mbkbucket 3.8.2 → 4.0.0

package/lib/src/controllers/dashboard.controller.js

@@ -1,49 +1,69 @@
-import fs from "fs";
-import path from "path";
-import { resolveBucketName, getAvailableBucketNames } from "../services/s3.service.js";
-import { renderPage, mbkautheVar } from "mbkauthe";
-import { commonHandlebarsHelpers } from "../utils/helpers.js";
-
-/**
- * Render the main bucket dashboard page.
- */
-export function renderBucketDashboard(req, res) {
-  const allBuckets = getAvailableBucketNames();
-  const configuredDefaultBucket = mbkautheVar?.bucket;
-  const isPortal = mbkautheVar?.APP_NAME === "portal";
-  const bucketfilePath = isPortal ? "bucketportal.hbs" : "bucket.hbs";
-
-  const mainLayoutPath = path.resolve(process.cwd(), "views", "layouts", "main");
-  const hasMainLayout = fs.existsSync(`${mainLayoutPath}.hbs`) || fs.existsSync(mainLayoutPath);
-  const portalLayout = (isPortal && hasMainLayout) && mainLayoutPath;
-
-  let selectedBucket;
-  let error = req.query.error;
-
-  try {
-    selectedBucket = resolveBucketName(req.query.bucket);
-  } catch (err) {
-    selectedBucket = mbkautheVar?.bucket;
-    error ||= err.message;
-  }
-
-  const bucketOptions = allBuckets.map(name => ({
-    name,
-    isSelected: name === selectedBucket,
-    isDefault: name === configuredDefaultBucket
-  }));
-
-  renderPage(req, res, bucketfilePath, Boolean(portalLayout), {
-    page: "Admin Bucket",
-    helpers: commonHandlebarsHelpers,
-    layout: portalLayout || false,
-    bucketvar: selectedBucket,
-    selectedBucket,
-    bucketOptions,
-    APP_NAME: mbkautheVar?.APP_NAME,
-    message: req.query.message,
-    error,
-    availableBuckets: allBuckets
-  });
-}
-
+import fs from "fs";
+import path from "path";
+import { resolveStorageName, getAvailableStorageNames, getStorageProvider, getStorageConfig } from "../services/storage.service.js";
+import { storageManager } from "../core/storage/storage-manager.js";
+import { renderPage, mbkautheVar } from "mbkauthe";
+import { commonHandlebarsHelpers } from "../utils/helpers.js";
+import { mbkbucketVar } from "../config/index.js";
+
+/**
+ * Render the main storage/bucket dashboard page.
+ */
+export function renderBucketDashboard(req, res) {
+  const allBuckets = getAvailableStorageNames();
+  const configuredDefaultBucket = mbkautheVar?.bucket;
+  const isPortal = mbkautheVar?.APP_NAME === "portal";
+  const bucketfilePath = isPortal ? "bucketportal.hbs" : "bucket.hbs";
+
+  const mainLayoutPath = path.resolve(process.cwd(), "views", "layouts", "main");
+  const hasMainLayout = fs.existsSync(`${mainLayoutPath}.hbs`) || fs.existsSync(mainLayoutPath);
+  const portalLayout = (isPortal && hasMainLayout) && mainLayoutPath;
+
+  let selectedBucket;
+  let error = req.query.error;
+  let providerType = 's3';
+  let providerCapabilities = {};
+
+  try {
+    selectedBucket = resolveStorageName(req.query.bucket);
+    const provider = getStorageProvider(selectedBucket);
+    providerType = provider.type;
+    providerCapabilities = provider.capabilities;
+  } catch (err) {
+    selectedBucket = mbkautheVar?.bucket;
+    error ||= err.message;
+  }
+
+  const bucketOptions = allBuckets.map(name => {
+    let type = 's3';
+    try {
+      const cfg = getStorageConfig(name);
+      type = storageManager.inferProviderType(cfg);
+    } catch {}
+    return {
+      name,
+      type,
+      isSelected: name === selectedBucket,
+      isDefault: name === configuredDefaultBucket
+    };
+  });
+
+  const publicViewEnabled = Boolean(mbkbucketVar?.publiView_enabled);
+
