lfss 0.9.2__py3-none-any.whl → 0.11.4__py3-none-any.whl

lfss/svc/app_dav.py

@@ -9,11 +9,11 @@ import xml.etree.ElementTree as ET
 from ..eng.connection_pool import unique_cursor
 from ..eng.error import *
 from ..eng.config import DATA_HOME, DEBUG_MODE
-from ..eng.datatype import UserRecord, FileRecord, DirectoryRecord
-from ..eng.database import FileConn
+from ..eng.datatype import UserRecord, FileRecord, DirectoryRecord, AccessLevel
+from ..eng.database import FileConn, UserConn, check_path_permission
 from ..eng.utils import ensure_uri_compnents, decode_uri_compnents, format_last_modified, static_vars
 from .app_base import *
-from .common_impl import get_file_impl, put_file_impl, delete_impl, copy_impl
+from .common_impl import copy_impl
 
 LOCK_DB_PATH = DATA_HOME / "lock.db"
 MKDIR_PLACEHOLDER = ".lfss_keep"
@@ -53,11 +53,27 @@ async def eval_path(path: str) -> tuple[ptype, str, Optional[FileRecord | Direct
     # path now is url-safe and without leading slash
     if path.endswith("/"):
         lfss_path = path
-        async with unique_cursor() as c:
-            fconn = FileConn(c)
-            if await fconn.count_path_files(path, flat=True) == 0:
-                return None, lfss_path, None
-            return "dir", lfss_path, await fconn.get_path_record(path)
+        dir_path_sp = path.split("/")
+        if len(dir_path_sp) > 2:
+            async with unique_cursor() as c:
+                fconn = FileConn(c)
+                if await fconn.count_dir_files(path, flat=True) == 0:
+                    return None, lfss_path, None
+                return "dir", lfss_path, await fconn.get_dir_record(path)
+        else:
+            # test if its a user's root directory
+            assert len(dir_path_sp) == 2
+            username = path.split("/")[0]
+            async with unique_cursor() as c:
+                uconn = UserConn(c)
+                u = await uconn.get_user(username)
+                if u is None: 
+                    return None, lfss_path, None
+                return "dir", lfss_path, DirectoryRecord(lfss_path)
+
+    # may be root directory
+    if path == "": 
+        return "dir", "", DirectoryRecord("")
 
     # not end with /, check if it is a file
     async with unique_cursor() as c:
@@ -66,12 +82,11 @@ async def eval_path(path: str) -> tuple[ptype, str, Optional[FileRecord | Direct
             lfss_path = path
             return "file", lfss_path, res
     
-    if path == "": return "dir", "", DirectoryRecord("")
     async with unique_cursor() as c:
+        lfss_path = path + "/"
         fconn = FileConn(c)
-        if await fconn.count_path_files(path + "/") > 0:
-            lfss_path = path + "/"
-            return "dir", lfss_path, await fconn.get_path_record(lfss_path)
+        if await fconn.count_dir_files(lfss_path) > 0:
+            return "dir", lfss_path, await fconn.get_dir_record(lfss_path)
     
