mbkbucket 4.2.0 → 4.4.0

package/lib/public/mbkbucket-helper-demo.html

@@ -478,7 +478,6 @@
       gap: 7px;
     }
     .toast-btn:active { transform: scale(0.97); }
-    .toast-btn:hover  { transform: translateY(-1px); }
 
     .tb-success { background: rgba(22,163,74,0.08);  border-color: rgba(22,163,74,0.25);  color: var(--success-color-ml); }
     .tb-error   { background: rgba(220,38,38,0.08);  border-color: rgba(220,38,38,0.25);  color: var(--danger-color-ml); }

package/lib/public/mbkbucket-helper.css

@@ -477,7 +477,6 @@
 }
 .mbkh-item:hover {
   border-color: var(--mbkh-primary);
-  transform: translateY(-2px);
   box-shadow: 0 6px 16px rgba(15, 118, 110, 0.1);
   background: #ffffff;
 }
@@ -871,7 +870,6 @@
 .mbkh-btn-primary:hover {
   background: var(--mbkh-primary-dk);
   border-color: var(--mbkh-primary-dk);
-  transform: translateY(-1px);
   color: #fff;
 }
 .mbkh-btn-primary:disabled {

package/lib/src/app.js

@@ -68,7 +68,9 @@ export function createApp() {
     additionalViewsDirs,
     additionalPartialsDirs,
     helpers: {
-      mbkbucket_cachebuster: () => `?v=${packageJson.version}`
+      bcachebust: (version) => `?v=${(version && typeof version === "string" ? version : packageJson.version)}`,
+      cachebust: (version) => `?v=${(version && typeof version === "string" ? version : packageJson.version)}`,
+      mbkbucket_cachebuster: (version) => `?v=${(version && typeof version === "string" ? version : packageJson.version)}`
     }
   });
 

package/lib/src/controllers/api.controller.js

@@ -3,7 +3,7 @@ import { listfiles, uploadFile, deleteFile, deleteFiles, deleteFolder, createFol
 import { metricsRegistry } from "../core/metrics.js";
 import { sendApiError, classifyApiError } from "../utils/errors.js";
 import { getBaseName } from "mbkutils";
-import { isSensitiveTextType, buildKey, normalizeKeyParam, getFolderPath, destroyStream } from "../utils/helpers.js";
+import { isSensitiveTextType, buildKey, normalizeKeyParam, getFolderPath, destroyStream, parseRangeHeader } from "../utils/helpers.js";
 import { createLogger } from "#logger";
 
 
@@ -376,22 +376,130 @@ export async function downloadFileHandler(req, res) {
 
     if (aborted) return;
 