+  renderPage(req, res, bucketfilePath, Boolean(portalLayout), {
+    page: "Admin Bucket",
+    helpers: commonHandlebarsHelpers,
+    layout: portalLayout || false,
+    bucketvar: selectedBucket,
+    selectedBucket,
+    bucketOptions,
+    providerType,
+    providerCapabilities,
+    APP_NAME: mbkautheVar?.APP_NAME,
+    publicViewEnabled,
+    publiViewEnabled: publicViewEnabled,
+    message: req.query.message,
+    error,
+    availableBuckets: allBuckets
+  });
+}

package/lib/src/controllers/info.controller.js

@@ -1,5 +1,7 @@
 import { renderPage, mbkautheVar } from "mbkauthe";
-import { packageJson, getLatestVersion } from "../config/index.js";
+import { packageJson, getLatestVersion, appVersion, mbkbucketVar } from "../config/index.js";
+import { getAvailableBucketNames, getStorageProvider } from "../services/storage.service.js";
+import { storageManager } from "../core/storage/storage-manager.js";
 
 async function getInfoData() {
   let latestVersion = 'unknown';
@@ -8,10 +10,38 @@ async function getInfoData() {
   } catch (err) {
     console.error("[mbkbucket] Error fetching latest version:", err);
   }
+
+  const buckets = getAvailableBucketNames();
+  const defaultBucket = storageManager.getDefaultConnectionName() || (buckets[0] ?? '');
+  let providerType = 'S3';
+  if (defaultBucket) {
+    try {
+      const provider = getStorageProvider(defaultBucket);
+      providerType = (provider?.type || 's3').toUpperCase();
+    } catch {}
+  }
+
+  // Safe subset only - strictly prevent leaking passwords, DB connection strings, OAuth secrets, or storage credentials
+  const safeMbkautheVar = {
+    APP_NAME: mbkautheVar?.APP_NAME || mbkautheVar?.app_name || "mbkbucket",
+  };
+
+  const safeMbkbucketVar = {
+    publiView_enabled: Boolean(mbkbucketVar?.publiView_enabled),
+    p_view_inline: Boolean(mbkbucketVar?.p_view_inline)
+  };
+
   return {
     CurrentVersion: packageJson.version,
+    version: packageJson.version,
     latestVersion,
-    APP_NAME: mbkautheVar?.APP_NAME
+    APP_NAME: safeMbkautheVar.APP_NAME,
+    APP_VERSION: appVersion,
+    mbkautheVar: safeMbkautheVar,
+    mbkbucketVar: safeMbkbucketVar,
+    defaultBucket,
+    configuredBucketsCount: buckets.length,
+    providerType
   };
 }
 
@@ -20,7 +50,8 @@ async function getInfoData() {
  */
 export async function infoPage(req, res) {
   renderPage(req, res, "mbkbucket_info.hbs", false, {
-    page: "MBK Bucket Info",
+    pageTitle: "MBKBucket Information",
+    ogUrl: "/mbkbucket/info",
     ...(await getInfoData())
   });
 }

package/lib/src/controllers/view.controller.js

@@ -1,231 +1,233 @@
-import { downloadFile, getFileMetadata, ensureKeyHasAppPrefix, generateSignedUrl, resolveBucketName } from "../services/s3.service.js";
-import { mbkbucketVar } from "../config/index.js";
-import { escapeHtml, getBaseName, getFileExt, getMimeType, normalizeKeyParam, destroyStream, VIEWABLE_TYPES, VIEWABLE_TYPES_SORTED, STATIC_ASSET_TYPES, VIDEO_TYPES, AUDIO_TYPES, buildCacheControl, parseRangeHeader, renderPlayerPage } from "../utils/helpers.js";
-import { createLogger } from "#logger";
-
-const debugView = createLogger('view');
-
-function attachStreamCleanup(req, res, stream, timeoutMs = 120000) {
-  const cleanup = () => destroyStream(stream);
-
-  stream.on('error', (err) => {
-    console.error('Stream error:', err);
-    cleanup();
-    if (!res.headersSent) res.status(500).end('Stream error');
-  });
-
-  req.on('close', cleanup);
-  req.on('aborted', cleanup);
-  req.setTimeout(timeoutMs, () => {
-    console.error('Request timeout for stream');
