mbkbucket 2.0.0 → 2.1.1

package/lib/config/index.js

@@ -1,8 +1,10 @@
 import { createRequire } from "module";
 import dotenv from "dotenv";
 import { parseAndValidateMbkbucketVar, parseAndValidateBucketConnection } from "./validation.js";
+import { createLogger } from "../debug.js";
 
 dotenv.config();
+const debugConfig = createLogger('config');
 
 // Load package.json from mbkbucket package (not parent project)
 const require = createRequire(import.meta.url);
@@ -28,19 +30,31 @@ try {
     }
 }
 
+function compareVersions(a, b) {
+    const left = String(a || '').split(/[.-]/).map((part) => parseInt(part, 10) || 0);
+    const right = String(b || '').split(/[.-]/).map((part) => parseInt(part, 10) || 0);
+    const length = Math.max(left.length, right.length);
+
+    for (let i = 0; i < length; i += 1) {
+        const diff = (left[i] || 0) - (right[i] || 0);
+        if (diff !== 0) return diff;
+    }
+    return 0;
+}
+
 // Fetch latest version from GitHub
 async function getLatestVersion() {
   try {
     const response = await fetch('https://raw.githubusercontent.com/MIbnEKhalid/mbkbucket/master/package.json');
     if (!response.ok) {
-      console.error(`[mbkbucket] GitHub API responded with status ${response.status}`);
+      debugConfig('GitHub API responded with status %s', response.status);
       return "0.0.0";
     }
 
     const latestPackageJson = await response.json();
     return latestPackageJson.version;
   } catch (error) {
-    console.error('[mbkbucket] Error fetching latest version from GitHub:', error);
+    debugConfig('Error fetching latest version from GitHub: %s', error.message);
     return null;
   }
 }
@@ -49,13 +63,15 @@ async function getLatestVersion() {
 async function checkVersion() {
     try {
         const latestVersion = await getLatestVersion();
-        if (latestVersion && latestVersion !== packageJson.version) {
-            console.warn(`[mbkbucket] Current version (${packageJson.version}) is outdated. Latest version: ${latestVersion}. Consider updating mbkbucket.`);
+        if (latestVersion && compareVersions(latestVersion, packageJson.version) > 0) {
+            debugConfig('Current version (%s) is outdated. Latest version: %s.', packageJson.version, latestVersion);
+        } else if (latestVersion && compareVersions(latestVersion, packageJson.version) < 0) {
+            debugConfig('Current version (%s) is newer than published version: %s.', packageJson.version, latestVersion);
         } else if (latestVersion) {
-            console.info(`[mbkbucket] Running latest version (${packageJson.version}).`);
+            debugConfig('Running latest version (%s).', packageJson.version);
         }
     } catch (error) {
-        console.warn(`[mbkbucket] Failed to check for updates: ${error.message}`);
+        debugConfig('Failed to check for updates: %s', error.message);
     }
 }
 
@@ -64,9 +80,9 @@ function validateConfiguration() {
     try {
         const parsed = parseAndValidateMbkbucketVar(process.env.mbkbucketVar);
         if (!process.env.mbkbucketVar) {
-            console.log(`[mbkbucket] mbkbucketVar not defined, using defaults`);
+            debugConfig('mbkbucketVar not defined, using defaults');
         }
-        console.log(`[mbkbucket] Configuration loaded`);
+        debugConfig('Configuration loaded');
         return parsed;
     } catch (error) {
         throw new Error(`[mbkbucket] Configuration Validation Failed:\n  - ${error.message}`);
@@ -86,7 +102,7 @@ function validateBucketConnection() {
         const bucketConfig = parseAndValidateBucketConnection(process.env.BucketConnection);
         const bucketNames = Object.keys(bucketConfig || {});
 
-        console.log(`[mbkbucket] ✓ BucketConnection validated (${bucketNames.length} bucket(s): ${bucketNames.join(', ')})`);
+        debugConfig('BucketConnection validated (%s bucket(s): %s)', bucketNames.length, bucketNames.join(', '));
         return bucketConfig;
     } catch (error) {
         console.error(`[mbkbucket] ❌ BucketConnection validation failed: ${error.message}`);
@@ -100,11 +116,11 @@ function validateBucketConnection() {
 