     return None, path, None
 
@@ -110,7 +125,7 @@ async def unlock_path(user: UserRecord, p: str, token: str):
                 raise FileLockedError(f"Failed to unlock file [{p}] with token {token}")
             await cur.execute("DELETE FROM locks WHERE path=?", (p,))
             await conn.commit()
-async def query_lock_el(p: str, top_el_name: str = f"{{{DAV_NS}}}lockinfo") -> Optional[ET.Element]:
+async def query_lock_element(p: str, top_el_name: str = f"{{{DAV_NS}}}lockinfo") -> Optional[ET.Element]:
     async with aiosqlite.connect(LOCK_DB_PATH) as conn:
         await conn.execute("BEGIN EXCLUSIVE")
         await conn.execute(lock_table_create_sql)
@@ -145,15 +160,16 @@ async def create_file_xml_element(frecord: FileRecord) -> ET.Element:
     href.text = f"/{frecord.url}"
     propstat = ET.SubElement(file_el, f"{{{DAV_NS}}}propstat")
     prop = ET.SubElement(propstat, f"{{{DAV_NS}}}prop")
-    ET.SubElement(prop, f"{{{DAV_NS}}}displayname").text = frecord.url.split("/")[-1]
+    ET.SubElement(prop, f"{{{DAV_NS}}}displayname").text = decode_uri_compnents(frecord.url.split("/")[-1])
     ET.SubElement(prop, f"{{{DAV_NS}}}resourcetype")
     ET.SubElement(prop, f"{{{DAV_NS}}}getcontentlength").text = str(frecord.file_size)
     ET.SubElement(prop, f"{{{DAV_NS}}}getlastmodified").text = format_last_modified(frecord.create_time)
     ET.SubElement(prop, f"{{{DAV_NS}}}getcontenttype").text = frecord.mime_type
-    lock_el = await query_lock_el(frecord.url, top_el_name=f"{{{DAV_NS}}}activelock")
+    lock_el = await query_lock_element(frecord.url, top_el_name=f"{{{DAV_NS}}}activelock")
     if lock_el is not None:
         lock_discovery = ET.SubElement(prop, f"{{{DAV_NS}}}lockdiscovery")
         lock_discovery.append(lock_el)
+    ET.SubElement(propstat, f"{{{DAV_NS}}}status").text = "HTTP/1.1 200 OK"
     return file_el
 
 async def create_dir_xml_element(drecord: DirectoryRecord) -> ET.Element:
@@ -162,15 +178,16 @@ async def create_dir_xml_element(drecord: DirectoryRecord) -> ET.Element:
     href.text = f"/{drecord.url}"
     propstat = ET.SubElement(dir_el, f"{{{DAV_NS}}}propstat")
     prop = ET.SubElement(propstat, f"{{{DAV_NS}}}prop")
-    ET.SubElement(prop, f"{{{DAV_NS}}}displayname").text = drecord.url.split("/")[-2]
+    ET.SubElement(prop, f"{{{DAV_NS}}}displayname").text = decode_uri_compnents(drecord.url.split("/")[-2])
     ET.SubElement(prop, f"{{{DAV_NS}}}resourcetype").append(ET.Element(f"{{{DAV_NS}}}collection"))
     if drecord.size >= 0:
         ET.SubElement(prop, f"{{{DAV_NS}}}getlastmodified").text = format_last_modified(drecord.create_time)
         ET.SubElement(prop, f"{{{DAV_NS}}}getcontentlength").text = str(drecord.size)
-    lock_el = await query_lock_el(drecord.url, top_el_name=f"{{{DAV_NS}}}activelock")
+    lock_el = await query_lock_element(drecord.url, top_el_name=f"{{{DAV_NS}}}activelock")
     if lock_el is not None:
         lock_discovery = ET.SubElement(prop, f"{{{DAV_NS}}}lockdiscovery")
         lock_discovery.append(lock_el)
+    ET.SubElement(propstat, f"{{{DAV_NS}}}status").text = "HTTP/1.1 200 OK"
     return dir_el
 
 async def xml_request_body(request: Request) -> Optional[ET.Element]:
@@ -186,64 +203,59 @@ async def dav_options(request: Request, path: str):
     return Response(headers={
         "DAV": "1,2",
         "MS-Author-Via": "DAV",
-        "Allow": "OPTIONS, GET, HEAD, POST, DELETE, TRACE, PROPFIND, PROPPATCH, COPY, MOVE, LOCK, UNLOCK",
+        "Allow": "OPTIONS, GET, HEAD, POST, DELETE, TRACE, PROPFIND, PROPPATCH, COPY, MOVE, LOCK, UNLOCK, MKCOL",
         "Content-Length": "0"
     })
 