-    const result = await downloadFile(keyToUse, { bucketName: req.activeBucket });
+    const rawFileName = getBaseName(keyToUse);
+    const safeAsciiName = rawFileName.replace(/["\\]/g, '').replace(/[^\x20-\x7E]/g, '_');
+    const encodedName = encodeURIComponent(rawFileName);
+    const ifNoneMatch = req.headers['if-none-match'];
+    const ifModifiedSince = req.headers['if-modified-since'];
+    const rangeHeader = req.headers.range;
+
+    // Fast path for HEAD requests
+    if (req.method === 'HEAD') {
+      let meta;
+      try {
+        meta = await getFileMetadata(keyToUse, req.activeBucket);
+      } catch (err) {
+        if (!res.headersSent) res.status(500).end();
+        return;
+      }
+
+      if (!meta?.exists) return res.status(404).end();
+
+      const etag = meta.ETag || `"${new Date(meta.LastModified || Date.now()).getTime()}-${meta.ContentLength || 0}"`;
+      if (ifNoneMatch && (ifNoneMatch === etag || ifNoneMatch === '*')) return res.status(304).end();
+      if (ifModifiedSince && meta.LastModified && new Date(meta.LastModified) <= new Date(ifModifiedSince)) {
+        return res.status(304).end();
+      }
+
+      const contentType = meta.ContentType || 'application/octet-stream';
+      const isSensitive = isSensitiveTextType(contentType);
+      const isLargeFile = Number(meta.ContentLength || 0) > 50 * 1024 * 1024;
+
+      res.status(200);
+      res.setHeader('Content-Disposition', `attachment; filename="${safeAsciiName}"; filename*=UTF-8''${encodedName}`);
+      res.setHeader('Content-Type', contentType);
+      if (meta.ContentLength) res.setHeader('Content-Length', meta.ContentLength);
+      res.setHeader('ETag', etag);
+      if (meta.LastModified) res.setHeader('Last-Modified', new Date(meta.LastModified).toUTCString());
+      res.setHeader('Accept-Ranges', 'bytes');
+      res.setHeader('Vary', 'Accept-Encoding, Range');
+      res.setHeader('Cache-Control', isSensitive ? 'private, no-store' : isLargeFile ? 'private, max-age=600, must-revalidate' : 'private, max-age=1800, must-revalidate');
+      return res.end();
+    }
+
+    // Range request support for multi-part download acceleration / resumption
+    if (rangeHeader) {
+      let meta;
+      try {
+        meta = await getFileMetadata(keyToUse, req.activeBucket);
+      } catch (err) {
+        if (!res.headersSent) res.status(500).json({ message: 'Failed to fetch metadata', error: err.message });
+        return;
+      }
+
+      if (!meta?.exists) return res.status(404).json({ message: 'File not found', key: req.params.key });
+
+      const total = Number(meta.ContentLength);
+      if (total) {
+        const range = parseRangeHeader(rangeHeader, total);
+        if (!range) {
+          res.status(416).setHeader('Content-Range', `bytes */${total}`);
+          return res.end();
+        }
+
+        const { start, end, size: chunksize } = range;
+        const rangeResult = await downloadFile(keyToUse, { range: `bytes=${start}-${end}`, bucketName: req.activeBucket });
+        const stream = rangeResult.Body || rangeResult.stream;
+        if (aborted) {
+          destroyStream(stream);
+          return;
+        }
+
+        const etag = meta.ETag || `"${new Date(meta.LastModified || Date.now()).getTime()}-${meta.ContentLength || 0}"`;
+        const contentType = meta.ContentType || rangeResult.ContentType || 'application/octet-stream';
+
+        res.status(206);
+        res.setHeader('Content-Range', `bytes ${start}-${end}/${total}`);
+        res.setHeader('Content-Length', chunksize);
+        res.setHeader('Content-Type', contentType);
+        res.setHeader('Content-Disposition', `attachment; filename="${safeAsciiName}"; filename*=UTF-8''${encodedName}`);
+        res.setHeader('ETag', etag);
+        res.setHeader('Accept-Ranges', 'bytes');
+        res.setHeader('Vary', 'Accept-Encoding, Range');
+        res.setHeader('Cache-Control', 'private, max-age=1800, must-revalidate');
+
+        try {
+          await pipeline(stream, res);
+        } catch (pipeErr) {
+          if (aborted) {
+            destroyStream(stream);
+            return;
+          }
+          throw pipeErr;
+        }
+        return;
+      }
+    }
+
+    // Standard full-file download
+    const downloadOptions = {
+      ...(ifNoneMatch && { ifNoneMatch }),
+      ...(ifModifiedSince && { ifModifiedSince: new Date(ifModifiedSince) }),
+      bucketName: req.activeBucket
+    };
+
+    const result = await downloadFile(keyToUse, downloadOptions);
+    if (result?.notModified) return res.status(304).end();
+
     const stream = result.Body || result.stream;
     if (aborted) {
       destroyStream(stream);
       return;
     }
 
-    const fileName = getBaseName(keyToUse).replace(/"/g, '\\"');
     const contentType = result.ContentType || 'application/octet-stream';
     const contentLength = result.ContentLength;
+    const etag = result.ETag || `"${new Date(result.LastModified || Date.now()).getTime()}-${contentLength || 0}"`;
+
+    if (ifNoneMatch === etag) return res.status(304).end();
 