 // Parse and validate mbkbucketVar once
 const mbkbucketVar = validateConfiguration();
-console.log(`[mbkbucket] mbkbucketVar configuration:`, mbkbucketVar);
+debugConfig('mbkbucketVar configuration: %O', mbkbucketVar);
 
 // Validate BucketConnection
 validateBucketConnection();
 
 export { packageJson, appVersion, getLatestVersion, checkVersion };
 export { mbkbucketVar };
-export { parseAndValidateMbkbucketVar, parseAndValidateBucketConnection };
+export { parseAndValidateMbkbucketVar, parseAndValidateBucketConnection };

package/lib/config/validation.js

@@ -1,9 +1,12 @@
+const TRUE_VALUES = new Set(['true', 't', '1', 'yes', 'y', 'on']);
+const FALSE_VALUES = new Set(['false', 'f', '0', 'no', 'n', 'off']);
+
 function normalizeBooleanLike(value) {
   if (typeof value === 'boolean') return value;
   if (typeof value === 'string') {
     const normalized = value.trim().toLowerCase();
-    if (['true', 't', '1', 'yes', 'y', 'on'].includes(normalized)) return true;
-    if (['false', 'f', '0', 'no', 'n', 'off'].includes(normalized)) return false;
+    if (TRUE_VALUES.has(normalized)) return true;
+    if (FALSE_VALUES.has(normalized)) return false;
   }
   return value;
 }

package/lib/debug.js

@@ -0,0 +1,12 @@
+import createDebug from "debug";
+import dotenv from "dotenv";
+
+dotenv.config();
+
+if (process.env.DEBUG) {
+  createDebug.enable(process.env.DEBUG);
+}
+
+export function createLogger(namespace) {
+  return createDebug(`mbkbucket:${namespace}`);
+}

package/lib/routes/api.js

@@ -1,9 +1,11 @@
 import express from "express";
-import { validateSessionAndRole,  } from "mbkauthe";
+import { sessRole,  } from "mbkauthe";
 import { listfiles, uploadFile, deleteFile, deleteFiles, deleteFolder, downloadFile, getFileMetadata, fileExists, ensureKeyHasAppPrefix, ensurePrefix, getAppName, createMultipartUpload, uploadPart, completeMultipartUpload, abortMultipartUpload, listIncompleteMultipartUploads, cleanupIncompleteMultipartUploads } from "../s3.js";
 import multer from "multer";
+import { createLogger } from "../debug.js";
 
 const router = express.Router();
+const debugApi = createLogger('api');
 
 function classifyApiError(error, fallbackMessage = 'Request failed') {
   const message = String(error?.message || fallbackMessage);
@@ -35,6 +37,12 @@ function sendApiError(res, error, fallbackMessage = 'Request failed') {
   return res.status(mapped.status).json({ success: false, code: mapped.code, error: mapped.message });
 }
 
+function getBaseName(path = '') {
+  const value = String(path || '');
+  const lastSlashIndex = value.lastIndexOf('/');
+  return lastSlashIndex === -1 ? value : value.substring(lastSlashIndex + 1);
+}
+
 // Central bucket guard for all API routes under /mbkbucket
 router.use((req, res, next) => {
   if (req.bucketResolveError) {
@@ -46,9 +54,8 @@ router.use((req, res, next) => {
   next();
 });
 
-// This is the maximum size we allow per chunk upload. It should be >=
-// the client chunk size (5MB) and leave room for any encoding overhead.
-// If you need to support larger chunks, increase this accordingly.
+// This is the maximum size we allow per file part. The dashboard uses the same
+// size as its single-upload threshold and multipart chunk size.
 const MAX_CHUNK_SIZE = 50 * 1024 * 1024; // 50 MB
 
 const upload = multer({
@@ -72,8 +79,22 @@ const uploadChunk = (req, res, next) => {
   });
 };
 
