fix(115): 20GB file upload restriction (#7452)

* fix(115): multipart upload error

* feat(115): Modify default page size

* fix(115): Replace temporary repair scheme

.github/workflows/beta_release.yml

@@ -8,6 +8,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: write
+
 jobs:
   changelog:
     strategy:
@@ -54,7 +57,7 @@ jobs:
     strategy:
       matrix:
         include:
-          - target: '!(*musl*|*windows-arm64*|*android*)' # xgo
+          - target: '!(*musl*|*windows-arm64*|*android*|*freebsd*)' # xgo
             hash: "md5"
           - target: 'linux-!(arm*)-musl*' #musl-not-arm
             hash: "md5-linux-musl"
@@ -64,6 +67,9 @@ jobs:
             hash: "md5-windows-arm64"
           - target: 'android-*' #android
             hash: "md5-android"
+          - target: 'freebsd-*' #freebsd
+            hash: "md5-freebsd"
+
     name: Beta Release
     runs-on: ubuntu-latest
     steps:

.github/workflows/build_docker.yml

@@ -53,7 +53,7 @@ jobs:
         uses: actions/cache@v4
         with:
           path: build/musl-libs
-          key: docker-musl-libs
+          key: docker-musl-libs-v2
 
       - name: Download Musl Library
         if: steps.cache-musl.outputs.cache-hit != 'true'
@@ -84,7 +84,7 @@ jobs:
           push: ${{ github.event_name == 'push' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
-          platforms: linux/amd64,linux/arm64,linux/arm/v7,linux/386,linux/arm/v6,linux/s390x
+          platforms: linux/amd64,linux/arm64,linux/arm/v7,linux/386,linux/arm/v6,linux/s390x,linux/ppc64le,linux/riscv64
 
       - name: Build and push with ffmpeg
         id: docker_build_ffmpeg
@@ -96,7 +96,7 @@ jobs:
           tags: ${{ steps.meta-ffmpeg.outputs.tags }}
           labels: ${{ steps.meta-ffmpeg.outputs.labels }}
           build-args: INSTALL_FFMPEG=true
-          platforms: linux/amd64,linux/arm64,linux/arm/v7,linux/386,linux/arm/v6,linux/s390x
+          platforms: linux/amd64,linux/arm64,linux/arm/v7,linux/386,linux/arm/v6,linux/s390x,linux/ppc64le,linux/riscv64
 
   build_docker_with_aria2:
     needs: build_docker

.github/workflows/release_docker.yml

@@ -22,7 +22,7 @@ jobs:
         uses: actions/cache@v4
         with:
           path: build/musl-libs
-          key: docker-musl-libs
+          key: docker-musl-libs-v2
 
       - name: Download Musl Library
         if: steps.cache-musl.outputs.cache-hit != 'true'
@@ -58,7 +58,7 @@ jobs:
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
-          platforms: linux/amd64,linux/arm64,linux/arm/v7,linux/386,linux/arm/v6,linux/s390x
+          platforms: linux/amd64,linux/arm64,linux/arm/v7,linux/386,linux/arm/v6,linux/s390x,linux/ppc64le,linux/riscv64
 
       - name: Docker meta with ffmpeg
         id: meta-ffmpeg
@@ -79,7 +79,7 @@ jobs:
           tags: ${{ steps.meta-ffmpeg.outputs.tags }}
           labels: ${{ steps.meta-ffmpeg.outputs.labels }}
           build-args: INSTALL_FFMPEG=true
-          platforms: linux/amd64,linux/arm64,linux/arm/v7,linux/386,linux/arm/v6,linux/s390x
+          platforms: linux/amd64,linux/arm64,linux/arm/v7,linux/386,linux/arm/v6,linux/s390x,linux/ppc64le,linux/riscv64
 
   release_docker_with_aria2:
     needs: release_docker

.github/workflows/release_freebsd.yml

@@ -0,0 +1,35 @@
+name: release_freebsd
+
+on:
+  release:
+    types: [ published ]
+
+jobs:
+  release_freebsd:
+    strategy:
+      matrix:
+        platform: [ ubuntu-latest ]
+        go-version: [ '1.21' ]
+    name: Release
+    runs-on: ${{ matrix.platform }}
+    steps:
+
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: ${{ matrix.go-version }}
+
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Build
+        run: |
+          bash build.sh release freebsd
+
+      - name: Upload assets
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: dev
+          files: build/compress/*

build.sh

@@ -93,7 +93,7 @@ BuildDocker() {
 PrepareBuildDockerMusl() {
   mkdir -p build/musl-libs
   BASE="https://musl.cc/"
-  FILES=(x86_64-linux-musl-cross aarch64-linux-musl-cross i486-linux-musl-cross s390x-linux-musl-cross armv6-linux-musleabihf-cross armv7l-linux-musleabihf-cross)
+  FILES=(x86_64-linux-musl-cross aarch64-linux-musl-cross i486-linux-musl-cross s390x-linux-musl-cross armv6-linux-musleabihf-cross armv7l-linux-musleabihf-cross riscv64-linux-musl-cross powerpc64le-linux-musl-cross)
   for i in "${FILES[@]}"; do
     url="${BASE}${i}.tgz"
     lib_tgz="build/${i}.tgz"
@@ -112,8 +112,8 @@ BuildDockerMultiplatform() {
   docker_lflags="--extldflags '-static -fpic' $ldflags"
   export CGO_ENABLED=1
 
-  OS_ARCHES=(linux-amd64 linux-arm64 linux-386 linux-s390x)
-  CGO_ARGS=(x86_64-linux-musl-gcc aarch64-linux-musl-gcc i486-linux-musl-gcc s390x-linux-musl-gcc)
+  OS_ARCHES=(linux-amd64 linux-arm64 linux-386 linux-s390x linux-riscv64 linux-ppc64le)
+  CGO_ARGS=(x86_64-linux-musl-gcc aarch64-linux-musl-gcc i486-linux-musl-gcc s390x-linux-musl-gcc riscv64-linux-musl-gcc powerpc64le-linux-musl-gcc)
   for i in "${!OS_ARCHES[@]}"; do
     os_arch=${OS_ARCHES[$i]}
     cgo_cc=${CGO_ARGS[$i]}
@@ -233,6 +233,29 @@ BuildReleaseAndroid() {
   done
 }
 
