- Fix QuickStartWizard error matching (services wrap errors in new Error(),
losing err.response; now checks err.message as fallback)
- Add shellEscape() to all remaining unescaped CLI commands (removeUser,
enableUser, disableUser, deletePolicy, attachPolicy, createPolicy)
- Fix inconsistent cookie secure flag in logout endpoint
- Add HTML escaping in email report templates to prevent XSS
- Add IP validation on token refresh to enforce IP binding
- Harden email recipient validation against header injection
- Add CSV injection prevention in report export
- Add JWT_SECRET minimum length validation (32 chars) in production
- Update bcrypt 5.x→6.x, nodemailer 6.x→8.x, fix all backend npm vulns
- Redesign UI: new theme (IBM Plex Sans, MinIO-inspired palette), improved
login page, dashboard with skeleton loaders, refined sidebar navigation
- Add missing i18n keys for login and user menu (DE + EN)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Passwords containing special characters like &, $, |, etc. were being
interpreted by the shell instead of being passed as literal values.
Added shellEscape() helper to properly quote values.
- Fix null-check in Users.tsx for user.accessKey filtering
- Fix null-check in Policies.tsx for policy.name filtering
- Add auto-initialization of default MinIO alias from env vars on startup
- Add validation to reject "undefined"/"null" as bucket names in browser API
- Server now creates DEFAULT_MINIO_ALIAS automatically if MINIO_ENDPOINT,
MINIO_ACCESS_KEY, and MINIO_SECRET_KEY are provided
- Add detailed logging for password verification to diagnose auth issues
- Validate bcrypt hash format before attempting comparison
- Use /tmp/minio-webui-temp as default temp directory (Docker-prepared)
- Add comment about escaping $ in bcrypt hashes for docker-compose
- Create single Dockerfile that builds frontend and backend together
- Add nginx.conf for combined container (proxies to localhost)
- Update docker-compose.prod.yml for Swarm compatibility:
- Use pre-built image instead of build directive
- Replace restart with deploy.restart_policy
- Single 'app' service instead of separate backend/frontend
- Adds docker-compose.prod.yml with Traefik labels
- Includes Redis for session management
- Configurable via environment variables for Portainer
- Homepage integration labels included
- Add CLI terminal for executing mc commands from the web interface
- Command history with up/down arrow navigation
- Dark theme with monospace font
- Auto-scroll output and loading states
- Add alias management page
- List all MinIO aliases with connection status
- Add, edit, delete aliases
- Test connection functionality
- Add file browser for navigating bucket contents
- Breadcrumb navigation (alias > bucket > path)
- File/folder table with size, type, last modified
- Upload files (drag-and-drop support)
- Download, rename, delete operations
- Create new folders
- Multi-select for batch delete
Backend:
- New API routes: /api/terminal, /api/aliases, /api/browser
- Multer middleware for file uploads
- Extended minio.service.js with file operations
Frontend:
- New Explorer component with Aliases/Terminal tabs
- Zustand stores for terminal and explorer state
- i18n translations (English and German)
- Updated Dockerfile to create local temp directory with proper permissions
- Added volume mount for backend/temp in docker-compose.yml
- Improved temp directory fallback logic with multiple alternatives
- Added unique timestamps to test files to avoid conflicts
- Better logging to identify which temp directory is being used
- Try process.cwd()/temp before falling back to OS temp directory
This should resolve the persistent EACCES permission errors in Docker
containers by ensuring the backend uses a writable temp directory.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Changed default temp directory to local backend/temp instead of system temp
- Added write permission test during temp directory initialization
- Implemented fallback to OS temp directory if local temp fails
- Added unique random suffix to policy filenames to avoid conflicts
- Set proper file permissions (0o644) when writing policy files
- Improved error handling for temp directory creation failures
- Fixed fs.constants reference for file access checks
This resolves the EACCES permission denied error when creating policies
in Docker/production environments.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Fixed error response format to send error message as string instead of boolean
- Enhanced error handling in QuickStartWizard to use handleApiError helper
- Improved policy creation with temp directory verification
- Added specific error detection for policy operations
- Fixed error display showing "true" instead of actual error message
- Ensured temp directory exists before writing policy files
- Added file access verification before executing MinIO commands
- Better cleanup of temporary files on failure
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Move temp directory outside app folder to /tmp/minio-webui-temp
- Add nodemon.json to ignore temp, logs, and node_modules
- Add TEMP_DIR environment variable configuration
- Add cleanup routine for old temporary policy files (>1 hour)
- Update both dev and production Dockerfiles
- Update docker-compose configurations
This fixes the 500 error during QuickStartWizard policy creation
caused by nodemon restarting when temporary files were created.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
Backend fixes:
- Fix bcrypt exec format error for ARM64 architecture
- Add architecture detection for MinIO client download
- Install build tools and rebuild bcrypt from source
- Add postinstall script to automatically rebuild bcrypt
- Rebuild bcrypt after copying files to ensure correct binary
Frontend fixes:
- Handle duplicate resource creation in QuickStartWizard
- Add error handling for "already exists" scenarios
- Prevent multiple executions with isCreating flag
- Allow wizard to complete even if resources already exist
These changes fix:
1. Backend crash on ARM64 due to bcrypt binary mismatch
2. 500 errors when resources already exist in QuickStartWizard
3. Race conditions when clicking Complete button multiple times
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Make email authentication optional in transporter config
- Only add auth object if both username and password are provided
- Update initialization to only require SMTP_HOST
- Add logging to show whether auth is enabled
- Update documentation with no-auth configuration examples
- Fix "Unrecognized authentication type" error for open relays
Exchange servers configured as internal relays often don't
require authentication. This fix allows using them by leaving
SMTP_USER and SMTP_PASS empty in the .env file.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add simple hash-password script for quick hash generation
- Add interactive generate-password script with hidden input
- Include password validation and requirements display
- Add npm scripts for easy execution
- Create comprehensive PASSWORD_GENERATION.md guide
- Use existing bcrypt infrastructure with 12 salt rounds
Usage:
npm run hash-password YourPassword123\!