-@router_dav.get("/{path:path}")
-@handle_exception
-async def dav_get(request: Request, path: str, user: UserRecord = Depends(get_current_user)):
-    ptype, path, _ = await eval_path(path)
-    if ptype is None: raise PathNotFoundError(path)
-    # elif ptype == "dir": raise InvalidOptionsError("Directory should not be fetched")
-    else: return await get_file_impl(request, user=user, path=path)
-
-@router_dav.head("/{path:path}")
-@handle_exception
-async def dav_head(request: Request, path: str, user: UserRecord = Depends(registered_user)):
-    ptype, path, _ = await eval_path(path)
-    # some clients may send HEAD request to check if the file exists
-    if ptype is None: raise PathNotFoundError(path)
-    elif ptype == "dir": return Response(status_code=200)
-    else: return await get_file_impl(request, user=user, path=path, is_head=True)
-
-@router_dav.put("/{path:path}")
-@handle_exception
-async def dav_put(request: Request, path: str, user: UserRecord = Depends(registered_user)):
-    _, path, _ = await eval_path(path)
-    return await put_file_impl(request, user=user, path=path, conflict='overwrite')
-
-@router_dav.delete("/{path:path}")
-@handle_exception
-async def dav_delete(path: str, user: UserRecord = Depends(registered_user)):
-    _, path, _ = await eval_path(path)
-    return await delete_impl(user=user, path=path)
-
 @router_dav.api_route("/{path:path}", methods=["PROPFIND"])
 @handle_exception
-async def dav_propfind(request: Request, path: str, user: UserRecord = Depends(registered_user)):
+async def dav_propfind(request: Request, path: str, user: UserRecord = Depends(registered_user), body: Optional[ET.Element] = Depends(xml_request_body)):
     if path.startswith("/"): path = path[1:]
     path = ensure_uri_compnents(path)
 
-    depth = request.headers.get("Depth", "1")
+    if body and DEBUG_MODE:
+        print("Propfind-body:", ET.tostring(body, encoding="utf-8", method="xml"))
+
+    depth = request.headers.get("Depth", "0")
     # Generate XML response
     multistatus = ET.Element(f"{{{DAV_NS}}}multistatus")
     path_type, lfss_path, record = await eval_path(path)
-    logger.info(f"PROPFIND {lfss_path} (depth: {depth})")
-    return_status = 200
+    logger.info(f"PROPFIND {lfss_path} (depth: {depth}), type: {path_type}, record: {record}")
+
+    if lfss_path and await check_path_permission(lfss_path, user) < AccessLevel.READ:
+        raise PermissionDeniedError(lfss_path)
+
     if path_type == "dir" and depth == "0":
         # query the directory itself
-        return_status = 200
         assert isinstance(record, DirectoryRecord)
         dir_el = await create_dir_xml_element(record)
         multistatus.append(dir_el)
 
+    elif path_type == "dir" and lfss_path == "":
+        # query root directory content
+        async def user_path_record(user_name: str, cur) -> DirectoryRecord:
+            try:
+                return await FileConn(cur).get_dir_record(user_name + "/")
+            except PathNotFoundError:
+                return DirectoryRecord(user_name + "/", size=0, n_files=0, create_time="1970-01-01 00:00:00", update_time="1970-01-01 00:00:00", access_time="1970-01-01 00:00:00")
+
+        async with unique_cursor() as c:
+            uconn = UserConn(c)
+            if not user.is_admin:
+                for u in [user] + await uconn.list_peer_users(user.id, AccessLevel.READ):
+                    dir_el = await create_dir_xml_element(await user_path_record(u.username, c))
+                    multistatus.append(dir_el)
+            else:
+                async for u in uconn.all():
+                    dir_el = await create_dir_xml_element(await user_path_record(u.username, c))
+                    multistatus.append(dir_el)
+
     elif path_type == "dir":
-        return_status = 207
+        # query directory content
         async with unique_cursor() as c:
-            flist = await FileConn(c).list_path_files(lfss_path, flat = True if depth == "infinity" else False)
+            flist = await FileConn(c).list_dir_files(lfss_path, flat = True if depth == "infinity" else False)
         for frecord in flist:
-            if frecord.url.split("/")[-1] == MKDIR_PLACEHOLDER: continue
+            if frecord.url.endswith(f"/{MKDIR_PLACEHOLDER}"): continue
             file_el = await create_file_xml_element(frecord)
             multistatus.append(file_el)
 
