v0.332.0: one sign-in for the file manager — a dashboard pass, a host-only files cookie, a per-box secret header (R-1100, operator D16)

controller/internal/web/server.go

@@ -62,6 +62,7 @@ type Server struct {
 	fam                 familyState   // v0.287.0: the family gate (family_gate.go)
 	familyStoreOverride *family.Store // test seam: the family list without a data dir
 	gateClock           func() time.Time
+	filesSSO            filesSSOState      // R-1100: the file manager's header name, read once
 	tmpl                *template.Template // the Hungarian set (i18n.Default) — every pre-i18n caller renders this
 	tmplByLang          map[string]*template.Template
 	i18n                *i18n.Bundle
@@ -983,6 +984,10 @@ func (s *Server) CatchAllMiddleware(next http.Handler) http.Handler {
 			s.ServeFamilyGateAuth(w, r)
 			return
 		}
+		if r.URL.Path == filesAuthPath { // R-1100: the file manager's forwardAuth, any host (it checks X-Forwarded-Host)
+			s.ServeFilesAuth(w, r)
+			return
+		}
 		// R-983 (v0.324.0): no page of ours may be shown inside another page's frame. Every app on *.<domain> is
 		// SAME-SITE with the dashboard, so the Lax session cookie goes along into a frame an app page draws — a page
 		// on any app host could lay the signed-in dashboard under its own buttons. Nothing frames the dashboard
@@ -1003,6 +1008,9 @@ func (s *Server) CatchAllMiddleware(next http.Handler) http.Handler {
 			case familyLogoutPath:
 				s.ServeFamilyLogout(w, r)
 				return
+			case filesOpenPath: // R-1100: „Fájlok ↗" — the pass to the file manager (it checks the session itself)
+				s.ServeFilesOpen(w, r)
+				return
 			}
 		}
 		if r.URL.Path == signupClosedPath { // v0.281.0 (decision 47): an app's own sign-up address while closed