John O'Keefe
b77eab7ffd
Beam backfilled 11 library docs (CRUD, folders, visibility, browse, stats,
media-items) and re-attached frontmatter to create_collection.md — which had
silently lost its pilot version in cc893f75: the negative-test
'git checkout --' restored the OLD file because the pilot was never staged,
and a frontmatter-less doc is invisible to the gate. Claude restored the full
corrected pilot content (priority higher-wins, time.String() note, 409).
Claude registry: 11 entries + one inverted catch — DELETE /:id/folders DOES
bind {folder_path} (handler reuses AddLibraryFolderRequest); registry first
draft said bodyless. GET /:id/visibility returns joined
GetUserVisibleLibrariesRow (type_name etc.), not bare Libraries.
Gate-driven merges fixed create/get library response shapes (sqlc row keys:
created_by_admin_id, library_type_id, updated_at; dropped invented type/
folders/is_visible). Fixed invented request fields (user_id in
set-visibility; library_type_id in update). make test 9/9.
1.7 KiB
1.7 KiB
method, path, auth, area
| method | path | auth | area |
|---|---|---|---|
| GET | /api/libraries/browse | jwt+admin | libraries |
Browse Library Folders
Browse server directories for folder selection in library management.
Endpoint: GET /api/libraries/browse
Auth: Required (Admin only)
Query Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
| path | string | No | Directory path to browse (default: "/") |
Request Headers
| Header | Type | Required | Description |
|---|---|---|---|
| Authorization | string | Yes | Bearer token (admin only) |
Example Request
GET /api/libraries/browse?path=/home/user
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
Response (200 OK)
{
"current_path": "/home/user",
"parent_path": "/home",
"directories": ["Documents", "Downloads", "Books", "Music"]
}
Error Responses
| Code | Description |
|---|---|
| 400 | Path traversal attempt or invalid path |
| 401 | Invalid or expired token |
| 403 | User is not an admin |
| 400 | Path does not exist |
| 400 | Path is not a directory |
Security
- Path traversal protection: Blocks requests containing ".."
- Admin only: Regular users receive 403 Forbidden
- Directories only: Returns only directory names, not file listings
- Server filesystem: Browses server's filesystem, not client's