-    cleanup();
-    if (!res.headersSent) res.status(408).end('Request timeout');
-  });
-  res.on('finish', cleanup);
-  res.on('close', cleanup);
-}
-
-async function serveFileInline(req, res, keyToUse, { noindex = true, bucketName, publicCache = false } = {}) {
-  const fileName = getBaseName(keyToUse);
-  const fileExtension = getFileExt(fileName);
-
-  debugView('Request for %s (type: %s, range: %s)', fileName, fileExtension, req.headers.range || 'none');
-
-  if (!VIEWABLE_TYPES.has(fileExtension)) {
-    return res.status(415).json({
-      message: 'File type not supported for viewing',
-      supportedTypes: VIEWABLE_TYPES_SORTED
-    });
-  }
-
-  const ifNoneMatch = req.headers['if-none-match'];
-  const ifModifiedSince = req.headers['if-modified-since'];
-  const rangeHeader = req.headers.range;
-
-  const isStaticAsset = STATIC_ASSET_TYPES.has(fileExtension);
-  const isVideo = VIDEO_TYPES.has(fileExtension);
-  const isAudio = AUDIO_TYPES.has(fileExtension);
-  const isPdf = fileExtension === 'pdf';
-  const supportsRanges = isVideo || isAudio || isPdf;
-  const contentType = getMimeType(fileName);
-
-  // Fast path for range requests (video / audio / PDF streaming)
-  if (supportsRanges && rangeHeader) {
-    debugView('Processing range request: %s for %s', rangeHeader, fileName);
-    let meta;
-    try {
-      meta = await getFileMetadata(keyToUse, bucketName);
-    } catch (err) {
-      console.error('[mbkbucket] serveFileInline metadata error:', err);
-      return res.status(500).json({ message: 'Failed to fetch file metadata', error: err.message });
-    }
-
-    if (!meta?.exists) return res.status(404).json({ message: 'File not found', key: keyToUse });
-
-    const etag = `"${meta.LastModified?.getTime() || Date.now()}-${meta.ContentLength || 0}"`;
-    if (ifNoneMatch === etag) return res.status(304).end();
-
-    const total = Number(meta.ContentLength);
-    if (total) {
-      const range = parseRangeHeader(rangeHeader, total);
-      if (!range) {
-        res.status(416).setHeader('Content-Range', `bytes */${total}`);
-        return res.end();
-      }
-
-      const { start, end, size: chunksize } = range;
-      try {
-        const rangeResult = await downloadFile(keyToUse, { range: `bytes=${start}-${end}`, bucketName });
-        if (typeof rangeResult.ContentLength === 'number' && rangeResult.ContentLength !== chunksize) {
-          debugView('Range size mismatch for %s: expected=%s got=%s', keyToUse, chunksize, rangeResult.ContentLength);
-        }
-
-        debugView('Serving range bytes %s-%s/%s (%s bytes) for %s', start, end, total, chunksize, fileName);
-
-        res.status(206);
-        res.setHeader('Content-Range', `bytes ${start}-${end}/${total}`);
-        res.setHeader('Content-Length', chunksize);
-        res.setHeader('Content-Type', contentType);
-        res.setHeader('Cache-Control', buildCacheControl(contentType, { supportsRanges: true, publicCache }));
-        res.setHeader('ETag', etag);
-        res.setHeader('Accept-Ranges', 'bytes');
-        if (noindex) res.setHeader('X-Robots-Tag', 'noindex, nofollow');
-        res.setHeader('X-Content-Type-Options', 'nosniff');
-        if (meta.LastModified) res.setHeader('Last-Modified', meta.LastModified.toUTCString());
-
-        attachStreamCleanup(req, res, rangeResult.Body);
-        return rangeResult.Body.pipe(res);
-      } catch (rangeError) {
-        console.error('Range request failed:', rangeError);
-      }
-    }
-  }
-
-  // Standard path: full-file download
-  const downloadOptions = {