+async function cleanupFolderMarker(folderPath, bucketName) {
+  if (!folderPath) return;
+
+  try {
+    const metadata = await getFileMetadata(folderPath, bucketName);
+    if (metadata.exists && (metadata.ContentLength === 0 || metadata.Metadata?.marker === 'true')) {
+      await deleteFile(folderPath, bucketName);
+      debugApi('Cleaned up folder marker: %s', folderPath);
+    }
+  } catch (cleanupErr) {
+    debugApi('Failed to clean up folder marker: %s', cleanupErr.message);
+  }
+}
+
 // API endpoint for multipart upload cleanup
-router.post('/api/cleanup-uploads', validateSessionAndRole('SuperAdmin'), async (req, res) => {
+router.post('/api/cleanup-uploads', sessRole('SuperAdmin'), async (req, res) => {
   try {
     const { olderThanDays = 7, prefix = '' } = req.body;
     const bucketName = req.activeBucket;
@@ -84,7 +105,7 @@ router.post('/api/cleanup-uploads', validateSessionAndRole('SuperAdmin'), async
       return res.status(400).json({ success: false, error: 'olderThanDays must be a positive integer' });
     }
 
-    console.log(`[mbkbucket] Starting cleanup of incomplete uploads older than ${days} days`);
+    debugApi('Starting cleanup of incomplete uploads older than %s days', days);
     const result = await cleanupIncompleteMultipartUploads(days, prefix, bucketName);
 
     res.json({
@@ -99,7 +120,7 @@ router.post('/api/cleanup-uploads', validateSessionAndRole('SuperAdmin'), async
 });
 
 // API endpoint to list incomplete multipart uploads
-router.get('/api/incomplete-uploads', validateSessionAndRole('SuperAdmin'), async (req, res) => {
+router.get('/api/incomplete-uploads', sessRole('SuperAdmin'), async (req, res) => {
   try {
     const { prefix = '' } = req.query;
     const bucketName = req.activeBucket;
@@ -122,7 +143,7 @@ router.get('/api/incomplete-uploads', validateSessionAndRole('SuperAdmin'), asyn
 });
 
 // API endpoint for fetching files
-router.get('/api/files', validateSessionAndRole('SuperAdmin'), async (req, res) => {
+router.get('/api/files', sessRole('SuperAdmin'), async (req, res) => {
   const { prefix = '', page = '1', search = '', recursive = 'true', token = '' } = req.query;
   const pageSize = 100;
   const bucketName = req.activeBucket;
@@ -166,11 +187,12 @@ router.get('/api/files', validateSessionAndRole('SuperAdmin'), async (req, res)
         bucketName
       });
 
-      files = result.Contents || [];
       // Filter out folder marker objects (zero-byte files ending with /)
-      files = files.filter(f => !f.Key.endsWith('/'));
+      files = (result.Contents || []).filter(f => !f.Key.endsWith('/'));
       // S3 returns CommonPrefixes for folders when delimiter is used
-      folders = (result.CommonPrefixes || []).map(p => p.Prefix).filter(p => p !== effectivePrefix);
+      folders = (result.CommonPrefixes || [])
+        .filter(p => p.Prefix !== effectivePrefix)
+        .map(p => p.Prefix);
       nextContinuationToken = result.NextContinuationToken;
 
       // Note: In optimized mode, totalFiles is unknown without scanning everything.
@@ -181,10 +203,11 @@ router.get('/api/files', validateSessionAndRole('SuperAdmin'), async (req, res)
       // Fetch all files recursively (handling S3 pagination)
       do {
         const result = await listfiles(effectivePrefix, { continuationToken, bucketName });
-        if (result.Contents) {
+        if (result.Contents?.length) {
           // Filter out folder marker objects (zero-byte files ending with /)
-          const actualFiles = result.Contents.filter(f => !f.Key.endsWith('/'));
-          files = files.concat(actualFiles);
+          for (const file of result.Contents) {
+            if (!file.Key.endsWith('/')) files.push(file);
+          }
         }
         continuationToken = result.nextToken;
       } while (continuationToken);
@@ -199,16 +222,14 @@ router.get('/api/files', validateSessionAndRole('SuperAdmin'), async (req, res)
             legacyFallback = true;
           }
         } catch (fallbackErr) {
-          console.warn('Fallback root listing failed:', fallbackErr.message);
+          debugApi('Fallback root listing failed: %s', fallbackErr.message);
         }
       }
 
       // Apply search filter if provided
       if (isSearch) {
-        const searchLower = search.toLowerCase();
-        files = files.filter(file => {
-          return file.Key.toLowerCase().includes(searchLower);
-        });
+        const searchLower = search.trim().toLowerCase();
+        files = files.filter(file => file.Key.toLowerCase().includes(searchLower));
       }
     }
 