-    res.setHeader('Content-Disposition', `attachment; filename="${fileName}"`);
+    res.setHeader('Content-Disposition', `attachment; filename="${safeAsciiName}"; filename*=UTF-8''${encodedName}`);
     res.setHeader('Content-Type', contentType);
     if (contentLength) res.setHeader('Content-Length', contentLength);
-    if (result.ETag) res.setHeader('ETag', result.ETag);
+    res.setHeader('ETag', etag);
     if (result.LastModified) res.setHeader('Last-Modified', new Date(result.LastModified).toUTCString());
+    res.setHeader('Accept-Ranges', 'bytes');
+    res.setHeader('Vary', 'Accept-Encoding, Range');
 
     const isSensitive = isSensitiveTextType(contentType);
     const isLargeFile = Number(contentLength || 0) > 50 * 1024 * 1024;

package/lib/src/controllers/view.controller.js

@@ -11,7 +11,10 @@ function attachStreamCleanup(req, res, stream, timeoutMs = 120000) {
   const cleanup = () => destroyStream(stream);
 
   stream.on('error', (err) => {
-    console.error('Stream error:', err);
+    const isAbort = err.name === 'AbortError' || err.code === 'ERR_STREAM_PREMATURE_CLOSE' || err.message?.includes('premature close');
+    if (!isAbort) {
+      console.error('Stream error:', err);
+    }
     cleanup();
     if (!res.headersSent) res.status(500).end('Stream error');
   });
@@ -19,7 +22,6 @@ function attachStreamCleanup(req, res, stream, timeoutMs = 120000) {
   req.on('close', cleanup);
   req.on('aborted', cleanup);
   req.setTimeout(timeoutMs, () => {
-    console.error('Request timeout for stream');
     cleanup();
     if (!res.headersSent) res.status(408).end('Request timeout');
   });
@@ -27,14 +29,28 @@ function attachStreamCleanup(req, res, stream, timeoutMs = 120000) {
   res.on('close', cleanup);
 }
 
+function isIfRangeValid(validator, etag, lastModified) {
+  if (!validator) return true;
+  const cleanValidator = validator.trim();
+  if (cleanValidator.startsWith('"') || cleanValidator.startsWith('W/"')) {
+    return cleanValidator === etag || cleanValidator === `W/${etag}`;
+  }
+  if (lastModified) {
+    const validatorDate = new Date(cleanValidator).getTime();
+    const modDate = new Date(lastModified).getTime();
+    return !isNaN(validatorDate) && modDate <= validatorDate;
+  }
+  return false;
+}
 
 async function serveFileInline(req, res, keyToUse, { noindex = true, bucketName, publicCache = false } = {}) {
   const fileName = getBaseName(keyToUse);
   const fileExtension = getFileExt(fileName);
+  const isDownload = req.query?.download === 'true' || req.query?.download === '1' || req.query?.dl === '1' || req.query?.dl === 'true';
 
-  debugView('Request for %s (type: %s, range: %s)', fileName, fileExtension, req.headers.range || 'none');
+  debugView('Request for %s (type: %s, range: %s, download: %s)', fileName, fileExtension, req.headers.range || 'none', isDownload);
 
-  if (!VIEWABLE_TYPES.has(fileExtension)) {
+  if (!isDownload && !VIEWABLE_TYPES.has(fileExtension)) {
     return res.status(415).json({
       message: 'File type not supported for viewing',
       supportedTypes: VIEWABLE_TYPES_SORTED
@@ -43,6 +59,7 @@ async function serveFileInline(req, res, keyToUse, { noindex = true, bucketName,
 
   const ifNoneMatch = req.headers['if-none-match'];
   const ifModifiedSince = req.headers['if-modified-since'];
+  const ifRange = req.headers['if-range'];
   const rangeHeader = req.headers.range;
 