npm run generate-password (interactive)
This solves the issue where bcrypt command line tools
don't work properly for generating compatible hashes.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add TLS configuration to accept self-signed certificates
- Disable TLS/STARTTLS for port 25 when SMTP_SECURE=false
- Add ignoreTLS option for Exchange servers on port 25
- Update .env.example with Exchange-specific configuration
- Create comprehensive EMAIL_CONFIGURATION.md guide
- Support both Exchange internal servers and modern SMTP servers
This fixes the "self-signed certificate" error when connecting
to Microsoft Exchange servers on port 25 without TLS.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Update i18n package versions to stable, compatible versions
- Add install-i18n.sh script for easy setup in any environment
- Create comprehensive I18N_SETUP.md troubleshooting guide
- Use legacy-peer-deps flag to avoid npm conflicts
- Provide clear instructions for Docker and local environments
This ensures the German translation feature works correctly
across different development and deployment environments.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Set up i18n infrastructure with react-i18next
- Add German as default language with English fallback
- Create comprehensive translation files for all UI components
- Translate Dashboard, QuickStartWizard, Reports, and navigation
- Add language switcher in app header
- Maintain existing German email template in backend
- Create modular translation structure with namespaces
- Add testing checklist and implementation summary
All user-facing strings in dashboard, quick wizard, and reports
sections are now available in German, fulfilling the requirement
for complete German localization.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Change generatePolicyFromTemplate to return object instead of string
- Update CreatePolicyRequest interface to accept string | object for policy
- Update CreatePolicyDialog to stringify policy object only when needed
- Fix QuickStartWizard to send policy object directly to API
This fixes the 'Proxy error' when creating policies as the backend was
receiving double-stringified JSON which failed validation.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Update createPolicy to send 'policyName' and 'policyDocument' fields
- Update attachPolicy to use correct endpoint format /policies/{name}/attach
- Send 'username' field in attachPolicy request body
This fixes the 'Validation Error' when creating policies in QuickStartWizard
and ensures policies are created and attached correctly to users.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Fix 'Invalid template' error by correctly mapping policy types to template keys
- 'readwrite' -> 'bucketFullAccess'
- 'readonly' -> 'bucketReadOnly'
- 'writeonly' -> 'bucketWriteOnly'
- Update user creation form labels to 'Username (Access Key)' and 'Password (Secret Key)'
- Update review section to show consistent MinIO credential terminology
- Add helpful text explaining these are MinIO credentials
This ensures the QuickStartWizard creates policies correctly and maintains
consistent credential terminology across all UI components.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Update CreateUserDialog labels to show 'Username (Access Key)' and 'Password (Secret Key)'
- Add helper text explaining these are MinIO credentials
- Enhanced success display to show credentials with proper MinIO terminology
- Add MinIO CLI connection examples in credential displays
- Fix confusion about where to get access key and secret key
This addresses user feedback about unclear credential terminology and aligns
with MinIO documentation where username = Access Key and password = Secret Key.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Fix validateDOMNesting warning by using secondaryTypographyProps with component='div'
- Fix 400 Bad Request by sending 'bucketName' instead of 'name' in bucket creation API
- This allows the Quick Start wizard to complete successfully
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Fix validateDOMNesting warnings in Reports and QuickStartWizard components
- Fix user creation API field mapping (accessKey/secretKey to username/password)
- Increase timeout for bucket-with-user creation to prevent socket hang up errors
- Improve credential display with clear Access Key/Secret Key labels
- Add MinIO CLI connection examples to credential displays
- Make timeout 60 seconds for complex operations that create bucket, user, and policy
This fixes:
- React DOM nesting warnings with Chip components
- 400 Bad Request errors when creating users
- Socket hang up errors during bucket+user creation
- Clear display of MinIO access credentials
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Fix API URL configuration to use relative paths (fixes localhost:8080 error)
- Add Quick Start Wizard to dashboard for guided bucket/user setup
- Create bash scripts for automated bucket and user creation
- Add quickstart.sh for interactive setup experience
- Update documentation with correct ports and new features
- Improve user onboarding with step-by-step wizard
This addresses:
- Connection refused errors when creating users/policies
- WebSocket connection issues
- Need for easy one-step setup process
- Port configuration clarity in documentation
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add comprehensive user management with CRUD operations
- Implement policy management with templates and custom JSON