-    ...(ifNoneMatch && { ifNoneMatch }),
-    ...(ifModifiedSince && { ifModifiedSince: new Date(ifModifiedSince) }),
-    bucketName
-  };
-
-  if (isPdf) debugView('Serving full PDF (no range header) for %s', fileName);
-
-  let result;
-  try {
-    result = await downloadFile(keyToUse, downloadOptions);
-  } catch (err) {
-    if (err.name === 'NoSuchKey' || err.name === 'NotFound') {
-      return res.status(404).json({ message: 'File not found', key: keyToUse });
-    }
-    if (err.name === 'AccessDenied') {
-      return res.status(403).json({ message: 'Access denied' });
-    }
-    console.error('[mbkbucket] serveFileInline download error:', err);
-    return res.status(500).json({ message: 'Failed to fetch file', error: err.message });
-  }
-
-  if (result?.notModified) return res.status(304).end();
-
-  const etag = `"${result.LastModified?.getTime() || Date.now()}-${result.ContentLength || 0}"`;
-  if (ifNoneMatch === etag) return res.status(304).end();
-
-  res.setHeader('Content-Type', contentType);
-  res.setHeader('Content-Disposition', `inline; filename="${fileName}"`);
-  res.setHeader('ETag', etag);
-  res.setHeader('X-Content-Type-Options', 'nosniff');
-  res.setHeader('X-Frame-Options', 'SAMEORIGIN');
-  if (noindex) res.setHeader('X-Robots-Tag', 'noindex, nofollow');
-  if (result.ContentLength) res.setHeader('Content-Length', result.ContentLength);
-  if (result.LastModified) res.setHeader('Last-Modified', result.LastModified.toUTCString());
-  if (fileExtension === 'html' || fileExtension === 'htm') {
-    res.setHeader('Content-Security-Policy', "default-src 'self'; script-src 'none'; object-src 'none';");
-  }
-  if (supportsRanges) res.setHeader('Accept-Ranges', 'bytes');
-  res.setHeader('Cache-Control', buildCacheControl(contentType, { isStaticAsset, supportsRanges, publicCache }));
-  res.status(200);
-
-  const timeoutDuration = result.ContentLength > 50 * 1024 * 1024 ? 300000 : 120000;
-  attachStreamCleanup(req, res, result.Body, timeoutDuration);
-  result.Body.pipe(res);
-}
-
-export async function viewFile(req, res) {
-  try {
-    const key = normalizeKeyParam(req.params.key);
-    let keyToUse;
-    try {
-      keyToUse = ensureKeyHasAppPrefix(key);
-    } catch (e) {
-      return res.status(400).json({ message: e.message });
-    }
-
-    await serveFileInline(req, res, keyToUse, { noindex: true, bucketName: req.activeBucket, publicCache: false });
-  } catch (error) {
-    console.error("Error viewing file:", error);
-    if (error.name === 'NoSuchKey' || error.name === 'NotFound') {
-      res.status(404).json({ message: "File not found", key: req.params.key });
-    } else if (error.name === 'AccessDenied') {
-      res.status(403).json({ message: "Access denied" });
-    } else {
-      res.status(500).json({ message: "View failed", error: error.message });
-    }
-  }
-}
-
-export async function playerPage(req, res) {
-  try {
-    const key = normalizeKeyParam(req.params.key);
-    let keyToUse;
-    try {
-      keyToUse = ensureKeyHasAppPrefix(key);
-    } catch (e) {
-      return res.status(400).send(e.message);
-    }
-
-    const html = renderPlayerPage(
-      escapeHtml(getBaseName(keyToUse)),
-      encodeURIComponent(keyToUse),
-      `?bucket=${encodeURIComponent(req.activeBucket)}`
-    );
-
-    res.setHeader('Content-Type', 'text/html; charset=utf-8');
-    res.setHeader('X-Content-Type-Options', 'nosniff');
-    return res.status(200).send(html);
-  } catch (err) {
-    console.error('Error rendering player page:', err);
-    return res.status(500).send('Failed to render player');