@@ -254,6 +266,7 @@ async def dav_propfind(request: Request, path: str, user: UserRecord = Depends(r
             multistatus.append(dir_el)
 
     elif path_type == "file": 
+        # query file
         assert isinstance(record, FileRecord)
         file_el = await create_file_xml_element(record)
         multistatus.append(file_el)
@@ -262,7 +275,7 @@ async def dav_propfind(request: Request, path: str, user: UserRecord = Depends(r
         raise PathNotFoundError(path)
 
     xml_response = ET.tostring(multistatus, encoding="utf-8", method="xml")
-    return Response(content=xml_response, media_type="application/xml", status_code=return_status)
+    return Response(content=xml_response, media_type="application/xml", status_code=207)
 
 @router_dav.api_route("/{path:path}", methods=["MKCOL"])
 @handle_exception
@@ -289,7 +302,7 @@ async def dav_move(request: Request, path: str, user: UserRecord = Depends(regis
     ptype, lfss_path, _ = await eval_path(path)
     if ptype is None:
         raise PathNotFoundError(path)
-    dptype, dlfss_path, ddav_path = await eval_path(destination)
+    dptype, dlfss_path, _ = await eval_path(destination)
     if dptype is not None:
         raise HTTPException(status_code=409, detail="Conflict")
 
@@ -302,7 +315,7 @@ async def dav_move(request: Request, path: str, user: UserRecord = Depends(regis
         assert ptype == "dir", "Directory path should end with /"
         assert lfss_path.endswith("/"), "Directory path should end with /"
         if not dlfss_path.endswith("/"): dlfss_path += "/"  # the header destination may not end with /
-        await db.move_path(lfss_path, dlfss_path, user)
+        await db.move_dir(lfss_path, dlfss_path, user)
     return Response(status_code=201)
 
 @router_dav.api_route("/{path:path}", methods=["COPY"])
@@ -339,13 +352,13 @@ async def dav_lock(request: Request, path: str, user: UserRecord = Depends(regis
     # lock_token = f"opaquelocktoken:{uuid.uuid4().hex}"
     lock_token = f"urn:uuid:{uuid.uuid4()}"
     logger.info(f"LOCK {path} (timeout: {timeout}), token: {lock_token}, depth: {lock_depth}")
-    if DEBUG_MODE:
+    if DEBUG_MODE and body:
         print("Lock-body:", ET.tostring(body, encoding="utf-8", method="xml"))
     async with dav_lock.lock:
         await lock_path(user, path, lock_token, lock_depth, timeout=timeout)
         response_elem = ET.Element(f"{{{DAV_NS}}}prop")
         lockdiscovery = ET.SubElement(response_elem, f"{{{DAV_NS}}}lockdiscovery")
-        activelock = await query_lock_el(path, top_el_name=f"{{{DAV_NS}}}activelock")
+        activelock = await query_lock_element(path, top_el_name=f"{{{DAV_NS}}}activelock")
         assert activelock is not None
     lockdiscovery.append(activelock)
     lock_response = ET.tostring(response_elem, encoding="utf-8", method="xml")
@@ -362,7 +375,7 @@ async def dav_unlock(request: Request, path: str, user: UserRecord = Depends(reg
     if lock_token.startswith("<") and lock_token.endswith(">"):
         lock_token = lock_token[1:-1]
     logger.info(f"UNLOCK {path}, token: {lock_token}")
-    if DEBUG_MODE:
+    if DEBUG_MODE and body:
         print("Unlock-body:", ET.tostring(body, encoding="utf-8", method="xml"))
     _, path, _ = await eval_path(path)
     await unlock_path(user, path, lock_token)

lfss/svc/app_native.py

@@ -1,19 +1,22 @@
-from typing import Optional, Literal
+from typing import Optional, Literal, Annotated
+from collections import OrderedDict
 