+BuildReleaseFreeBSD() {
+  rm -rf .git/
+  mkdir -p "build/freebsd"
+  OS_ARCHES=(amd64 arm64 i386)
+  GO_ARCHES=(amd64 arm64 386)
+  CGO_ARGS=(x86_64-unknown-freebsd14.1 aarch64-unknown-freebsd14.1 i386-unknown-freebsd14.1)
+  for i in "${!OS_ARCHES[@]}"; do
+    os_arch=${OS_ARCHES[$i]}
+    cgo_cc="clang --target=${CGO_ARGS[$i]} --sysroot=/opt/freebsd/${os_arch}"
+    echo building for freebsd-${os_arch}
+    sudo mkdir -p "/opt/freebsd/${os_arch}"
+    wget -q https://download.freebsd.org/releases/${os_arch}/14.1-RELEASE/base.txz
+    sudo tar -xf ./base.txz -C /opt/freebsd/${os_arch}
+    rm base.txz
+    export GOOS=freebsd
+    export GOARCH=${GO_ARCHES[$i]}
+    export CC=${cgo_cc}
+    export CGO_ENABLED=1
+    export CGO_LDFLAGS="-fuse-ld=lld"
+    go build -o ./build/$appName-freebsd-$os_arch -ldflags="$ldflags" -tags=jsoniter .
+  done
+}
+
 MakeRelease() {
   cd build
   mkdir compress
@@ -251,6 +274,11 @@ MakeRelease() {
     tar -czvf compress/"$i".tar.gz alist
     rm -f alist
   done
+  for i in $(find . -type f -name "$appName-freebsd-*"); do
+    cp "$i" alist
+    tar -czvf compress/"$i".tar.gz alist
+    rm -f alist
+  done
   for i in $(find . -type f -name "$appName-windows-*"); do
     cp "$i" alist.exe
     zip compress/$(echo $i | sed 's/\.[^.]*$//').zip alist.exe
@@ -288,6 +316,9 @@ elif [ "$1" = "release" ]; then
   elif [ "$2" = "android" ]; then
     BuildReleaseAndroid
     MakeRelease "md5-android.txt"
+  elif [ "$2" = "freebsd" ]; then
+    BuildReleaseFreeBSD
+    MakeRelease "md5-freebsd.txt"
   elif [ "$2" = "web" ]; then
     echo "web only"
   else

drivers/115/driver.go

@@ -2,6 +2,7 @@ package _115
 
 import (
 	"context"
+	"fmt"
 	"strings"
 	"sync"
 
@@ -121,7 +122,10 @@ func (d *Pan115) Put(ctx context.Context, dstDir model.Obj, stream model.FileStr
 	if err := d.WaitLimit(ctx); err != nil {
 		return err
 	}
-
+	if stream.GetSize() > utils.GB*20 { // TODO 由于官方分片上传接口失效，所以使用普通上传小于20GB的文件
+		return fmt.Errorf("unsupported file size: 20GB limit exceeded")
+	}
+	// 分片上传
 	var (
 		fastInfo *driver115.UploadInitResp
 		dirID    = dstDir.GetID()
@@ -177,11 +181,13 @@ func (d *Pan115) Put(ctx context.Context, dstDir model.Obj, stream model.FileStr
 	}
 
 	// 闪传失败，上传
-	if stream.GetSize() <= utils.KB { // 文件大小小于1KB，改用普通模式上传
+	// if stream.GetSize() <= utils.KB{ // 文件大小小于1KB，改用普通模式上传
+	if stream.GetSize() <= utils.GB*20 { // TODO 由于官方分片上传接口失效，所以使用普通上传小于20GB的文件
 		return d.client.UploadByOSS(&fastInfo.UploadOSSParams, stream, dirID)
 	}
+	return driver115.ErrUnexpected
 	// 分片上传
-	return d.UploadByMultipart(&fastInfo.UploadOSSParams, stream.GetSize(), stream, dirID)
+	// return d.UploadByMultipart(&fastInfo.UploadOSSParams, stream.GetSize(), stream, dirID)
 }
 
 func (d *Pan115) OfflineList(ctx context.Context) ([]*driver115.OfflineTask, error) {

drivers/115/meta.go

@@ -9,7 +9,7 @@ type Addition struct {
 	Cookie       string  `json:"cookie" type:"text" help:"one of QR code token and cookie required"`
 	QRCodeToken  string  `json:"qrcode_token" type:"text" help:"one of QR code token and cookie required"`
 	QRCodeSource string  `json:"qrcode_source" type:"select" options:"web,android,ios,tv,alipaymini,wechatmini,qandroid" default:"linux" help:"select the QR code device, default linux"`
-	PageSize     int64   `json:"page_size" type:"number" default:"56" help:"list api per page size of 115 driver"`
+	PageSize     int64   `json:"page_size" type:"number" default:"1000" help:"list api per page size of 115 driver"`
 	LimitRate    float64 `json:"limit_rate" type:"number" default:"2" help:"limit all api request rate (1r/[limit_rate]s)"`
 	driver.RootID
 }

drivers/115/types.go

@@ -1,10 +1,11 @@
 package _115
 
 import (
+	"time"
+
 	"github.com/SheltonZhu/115driver/pkg/driver"
 	"github.com/alist-org/alist/v3/internal/model"
 	"github.com/alist-org/alist/v3/pkg/utils"
-	"time"
 )
 
 var _ model.Obj = (*FileObj)(nil)
@@ -20,3 +21,18 @@ func (f *FileObj) CreateTime() time.Time {
 func (f *FileObj) GetHash() utils.HashInfo {
 	return utils.NewHashInfo(utils.SHA1, f.Sha1)
 }
+
+type UploadResult struct {
+	driver.BasicResp
+	Data struct {
+		PickCode string `json:"pick_code"`
+		FileSize int    `json:"file_size"`
+		FileID   string `json:"file_id"`
+		ThumbURL string `json:"thumb_url"`
+		Sha1     string `json:"sha1"`
+		Aid      int    `json:"aid"`
+		FileName string `json:"file_name"`
+		Cid      string `json:"cid"`
+		IsVideo  int    `json:"is_video"`
+	} `json:"data"`
+}

drivers/115/util.go

@@ -10,7 +10,6 @@ import (
 	"io"
 	"net/http"
 	"net/url"
-	"path/filepath"
 	"strconv"
 	"strings"
 	"sync"
@@ -254,6 +253,7 @@ func (d *Pan115) UploadByMultipart(params *driver115.UploadOSSParams, fileSize i
 		ossClient *oss.Client
 		bucket    *oss.Bucket
 		ossToken  *driver115.UploadOSSTokenResp
+		bodyBytes []byte
 		err       error
 	)
 
@@ -268,12 +268,14 @@ func (d *Pan115) UploadByMultipart(params *driver115.UploadOSSParams, fileSize i
 			f(options)
 		}
 	}
+	// oss 启用Sequential必须按顺序上传
+	options.ThreadsNum = 1
 
 	if ossToken, err = d.client.GetOSSToken(); err != nil {
 		return err
 	}
 
-	if ossClient, err = oss.New(driver115.OSSEndpoint, ossToken.AccessKeyID, ossToken.AccessKeySecret); err != nil {
+	if ossClient, err = oss.New(driver115.OSSEndpoint, ossToken.AccessKeyID, ossToken.AccessKeySecret, oss.EnableMD5(true), oss.EnableCRC(true)); err != nil {
 		return err
 	}
 
@@ -294,6 +296,7 @@ func (d *Pan115) UploadByMultipart(params *driver115.UploadOSSParams, fileSize i
 	if imur, err = bucket.InitiateMultipartUpload(params.Object,
 		oss.SetHeader(driver115.OssSecurityTokenHeaderName, ossToken.SecurityToken),
 		oss.UserAgentHeader(driver115.OSSUserAgent),
+		oss.EnableSha1(), oss.Sequential(),
 	); err != nil {
 		return err
 	}
@@ -337,8 +340,7 @@ func (d *Pan115) UploadByMultipart(params *driver115.UploadOSSParams, fileSize i
 						continue
 					}
 