-  }
-}
-
-export async function publicView(req, res) {
-  try {
-    const bucketName = resolveBucketName();
-    const key = normalizeKeyParam(req.params.key);
-
-    if (!key || key.endsWith('/')) {
-      return res.status(403).json({ message: 'Directory indexing is not allowed' });
-    }
-
-    let keyToUse;
-    try {
-      keyToUse = ensureKeyHasAppPrefix(key);
-    } catch (e) {
-      return res.status(400).json({ message: e.message });
-    }
-
-    if (!mbkbucketVar?.p_view_inline) {
-      try {
-        const signed = await generateSignedUrl(keyToUse, 'getObject', 3600, bucketName);
-        return res.redirect(302, signed.url);
-      } catch (err) {
-        console.error('[mbkbucket] p_view signed URL error:', err);
-        return res.status(500).json({ message: 'Failed to generate access URL' });
-      }
-    }
-
-    await serveFileInline(req, res, keyToUse, { noindex: true, bucketName, publicCache: true });
-  } catch (error) {
-    console.error('[mbkbucket] p_view error:', error);
-    res.status(500).json({ message: 'Internal server error', error: error.message });
-  }
-}
+import { downloadFile, getFileMetadata, ensureKeyHasAppPrefix, generateSignedUrl, resolveStorageName, getStorageProvider } from "../services/storage.service.js";
+import { mbkbucketVar } from "../config/index.js";
+import { escapeHtml, getBaseName, getFileExt, getMimeType, normalizeKeyParam, destroyStream, VIEWABLE_TYPES, VIEWABLE_TYPES_SORTED, STATIC_ASSET_TYPES, VIDEO_TYPES, AUDIO_TYPES, buildCacheControl, parseRangeHeader, renderPlayerPage } from "../utils/helpers.js";
+import { createLogger } from "#logger";
+
+const debugView = createLogger('view');
+
+function attachStreamCleanup(req, res, stream, timeoutMs = 120000) {
+  const cleanup = () => destroyStream(stream);
+
+  stream.on('error', (err) => {
+    console.error('Stream error:', err);
+    cleanup();
+    if (!res.headersSent) res.status(500).end('Stream error');
+  });
+
+  req.on('close', cleanup);
+  req.on('aborted', cleanup);
+  req.setTimeout(timeoutMs, () => {
+    console.error('Request timeout for stream');
+    cleanup();
+    if (!res.headersSent) res.status(408).end('Request timeout');
+  });
+  res.on('finish', cleanup);
+  res.on('close', cleanup);
+}
+
+async function serveFileInline(req, res, keyToUse, { noindex = true, bucketName, publicCache = false } = {}) {
+  const fileName = getBaseName(keyToUse);
+  const fileExtension = getFileExt(fileName);
+
+  debugView('Request for %s (type: %s, range: %s)', fileName, fileExtension, req.headers.range || 'none');
+
+  if (!VIEWABLE_TYPES.has(fileExtension)) {
+    return res.status(415).json({
+      message: 'File type not supported for viewing',
+      supportedTypes: VIEWABLE_TYPES_SORTED
+    });
+  }
+
+  const ifNoneMatch = req.headers['if-none-match'];
+  const ifModifiedSince = req.headers['if-modified-since'];
+  const rangeHeader = req.headers.range;
+
+  const isStaticAsset = STATIC_ASSET_TYPES.has(fileExtension);
+  const isVideo = VIDEO_TYPES.has(fileExtension);
+  const isAudio = AUDIO_TYPES.has(fileExtension);
+  const isPdf = fileExtension === 'pdf';
+  const supportsRanges = isVideo || isAudio || isPdf;
+  const contentType = getMimeType(fileName);
+
+  // Fast path for range requests (video / audio / PDF streaming)
+  if (supportsRanges && rangeHeader) {
+    debugView('Processing range request: %s for %s', rangeHeader, fileName);
+    let meta;
+    try {
+      meta = await getFileMetadata(keyToUse, bucketName);
+    } catch (err) {
+      console.error('[mbkbucket] serveFileInline metadata error:', err);