   const isStaticAsset = STATIC_ASSET_TYPES.has(fileExtension);
@@ -53,6 +70,47 @@ async function serveFileInline(req, res, keyToUse, { noindex = true, bucketName,
   const contentType = getMimeType(fileName);
   const safeAsciiName = fileName.replace(/["\\]/g, '').replace(/[^\x20-\x7E]/g, '_');
   const encodedName = encodeURIComponent(fileName);
+  const dispositionType = isDownload ? 'attachment' : 'inline';
+
+  // Fast path for HEAD requests (Vercel & CDN friendly: 0 bytes downloaded)
+  if (req.method === 'HEAD') {
+    debugView('Processing HEAD request for %s', fileName);
+    let meta;
+    try {
+      meta = await getFileMetadata(keyToUse, bucketName);
+    } catch (err) {
+      console.error('[mbkbucket] serveFileInline HEAD metadata error:', err);
+      return res.status(500).end();
+    }
+
+    if (!meta?.exists) return res.status(404).end();
+
+    const etag = meta.ETag || `"${new Date(meta.LastModified || Date.now()).getTime()}-${meta.ContentLength || 0}"`;
+    if (ifNoneMatch && (ifNoneMatch === etag || ifNoneMatch === '*')) return res.status(304).end();
+    if (ifModifiedSince && meta.LastModified && new Date(meta.LastModified) <= new Date(ifModifiedSince)) {
+      return res.status(304).end();
+    }
+
+    res.status(200);
+    res.setHeader('Content-Type', contentType);
+    if (meta.ContentLength) res.setHeader('Content-Length', meta.ContentLength);
+    res.setHeader('Content-Disposition', `${dispositionType}; filename="${safeAsciiName}"; filename*=UTF-8''${encodedName}`);
+    res.setHeader('ETag', etag);
+    if (meta.LastModified) res.setHeader('Last-Modified', new Date(meta.LastModified).toUTCString());
+    if (supportsRanges) {
+      res.setHeader('Accept-Ranges', 'bytes');
+      res.setHeader('Vary', 'Accept-Encoding, Range');
+    }
+    res.setHeader('Cache-Control', buildCacheControl(contentType, { isStaticAsset, supportsRanges, publicCache }));
+    if (publicCache) {
+      res.setHeader('CDN-Cache-Control', supportsRanges ? 'public, s-maxage=31536000, stale-while-revalidate=86400' : 'public, s-maxage=86400, stale-while-revalidate=3600');
+      res.setHeader('Vercel-CDN-Cache-Control', supportsRanges ? 'public, s-maxage=31536000, stale-while-revalidate=86400' : 'public, s-maxage=86400, stale-while-revalidate=3600');
+    }
+    res.setHeader('X-Frame-Options', 'SAMEORIGIN');
+    if (noindex) res.setHeader('X-Robots-Tag', 'noindex, nofollow');
+    res.setHeader('X-Content-Type-Options', 'nosniff');
+    return res.end();
+  }
 
   // Fast path for range requests (video / audio / PDF streaming)
   if (supportsRanges && rangeHeader) {
@@ -67,52 +125,61 @@ async function serveFileInline(req, res, keyToUse, { noindex = true, bucketName,
 
     if (!meta?.exists) return res.status(404).json({ message: 'File not found', key: keyToUse });
 
-    const etag = `"${new Date(meta.LastModified || Date.now()).getTime()}-${meta.ContentLength || 0}"`;
-    if (ifNoneMatch === etag) return res.status(304).end();
+    const etag = meta.ETag || `"${new Date(meta.LastModified || Date.now()).getTime()}-${meta.ContentLength || 0}"`;
+    if (ifNoneMatch && (ifNoneMatch === etag || ifNoneMatch === '*')) return res.status(304).end();
 
-    const total = Number(meta.ContentLength);
-    if (total) {
-      const range = parseRangeHeader(rangeHeader, total);
-      if (!range) {
-        res.status(416).setHeader('Content-Range', `bytes */${total}`);
-        return res.end();
-      }
+    const ifRangeSatisfied = !ifRange || isIfRangeValid(ifRange, etag, meta.LastModified);
 