-					b := bytes.NewBuffer(buf)
-					if part, err = bucket.UploadPart(imur, b, chunk.Size, chunk.Number, driver115.OssOption(params, ossToken)...); err == nil {
+					if part, err = bucket.UploadPart(imur, bytes.NewBuffer(buf), chunk.Size, chunk.Number, driver115.OssOption(params, ossToken)...); err == nil {
 						break
 					}
 				}
@@ -373,14 +375,20 @@ LOOP:
 		}
 	}
 
-	// EOF错误是xml的Unmarshal导致的，响应其实是json格式，所以实际上上传是成功的
-	if _, err = bucket.CompleteMultipartUpload(imur, parts, driver115.OssOption(params, ossToken)...); err != nil && !errors.Is(err, io.EOF) {
-		// 当文件名含有 &< 这两个字符之一时响应的xml解析会出现错误，实际上上传是成功的
-		if filename := filepath.Base(stream.GetName()); !strings.ContainsAny(filename, "&<") {
-			return err
-		}
+	// 不知道啥原因，oss那边分片上传不计算sha1，导致115服务器校验错误
+	// params.Callback.Callback = strings.ReplaceAll(params.Callback.Callback, "${sha1}", params.SHA1)
+	if _, err := bucket.CompleteMultipartUpload(imur, parts, append(
+		driver115.OssOption(params, ossToken),
+		oss.CallbackResult(&bodyBytes),
+	)...); err != nil {
+		return err
 	}
-	return d.checkUploadStatus(dirID, params.SHA1)
+
+	var uploadResult UploadResult
+	if err = json.Unmarshal(bodyBytes, &uploadResult); err != nil {
+		return err
+	}
+	return uploadResult.Err(string(bodyBytes))
 }
 
 func chunksProducer(ch chan oss.FileChunk, chunks []oss.FileChunk) {
@@ -389,27 +397,6 @@ func chunksProducer(ch chan oss.FileChunk, chunks []oss.FileChunk) {
 	}
 }
 
-func (d *Pan115) checkUploadStatus(dirID, sha1 string) error {
-	// 验证上传是否成功
-	req := d.client.NewRequest().ForceContentType("application/json;charset=UTF-8")
-	opts := []driver115.GetFileOptions{
-		driver115.WithOrder(driver115.FileOrderByTime),
-		driver115.WithShowDirEnable(false),
-		driver115.WithAsc(false),
-		driver115.WithLimit(500),
-	}
-	fResp, err := driver115.GetFiles(req, dirID, opts...)
-	if err != nil {
-		return err
-	}
-	for _, fileInfo := range fResp.Files {
-		if fileInfo.Sha1 == sha1 {
-			return nil
-		}
-	}
-	return driver115.ErrUploadFailed
-}
-
 func SplitFile(fileSize int64) (chunks []oss.FileChunk, err error) {
 	for i := int64(1); i < 10; i++ {
 		if fileSize < i*utils.GB { // 文件大小小于iGB时分为i*1000片

drivers/115_share/meta.go

@@ -9,7 +9,7 @@ type Addition struct {
 	Cookie       string  `json:"cookie" type:"text" help:"one of QR code token and cookie required"`
 	QRCodeToken  string  `json:"qrcode_token" type:"text" help:"one of QR code token and cookie required"`
 	QRCodeSource string  `json:"qrcode_source" type:"select" options:"web,android,ios,tv,alipaymini,wechatmini,qandroid" default:"linux" help:"select the QR code device, default linux"`
-	PageSize     int64   `json:"page_size" type:"number" default:"20" help:"list api per page size of 115 driver"`
+	PageSize     int64   `json:"page_size" type:"number" default:"1000" help:"list api per page size of 115 driver"`
 	LimitRate    float64 `json:"limit_rate" type:"number" default:"2" help:"limit all api request rate (1r/[limit_rate]s)"`
 	ShareCode    string  `json:"share_code" type:"text" required:"true" help:"share code of 115 share link"`
 	ReceiveCode  string  `json:"receive_code" type:"text" required:"true" help:"receive code of 115 share link"`

drivers/123/driver.go

@@ -82,6 +82,7 @@ func (d *Pan123) Link(ctx context.Context, file model.Obj, args model.LinkArgs)
 			"type":      f.Type,
 		}
 		resp, err := d.request(DownloadInfo, http.MethodPost, func(req *resty.Request) {
+			
 			req.SetBody(data).SetHeaders(headers)
 		}, nil)
 		if err != nil {

drivers/123/util.go

@@ -26,8 +26,9 @@ const (
 	Api              = "https://www.123pan.com/api"
 	AApi             = "https://www.123pan.com/a/api"
 	BApi             = "https://www.123pan.com/b/api"
+	LoginApi         = "https://login.123pan.com/api"
 	MainApi          = BApi
-	SignIn           = MainApi + "/user/sign_in"
+	SignIn           = LoginApi + "/user/sign_in"
 	Logout           = MainApi + "/user/logout"
 	UserInfo         = MainApi + "/user/info"
 	FileList         = MainApi + "/file/list/new"

drivers/all.go

@@ -22,6 +22,7 @@ import (
 	_ "github.com/alist-org/alist/v3/drivers/cloudreve"
 	_ "github.com/alist-org/alist/v3/drivers/crypt"
 	_ "github.com/alist-org/alist/v3/drivers/dropbox"
+	_ "github.com/alist-org/alist/v3/drivers/febbox"
 	_ "github.com/alist-org/alist/v3/drivers/ftp"
 	_ "github.com/alist-org/alist/v3/drivers/google_drive"
 	_ "github.com/alist-org/alist/v3/drivers/google_photo"

drivers/cloudreve/driver.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"io"
 	"net/http"
+	"path"
 	"strconv"
 	"strings"
 
@@ -90,7 +91,7 @@ func (d *Cloudreve) MakeDir(ctx context.Context, parentDir model.Obj, dirName st
 func (d *Cloudreve) Move(ctx context.Context, srcObj, dstDir model.Obj) error {
 	body := base.Json{
 		"action":  "move",
-		"src_dir": srcObj.GetPath(),
+		"src_dir": path.Dir(srcObj.GetPath()),
 		"dst":     dstDir.GetPath(),
 		"src":     convertSrc(srcObj),
 	}
@@ -112,7 +113,7 @@ func (d *Cloudreve) Rename(ctx context.Context, srcObj model.Obj, newName string
 
 func (d *Cloudreve) Copy(ctx context.Context, srcObj, dstDir model.Obj) error {
 	body := base.Json{
-		"src_dir": srcObj.GetPath(),
+		"src_dir": path.Dir(srcObj.GetPath()),
 		"dst":     dstDir.GetPath(),
 		"src":     convertSrc(srcObj),
 	}

