optional password

src/routes/download.ts

@@ -24,7 +24,7 @@ export async function handleDownload(
   }
   if (!secretMatches(meta.downloadKeyHash, rawKey)) return notFound();
 
-  if (!hasValidAuth(req, secret, rawKey)) {
+  if (meta.passwordHash && !hasValidAuth(req, secret, rawKey)) {
     const url = new URL(req.url);
     return renderPasswordForm(rawKey, meta.originalName, url.searchParams.has("e"));
   }

src/routes/upload.ts

@@ -74,23 +74,23 @@ export async function handleUpload(
     }
 
     if (!hasFile) return jsonError(400, "no file part in the upload");
-    if (!password.trim()) return jsonError(400, "a password is required");
 
     const originalName = sanitizeOriginalName(filename);
+    const passwordHash = password.trim() ? hashPassword(password) : undefined;
     await storage.writeMetadata({
       id,
       originalName,
       size,
       mimeType: mime,
       downloadKeyHash: hashSecret(key),
-      passwordHash: hashPassword(password),
+      passwordHash,
       createdAt: new Date().toISOString(),
       expiresAt: new Date(Date.now() + ttlMs).toISOString(),
     });
 
     const url = publicBaseUrl ? `${publicBaseUrl}/${key}` : `/${key}`;
     log("info", `upload ok id=${id} size=${size} name=${JSON.stringify(originalName)}`);
-    return json({ id, key, url, originalName, size, protected: true });
+    return json({ id, key, url, originalName, size, protected: !!passwordHash });
   } catch (err) {
     await storage.delete(id);
     await storage.deletePartial(id);