-      const { start, end, size: chunksize } = range;
-      try {
-        const rangeResult = await downloadFile(keyToUse, { range: `bytes=${start}-${end}`, bucketName });
-        if (typeof rangeResult.ContentLength === 'number' && rangeResult.ContentLength !== chunksize) {
-          debugView('Range size mismatch for %s: expected=%s got=%s', keyToUse, chunksize, rangeResult.ContentLength);
+    if (ifRangeSatisfied) {
+      const total = Number(meta.ContentLength);
+      if (total) {
+        const range = parseRangeHeader(rangeHeader, total);
+        if (!range) {
+          res.status(416).setHeader('Content-Range', `bytes */${total}`);
+          return res.end();
         }
 
-        debugView('Serving range bytes %s-%s/%s (%s bytes) for %s', start, end, total, chunksize, fileName);
-
-        res.status(206);
-        res.setHeader('Content-Range', `bytes ${start}-${end}/${total}`);
-        res.setHeader('Content-Length', chunksize);
-        res.setHeader('Content-Type', contentType);
-        res.setHeader('Content-Disposition', `inline; filename="${safeAsciiName}"; filename*=UTF-8''${encodedName}`);
-        res.setHeader('Cache-Control', buildCacheControl(contentType, { supportsRanges: true, publicCache }));
-        res.setHeader('ETag', etag);
-        res.setHeader('Accept-Ranges', 'bytes');
-        res.setHeader('X-Frame-Options', 'SAMEORIGIN');
-        if (noindex) res.setHeader('X-Robots-Tag', 'noindex, nofollow');
-        res.setHeader('X-Content-Type-Options', 'nosniff');
-        const stream = rangeResult.Body || rangeResult.stream;
-        attachStreamCleanup(req, res, stream);
-        return stream.pipe(res);
-      } catch (rangeError) {
-        console.error('[mbkbucket] Range request failed for %s:', keyToUse, rangeError);
-        if (!res.headersSent) {
-          return res.status(500).json({ message: 'Range stream failed', error: rangeError.message });
+        const { start, end, size: chunksize } = range;
+        try {
+          const rangeResult = await downloadFile(keyToUse, { range: `bytes=${start}-${end}`, bucketName });
+          if (typeof rangeResult.ContentLength === 'number' && rangeResult.ContentLength !== chunksize) {
+            debugView('Range size mismatch for %s: expected=%s got=%s', keyToUse, chunksize, rangeResult.ContentLength);
+          }
+
+          debugView('Serving range bytes %s-%s/%s (%s bytes) for %s', start, end, total, chunksize, fileName);
+
+          res.status(206);
+          res.setHeader('Content-Range', `bytes ${start}-${end}/${total}`);
+          res.setHeader('Content-Length', chunksize);
+          res.setHeader('Content-Type', contentType);
+          res.setHeader('Content-Disposition', `${dispositionType}; filename="${safeAsciiName}"; filename*=UTF-8''${encodedName}`);
+          res.setHeader('Cache-Control', buildCacheControl(contentType, { supportsRanges: true, publicCache }));
+          if (publicCache) {
+            res.setHeader('CDN-Cache-Control', 'public, s-maxage=31536000, stale-while-revalidate=86400');
+            res.setHeader('Vercel-CDN-Cache-Control', 'public, s-maxage=31536000, stale-while-revalidate=86400');
+          }
+          res.setHeader('ETag', etag);
+          res.setHeader('Accept-Ranges', 'bytes');
+          res.setHeader('Vary', 'Accept-Encoding, Range');
+          res.setHeader('X-Frame-Options', 'SAMEORIGIN');
+          if (noindex) res.setHeader('X-Robots-Tag', 'noindex, nofollow');
+          res.setHeader('X-Content-Type-Options', 'nosniff');
+          const stream = rangeResult.Body || rangeResult.stream;
+          attachStreamCleanup(req, res, stream);
+          return stream.pipe(res);
+        } catch (rangeError) {
+          console.error('[mbkbucket] Range request failed for %s:', keyToUse, rangeError);
+          if (!res.headersSent) {
+            return res.status(500).json({ message: 'Range stream failed', error: rangeError.message });
+          }
+          return;
         }
-        return;
       }
     }
   }
 