drivers/febbox/driver.go

@@ -0,0 +1,132 @@
+package febbox
+
+import (
+	"context"
+	"github.com/alist-org/alist/v3/internal/op"
+	"github.com/alist-org/alist/v3/pkg/utils"
+	"golang.org/x/oauth2"
+	"golang.org/x/oauth2/clientcredentials"
+
+	"github.com/alist-org/alist/v3/internal/driver"
+	"github.com/alist-org/alist/v3/internal/errs"
+	"github.com/alist-org/alist/v3/internal/model"
+)
+
+type FebBox struct {
+	model.Storage
+	Addition
+	accessToken string
+	oauth2Token oauth2.TokenSource
+}
+
+func (d *FebBox) Config() driver.Config {
+	return config
+}
+
+func (d *FebBox) GetAddition() driver.Additional {
+	return &d.Addition
+}
+
+func (d *FebBox) Init(ctx context.Context) error {
+	// 初始化 oauth2Config
+	oauth2Config := &clientcredentials.Config{
+		ClientID:     d.ClientID,
+		ClientSecret: d.ClientSecret,
+		AuthStyle:    oauth2.AuthStyleInParams,
+		TokenURL:     "https://api.febbox.com/oauth/token",
+	}
+
+	d.initializeOAuth2Token(ctx, oauth2Config, d.Addition.RefreshToken)
+
+	token, err := d.oauth2Token.Token()
+	if err != nil {
+		return err
+	}
+	d.accessToken = token.AccessToken
+	d.Addition.RefreshToken = token.RefreshToken
+	op.MustSaveDriverStorage(d)
+
+	return nil
+}
+
+func (d *FebBox) Drop(ctx context.Context) error {
+	return nil
+}
+
+func (d *FebBox) List(ctx context.Context, dir model.Obj, args model.ListArgs) ([]model.Obj, error) {
+	files, err := d.getFilesList(dir.GetID())
+	if err != nil {
+		return nil, err
+	}
+	return utils.SliceConvert(files, func(src File) (model.Obj, error) {
+		return fileToObj(src), nil
+	})
+}
+
+func (d *FebBox) Link(ctx context.Context, file model.Obj, args model.LinkArgs) (*model.Link, error) {
+	var ip string
+	if d.Addition.UserIP != "" {
+		ip = d.Addition.UserIP
+	} else {
+		ip = args.IP
+	}
+
+	url, err := d.getDownloadLink(file.GetID(), ip)
+	if err != nil {
+		return nil, err
+	}
+	return &model.Link{
+		URL: url,
+	}, nil
+}
+
+func (d *FebBox) MakeDir(ctx context.Context, parentDir model.Obj, dirName string) (model.Obj, error) {
+	err := d.makeDir(parentDir.GetID(), dirName)
+	if err != nil {
+		return nil, err
+	}
+
+	return nil, nil
+}
+
+func (d *FebBox) Move(ctx context.Context, srcObj, dstDir model.Obj) (model.Obj, error) {
+	err := d.move(srcObj.GetID(), dstDir.GetID())
+	if err != nil {
+		return nil, err
+	}
+
+	return nil, nil
+}
+
+func (d *FebBox) Rename(ctx context.Context, srcObj model.Obj, newName string) (model.Obj, error) {
+	err := d.rename(srcObj.GetID(), newName)
+	if err != nil {
+		return nil, err
+	}
+
+	return nil, nil
+}
+
+func (d *FebBox) Copy(ctx context.Context, srcObj, dstDir model.Obj) (model.Obj, error) {
+	err := d.copy(srcObj.GetID(), dstDir.GetID())
+	if err != nil {
+		return nil, err
+	}
+
+	return nil, nil
+}
+
+func (d *FebBox) Remove(ctx context.Context, obj model.Obj) error {
+	err := d.remove(obj.GetID())
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (d *FebBox) Put(ctx context.Context, dstDir model.Obj, stream model.FileStreamer, up driver.UpdateProgress) (model.Obj, error) {
+	return nil, errs.NotImplement
+}
+
+var _ driver.Driver = (*FebBox)(nil)

drivers/febbox/meta.go

@@ -0,0 +1,36 @@
+package febbox
+
+import (
+	"github.com/alist-org/alist/v3/internal/driver"
+	"github.com/alist-org/alist/v3/internal/op"
+)
+
+type Addition struct {
+	driver.RootID
+	ClientID     string `json:"client_id" required:"true" default:""`
+	ClientSecret string `json:"client_secret" required:"true" default:""`
+	RefreshToken string
+	SortRule     string `json:"sort_rule" required:"true" type:"select" options:"size_asc,size_desc,name_asc,name_desc,update_asc,update_desc,ext_asc,ext_desc" default:"name_asc"`
+	PageSize     int64  `json:"page_size" required:"true" type:"number" default:"100" help:"list api per page size of FebBox driver"`
+	UserIP       string `json:"user_ip" default:"" help:"user ip address for download link which can speed up the download"`
+}
+
+var config = driver.Config{
+	Name:              "FebBox",
+	LocalSort:         false,
+	OnlyLocal:         false,
+	OnlyProxy:         false,
+	NoCache:           false,
+	NoUpload:          true,
+	NeedMs:            false,
+	DefaultRoot:       "0",
+	CheckStatus:       false,
+	Alert:             "",
+	NoOverwriteUpload: false,
+}
+
+func init() {
+	op.RegisterDriver(func() driver.Driver {
+		return &FebBox{}
+	})
+}

drivers/febbox/oauth2.go

@@ -0,0 +1,88 @@
+package febbox
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+
+	"golang.org/x/oauth2"
+	"golang.org/x/oauth2/clientcredentials"
+)
+
+type customTokenSource struct {
+	config       *clientcredentials.Config
+	ctx          context.Context
+	refreshToken string
+}
+
+func (c *customTokenSource) Token() (*oauth2.Token, error) {
+	v := url.Values{}
+	if c.refreshToken != "" {
+		v.Set("grant_type", "refresh_token")
+		v.Set("refresh_token", c.refreshToken)
+	} else {
+		v.Set("grant_type", "client_credentials")
+	}
+
+	v.Set("client_id", c.config.ClientID)
+	v.Set("client_secret", c.config.ClientSecret)
+
+	req, err := http.NewRequest("POST", c.config.TokenURL, strings.NewReader(v.Encode()))
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+
+	resp, err := http.DefaultClient.Do(req.WithContext(c.ctx))
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, errors.New("oauth2: cannot fetch token")
+	}
+
+	var tokenResp struct {
+		Code int    `json:"code"`
+		Msg  string `json:"msg"`
+		Data struct {
+			AccessToken  string `json:"access_token"`
+			ExpiresIn    int64  `json:"expires_in"`
+			TokenType    string `json:"token_type"`
+			Scope        string `json:"scope"`
+			RefreshToken string `json:"refresh_token"`
+		} `json:"data"`
+	}
+
+	if err := json.NewDecoder(resp.Body).Decode(&tokenResp); err != nil {
+		return nil, err
+	}
+
+	if tokenResp.Code != 1 {
+		return nil, errors.New("oauth2: server response error")
+	}
+
+	c.refreshToken = tokenResp.Data.RefreshToken
+
+	token := &oauth2.Token{
+		AccessToken:  tokenResp.Data.AccessToken,
+		TokenType:    tokenResp.Data.TokenType,
+		RefreshToken: tokenResp.Data.RefreshToken,
+		Expiry:       time.Now().Add(time.Duration(tokenResp.Data.ExpiresIn) * time.Second),
+	}
+
+	return token, nil
+}
+
+func (d *FebBox) initializeOAuth2Token(ctx context.Context, oauth2Config *clientcredentials.Config, refreshToken string) {
+	d.oauth2Token = oauth2.ReuseTokenSource(nil, &customTokenSource{
+		config:       oauth2Config,
+		ctx:          ctx,
+		refreshToken: refreshToken,
+	})
+}