-from fastapi import Depends, Request, Response, UploadFile
+from fastapi import Depends, Request, Response, UploadFile, Query
+from fastapi.responses import StreamingResponse, JSONResponse
 from fastapi.exceptions import HTTPException 
 
-from ..eng.config import MAX_BUNDLE_BYTES
 from ..eng.utils import ensure_uri_compnents
+from ..eng.config import MAX_MEM_FILE_BYTES
 from ..eng.connection_pool import unique_cursor
-from ..eng.database import check_file_read_permission, check_path_permission, UserConn, FileConn
+from ..eng.database import check_file_read_permission, check_path_permission, FileConn, delayed_log_access
 from ..eng.datatype import (
-    FileReadPermission, FileRecord, UserRecord, AccessLevel, 
+    FileReadPermission, UserRecord, AccessLevel, 
     FileSortKey, DirSortKey
 )
+from ..eng.error import InvalidPathError
 
 from .app_base import *
-from .common_impl import get_file_impl, put_file_impl, post_file_impl, delete_impl, copy_impl
+from .common_impl import get_impl, put_file_impl, post_file_impl, delete_impl, copy_impl
 
 @router_fs.get("/{path:path}")
 @handle_exception
@@ -23,7 +26,7 @@ async def get_file(
     download: bool = False, thumb: bool = False,
     user: UserRecord = Depends(get_current_user)
     ):
-    return await get_file_impl(
+    return await get_impl(
         request = request,
         user = user, path = path, download = download, thumb = thumb
         )
@@ -38,9 +41,7 @@ async def head_file(
     ):
     if path.startswith("_api/"):
         raise HTTPException(status_code=405, detail="HEAD not supported for API")
-    if path.endswith("/"):
-        raise HTTPException(status_code=405, detail="HEAD not supported for directory")
-    return await get_file_impl(
+    return await get_impl(
         request = request,
         user = user, path = path, download = download, thumb = thumb, is_head = True
         )
@@ -50,7 +51,7 @@ async def head_file(
 async def put_file(
     request: Request, 
     path: str, 
-    conflict: Literal["overwrite", "skip", "abort"] = "abort",
+    conflict: Literal["overwrite", "skip", "abort"] = "overwrite",
     permission: int = 0,
     user: UserRecord = Depends(registered_user)
     ):
@@ -64,7 +65,7 @@ async def put_file(
 async def post_file(
     path: str, 
     file: UploadFile,
-    conflict: Literal["overwrite", "skip", "abort"] = "abort",
+    conflict: Literal["overwrite", "skip", "abort"] = "overwrite",
     permission: int = 0,
     user: UserRecord = Depends(registered_user)
     ):
@@ -83,48 +84,40 @@ async def delete_file(path: str, user: UserRecord = Depends(registered_user)):
 async def bundle_files(path: str, user: UserRecord = Depends(registered_user)):
     logger.info(f"GET bundle({path}), user: {user.username}")
     path = ensure_uri_compnents(path)
-    assert path.endswith("/") or path == ""
-
-    if not path == "" and path[0] == "/":   # adapt to both /path and path
+    if not path.endswith("/"):
+        raise HTTPException(status_code=400, detail="Path must end with /")
+    if path[0] == "/":      # adapt to both /path and path
         path = path[1:]
+    if path == "":
+        raise HTTPException(status_code=400, detail="Cannot bundle root")
     
