John O'Keefe
b77eab7ffd
Beam backfilled 11 library docs (CRUD, folders, visibility, browse, stats,
media-items) and re-attached frontmatter to create_collection.md — which had
silently lost its pilot version in cc893f75: the negative-test
'git checkout --' restored the OLD file because the pilot was never staged,
and a frontmatter-less doc is invisible to the gate. Claude restored the full
corrected pilot content (priority higher-wins, time.String() note, 409).
Claude registry: 11 entries + one inverted catch — DELETE /:id/folders DOES
bind {folder_path} (handler reuses AddLibraryFolderRequest); registry first
draft said bodyless. GET /:id/visibility returns joined
GetUserVisibleLibrariesRow (type_name etc.), not bare Libraries.
Gate-driven merges fixed create/get library response shapes (sqlc row keys:
created_by_admin_id, library_type_id, updated_at; dropped invented type/
folders/is_visible). Fixed invented request fields (user_id in
set-visibility; library_type_id in update). make test 9/9.
61 lines
1.7 KiB
Markdown
61 lines
1.7 KiB
Markdown
---
|
|
method: GET
|
|
path: /api/libraries/browse
|
|
auth: jwt+admin
|
|
area: libraries
|
|
---
|
|
<!-- source: internal/handlers/library.go:254 LibraryHandler.BrowseDirectories -->
|
|
|
|
# Browse Library Folders
|
|
|
|
Browse server directories for folder selection in library management.
|
|
|
|
**Endpoint**: `GET /api/libraries/browse`
|
|
**Auth**: Required (Admin only)
|
|
|
|
## Query Parameters
|
|
|
|
| Parameter | Type | Required | Description |
|
|
| --------- | ------ | -------- | --------------------------------------- |
|
|
| path | string | No | Directory path to browse (default: "/") |
|
|
|
|
## Request Headers
|
|
|
|
| Header | Type | Required | Description |
|
|
| ------------- | ------ | -------- | ------------------------- |
|
|
| Authorization | string | Yes | Bearer token (admin only) |
|
|
|
|
### Example Request
|
|
|
|
```http
|
|
GET /api/libraries/browse?path=/home/user
|
|
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
|
|
```
|
|
|
|
## Response (200 OK)
|
|
|
|
```json example-response
|
|
{
|
|
"current_path": "/home/user",
|
|
"parent_path": "/home",
|
|
"directories": ["Documents", "Downloads", "Books", "Music"]
|
|
}
|
|
```
|
|
|
|
## Error Responses
|
|
|
|
| Code | Description |
|
|
| ---- | -------------------------------------- |
|
|
| 400 | Path traversal attempt or invalid path |
|
|
| 401 | Invalid or expired token |
|
|
| 403 | User is not an admin |
|
|
| 400 | Path does not exist |
|
|
| 400 | Path is not a directory |
|
|
|
|
## Security
|
|
|
|
- **Path traversal protection**: Blocks requests containing ".."
|
|
- **Admin only**: Regular users receive 403 Forbidden
|
|
- **Directories only**: Returns only directory names, not file listings
|
|
- **Server filesystem**: Browses server's filesystem, not client's
|