drivers/febbox/types.go

@@ -0,0 +1,123 @@
+package febbox
+
+import (
+	"fmt"
+	"github.com/alist-org/alist/v3/internal/model"
+	"github.com/alist-org/alist/v3/pkg/utils"
+	hash_extend "github.com/alist-org/alist/v3/pkg/utils/hash"
+	"strconv"
+	"time"
+)
+
+type ErrResp struct {
+	ErrorCode     int64   `json:"code"`
+	ErrorMsg      string  `json:"msg"`
+	ServerRunTime float64 `json:"server_runtime"`
+	ServerName    string  `json:"server_name"`
+}
+
+func (e *ErrResp) IsError() bool {
+	return e.ErrorCode != 0 || e.ErrorMsg != "" || e.ServerRunTime != 0 || e.ServerName != ""
+}
+
+func (e *ErrResp) Error() string {
+	return fmt.Sprintf("ErrorCode: %d ,Error: %s ,ServerRunTime: %f ,ServerName: %s", e.ErrorCode, e.ErrorMsg, e.ServerRunTime, e.ServerName)
+}
+
+type FileListResp struct {
+	Code int    `json:"code"`
+	Msg  string `json:"msg"`
+	Data struct {
+		FileList []File `json:"file_list"`
+		ShowType string `json:"show_type"`
+	} `json:"data"`
+}
+
+type Rules struct {
+	AllowCopy     int64 `json:"allow_copy"`
+	AllowDelete   int64 `json:"allow_delete"`
+	AllowDownload int64 `json:"allow_download"`
+	AllowComment  int64 `json:"allow_comment"`
+	HideLocation  int64 `json:"hide_location"`
+}
+
+type File struct {
+	Fid              int64  `json:"fid"`
+	UID              int64  `json:"uid"`
+	FileSize         int64  `json:"file_size"`
+	Path             string `json:"path"`
+	FileName         string `json:"file_name"`
+	Ext              string `json:"ext"`
+	AddTime          int64  `json:"add_time"`
+	FileCreateTime   int64  `json:"file_create_time"`
+	FileUpdateTime   int64  `json:"file_update_time"`
+	ParentID         int64  `json:"parent_id"`
+	UpdateTime       int64  `json:"update_time"`
+	LastOpenTime     int64  `json:"last_open_time"`
+	IsDir            int64  `json:"is_dir"`
+	Epub             int64  `json:"epub"`
+	IsMusicList      int64  `json:"is_music_list"`
+	OssFid           int64  `json:"oss_fid"`
+	Faststart        int64  `json:"faststart"`
+	HasVideoQuality  int64  `json:"has_video_quality"`
+	TotalDownload    int64  `json:"total_download"`
+	Status           int64  `json:"status"`
+	Remark           string `json:"remark"`
+	OldHash          string `json:"old_hash"`
+	Hash             string `json:"hash"`
+	HashType         string `json:"hash_type"`
+	FromUID          int64  `json:"from_uid"`
+	FidOrg           int64  `json:"fid_org"`
+	ShareID          int64  `json:"share_id"`
+	InvitePermission int64  `json:"invite_permission"`
+	ThumbSmall       string `json:"thumb_small"`
+	ThumbSmallWidth  int64  `json:"thumb_small_width"`
+	ThumbSmallHeight int64  `json:"thumb_small_height"`
+	Thumb            string `json:"thumb"`
+	ThumbWidth       int64  `json:"thumb_width"`
+	ThumbHeight      int64  `json:"thumb_height"`
+	ThumbBig         string `json:"thumb_big"`
+	ThumbBigWidth    int64  `json:"thumb_big_width"`
+	ThumbBigHeight   int64  `json:"thumb_big_height"`
+	IsCustomThumb    int64  `json:"is_custom_thumb"`
+	Photos           int64  `json:"photos"`
+	IsAlbum          int64  `json:"is_album"`
+	ReadOnly         int64  `json:"read_only"`
+	Rules            Rules  `json:"rules"`
+	IsShared         int64  `json:"is_shared"`
+}
+
+func fileToObj(f File) *model.ObjThumb {
+	return &model.ObjThumb{
+		Object: model.Object{
+			ID:       strconv.FormatInt(f.Fid, 10),
+			Name:     f.FileName,
+			Size:     f.FileSize,
+			Ctime:    time.Unix(f.FileCreateTime, 0),
+			Modified: time.Unix(f.FileUpdateTime, 0),
+			IsFolder: f.IsDir == 1,
+			HashInfo: utils.NewHashInfo(hash_extend.GCID, f.Hash),
+		},
+		Thumbnail: model.Thumbnail{
+			Thumbnail: f.Thumb,
+		},
+	}
+}
+
+type FileDownloadResp struct {
+	Code int    `json:"code"`
+	Msg  string `json:"msg"`
+	Data []struct {
+		Error       int    `json:"error"`
+		DownloadURL string `json:"download_url"`
+		Hash        string `json:"hash"`
+		HashType    string `json:"hash_type"`
+		Fid         int    `json:"fid"`
+		FileName    string `json:"file_name"`
+		ParentID    int    `json:"parent_id"`
+		FileSize    int    `json:"file_size"`
+		Ext         string `json:"ext"`
+		Thumb       string `json:"thumb"`
+		VipLink     int    `json:"vip_link"`
+	} `json:"data"`
+}