@@ -269,7 +290,7 @@ router.get('/api/files', validateSessionAndRole('SuperAdmin'), async (req, res)
 });
 
 // Standard single-file upload
-router.post('/upload', validateSessionAndRole('SuperAdmin'), upload.single('file'), async (req, res) => {
+router.post('/upload', sessRole('SuperAdmin'), upload.single('file'), async (req, res) => {
   try {
     const bucketName = req.activeBucket;
     if (!req.file) {
@@ -299,26 +320,9 @@ router.post('/upload', validateSessionAndRole('SuperAdmin'), upload.single('file
     try {
       await uploadFile(key, req.file.buffer, req.file.mimetype, uploadOptions);
 
-      // Clean up folder marker if it exists in the parent directory
-      // This happens when a file is uploaded to a folder that was previously empty
+      // Clean up folder marker if it exists in the parent directory.
       const folderPath = key.substring(0, key.lastIndexOf('/') + 1);
-      if (folderPath) {
-        const folderMarkerKey = folderPath; // Already ends with /
-        try {
-          const markerExists = await fileExists(folderMarkerKey, bucketName);
-          if (markerExists) {
-            // Check if this is actually a folder marker (zero-byte file)
-            const metadata = await getFileMetadata(folderMarkerKey, bucketName);
-            if (metadata.ContentLength === 0 || metadata.Metadata?.marker === 'true') {
-              await deleteFile(folderMarkerKey, bucketName);
-              console.log(`[mbkbucket] Cleaned up folder marker: ${folderMarkerKey}`);
-            }
-          }
-        } catch (cleanupErr) {
-          // Non-critical error, just log it
-          console.warn('[mbkbucket] Failed to clean up folder marker:', cleanupErr.message);
-        }
-      }
+      await cleanupFolderMarker(folderPath, bucketName);
 
       res.json({ success: true, message: 'File uploaded successfully', key: key });
     } catch (uploadError) {
@@ -337,7 +341,7 @@ router.post('/upload', validateSessionAndRole('SuperAdmin'), upload.single('file
 // S3 Multipart Upload — Step 1: Initiate
 // Body: { fileName, prefix?, contentType? }
 // Returns: { uploadId, key }
-router.post('/upload-init', validateSessionAndRole('SuperAdmin'), async (req, res) => {
+router.post('/upload-init', sessRole('SuperAdmin'), async (req, res) => {
   try {
     const bucketName = req.activeBucket;
     const { fileName, prefix = '', contentType = 'application/octet-stream' } = req.body;
@@ -364,7 +368,7 @@ router.post('/upload-init', validateSessionAndRole('SuperAdmin'), async (req, re
 // S3 Multipart Upload — Step 2: Upload a part
 // FormData: chunk (file), partNumber (1-based integer), uploadId, key
 // Returns: { partNumber, ETag }
-router.post('/upload-chunk', validateSessionAndRole('SuperAdmin'), uploadChunk, async (req, res) => {
+router.post('/upload-chunk', sessRole('SuperAdmin'), uploadChunk, async (req, res) => {
   try {
     const bucketName = req.activeBucket;
     const { uploadId, key, partNumber } = req.body;
@@ -387,7 +391,7 @@ router.post('/upload-chunk', validateSessionAndRole('SuperAdmin'), uploadChunk,
 // S3 Multipart Upload — Step 3: Complete
 // Body: { uploadId, key, parts: [{ partNumber, ETag }] }
 // Returns: { key }
-router.post('/upload-complete', validateSessionAndRole('SuperAdmin'), async (req, res) => {
+router.post('/upload-complete', sessRole('SuperAdmin'), async (req, res) => {
   try {
     const bucketName = req.activeBucket;
     const { uploadId, key, parts } = req.body;
@@ -399,21 +403,7 @@ router.post('/upload-complete', validateSessionAndRole('SuperAdmin'), async (req
 