-    # TODO: may check peer users here
-    owner_records_cache: dict[int, UserRecord] = {}     # cache owner records, ID -> UserRecord
-    async def is_access_granted(file_record: FileRecord):
-        owner_id = file_record.owner_id
-        owner = owner_records_cache.get(owner_id, None)
-        if owner is None:
-            async with unique_cursor() as conn:
-                uconn = UserConn(conn)
-                owner = await uconn.get_user_by_id(owner_id, throw=True)
-            owner_records_cache[owner_id] = owner
-            
-        allow_access, _ = check_file_read_permission(user, owner, file_record)
-        return allow_access
-    
-    async with unique_cursor() as conn:
-        fconn = FileConn(conn)
-        files = await fconn.list_path_files(
-            url = path, flat = True, 
-            limit=(await fconn.count_path_files(url = path, flat = True))
-            )
-    files = [f for f in files if await is_access_granted(f)]
-    if len(files) == 0:
-        raise HTTPException(status_code=404, detail="No files found")
-
-    # return bundle of files
-    total_size = sum([f.file_size for f in files])
-    if total_size > MAX_BUNDLE_BYTES:
-        raise HTTPException(status_code=400, detail="Too large to zip")
-
-    file_paths = [f.url for f in files]
-    zip_buffer = await db.zip_path(path, file_paths)
-    return Response(
-        content=zip_buffer.getvalue(), media_type="application/zip", headers={
-            "Content-Disposition": f"attachment; filename=bundle.zip", 
-            "Content-Length": str(zip_buffer.getbuffer().nbytes)
-        }
-    )
+    async with unique_cursor() as cur:
+        dir_record = await FileConn(cur).get_dir_record(path)
+
+    pathname = f"{path.split('/')[-2]}"
+
+    if dir_record.size < MAX_MEM_FILE_BYTES:
+        logger.debug(f"Bundle {path} in memory")
+        dir_bytes = (await db.zip_dir(path, op_user=user)).getvalue()
+        return Response(
+            content = dir_bytes,
+            media_type = "application/zip",
+            headers = {
+                f"Content-Disposition": f"attachment; filename=bundle-{pathname}.zip",
+                "Content-Length": str(len(dir_bytes)),
+                "X-Content-Bytes": str(dir_record.size),
+            }
+        )
+    else:
+        logger.debug(f"Bundle {path} in stream")
+        return StreamingResponse(
+            content = await db.zip_dir_stream(path, op_user=user),
+            media_type = "application/zip",
+            headers = {
+                f"Content-Disposition": f"attachment; filename=bundle-{pathname}.zip",
+                "X-Content-Bytes": str(dir_record.size),
+            }
+        )
 
 @router_api.get("/meta")
 @handle_exception
@@ -137,15 +130,13 @@ async def get_file_meta(path: str, user: UserRecord = Depends(registered_user)):
         if is_file:
             record = await fconn.get_file_record(path, throw=True)
             if await check_path_permission(path, user, cursor=cur) < AccessLevel.READ:
-                uconn = UserConn(cur)
-                owner = await uconn.get_user_by_id(record.owner_id, throw=True)
-                is_allowed, reason = check_file_read_permission(user, owner, record)
+                is_allowed, reason = await check_file_read_permission(user, record, cursor=cur)
                 if not is_allowed:
                     raise HTTPException(status_code=403, detail=reason)
         else:
             if await check_path_permission(path, user, cursor=cur) < AccessLevel.READ:
                 raise HTTPException(status_code=403, detail="Permission denied")
-            record = await fconn.get_path_record(path)
+            record = await fconn.get_dir_record(path)
     return record
 
 @router_api.post("/meta")
@@ -182,7 +173,7 @@ async def update_file_meta(
             new_path = ensure_uri_compnents(new_path)
             logger.info(f"Update path of {path} to {new_path}")
             # will raise duplicate path error if same name path exists in the new path
-            await db.move_path(path, new_path, user)
+            await db.move_dir(path, new_path, user)
 
     return Response(status_code=200, content="OK")
 
