Query executes a query that returns rows. This is a convenience method that handles locking.

Close closes the database connection and removes the temporary file if it is not persistent.

Permitted checks if a username is permitted for a given sourcePath and indexPath, recursively checking parent directories.

Add records a pinned item name under sourcePath and indexDirPath.

Remove deletes a pinned item name and prunes empty map entries.

boolPtr returns a pointer to a bool value

Implement the Open method for dirFS, which wraps http.Dir

AllowUser adds a user to the allow list for a given source and index path.

Scan implements the Scanner interface.

LoadFromDB loads all rules from the DB if DB is set.

GetScopeForSourceName returns the scope for a given source name (frontend-style) Uses the global SourceNameResolver to convert source names to paths

input should be non-index path. isDir indicates whether the path is a directory (true) or file (false). Directories will have a trailing slash added,

SaveToDB persists all rules to the DB if DB is set. IMPORTANT: Caller must hold s.mux lock (either read or write).

GetRule retrieves a rule for a sourcePath and indexPath.

DenyUser adds a user to the deny list for a given source and index path.

Exec executes a SQL statement that doesn't return rows. This is a convenience method that handles locking.

isBusyError checks if an error is SQLITE_BUSY (error code 5)

isTransactionError checks if an error is related to nested transactions (error code 1)

QueryRow executes a query that is expected to return at most one row. This is a convenience method that handles locking.

ShouldSkip checks if a path should be skipped from indexing isRoutineScan: true for scanner (no parent checks), false for API (check parents)

clearAllCaches clears ALL caches. This should be called whenever rules are created, updated, or deleted.

GetMetadataInfo retrieves the FileInfo from the specified file or directory in the index.

String implements the Stringer interface.

withRateLimitChain applies a rate limit tier then fn for nesting inside withUser / withOrWithoutUser / withoutUser.

WriteHeader captures the status code and ensures it's only written once

setupConditionalTestIndex creates a test index with conditional rules configured

GetItem retrieves a single item by path for a specific source. Returns nil on database busy/lock errors (non-fatal).

raw directory info retrieval -- does not work on files, only returns a directory

boolValueOrDefault returns the value of a bool pointer, or the default if nil

returnOnlyOfficeError returns an error response to OnlyOffice server with proper status code

UpdateMetadata persists a completed directory listing to the index. The directory row's has_preview reflects direct previewable children only (see Get

AllowGroup adds a group to the allow list for a given source and index path.

DeleteMetadata removes the specified path from the index. SQLite handles locking automatically, so no mutex needed.

GetAllRules returns all access rules as a map.

DenyGroup adds a group to the deny list for a given source and index path.

RemoveUserCascade removes a user from either the allow or deny list for a given path and all its subpaths. This is used for cascade delete operations

askQuestion displays a prompt and reads a line of input from the user. It returns the defaultValue if the user's input is empty.

flushBatch writes all remaining batch items to the database (Scanner method) This is called at the end of a scan to flush any items that didn't reach

Helper functions getNextPathPrefix returns the lexicographically next string after the given prefix. This is used for efficient range queries on path

newLDAPEntry creates a minimal *ldap.Entry for testing (DN and optional objectClass).

AddUserToGroup adds a username to a group.