     // Clean up folder marker if it exists in the parent directory
     const folderPath = result.key.substring(0, result.key.lastIndexOf('/') + 1);
-    if (folderPath) {
-      const folderMarkerKey = folderPath;
-      try {
-        const markerExists = await fileExists(folderMarkerKey, bucketName);
-        if (markerExists) {
-          const metadata = await getFileMetadata(folderMarkerKey, bucketName);
-          if (metadata.ContentLength === 0 || metadata.Metadata?.marker === 'true') {
-            await deleteFile(folderMarkerKey, bucketName);
-            console.log(`[mbkbucket] Cleaned up folder marker: ${folderMarkerKey}`);
-          }
-        }
-      } catch (cleanupErr) {
-        console.warn('[mbkbucket] Failed to clean up folder marker:', cleanupErr.message);
-      }
-    }
+    await cleanupFolderMarker(folderPath, bucketName);
 
     return res.json({ success: true, message: 'File uploaded successfully', key: result.key });
   } catch (err) {
@@ -424,7 +414,7 @@ router.post('/upload-complete', validateSessionAndRole('SuperAdmin'), async (req
 
 // S3 Multipart Upload — Abort (cleanup on client cancel/error)
 // Body: { uploadId, key }
-router.post('/upload-abort', validateSessionAndRole('SuperAdmin'), async (req, res) => {
+router.post('/upload-abort', sessRole('SuperAdmin'), async (req, res) => {
   try {
     const bucketName = req.activeBucket;
     const { uploadId, key } = req.body;
@@ -439,7 +429,7 @@ router.post('/upload-abort', validateSessionAndRole('SuperAdmin'), async (req, r
 });
 
 // Create folder (zero-byte object with trailing slash)
-router.post('/create-folder', validateSessionAndRole('SuperAdmin'), async (req, res) => {
+router.post('/create-folder', sessRole('SuperAdmin'), async (req, res) => {
   try {
     const bucketName = req.activeBucket;
     const { prefix = '', folderName } = req.body;
@@ -481,7 +471,7 @@ router.post('/create-folder', validateSessionAndRole('SuperAdmin'), async (req,
   }
 });
 
-router.post('/delete', validateSessionAndRole('SuperAdmin'), async (req, res) => {
+router.post('/delete', sessRole('SuperAdmin'), async (req, res) => {
   try {
     const bucketName = req.activeBucket;
     const { key, keys, folder } = req.body;
@@ -511,7 +501,7 @@ router.post('/delete', validateSessionAndRole('SuperAdmin'), async (req, res) =>
   }
 });
 
-router.get('/download/:key(*)', validateSessionAndRole('SuperAdmin'), async (req, res) => {
+router.get('/download/:key(*)', sessRole('SuperAdmin'), async (req, res) => {
   let stream = null;
   try {
     const bucketName = req.activeBucket;
@@ -525,7 +515,7 @@ router.get('/download/:key(*)', validateSessionAndRole('SuperAdmin'), async (req
     const result = await downloadFile(keyToUse, { bucketName });
     stream = result.Body;
 
-    res.setHeader('Content-Disposition', `attachment; filename="${keyToUse.split('/').pop()}"`);
+    res.setHeader('Content-Disposition', `attachment; filename="${getBaseName(keyToUse).replace(/"/g, '\\"')}"`);
     const contentType = result.ContentType || 'application/octet-stream';
     res.setHeader('Content-Type', contentType);
 
@@ -592,4 +582,4 @@ router.get('/download/:key(*)', validateSessionAndRole('SuperAdmin'), async (req
   }
 });
 
-export default router;
+export default router;

package/lib/routes/index.js

@@ -2,7 +2,7 @@ import express from "express";
 import infoRoutes from "./info.js";
 import viewRoutes from "./view.js";
 import apiRoutes from "./api.js";
-import { validateSessionAndRole, renderPage, mbkautheVar } from "mbkauthe";
+import { sessRole, renderPage, mbkautheVar } from "mbkauthe";
 import { resolveBucketName, getAvailableBucketNames } from "../s3.js";
 
 const router = express.Router();
@@ -62,7 +62,7 @@ function renderBucketDashboard(req, res) {
   });
 }
 
-router.get('/mbkbucket', validateSessionAndRole('SuperAdmin'), async (req, res) => {
+router.get('/mbkbucket', sessRole('SuperAdmin'), async (req, res) => {
   return renderBucketDashboard(req, res);
 });
 

package/lib/routes/view.js

@@ -1,8 +1,11 @@
 import express from "express";
-import { validateSessionAndRole } from "mbkauthe";
+import { sessRole } from "mbkauthe";
 import { downloadFile, getFileMetadata, ensureKeyHasAppPrefix, generateSignedUrl, resolveBucketName } from "../s3.js";
 import { mbkbucketVar } from "../config/index.js";
 import rateLimit from "express-rate-limit";
+import { createLogger } from "../debug.js";
+
+const debugView = createLogger('view');
 
