytes ${start}-${end}/${total}`);
-          res.setHeader('Content-Length', chunksize);
-          res.setHeader('Content-Type', contentType);
-          res.setHeader('Cache-Control', 'public, max-age=3600');
-          res.setHeader('ETag', etag);
-
-          // Handle stream errors for range requests
-          rangeResult.Body.on('error', (error) => {
-            console.error("Range stream error:", error);
-            if (!res.headersSent) {
-              res.status(500).end('Stream error');
-            }
-          });
-
-          // Log stream end/close
-          rangeResult.Body.on('end', () => {
-            console.log(`[mbkbucket] Range stream ended for ${keyToUse}: ${start}-${end}`);
-          });
-          rangeResult.Body.on('close', () => {
-            console.log(`[mbkbucket] Range stream closed for ${keyToUse}: ${start}-${end}`);
-          });
-
-          // Handle client disconnect
-          req.on('close', () => {
-            console.log('[mbkbucket] Client closed connection during range request for', keyToUse, start, end);
-            if (rangeResult.Body && typeof rangeResult.Body.destroy === 'function') {
-              rangeResult.Body.destroy();
-            }
-          });
+        rangeResult.Body.on('error', (err) => {
+          console.error('Range stream error:', err);
+          cleanupStream();
+          if (!res.headersSent) res.status(500).end('Stream error');
+        });
 
-          // Set timeout for range requests (longer timeout to allow streaming)
-          req.setTimeout(120000, () => {
-            console.error("Range request timeout for file:", keyToUse);
-            if (rangeResult.Body && typeof rangeResult.Body.destroy === 'function') {
-              rangeResult.Body.destroy();
-            }
-          });
+        req.on('close', cleanupStream);
+        req.on('aborted', cleanupStream);
+        
+        req.setTimeout(120000, () => {
+          console.error('Range request timeout for file:', keyToUse);
+          cleanupStream();
+          if (!res.headersSent) res.status(408).end('Request timeout');
+        });
 
-          return rangeResult.Body.pipe(res);
+        res.on('finish', cleanupStream);
+        res.on('close', cleanupStream);
 
-        } catch (rangeError) {
-          console.error("Range request failed:", rangeError);
-          // Fallback to full file if range request fails
-          res.setHeader('Accept-Ranges', 'none');
-        }
+        return rangeResult.Body.pipe(res);
+
+      } catch (rangeError) {
+        console.error('Range request failed:', rangeError);
+        // fall through to full-file path
       }
     }
+  }
 
-    // Set appropriate status code
-    res.status(200);
+  // ---------------------------------------------------------------------------
+  // Standard path: full-file download (non-media, or media without Range header)
+  // ---------------------------------------------------------------------------
+  const downloadOptions = {
+    ...(ifNoneMatch && { ifNoneMatch }),
+    ...(ifModifiedSince && { ifModifiedSince: new Date(ifModifiedSince) })
+  };
 
-    // Pipe the response with error handling
-    result.Body.on('error', (error) => {
-      console.error("Stream error:", error);
-      if (!res.headersSent) {
-        res.status(500).json({ message: "Error streaming file", error: error.message });
-      }
-    });
+  if (isPdf) {
+    console.log(`[mbkbucket] Serving full PDF (no range header) for ${fileName}`);
+  }
 
-    // Handle client disconnect
-    req.on('close', () => {
-      if (result.Body && typeof result.Body.destroy === 'function') {
-        result.Body.destroy();
-      }
-    });
+  let result;
+  try {
+    result = await downloadFile(keyToUse, downloadOptions);
+  } catch (err) {
+    if (err.name === 'NoSuchKey' || err.name === 'NotFound') {
+      return res.status(404).json({ message: 'File not found', key: keyToUse });
+    } else if (err.name === 'AccessDenied') {
+      return res.status(403).json({ message: 'Access denied' });
+    }
+    console.error('[mbkbucket] serveFileInline download error:', err);
+    return res.status(500).json({ message: 'Failed to fetch file', error: err.message });
+  }
 