 
-  // Standard path: full-file download
+  // Standard path: full-file download/view
   const downloadOptions = {
     ...(ifNoneMatch && { ifNoneMatch }),
     ...(ifModifiedSince && { ifModifiedSince: new Date(ifModifiedSince) }),
@@ -137,11 +204,11 @@ async function serveFileInline(req, res, keyToUse, { noindex = true, bucketName,
 
   if (result?.notModified) return res.status(304).end();
 
-  const etag = `"${new Date(result.LastModified || Date.now()).getTime()}-${result.ContentLength || 0}"`;
-  if (ifNoneMatch === etag) return res.status(304).end();
+  const etag = result.ETag || `"${new Date(result.LastModified || Date.now()).getTime()}-${result.ContentLength || 0}"`;
+  if (ifNoneMatch && (ifNoneMatch === etag || ifNoneMatch === '*')) return res.status(304).end();
 
   res.setHeader('Content-Type', contentType);
-  res.setHeader('Content-Disposition', `inline; filename="${safeAsciiName}"; filename*=UTF-8''${encodedName}`);
+  res.setHeader('Content-Disposition', `${dispositionType}; filename="${safeAsciiName}"; filename*=UTF-8''${encodedName}`);
   res.setHeader('ETag', etag);
   res.setHeader('X-Content-Type-Options', 'nosniff');
   res.setHeader('X-Frame-Options', 'SAMEORIGIN');
@@ -152,8 +219,15 @@ async function serveFileInline(req, res, keyToUse, { noindex = true, bucketName,
   if (fileExtension === 'html' || fileExtension === 'htm') {
     res.setHeader('Content-Security-Policy', "default-src 'self'; script-src 'none'; object-src 'none';");
   }
-  if (supportsRanges) res.setHeader('Accept-Ranges', 'bytes');
+  if (supportsRanges) {
+    res.setHeader('Accept-Ranges', 'bytes');
+    res.setHeader('Vary', 'Accept-Encoding, Range');
+  }
   res.setHeader('Cache-Control', buildCacheControl(contentType, { isStaticAsset, supportsRanges, publicCache }));
+  if (publicCache) {
+    res.setHeader('CDN-Cache-Control', supportsRanges ? 'public, s-maxage=31536000, stale-while-revalidate=86400' : 'public, s-maxage=86400, stale-while-revalidate=3600');
+    res.setHeader('Vercel-CDN-Cache-Control', supportsRanges ? 'public, s-maxage=31536000, stale-while-revalidate=86400' : 'public, s-maxage=86400, stale-while-revalidate=3600');
+  }
   res.status(200);
 
   const stream = result.Body || result.stream;

package/lib/src/middleware/rate-limiter.js

@@ -1,5 +1,6 @@
 import rateLimit from "express-rate-limit";
 import { renderPage } from "mbkutils";
+import { mbkbucketVar } from "../config/index.js";
 
 export const generalLimiter = rateLimit({
   windowMs: 2 * 60 * 1000,
@@ -14,9 +15,10 @@ export const generalLimiter = rateLimit({
 
 export const pviewRateLimit = rateLimit({
   windowMs: 60 * 1000,
-  max: 10,
+  max: () => Number(mbkbucketVar?.pview_rate_limit) || 300,
   standardHeaders: 'draft-7',
   legacyHeaders: false,
+  skip: (req) => Boolean(req.headers.range) || req.method === 'HEAD' || req.method === 'OPTIONS',
   keyGenerator: req => req.headers['x-forwarded-for']?.split(',')[0].trim() || req.socket.remoteAddress || 'unknown',
   handler: (_req, res) => {
     res.status(429).json({ message: 'Too many requests. Please slow down and try again later.' });

package/lib/src/middleware/security.js

@@ -3,19 +3,52 @@
  * Blocks bot/scraper User-Agents and sets security headers.
  */
 