 // ---------------------------------------------------------------------------
 // p_view security: rate limiter + basic bot/security middleware
@@ -42,9 +45,6 @@ function pviewSecurity(req, res, next) {
     return res.status(403).json({ message: 'Forbidden' });
   }
   
-  // Rate limit check - ensure unique fingerprint per request
-  const fingerprint = `${req.headers['x-forwarded-for']?.split(',')[0].trim() || req.socket.remoteAddress}:${ua}`;
-  
   // Verify Accept header is present (legitimate browsers always send this)
   if (!req.headers['accept']) {
     return res.status(403).json({ message: 'Forbidden' });
@@ -63,6 +63,21 @@ function pviewSecurity(req, res, next) {
 
 const router = express.Router();
 
+function escapeHtml(value = '') {
+  return String(value)
+    .replace(/&/g, '&')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#39;');
+}
+
+function getBaseName(path = '') {
+  const value = String(path || '');
+  const lastSlashIndex = value.lastIndexOf('/');
+  return lastSlashIndex === -1 ? value : value.substring(lastSlashIndex + 1);
+}
+
 function classifyViewError(error, fallbackMessage = 'Request failed') {
   const message = String(error?.message || fallbackMessage);
   const lower = message.toLowerCase();
@@ -98,7 +113,7 @@ router.use((req, res, next) => {
 });
 
 // New: lightweight player page for robust playback in browsers
-router.get('/player/:key(*)', validateSessionAndRole('SuperAdmin'), async (req, res) => {
+router.get('/player/:key(*)', sessRole('SuperAdmin'), async (req, res) => {
   try {
     const bucketName = req.activeBucket;
     const key = req.params.key;
@@ -109,7 +124,8 @@ router.get('/player/:key(*)', validateSessionAndRole('SuperAdmin'), async (req,
       return res.status(400).send(e.message);
     }
     const encoded = encodeURIComponent(keyToUse);
-    const fileName = keyToUse.split('/').pop();
+    const fileName = getBaseName(keyToUse);
+    const safeFileName = escapeHtml(fileName);
 
     const bucketQuery = `?bucket=${encodeURIComponent(bucketName)}`;
     const html = `<!doctype html>
@@ -117,7 +133,7 @@ router.get('/player/:key(*)', validateSessionAndRole('SuperAdmin'), async (req,
       <head>
         <meta charset="utf-8">
         <meta name="viewport" content="width=device-width,initial-scale=1">
-        <title>Preview: ${fileName}</title>
+        <title>Preview: ${safeFileName}</title>
         <style>
           * { margin: 0; padding: 0; box-sizing: border-box; }
           body { margin: 0; display: flex; align-items: center; justify-content: center; min-height: 100vh; background: #000; color: #fff; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif; }
@@ -127,7 +143,7 @@ router.get('/player/:key(*)', validateSessionAndRole('SuperAdmin'), async (req,
         </style>
       </head>
       <body>
-        <div class="file-name">${fileName}</div>
+        <div class="file-name">${safeFileName}</div>
         <div class="player-container">
           <video controls preload="metadata" src="/mbkbucket/view/${encoded}${bucketQuery}">
             Your browser does not support the video tag.
@@ -159,6 +175,9 @@ const VIEWABLE_TYPES = new Set([
 ]);
 // Pre-sorted for 415 error responses (avoids re-sorting on every error)
 const VIEWABLE_TYPES_SORTED = Array.from(VIEWABLE_TYPES).sort();
+const STATIC_ASSET_TYPES = new Set(['jpg', 'jpeg', 'png', 'gif', 'webp', 'svg', 'bmp', 'ico', 'css', 'js']);
+const VIDEO_TYPES = new Set(['mp4', 'webm', 'ogg', 'avi', 'mov']);
+const AUDIO_TYPES = new Set(['mp3', 'wav', 'flac', 'aac', 'm4a']);
 
 const MIME_TYPES = {
   // Images
@@ -218,10 +237,11 @@ function buildCacheControl(contentType, { isStaticAsset = false, supportsRanges
 }
 
 async function serveFileInline(req, res, keyToUse, { noindex = true, bucketName, publicCache = false } = {}) {
-  const fileName = keyToUse.split('/').pop();
-  const fileExtension = fileName.includes('.') ? fileName.split('.').pop().toLowerCase() : '';
+  const fileName = getBaseName(keyToUse);
+  const dotIndex = fileName.lastIndexOf('.');
+  const fileExtension = dotIndex === -1 ? '' : fileName.substring(dotIndex + 1).toLowerCase();
 