@@ -200,13 +191,15 @@ async def validate_path_read_permission(path: str, user: UserRecord):
     if not await check_path_permission(path, user) >= AccessLevel.READ:
         raise HTTPException(status_code=403, detail="Permission denied")
 @router_api.get("/count-files")
+@handle_exception
 async def count_files(path: str, flat: bool = False, user: UserRecord = Depends(registered_user)):
     await validate_path_read_permission(path, user)
     path = ensure_uri_compnents(path)
     async with unique_cursor() as conn:
         fconn = FileConn(conn)
-        return { "count": await fconn.count_path_files(url = path, flat = flat) }
+        return { "count": await fconn.count_dir_files(url = path, flat = flat) }
 @router_api.get("/list-files")
+@handle_exception
 async def list_files(
     path: str, offset: int = 0, limit: int = 1000,
     order_by: FileSortKey = "", order_desc: bool = False,
@@ -216,13 +209,14 @@ async def list_files(
     path = ensure_uri_compnents(path)
     async with unique_cursor() as conn:
         fconn = FileConn(conn)
-        return await fconn.list_path_files(
+        return await fconn.list_dir_files(
             url = path, offset = offset, limit = limit,
             order_by=order_by, order_desc=order_desc, 
             flat=flat
         )
 
 @router_api.get("/count-dirs")
+@handle_exception
 async def count_dirs(path: str, user: UserRecord = Depends(registered_user)):
     await validate_path_read_permission(path, user)
     path = ensure_uri_compnents(path)
@@ -230,6 +224,7 @@ async def count_dirs(path: str, user: UserRecord = Depends(registered_user)):
         fconn = FileConn(conn)
         return { "count": await fconn.count_path_dirs(url = path) }
 @router_api.get("/list-dirs")
+@handle_exception
 async def list_dirs(
     path: str, offset: int = 0, limit: int = 1000,
     order_by: DirSortKey = "", order_desc: bool = False,
@@ -243,6 +238,47 @@ async def list_dirs(
             url = path, offset = offset, limit = limit,
             order_by=order_by, order_desc=order_desc, skim=skim
         )
+
+# https://fastapi.tiangolo.com/tutorial/query-params-str-validations/#query-parameter-list-multiple-values
+@router_api.get("/get-multiple")
+@handle_exception
+async def get_multiple_files(
+    path: Annotated[list[str], Query()], 
+    skip_content: bool = False,
+    user: UserRecord = Depends(registered_user)
+    ):
+    """
+    Get multiple files by path. 
+    Please note that the content is supposed to be text and are small enough to fit in memory.
+
+    Not existing files will have content null, and the response will be 206 Partial Content if not all files are found.
+    if skip_content is True, the content of the files will always be ''
+    """
+    for p in path:
+        if p.endswith("/"):
+            raise InvalidPathError(f"Path '{p}' must not end with /")
+
+    # here we unify the path, so need to keep a record of the inputs
+    # make output keys consistent with inputs
+    upath2path = OrderedDict[str, str]()
+    for p in path:
+        p_ = p if not p.startswith("/") else p[1:]
+        upath2path[ensure_uri_compnents(p_)] = p
+    upaths = list(upath2path.keys())
+
+    # get files
+    raw_res = await db.read_files_bulk(upaths, skip_content=skip_content, op_user=user)
+    for k in raw_res.keys():
+        await delayed_log_access(k)
+    partial_content = len(raw_res) != len(upaths)
+
+    return JSONResponse(
+        content = {
+            upath2path[k]: v.decode('utf-8') if v is not None else None for k, v in raw_res.items()
+        },
+        status_code = 206 if partial_content else 200
+    )
+    
     
 @router_api.get("/whoami")
 @handle_exception