+      return res.status(500).json({ message: 'Failed to fetch file metadata', error: err.message });
+    }
+
+    if (!meta?.exists) return res.status(404).json({ message: 'File not found', key: keyToUse });
+
+    const etag = `"${new Date(meta.LastModified || Date.now()).getTime()}-${meta.ContentLength || 0}"`;
+    if (ifNoneMatch === etag) return res.status(304).end();
+
+    const total = Number(meta.ContentLength);
+    if (total) {
+      const range = parseRangeHeader(rangeHeader, total);
+      if (!range) {
+        res.status(416).setHeader('Content-Range', `bytes */${total}`);
+        return res.end();
+      }
+
+      const { start, end, size: chunksize } = range;
+      try {
+        const rangeResult = await downloadFile(keyToUse, { range: `bytes=${start}-${end}`, bucketName });
+        if (typeof rangeResult.ContentLength === 'number' && rangeResult.ContentLength !== chunksize) {
+          debugView('Range size mismatch for %s: expected=%s got=%s', keyToUse, chunksize, rangeResult.ContentLength);
+        }
+
+        debugView('Serving range bytes %s-%s/%s (%s bytes) for %s', start, end, total, chunksize, fileName);
+
+        res.status(206);
+        res.setHeader('Content-Range', `bytes ${start}-${end}/${total}`);
+        res.setHeader('Content-Length', chunksize);
+        res.setHeader('Content-Type', contentType);
+        res.setHeader('Cache-Control', buildCacheControl(contentType, { supportsRanges: true, publicCache }));
+        res.setHeader('ETag', etag);
+        res.setHeader('Accept-Ranges', 'bytes');
+        if (noindex) res.setHeader('X-Robots-Tag', 'noindex, nofollow');
+        res.setHeader('X-Content-Type-Options', 'nosniff');
+        if (meta.LastModified) res.setHeader('Last-Modified', new Date(meta.LastModified).toUTCString());
+
+        attachStreamCleanup(req, res, rangeResult.Body);
+        return rangeResult.Body.pipe(res);
+      } catch (rangeError) {
+        console.error('Range request failed:', rangeError);
+      }
+    }
+  }
+
+  // Standard path: full-file download
+  const downloadOptions = {
+    ...(ifNoneMatch && { ifNoneMatch }),
+    ...(ifModifiedSince && { ifModifiedSince: new Date(ifModifiedSince) }),
+    bucketName
+  };
+
+  if (isPdf) debugView('Serving full PDF (no range header) for %s', fileName);
+
+  let result;
+  try {
+    result = await downloadFile(keyToUse, downloadOptions);
+  } catch (err) {
+    if (err.name === 'NoSuchKey' || err.name === 'NotFound' || err.message?.includes('File not found')) {
+      return res.status(404).json({ message: 'File not found', key: keyToUse });
+    }
+    if (err.name === 'AccessDenied' || err.message?.includes('Access denied')) {
+      return res.status(403).json({ message: 'Access denied' });
+    }
+    console.error('[mbkbucket] serveFileInline download error:', err);
+    return res.status(500).json({ message: 'Failed to fetch file', error: err.message });
+  }
+
+  if (result?.notModified) return res.status(304).end();
+
+  const etag = `"${new Date(result.LastModified || Date.now()).getTime()}-${result.ContentLength || 0}"`;
+  if (ifNoneMatch === etag) return res.status(304).end();
+
+  res.setHeader('Content-Type', contentType);
+  res.setHeader('Content-Disposition', `inline; filename="${fileName}"`);
+  res.setHeader('ETag', etag);
+  res.setHeader('X-Content-Type-Options', 'nosniff');
+  res.setHeader('X-Frame-Options', 'SAMEORIGIN');
+  if (noindex) res.setHeader('X-Robots-Tag', 'noindex, nofollow');
+  if (result.ContentLength) res.setHeader('Content-Length', result.ContentLength);