-  console.log(`[mbkbucket] 📥 Request for ${fileName} (type: ${fileExtension}, range: ${req.headers.range || 'none'})`);
+  debugView('Request for %s (type: %s, range: %s)', fileName, fileExtension, req.headers.range || 'none');
 
   if (!VIEWABLE_TYPES.has(fileExtension)) {
     return res.status(415).json({
@@ -234,9 +254,9 @@ async function serveFileInline(req, res, keyToUse, { noindex = true, bucketName,
   const ifModifiedSince = req.headers['if-modified-since'];
   const rangeHeader = req.headers.range;
 
-  const isStaticAsset = ['jpg', 'jpeg', 'png', 'gif', 'webp', 'svg', 'bmp', 'ico', 'css', 'js'].includes(fileExtension);
-  const isVideo = ['mp4', 'webm', 'ogg', 'avi', 'mov'].includes(fileExtension);
-  const isAudio = ['mp3', 'wav', 'flac', 'aac', 'm4a'].includes(fileExtension);
+  const isStaticAsset = STATIC_ASSET_TYPES.has(fileExtension);
+  const isVideo = VIDEO_TYPES.has(fileExtension);
+  const isAudio = AUDIO_TYPES.has(fileExtension);
   const isPdf = fileExtension === 'pdf';
   const supportsRanges = isVideo || isAudio || isPdf;
   const contentType = MIME_TYPES[fileExtension] || 'application/octet-stream';
@@ -247,7 +267,7 @@ async function serveFileInline(req, res, keyToUse, { noindex = true, bucketName,
   // requested byte range — avoids downloading the full file first.
   // ---------------------------------------------------------------------------
   if (supportsRanges && rangeHeader) {
-    console.log(`[mbkbucket] Processing range request: ${rangeHeader} for ${fileName}`);
+    debugView('Processing range request: %s for %s', rangeHeader, fileName);
     let meta;
     try {
       meta = await getFileMetadata(keyToUse, bucketName);
@@ -309,10 +329,10 @@ async function serveFileInline(req, res, keyToUse, { noindex = true, bucketName,
         const rangeResult = await downloadFile(keyToUse, { range: `bytes=${start}-${end}`, bucketName });
 
         if (typeof rangeResult.ContentLength === 'number' && rangeResult.ContentLength !== chunksize) {
-          console.warn(`Range size mismatch for ${keyToUse}: expected=${chunksize} got=${rangeResult.ContentLength}`);
+          debugView('Range size mismatch for %s: expected=%s got=%s', keyToUse, chunksize, rangeResult.ContentLength);
         }
 
-        console.log(`[mbkbucket] ✓ Serving range bytes ${start}-${end}/${total} (${chunksize} bytes) for ${fileName}`);
+        debugView('Serving range bytes %s-%s/%s (%s bytes) for %s', start, end, total, chunksize, fileName);
 
         res.status(206);
         res.setHeader('Content-Range', `bytes ${start}-${end}/${total}`);
@@ -370,7 +390,7 @@ async function serveFileInline(req, res, keyToUse, { noindex = true, bucketName,
   };
 
   if (isPdf) {
-    console.log(`[mbkbucket] Serving full PDF (no range header) for ${fileName}`);
+    debugView('Serving full PDF (no range header) for %s', fileName);
   }
 
   let result;
@@ -442,7 +462,7 @@ async function serveFileInline(req, res, keyToUse, { noindex = true, bucketName,
 // Routes
 // ---------------------------------------------------------------------------
 
-router.get('/view/:key(*)', validateSessionAndRole('SuperAdmin'), async (req, res) => {
+router.get('/view/:key(*)', sessRole('SuperAdmin'), async (req, res) => {
   try {
     const bucketName = req.activeBucket;
     let keyToUse;
@@ -508,4 +528,4 @@ if (mbkbucketVar?.publiView_enabled) {
   });
 }
 
-export default router;
+export default router;