WebDAV sync support, access tokens, REST control endpoints #10

2026-04-26T05:22:36Z

LeoVasanko commented

2026-04-26 05:22:36 +00:00

Implement complete WebDAV file serving compatible with various clients from Windows File Explorer to more specialized sync tools. The old control WebSocket has been updated to part-DAV, part REST API instead. Implemented user:pass BASIC auth. Added UI and backend for creating tokens that avoid the need to use actual username and password for requests from CLI or DAV.

LeoVasanko added 6 commits 2026-04-26 05:22:36 +00:00

Replace WebSocket control API with REST file operations 410a8a7568

- Add cista/fileserver.py: REST blueprint at /files with PUT upload,
  DELETE, MKCOL, POST cp/mv (combined), GET/HEAD static serving
- Remove WS control handler and all ControlBase/Cmd protocol types
- Frontend: SelectionToolbar, FileExplorer, Gallery now POST to /files
  instead of opening a control WebSocket per operation
- Remove controlUrl export from WS.ts
- Add tests: REST API, static streaming, path/escaping security
- Catch ValueError from filename.sanitize and return 400 Bad Request

WebDAV support! d1faedc011

Add token-based auth for WebDAV/NTLM and API access de78b41be4

- Add Token model with CRUD endpoints (/api/tokens, /auth/tokens)
- Support Basic auth with token:<secret> for built-in users
- Implement full NTLMv2 handshake for Windows WebDAV clients
- Add SSO token auth via check_permissions() proxy
- Hydrate request auth context from session or Authorization header
- Persist session cookie after successful Authorization-based login
- Add secure flag to session cookies based on request scheme
- Add frontend UserTokensModal for creating/revoking tokens
- Fix devserver to run workspace source via python -m cista
- Add tests for token CRUD and file auth (Basic, NTLM, session)
- Remove proactive WWW-Authenticate advertisement

Restore UA-aware auth header advertisement f7ffc3f8bc

Revert accidental removal of WWW-Authenticate headers.
Windows WebDAV clients receive Basic + Negotiate;
all other clients receive Basic only.

Document WebDAV access and compatible clients in README 747ae7a8d5

- Add WebDAV Access section with client setup instructions
- Explain Basic auth and API token authentication for WebDAV
- Document Windows NTLM limitation and token-based workaround
- Fix typo: authenticatioon → authentication

Use https in WebDAV examples and add Android clients 4fd166b934

- Replace all http:// example URLs with https:// in WebDAV section
- Add Solid Explorer and CX File Explorer Android setup instructions
- Use davs:// and webdavs:// for Linux HTTPS WebDAV URLs

LeoVasanko merged commit 123cb45daa into main

2026-04-26 05:22:52 +00:00

LeoVasanko deleted branch webdav

2026-04-26 05:22:52 +00:00

LeoVasanko referenced this issue from a commit

2026-04-26 05:22:54 +00:00

WebDAV sync support, access tokens, REST control endpoints (#10)

LeoVasanko referenced this issue from a commit

2026-09-10 20:14:18 +00:00

WebDAV sync support, access tokens, REST control endpoints (#10)

Sign in to join this conversation.