+import { mbkbucketVar } from "../config/index.js";
+
 const BLOCKED_UA_PATTERNS = /curl|wget|python-requests|python-urllib|go-http|scrapy|libwww|java\/|bot|crawl|spider|headless|phantom|selenium|puppeteer|playwright|postman|insomnia|httpie/i;
 const SUSPICIOUS_HEADERS = ['x-devtools-emulate-network-conditions-client-id', 'x-chromedriver-clientid', 'x-automated-tool'];
 
 export function pviewSecurity(req, res, next) {
   const ua = req.headers['user-agent'] || '';
 
-  if (!ua || BLOCKED_UA_PATTERNS.test(ua) || !req.headers.accept || SUSPICIOUS_HEADERS.some(h => h in req.headers)) {
+  if (!ua || BLOCKED_UA_PATTERNS.test(ua) || SUSPICIOUS_HEADERS.some(h => h in req.headers)) {
+    return res.status(403).json({ message: 'Forbidden' });
+  }
+
+  // Handle OPTIONS preflight immediately
+  if (req.method === 'OPTIONS') {
+    if (mbkbucketVar?.p_view_cors !== false) {
+      const allowedOrigin = mbkbucketVar?.p_view_cors_origin || '*';
+      res.setHeader('Access-Control-Allow-Origin', allowedOrigin);
+      res.setHeader('Access-Control-Allow-Methods', 'GET, HEAD, OPTIONS');
+      res.setHeader('Access-Control-Allow-Headers', 'Range, If-Range, If-None-Match, If-Modified-Since, Accept, Content-Type');
+      res.setHeader('Access-Control-Expose-Headers', 'Content-Range, Content-Length, Accept-Ranges, ETag, Last-Modified, Content-Type');
+      res.setHeader('Access-Control-Max-Age', '86400');
+    }
+    return res.status(204).end();
+  }
+
+  // Require Accept header only for standard non-range, non-HEAD requests
+  if (!req.headers.accept && !req.headers.range && req.method !== 'HEAD') {
     return res.status(403).json({ message: 'Forbidden' });
   }
 
   res.setHeader('X-Content-Type-Options', 'nosniff');
-  res.setHeader('X-Frame-Options', 'SAMEORIGIN');
   res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
-  res.removeHeader('Access-Control-Allow-Origin');
+
+  // Enable CORS for public views so cross-origin web apps and PDF.js can stream files
+  if (mbkbucketVar?.p_view_cors !== false) {
+    const allowedOrigin = mbkbucketVar?.p_view_cors_origin || '*';
+    res.setHeader('Access-Control-Allow-Origin', allowedOrigin);
+    res.setHeader('Access-Control-Allow-Methods', 'GET, HEAD, OPTIONS');
+    res.setHeader('Access-Control-Allow-Headers', 'Range, If-Range, If-None-Match, If-Modified-Since, Accept, Content-Type');
+    res.setHeader('Access-Control-Expose-Headers', 'Content-Range, Content-Length, Accept-Ranges, ETag, Last-Modified, Content-Type');
+  }
+
+  const frameOpt = mbkbucketVar?.p_view_frame_options || 'SAMEORIGIN';
+  if (frameOpt && frameOpt !== 'none' && frameOpt !== 'ALLOWALL') {
+    res.setHeader('X-Frame-Options', frameOpt);
+  }
+
   next();
 }

package/lib/src/routes/api.routes.js

@@ -50,6 +50,7 @@ export function createApiRoutes({
   apiRouter.post('/move', uploadAuth, moveItem);
   apiRouter.post('/copy', uploadAuth, copyItem);
   apiRouter.get('/download/*key', viewAuth, downloadFileHandler);
+  apiRouter.head('/download/*key', viewAuth, downloadFileHandler);
 