drivers/febbox/util.go

@@ -0,0 +1,224 @@
+package febbox
+
+import (
+	"encoding/json"
+	"errors"
+	"github.com/alist-org/alist/v3/drivers/base"
+	"github.com/alist-org/alist/v3/internal/op"
+	"github.com/go-resty/resty/v2"
+	"net/http"
+	"strconv"
+)
+
+func (d *FebBox) refreshTokenByOAuth2() error {
+	token, err := d.oauth2Token.Token()
+	if err != nil {
+		return err
+	}
+	d.Status = "work"
+	d.accessToken = token.AccessToken
+	d.Addition.RefreshToken = token.RefreshToken
+	op.MustSaveDriverStorage(d)
+	return nil
+}
+
+func (d *FebBox) request(url string, method string, callback base.ReqCallback, resp interface{}) ([]byte, error) {
+	req := base.RestyClient.R()
+	// 使用oauth2 获取 access_token
+	token, err := d.oauth2Token.Token()
+	if err != nil {
+		return nil, err
+	}
+	req.SetAuthScheme(token.TokenType).SetAuthToken(token.AccessToken)
+
+	if callback != nil {
+		callback(req)
+	}
+	if resp != nil {
+		req.SetResult(resp)
+	}
+	var e ErrResp
+	req.SetError(&e)
+	res, err := req.Execute(method, url)
+	if err != nil {
+		return nil, err
+	}
+
+	switch e.ErrorCode {
+	case 0:
+		return res.Body(), nil
+	case 1:
+		return res.Body(), nil
+	case -10001:
+		if e.ServerName != "" {
+			// access_token 过期
+			if err = d.refreshTokenByOAuth2(); err != nil {
+				return nil, err
+			}
+			return d.request(url, method, callback, resp)
+		} else {
+			return nil, errors.New(e.Error())
+		}
+	default:
+		return nil, errors.New(e.Error())
+	}
+}
+
+func (d *FebBox) getFilesList(id string) ([]File, error) {
+	if d.PageSize <= 0 {
+		d.PageSize = 100
+	}
+	res, err := d.listWithLimit(id, d.PageSize)
+	if err != nil {
+		return nil, err
+	}
+	return *res, nil
+}
+
+func (d *FebBox) listWithLimit(dirID string, pageLimit int64) (*[]File, error) {
+	var files []File
+	page := int64(1)
+	for {
+		result, err := d.getFiles(dirID, page, pageLimit)
+		if err != nil {
+			return nil, err
+		}
+		files = append(files, *result...)
+		if int64(len(*result)) < pageLimit {
+			break
+		} else {
+			page++
+		}
+	}
+	return &files, nil
+}
+
+func (d *FebBox) getFiles(dirID string, page, pageLimit int64) (*[]File, error) {
+	var fileList FileListResp
+	queryParams := map[string]string{
+		"module":    "file_list",
+		"parent_id": dirID,
+		"page":      strconv.FormatInt(page, 10),
+		"pagelimit": strconv.FormatInt(pageLimit, 10),
+		"order":     d.Addition.SortRule,
+	}
+
+	res, err := d.request("https://api.febbox.com/oauth", http.MethodPost, func(req *resty.Request) {
+		req.SetMultipartFormData(queryParams)
+	}, &fileList)
+	if err != nil {
+		return nil, err
+	}
+
+	if err = json.Unmarshal(res, &fileList); err != nil {
+		return nil, err
+	}
+
+	return &fileList.Data.FileList, nil
+}
+
+func (d *FebBox) getDownloadLink(id string, ip string) (string, error) {
+	var fileDownloadResp FileDownloadResp
+	queryParams := map[string]string{
+		"module": "file_get_download_url",
+		"fids[]": id,
+		"ip":     ip,
+	}
+
+	res, err := d.request("https://api.febbox.com/oauth", http.MethodPost, func(req *resty.Request) {
+		req.SetMultipartFormData(queryParams)
+	}, &fileDownloadResp)
+	if err != nil {
+		return "", err
+	}
+
+	if err = json.Unmarshal(res, &fileDownloadResp); err != nil {
+		return "", err
+	}
+
+	return fileDownloadResp.Data[0].DownloadURL, nil
+}
+
+func (d *FebBox) makeDir(id string, name string) error {
+	queryParams := map[string]string{
+		"module":    "create_dir",
+		"parent_id": id,
+		"name":      name,
+	}
+
+	_, err := d.request("https://api.febbox.com/oauth", http.MethodPost, func(req *resty.Request) {
+		req.SetMultipartFormData(queryParams)
+	}, nil)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (d *FebBox) move(id string, id2 string) error {
+	queryParams := map[string]string{
+		"module": "file_move",
+		"fids[]": id,
+		"to":     id2,
+	}
+
+	_, err := d.request("https://api.febbox.com/oauth", http.MethodPost, func(req *resty.Request) {
+		req.SetMultipartFormData(queryParams)
+	}, nil)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (d *FebBox) rename(id string, name string) error {
+	queryParams := map[string]string{
+		"module": "file_rename",
+		"fid":    id,
+		"name":   name,
+	}
+
+	_, err := d.request("https://api.febbox.com/oauth", http.MethodPost, func(req *resty.Request) {
+		req.SetMultipartFormData(queryParams)
+	}, nil)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (d *FebBox) copy(id string, id2 string) error {
+	queryParams := map[string]string{
+		"module": "file_copy",
+		"fids[]": id,
+		"to":     id2,
+	}
+
+	_, err := d.request("https://api.febbox.com/oauth", http.MethodPost, func(req *resty.Request) {
+		req.SetMultipartFormData(queryParams)
+	}, nil)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (d *FebBox) remove(id string) error {
+	queryParams := map[string]string{
+		"module": "file_delete",
+		"fids[]": id,
+	}
+
+	_, err := d.request("https://api.febbox.com/oauth", http.MethodPost, func(req *resty.Request) {
+		req.SetMultipartFormData(queryParams)
+	}, nil)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}

drivers/ilanzou/driver.go

@@ -66,12 +66,13 @@ func (d *ILanZou) Drop(ctx context.Context) error {
 }
 
 func (d *ILanZou) List(ctx context.Context, dir model.Obj, args model.ListArgs) ([]model.Obj, error) {
+	offset := 1
 	var res []ListItem
 	for {
 		var resp ListResp
 		_, err := d.proved("/record/file/list", http.MethodGet, func(req *resty.Request) {
 			params := []string{
-				"offset=1",
+				"offset=" + strconv.Itoa(offset),
 				"limit=60",
 				"folderId=" + dir.GetID(),
 				"type=0",
@@ -83,7 +84,9 @@ func (d *ILanZou) List(ctx context.Context, dir model.Obj, args model.ListArgs)
 			return nil, err
 		}
 		res = append(res, resp.List...)
-		if resp.TotalPage <= resp.Offset {
+		if resp.Offset < resp.TotalPage {
+			offset++
+		} else {
 			break
 		}
 	}
@@ -286,7 +289,7 @@ func (d *ILanZou) Put(ctx context.Context, dstDir model.Obj, stream model.FileSt
 		req.SetBody(base.Json{
 			"fileId":   "",
 			"fileName": stream.GetName(),
-			"fileSize": stream.GetSize() / 1024,
+			"fileSize": stream.GetSize()/1024 + 1,
 			"folderId": dstDir.GetID(),
 			"md5":      etag,
 			"type":     1,

drivers/local/driver.go

@@ -22,6 +22,7 @@ import (
 	"github.com/alist-org/alist/v3/pkg/utils"
 	"github.com/alist-org/alist/v3/server/common"
 	"github.com/alist-org/times"
+	cp "github.com/otiai10/copy"
 	log "github.com/sirupsen/logrus"
 	_ "golang.org/x/image/webp"
 )
@@ -76,7 +77,7 @@ func (d *Local) Init(ctx context.Context) error {
 	if d.thumbConcurrency == 0 {
 		d.thumbTokenBucket = NewNopTokenBucket()
 	} else {
-		d.thumbTokenBucket = NewStaticTokenBucket(d.thumbConcurrency)
+		d.thumbTokenBucket = NewStaticTokenBucketWithMigration(d.thumbTokenBucket, d.thumbConcurrency)
 	}
 	return nil
 }
@@ -241,11 +242,22 @@ func (d *Local) Move(ctx context.Context, srcObj, dstDir model.Obj) error {
 	if utils.IsSubPath(srcPath, dstPath) {
 		return fmt.Errorf("the destination folder is a subfolder of the source folder")
 	}
-	err := os.Rename(srcPath, dstPath)
-	if err != nil {
+	if err := os.Rename(srcPath, dstPath); err != nil && strings.Contains(err.Error(), "invalid cross-device link") {
+		// Handle cross-device file move in local driver
+		if err = d.Copy(ctx, srcObj, dstDir); err != nil {
+			return err
+		} else {
+			// Directly remove file without check recycle bin if successfully copied
+			if srcObj.IsDir() {
+				err = os.RemoveAll(srcObj.GetPath())
+			} else {
+				err = os.Remove(srcObj.GetPath())
+			}
+			return err
+		}
+	} else {
 		return err
 	}
-	return nil
 }
 
 func (d *Local) Rename(ctx context.Context, srcObj model.Obj, newName string) error {
@@ -258,22 +270,18 @@ func (d *Local) Rename(ctx context.Context, srcObj model.Obj, newName string) er
 	return nil
 }
 
