v0.332.0: one sign-in for the file manager — a dashboard pass, a host-only files cookie, a per-box secret header (R-1100, operator D16)

controller/internal/web/datapath_card.go

@@ -99,7 +99,7 @@ func (s *Server) buildDataPathCards(st *stacks.Stack, lang string) []DataPathCar
 			// bind it) is TEXT, never a link — a link to a missing source opens an empty or broken view.
 			src, drive := s.fbSourceForApp(st.Name)
 			if src != "" && s.drivePresent(drive) {
-				link = fileBrowserLink(domain, src, dp.Path)
+				link = fileBrowserOpenLink(domain, src, dp.Path)
 			} else {
 				s.logger.Printf("[WARN] [web] app page %s: folder %q has no FileBrowser source on this box now (drive %q) — shown without a link", st.Name, dp.Path, drive)
 			}
@@ -185,7 +185,7 @@ func (s *Server) mediaFolderCards(st *stacks.Stack, domain, lang string, have []
 			}
 			card := DataPathCard{Label: s.msgLang(lang, "datapath.media.row", label, src), Role: stacks.RoleLibrary, IsMedia: true}
 			if present {
-				card.Link = fileBrowserLink(domain, src, path.Join("media", sub))
+				card.Link = fileBrowserOpenLink(domain, src, path.Join("media", sub))
 				if seen[card.Link] {
 					continue
 				}
@@ -255,7 +255,7 @@ func (s *Server) filesButtonLink(st *stacks.Stack, cards []DataPathCard) string
 	}
 	for _, sp := range s.mediaStoragePaths() {
 		if s.drivePresent(sp.Path) {
-			return fileBrowserLink(s.cfg.Customer.Domain, fbSourceName(sp), "media")
+			return fileBrowserOpenLink(s.cfg.Customer.Domain, fbSourceName(sp), "media")
 		}
 	}
 	return ""