   return apiRouter;
 }

package/lib/src/routes/view.routes.js

@@ -15,9 +15,12 @@ export function createViewRoutes({
   viewRouter.use(requireBucketView);
   viewRouter.get('/player/*key', authorization, playerPage);
   viewRouter.get('/view/*key', authorization, viewFile);
+  viewRouter.head('/view/*key', authorization, viewFile);
 
   if (publiViewEnabled ?? mbkbucketVar?.publiView_enabled) {
+    viewRouter.options('/p_view/*key', pviewSecurity);
     viewRouter.get('/p_view/*key', pviewRateLimit, pviewSecurity, publicView);
+    viewRouter.head('/p_view/*key', pviewRateLimit, pviewSecurity, publicView);
   }
 
   return viewRouter;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mbkbucket",
-  "version": "4.2.0",
+  "version": "4.4.0",
   "description": "Flexible S3/R2/Google Drive/Local bucket management — library, Express router, and standalone server CLI for mbktech.org applications. Provides upload, download, listing, multipart utilities, and a standalone server runner with built-in configuration validation and health checks",
   "author": "Muhammad Bin Khalid",
   "homepage": "https://github.com/MIbnEKhalid/mbkbucket#readme",

package/views/bucket.hbs

@@ -12,8 +12,8 @@
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>{{#if page}}{{page}} - {{/if}}Web Portal</title>
-    <script src="/mbkauthe/main.js" defer></script>
-    <link rel="icon" type="image/x-icon" href="/icon.svg">
+    <script src="/mbkauthe/main.js{{acachebust}}" defer></script>
+    <link rel="icon" type="image/x-icon" href="/icon.svg{{bcachebust}}">
     <style>
         :root {
             --primary-color-ml: #0f766e;
@@ -145,14 +145,14 @@
             }
         }
     </style>
-    {{> showmessage }}
+    {{> mbkutils_showmessage }}
 </head>
 
 <body>
     <div class="main-content">
         <nav class="top-nav">
             <div class="logo" onclick="window.location='/mbkbucket'">
-                <img src="/icon.svg" alt="Logo">
+                <img src="/icon.svg{{bcachebust}}" alt="Logo">
                 <span>MBKBucket</span>
             </div>
 

package/views/bucketadmincontent.hbs

@@ -1,4 +1,4 @@
-<link rel="stylesheet" href="/mbkbucket/bucketadmin.css{{mbkbucket_cachebuster}}">
+<link rel="stylesheet" href="/mbkbucket/bucketadmin.css{{bcachebust}}">
 <div id="bucketAppData" data-app-name="{{APP_NAME}}" data-provider-type="{{providerType}}" data-public-view-enabled="{{publicViewEnabled}}" hidden></div>
 
 <div class="page-wrapper">
@@ -191,4 +191,4 @@
 <!-- Context Menu Element -->
 <div id="fm-context-menu" class="fm-context-menu" style="display: none;"></div>
 
-<script src="/mbkbucket/bucketadmin.js{{mbkbucket_cachebuster}}"></script>
+<script src="/mbkbucket/bucketadmin.js{{bcachebust}}"></script>

package/views/mbkbucket_info.hbs

@@ -8,13 +8,13 @@
 <!DOCTYPE html>
 <html lang="en">
 
-{{> head pageTitle="System Information" ogUrl="/mbkbucket/info"}}
+{{> mbkutils_head pageTitle="System Information" ogUrl="/mbkbucket/info"}}
 
 <body>
-    {{> header appName=APP_NAME customURL="/mbkbucket"}}
+    {{> mbkutils_header appName=APP_NAME customURL="/mbkbucket"}}
 
     <section class="login-container">
-        {{> backgroundElements}}
+        {{> mbkutils_backgroundElements}}
 
         <div class="auth-card info-box">
             <div class="info-header">
@@ -130,6 +130,6 @@
         </div>
     </section>
 
-    {{> versionInfo}}
+    {{> mbkutils_versionInfo}}
 </body>
 </html>