+  if (result.LastModified) res.setHeader('Last-Modified', new Date(result.LastModified).toUTCString());
+  if (fileExtension === 'html' || fileExtension === 'htm') {
+    res.setHeader('Content-Security-Policy', "default-src 'self'; script-src 'none'; object-src 'none';");
+  }
+  if (supportsRanges) res.setHeader('Accept-Ranges', 'bytes');
+  res.setHeader('Cache-Control', buildCacheControl(contentType, { isStaticAsset, supportsRanges, publicCache }));
+  res.status(200);
+
+  const timeoutDuration = result.ContentLength > 50 * 1024 * 1024 ? 300000 : 120000;
+  attachStreamCleanup(req, res, result.Body, timeoutDuration);
+  result.Body.pipe(res);
+}
+
+export async function viewFile(req, res) {
+  try {
+    const key = normalizeKeyParam(req.params.key);
+    let keyToUse;
+    try {
+      keyToUse = ensureKeyHasAppPrefix(key);
+    } catch (e) {
+      return res.status(400).json({ message: e.message });
+    }
+
+    await serveFileInline(req, res, keyToUse, { noindex: true, bucketName: req.activeBucket, publicCache: false });
+  } catch (error) {
+    console.error("Error viewing file:", error);
+    if (error.name === 'NoSuchKey' || error.name === 'NotFound' || error.message?.includes('File not found')) {
+      res.status(404).json({ message: "File not found", key: req.params.key });
+    } else if (error.name === 'AccessDenied' || error.message?.includes('Access denied')) {
+      res.status(403).json({ message: "Access denied" });
+    } else {
+      res.status(500).json({ message: "View failed", error: error.message });
+    }
+  }
+}
+
+export async function playerPage(req, res) {
+  try {
+    const key = normalizeKeyParam(req.params.key);
+    let keyToUse;
+    try {
+      keyToUse = ensureKeyHasAppPrefix(key);
+    } catch (e) {
+      return res.status(400).send(e.message);
+    }
+
+    const html = renderPlayerPage(
+      escapeHtml(getBaseName(keyToUse)),
+      encodeURIComponent(keyToUse),
+      `?bucket=${encodeURIComponent(req.activeBucket)}`
+    );
+
+    res.setHeader('Content-Type', 'text/html; charset=utf-8');
+    res.setHeader('X-Content-Type-Options', 'nosniff');
+    return res.status(200).send(html);
+  } catch (err) {
+    console.error('Error rendering player page:', err);
+    return res.status(500).send('Failed to render player');
+  }
+}
+
+export async function publicView(req, res) {
+  try {
+    const bucketName = req.query?.bucket ? resolveStorageName(req.query.bucket) : resolveStorageName();
+    const key = normalizeKeyParam(req.params.key);
+
+    if (!key || key.endsWith('/')) {
+      return res.status(403).json({ message: 'Directory indexing is not allowed' });
+    }
+
+    let keyToUse;
+    try {
+      keyToUse = ensureKeyHasAppPrefix(key);
+    } catch (e) {
+      return res.status(400).json({ message: e.message });
+    }
+
+    if (!mbkbucketVar?.p_view_inline) {
+      try {
+        const provider = getStorageProvider(bucketName);
+        if (provider.capabilities.presignedUrls) {
+          const signed = await generateSignedUrl(keyToUse, 'getObject', 3600, bucketName);
+          return res.redirect(302, signed.url);
+        }
+      } catch (err) {
+        debugView('Signed URL redirection failed, falling back to inline serve: %s', err.message);
+      }
+    }
+
+    await serveFileInline(req, res, keyToUse, { noindex: true, bucketName, publicCache: true });
+  } catch (error) {
+    console.error('[mbkbucket] p_view error:', error);
+    res.status(500).json({ message: 'Internal server error', error: error.message });
+  }
+}