-func (d *Local) Copy(ctx context.Context, srcObj, dstDir model.Obj) error {
+func (d *Local) Copy(_ context.Context, srcObj, dstDir model.Obj) error {
 	srcPath := srcObj.GetPath()
 	dstPath := filepath.Join(dstDir.GetPath(), srcObj.GetName())
 	if utils.IsSubPath(srcPath, dstPath) {
 		return fmt.Errorf("the destination folder is a subfolder of the source folder")
 	}
-	var err error
-	if srcObj.IsDir() {
-		err = utils.CopyDir(srcPath, dstPath)
-	} else {
-		err = utils.CopyFile(srcPath, dstPath)
-	}
-	if err != nil {
-		return err
-	}
-	return nil
+	// Copy using otiai10/copy to perform more secure & efficient copy
+	return cp.Copy(srcPath, dstPath, cp.Options{
+		Sync:          true, // Sync file to disk after copy, may have performance penalty in filesystem such as ZFS
+		PreserveTimes: true,
+		NumOfWorkers:  0, // Serialized copy without using goroutine
+	})
 }
 
 func (d *Local) Remove(ctx context.Context, obj model.Obj) error {

drivers/local/token_bucket.go

@@ -23,6 +23,38 @@ func NewStaticTokenBucket(size int) StaticTokenBucket {
 	return StaticTokenBucket{bucket: bucket}
 }
 
+func NewStaticTokenBucketWithMigration(oldBucket TokenBucket, size int) StaticTokenBucket {
+	if oldBucket != nil {
+		oldStaticBucket, ok := oldBucket.(StaticTokenBucket)
+		if ok {
+			oldSize := cap(oldStaticBucket.bucket)
+			migrateSize := oldSize
+			if size < migrateSize {
+				migrateSize = size
+			}
+
+			bucket := make(chan struct{}, size)
+			for range size - migrateSize {
+				bucket <- struct{}{}
+			}
+
+			if migrateSize != 0 {
+				go func() {
+					for range migrateSize {
+						<-oldStaticBucket.bucket
+						bucket <- struct{}{}
+					}
+					close(oldStaticBucket.bucket)
+				}()
+			}
+			return StaticTokenBucket{bucket: bucket}
+		}
+	}
+	return NewStaticTokenBucket(size)
+}
+
+// Take channel maybe closed when local driver is modified.
+// don't call Put method after the channel is closed.
 func (b StaticTokenBucket) Take() <-chan struct{} {
 	return b.bucket
 }
@@ -35,8 +67,10 @@ func (b StaticTokenBucket) Do(ctx context.Context, f func() error) error {
 	select {
 	case <-ctx.Done():
 		return ctx.Err()
-	case <-b.bucket:
-		defer b.Put()
+	case _, ok := <-b.Take():
+		if ok {
+			defer b.Put()
+		}
 	}
 	return f()
 }

go.mod

@@ -1,8 +1,6 @@
 module github.com/alist-org/alist/v3
 
-go 1.23.0
-
-toolchain go1.23.2
+go 1.22.4
 
 require (
 	github.com/SheltonZhu/115driver v1.0.29
@@ -18,7 +16,7 @@ require (
 	github.com/charmbracelet/bubbles v0.20.0
 	github.com/charmbracelet/bubbletea v1.1.0
 	github.com/charmbracelet/lipgloss v0.13.0
-	github.com/city404/v6-public-rpc-proto/go v0.0.0-20240923171555-b3ec1371da65
+	github.com/city404/v6-public-rpc-proto/go v0.0.0-20240817070657-90f8e24b653e
 	github.com/coreos/go-oidc v2.2.1+incompatible
 	github.com/deckarep/golang-set/v2 v2.6.0
 	github.com/dhowden/tag v0.0.0-20240417053706-3d75831295e8
@@ -58,13 +56,13 @@ require (
 	github.com/u2takey/ffmpeg-go v0.5.0
 	github.com/upyun/go-sdk/v3 v3.0.4
 	github.com/winfsp/cgofuse v1.5.1-0.20230130140708-f87f5db493b5
-	github.com/xhofe/tache v0.1.2
+	github.com/xhofe/tache v0.1.3
 	github.com/xhofe/wopan-sdk-go v0.1.3
 	github.com/zzzhr1990/go-common-entity v0.0.0-20221216044934-fd1c571e3a22
 	golang.org/x/crypto v0.27.0
 	golang.org/x/exp v0.0.0-20240904232852-e7e105dedf7e
 	golang.org/x/image v0.19.0
-	golang.org/x/net v0.29.0
+	golang.org/x/net v0.28.0
 	golang.org/x/oauth2 v0.22.0
 	golang.org/x/time v0.6.0
 	google.golang.org/appengine v1.6.8
@@ -191,6 +189,7 @@ require (
 	github.com/multiformats/go-multihash v0.2.3 // indirect
 	github.com/multiformats/go-multistream v0.4.1 // indirect
 	github.com/multiformats/go-varint v0.0.7 // indirect
+	github.com/otiai10/copy v1.14.0
 	github.com/pelletier/go-toml/v2 v2.2.2 // indirect
 	github.com/pierrec/lz4/v4 v4.1.18 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
@@ -227,8 +226,8 @@ require (
 	golang.org/x/text v0.18.0 // indirect
 	golang.org/x/tools v0.24.0 // indirect
 	google.golang.org/api v0.169.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20240814211410-ddb44dafa142 // indirect
-	google.golang.org/grpc v1.67.0
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20240604185151-ef581f913117 // indirect
+	google.golang.org/grpc v1.66.0
 	google.golang.org/protobuf v1.34.2 // indirect
 	gopkg.in/asn1-ber.v1 v1.0.0-20181015200546-f715ec2f112d // indirect
 	gopkg.in/natefinch/lumberjack.v2 v2.0.0 // indirect

