From ad469460a4f6dd21f12a023e152084452e452496 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ana=C3=AFs=20Saraiva?=
 <53227802+Kisakay@users.noreply.github.com>
Date: Sat, 15 Aug 2026 00:46:02 +0200
Subject: [PATCH] changing path

---
 scripts/smoke-test.sh |  4 ++--
 src/routes/auth.ts    |  6 +++---
 src/routes/upload.ts  |  2 +-
 src/server.ts         | 14 ++++++++++++++
 4 files changed, 20 insertions(+), 6 deletions(-)

diff --git a/scripts/smoke-test.sh b/scripts/smoke-test.sh
index 26265ce..1de96f6 100755
--- a/scripts/smoke-test.sh
+++ b/scripts/smoke-test.sh
@@ -42,7 +42,7 @@ auth() { # auth <key> -> POST password, stores cookie
 }
 
 fetch_auth() { # fetch_auth <key> <outfile>
-  curl -sS -b "$COOKIES" -o "$2" "$BASE/d/$1"
+  curl -sS -b "$COOKIES" -o "$2" "$BASE/$1"
 }
 
 printf 'hello world\n' > "$TMP/plain.txt"
@@ -62,7 +62,7 @@ URL="$(get "$TMP/up.json" url)"
 check "protected file serves a password form" test \
   "$(curl -sS -o /dev/null -w '%{content_type}' "$BASE$URL")" = "text/html; charset=utf-8"
 check "invalid key returns 404" test \
-  "$(curl -sS -o /dev/null -w '%{http_code}' "$BASE/d/AAAAAAAAAAAA")" = "404"
+  "$(curl -sS -o /dev/null -w '%{http_code}' "$BASE/AAAAAAAAAAAA")" = "404"
 check "storage directory not served" test \
   "$(curl -sS -o /dev/null -w '%{http_code}' "$BASE/storage/")" = "404"
 
diff --git a/src/routes/auth.ts b/src/routes/auth.ts
index df4fb44..c241576 100644
--- a/src/routes/auth.ts
+++ b/src/routes/auth.ts
@@ -19,7 +19,7 @@ export async function handleAuth(
   if (!meta) return notFound();
 
   if (!meta.passwordHash) {
-    return new Response(null, { status: 302, headers: { location: `/d/${rawKey}` } });
+    return new Response(null, { status: 302, headers: { location: `/${rawKey}` } });
   }
 
   const password = await req.formData().then(
@@ -32,7 +32,7 @@ export async function handleAuth(
 
   if (!passwordMatches(meta.passwordHash, password)) {
     log("warn", `auth failed id=${id}`);
-    return new Response(null, { status: 302, headers: { location: `/d/${rawKey}?e=1` } });
+    return new Response(null, { status: 302, headers: { location: `/${rawKey}?e=1` } });
   }
 
   const token = makeAuthToken(rawKey, secret, AUTH_TTL_MS);
@@ -41,5 +41,5 @@ export async function handleAuth(
   }; Max-Age=${Math.floor(AUTH_TTL_MS / 1000)}`;
 
   log("info", `auth ok id=${id}`);
-  return new Response(null, { status: 302, headers: { location: `/d/${rawKey}`, "set-cookie": cookie } });
+  return new Response(null, { status: 302, headers: { location: `/${rawKey}`, "set-cookie": cookie } });
 }
\ No newline at end of file
diff --git a/src/routes/upload.ts b/src/routes/upload.ts
index 06ce7ce..c156bad 100644
--- a/src/routes/upload.ts
+++ b/src/routes/upload.ts
@@ -76,7 +76,7 @@ export async function handleUpload(
     });
 
     log("info", `upload ok id=${id} size=${size} name=${JSON.stringify(originalName)}`);
-    return json({ id, key, url: `/d/${key}`, originalName, size, protected: true });
+    return json({ id, key, url: `/${key}`, originalName, size, protected: true });
   } catch (err) {
     await storage.delete(id);
     await storage.deletePartial(id);
diff --git a/src/server.ts b/src/server.ts
index bc65a1b..0a1e88c 100644
--- a/src/server.ts
+++ b/src/server.ts
@@ -7,6 +7,7 @@ import { handleAuth } from "./routes/auth";
 import { handleDelete } from "./routes/delete";
 import { handleDownload } from "./routes/download";
 import { handleUpload } from "./routes/upload";
+import { KEY_PATTERN } from "./security";
 import { Storage } from "./storage";
 
 const cfg = loadConfig();
@@ -113,6 +114,19 @@ async function route(req: Request, srv: Server<undefined>): Promise<Response> {
     return handleDownload(req, storage, path.slice(3), secret);
   }
 
+  const rootKey = path.slice(1);
+  if (
+    rootKey &&
+    !rootKey.includes("/") &&
+    KEY_PATTERN.test(rootKey) &&
+    (method === "GET" || method === "HEAD")
+  ) {
+    if (cfg.rateLimitEnabled && !limiter.check(clientIp(req, srv))) {
+      return jsonError(429, "too many requests");
+    }
+    return handleDownload(req, storage, rootKey, secret);
+  }
+
   if (path.startsWith("/api/files/") && method === "DELETE") {
     if (cfg.rateLimitEnabled && !limiter.check(clientIp(req, srv))) {
       return jsonError(429, "too many requests");