- Create reusable components (ConfirmDialog, LoadingState, EmptyState)
- Add user creation with password validation and credential copying
- Implement policy creation with built-in templates
- Add policy attachment to users functionality
- Include search, filtering, and status management
- Add proper error handling and validation
- Implement Material-UI based responsive design
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Replace read-only host mount with dedicated Docker volume for mc config
- Add init-mc-config.sh to initialize mc configuration with proper permissions
- Create setup-mc-alias.sh script to configure MinIO connection
- Add comprehensive MINIO_SETUP.md documentation
- Update docker-compose.dev.yml to use mc-config volume
- Update Dockerfile to run mc config initialization
- Document bcrypt architecture workaround in FIX_ENV_TRUNCATION.md
The mc client can now write to its configuration directory, resolving
the "permission denied" error when connecting to MinIO servers.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Document the solution for Docker environment variable truncation issue
- Add verification script to test the fix
- Include proper .env configuration with quoted values
- Add Docker network (172.20.0.0/16) to allowed IPs
The fix ensures bcrypt hashes and other values with special characters
are properly passed to Docker containers without truncation.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add debug-auth.sh to diagnose authentication issues
- Checks .env file content
- Verifies environment variables in container
- Tests bcrypt password verification
- Shows config loading status
- Displays recent auth logs
- Add test-auth-api.sh to test API endpoints directly
- Tests login endpoint with curl
- Shows raw API responses
- Tests auth status endpoint
These scripts help troubleshoot authentication problems by showing
exactly what's happening at each step of the auth process.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add setAdminPassword.js utility for setting password inside container
- Add set-admin-password.sh for easy Docker exec password setting
- Add reset-to-default-password.sh for quick testing (sets to admin123)
- Add debug logging to password verification for troubleshooting
- Improve error handling when password hash is missing
These tools make it much easier to manage the admin password without
dealing with bcrypt hash generation and .env file formatting issues.
Usage:
- Set custom password: ./scripts/set-admin-password.sh
- Reset to default: ./scripts/reset-to-default-password.sh
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add generate-password.js for Node.js password hash generation
- Add generate-password-docker.sh for Docker-based generation
- Add test-password.sh to verify password against current hash
These scripts help users generate correct bcrypt hashes for the
ADMIN_PASSWORD_HASH environment variable.
Usage:
- Generate new hash: ./scripts/generate-password-docker.sh
- Test current password: ./scripts/test-password.sh
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Update setupProxy.js to forward X-Real-IP and X-Forwarded-For headers
- Improve IP detection in backend middleware to prioritize X-Real-IP
- Add debug logging for IP detection in development mode
- Update .env.example with clearer IP configuration examples
- Enable debug logging in docker-compose.dev.yml
This fixes the issue where Docker network IPs (172.20.x.x) were being
detected instead of the real client IP addresses.
To fix IP restrictions, update your .env file:
ALLOWED_IPS=10.30.30.0/24,<your-other-ips>
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add setupProxy.js to proxy API calls to backend container
- Install http-proxy-middleware for development proxy support
- Update docker-compose.dev.yml to use backend service name
- Add HOST=0.0.0.0 to allow external connections to dev server
- Add empty favicon.ico to prevent 500 errors
- Update proxy configuration to use port 7510
This fixes the ERR_CONNECTION_REFUSED errors when the frontend
tries to connect to the backend API in Docker environment.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Remove custom nodejs user creation that was causing GID 1000 conflicts
- Use the built-in 'node' user from node:alpine image
- Update volume mount path from /home/nodejs to /home/node
- Simplify Dockerfile by removing unnecessary user creation
This fixes the "addgroup: gid '1000' in use" error during Docker build.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Explicitly set NODE_ENV=development during npm install to include devDependencies
- Add NODE_ENV=development environment variable in Dockerfile
- Add fallback dev:node script using Node.js --watch flag
- Ensure nodemon is installed with other development dependencies
This fixes the "sh: nodemon: not found" error in the development container.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Create dedicated Dockerfile.backend.dev for development with proper permissions
- Set user UID/GID to 1000 (common for development systems)
- Create logs and temp directories in Dockerfile before switching user
- Use named volumes for logs, temp, and node_modules to maintain permissions
- Mount only source files instead of entire backend directory
- Remove complex entrypoint script in favor of simple CMD
- Add LOG_DIR and TEMP_DIR environment variables
This fixes the "Permission denied" errors when creating directories in Docker.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
paul
Paul Nothaft