-    // Set timeout for large files based on file size
-    const timeoutDuration = result.ContentLength > 50 * 1024 * 1024 ? 300000 : 120000; // 5 minutes for files > 50MB, 2 minutes otherwise
-    req.setTimeout(timeoutDuration, () => {
-      console.error(`Request timeout (${timeoutDuration}ms) for file:`, key, `Size: ${result.ContentLength} bytes`);
-      if (!res.headersSent) {
-        res.status(408).json({ message: "Request timeout" });
-      }
-      if (result.Body && typeof result.Body.destroy === 'function') {
-        result.Body.destroy();
-      }
-    });
+  if (result && result.notModified) return res.status(304).end();
+
+  const etag = `"${result.LastModified?.getTime() || Date.now()}-${result.ContentLength || 0}"`;
+  if (ifNoneMatch === etag) return res.status(304).end();
+
+  res.setHeader('Content-Type', contentType);
+  res.setHeader('Content-Disposition', `inline; filename="${fileName}"`);
+  res.setHeader('ETag', etag);
+  res.setHeader('X-Content-Type-Options', 'nosniff');
+  res.setHeader('X-Frame-Options', 'SAMEORIGIN');
+  if (noindex) res.setHeader('X-Robots-Tag', 'noindex, nofollow');
+  if (result.ContentLength) res.setHeader('Content-Length', result.ContentLength);
+  if (result.LastModified) res.setHeader('Last-Modified', result.LastModified.toUTCString());
+  if (fileExtension === 'html' || fileExtension === 'htm') {
+    res.setHeader('Content-Security-Policy', "default-src 'self'; script-src 'none'; object-src 'none';");
+  }
+  if (supportsRanges) res.setHeader('Accept-Ranges', 'bytes');
+
+  if (isStaticAsset) {
+    res.setHeader('Cache-Control', 'public, max-age=3600, immutable');
+  } else if (supportsRanges) {
+    // For video, audio, and PDF - enable caching with revalidation
+    res.setHeader('Cache-Control', 'public, max-age=86400, must-revalidate');
+  } else {
+    res.setHeader('Cache-Control', 'public, max-age=300');
+  }
+
+  res.status(200);
+
+  // Comprehensive stream cleanup to prevent memory leaks
+  const cleanupStream = () => {
+    if (result.Body && typeof result.Body.destroy === 'function') {
+      result.Body.removeAllListeners();
+      result.Body.destroy();
+    }
+  };
+
+  result.Body.on('error', (err) => {
+    console.error('Stream error:', err);
+    cleanupStream();
+    if (!res.headersSent) res.status(500).json({ message: 'Error streaming file', error: err.message });
+  });
+
+  req.on('close', cleanupStream);
+  req.on('aborted', cleanupStream);
 
-    result.Body.pipe(res);
+  const timeoutDuration = result.ContentLength > 50 * 1024 * 1024 ? 300000 : 120000;
+  req.setTimeout(timeoutDuration, () => {
+    console.error(`Request timeout (${timeoutDuration}ms) for file: ${keyToUse}, size: ${result.ContentLength}`);
+    cleanupStream();
+    if (!res.headersSent) res.status(408).json({ message: 'Request timeout' });
+  });
+
+  res.on('finish', cleanupStream);
+  res.on('close', cleanupStream);
+
+  result.Body.pipe(res);
+}
+
+// ---------------------------------------------------------------------------
+// Routes
+// ---------------------------------------------------------------------------
+
+router.get('/mbkbucket/view/:key(*)', validateSessionAndRole('SuperAdmin'), async (req, res) => {
+  try {
+    let keyToUse;
+    try {
+      keyToUse = ensureKeyHasAppPrefix(req.params.key);
+    } catch (e) {
+      return res.status(400).json({ message: e.message });
+    }
+
+    await serveFileInline(req, res, keyToUse, { noindex: true });
 
   } catch (error) {
     console.error("Error viewing file:", error);
-
-    // Return appropriate error based on error type
     if (error.name === 'NoSuchKey' || error.name === 'NotFound') {
       res.status(404).json({ message: "File not found", key: req.params.key });
     } else if (error.name === 'AccessDenied') {
@@ -723,4 +935,45 @@ router.get('/mbkbucket/view/:key(*)', validateSessionAndRole('SuperAdmin'), asyn
   }
 });
 
+if (mbkbucketVar?.publiView_enabled) {
+  router.get('/mbkbucket/p_view/:key(*)', pviewRateLimit, pviewSecurity, async (req, res) => {
+    try {
+      const key = req.params.key;
+
+      // No directory indexing — reject folder-like or empty keys
+      if (!key || key.endsWith('/')) {
+        return res.status(403).json({ message: 'Directory indexing is not allowed' });
+      }
+
+      let keyToUse;
+      try {
+        keyToUse = ensureKeyHasAppPrefix(key);
+      } catch (e) {
+        return res.status(400).json({ message: e.message });
+      }
+
+      // Determine pview_b: check bucket config first, then env var
+      let p_view_inline = !!mbkbucketVar?.p_view_inline;
+
+
+      if (!p_view_inline) {
+        // Signed URL mode — redirect to a pre-signed S3 URL (1 hour expiry)
+        try {
+          const signed = await generateSignedUrl(keyToUse, 'getObject', 3600);
+          return res.redirect(302, signed.url);
+        } catch (err) {
+          console.error('[mbkbucket] p_view signed URL error:', err);
+          return res.status(500).json({ message: 'Failed to generate access URL' });
+        }
+      }
+
+      // Direct serve mode — stream file inline (with noindex header)
+      await serveFileInline(req, res, keyToUse, { noindex: true });
+    } catch (error) {
+      console.error('[mbkbucket] p_view error:', error);
+      res.status(500).json({ message: 'Internal server error', error: error.message });
+    }
+  });
+}
+
 export default router;