go.sum

@@ -112,8 +112,6 @@ github.com/cheekybits/is v0.0.0-20150225183255-68e9c0620927 h1:SKI1/fuSdodxmNNyV
 github.com/cheekybits/is v0.0.0-20150225183255-68e9c0620927/go.mod h1:h/aW8ynjgkuj+NQRlZcDbAbM1ORAbXjXX77sX7T289U=
 github.com/city404/v6-public-rpc-proto/go v0.0.0-20240817070657-90f8e24b653e h1:GLC8iDDcbt1H8+RkNao2nRGjyNTIo81e1rAJT9/uWYA=
 github.com/city404/v6-public-rpc-proto/go v0.0.0-20240817070657-90f8e24b653e/go.mod h1:ln9Whp+wVY/FTbn2SK0ag+SKD2fC0yQCF/Lqowc1LmU=
-github.com/city404/v6-public-rpc-proto/go v0.0.0-20240923171555-b3ec1371da65 h1:vLh9fz03TCXzY1J9njvMNCbZ2zQ4SXxjlrA3ZBxJ9rY=
-github.com/city404/v6-public-rpc-proto/go v0.0.0-20240923171555-b3ec1371da65/go.mod h1:qCsFeM98xbCz2oDIxxdNKp8dVelfG0W7ldRYJnB3Fjs=
 github.com/cloudwego/base64x v0.1.4 h1:jwCgWpFanWmN8xoIUHa2rtzmkd5J2plF/dnLS6Xd/0Y=
 github.com/cloudwego/base64x v0.1.4/go.mod h1:0zlkT4Wn5C6NdauXdJRhSKRlJvmclQ1hhJgA0rcu/8w=
 github.com/cloudwego/iasm v0.2.0 h1:1KNIy1I1H9hNNFEEH3DVnI4UujN+1zjpuk6gwHLTssg=
@@ -393,6 +391,8 @@ github.com/ncw/swift/v2 v2.0.3 h1:8R9dmgFIWs+RiVlisCEfiQiik1hjuR0JnOkLxaP9ihg=
 github.com/ncw/swift/v2 v2.0.3/go.mod h1:cbAO76/ZwcFrFlHdXPjaqWZ9R7Hdar7HpjRXBfbjigk=
 github.com/orzogc/fake115uploader v0.3.3-0.20230715111618-58f9eb76f831 h1:K3T3eu4h5aYIOzUtLjN08L4Qt4WGaJONMgcaD0ayBJQ=
 github.com/orzogc/fake115uploader v0.3.3-0.20230715111618-58f9eb76f831/go.mod h1:lSHD4lC4zlMl+zcoysdJcd5KFzsWwOD8BJbyg1Ws9Ng=
+github.com/otiai10/copy v1.14.0 h1:dCI/t1iTdYGtkvCuBG2BgR6KZa83PTclw4U5n2wAllU=
+github.com/otiai10/copy v1.14.0/go.mod h1:ECfuL02W+/FkTWZWgQqXPWZgW9oeKCSQ5qVfSc4qc4w=
 github.com/panjf2000/ants/v2 v2.4.2/go.mod h1:f6F0NZVFsGCp5A7QW/Zj/m92atWwOkY0OIhFxRNFr4A=
 github.com/pelletier/go-toml/v2 v2.0.1/go.mod h1:r9LEWfGN8R5k0VXJ+0BkIe7MYkRdwZOjgMj2KwnJFUo=
 github.com/pelletier/go-toml/v2 v2.2.2 h1:aYUidT7k73Pcl9nb2gScu7NSrKCSHIDE89b3+6Wq+LM=
@@ -514,6 +514,8 @@ github.com/xhofe/gsync v0.0.0-20230917091818-2111ceb38a25 h1:eDfebW/yfq9DtG9RO3K
 github.com/xhofe/gsync v0.0.0-20230917091818-2111ceb38a25/go.mod h1:fH4oNm5F9NfI5dLi0oIMtsLNKQOirUDbEMCIBb/7SU0=
 github.com/xhofe/tache v0.1.2 h1:pHrXlrWcbTb4G7hVUDW7Rc+YTUnLJvnLBrdktVE1Fqg=
 github.com/xhofe/tache v0.1.2/go.mod h1:iKumPFvywf30FRpAHHCt64G0JHLMzT0K+wyGedHsmTQ=
+github.com/xhofe/tache v0.1.3 h1:MipxzlljYX29E1YI/SLC7hVomVF+51iP1OUzlsuq1wE=
+github.com/xhofe/tache v0.1.3/go.mod h1:iKumPFvywf30FRpAHHCt64G0JHLMzT0K+wyGedHsmTQ=
 github.com/xhofe/wopan-sdk-go v0.1.3 h1:J58X6v+n25ewBZjb05pKOr7AWGohb+Rdll4CThGh6+A=
 github.com/xhofe/wopan-sdk-go v0.1.3/go.mod h1:dcY9yA28fnaoZPnXZiVTFSkcd7GnIPTpTIIlfSI5z5Q=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
@@ -587,8 +589,6 @@ golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
 golang.org/x/net v0.27.0/go.mod h1:dDi0PyhWNoiUOrAS8uXv/vnScO4wnHQO4mj9fn/RytE=
 golang.org/x/net v0.28.0 h1:a9JDOJc5GMUJ0+UDqmLT86WiEy7iWyIhz8gz8E4e5hE=
 golang.org/x/net v0.28.0/go.mod h1:yqtgsTWOOnlGLG9GFRrK3++bGOUEkNBoHZc8MEDWPNg=
-golang.org/x/net v0.29.0 h1:5ORfpBpCs4HzDYoodCDBbwHzdR5UrLBZ3sOnUJmFoHo=
-golang.org/x/net v0.29.0/go.mod h1:gLkgy8jTGERgjzMic6DS9+SP0ajcu6Xu3Orq/SpETg0=
 golang.org/x/oauth2 v0.22.0 h1:BzDx2FehcG7jJwgWLELCdmLuxk2i+x9UDpSiss2u0ZA=
 golang.org/x/oauth2 v0.22.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -687,12 +687,8 @@ google.golang.org/appengine v1.6.8 h1:IhEN5q69dyKagZPYMSdIjS2HqprW324FRQZJcGqPAs
 google.golang.org/appengine v1.6.8/go.mod h1:1jJ3jBArFh5pcgW8gCtRJnepW8FzD1V44FJffLiz/Ds=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20240604185151-ef581f913117 h1:1GBuWVLM/KMVUv1t1En5Gs+gFZCNd360GGb4sSxtrhU=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20240604185151-ef581f913117/go.mod h1:EfXuqaE1J41VCDicxHzUDm+8rk+7ZdXzHV0IhO/I6s0=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240814211410-ddb44dafa142 h1:e7S5W7MGGLaSu8j3YjdezkZ+m1/Nm0uRVRMEMGk26Xs=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240814211410-ddb44dafa142/go.mod h1:UqMtugtsSgubUsoxbuAoiCXvqvErP7Gf0so0mK9tHxU=
 google.golang.org/grpc v1.66.0 h1:DibZuoBznOxbDQxRINckZcUvnCEvrW9pcWIE2yF9r1c=
 google.golang.org/grpc v1.66.0/go.mod h1:s3/l6xSSCURdVfAnL+TqCNMyTDAGN6+lZeVxnZR128Y=
-google.golang.org/grpc v1.67.0 h1:IdH9y6PF5MPSdAntIcpjQ+tXO41pcQsfZV2RxtQgVcw=
-google.golang.org/grpc v1.67.0/go.mod h1:1gLDyUQU7CTLJI90u3nXZ9ekeghjeM7pTDZlqFNg2AA=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=

internal/fs/copy.go

@@ -11,13 +11,14 @@ import (
 	"github.com/alist-org/alist/v3/internal/model"
 	"github.com/alist-org/alist/v3/internal/op"
 	"github.com/alist-org/alist/v3/internal/stream"
+	"github.com/alist-org/alist/v3/internal/task"
 	"github.com/alist-org/alist/v3/pkg/utils"
 	"github.com/pkg/errors"
 	"github.com/xhofe/tache"
 )
 
 type CopyTask struct {
-	tache.Base
+	task.TaskWithCreator
 	Status       string        `json:"-"` //don't save status to save space
 	SrcObjPath   string        `json:"src_path"`
 	DstDirPath   string        `json:"dst_path"`
@@ -53,7 +54,7 @@ var CopyTaskManager *tache.Manager[*CopyTask]
 
 // Copy if in the same storage, call move method
 // if not, add copy task
-func _copy(ctx context.Context, srcObjPath, dstDirPath string, lazyCache ...bool) (tache.TaskWithInfo, error) {
+func _copy(ctx context.Context, srcObjPath, dstDirPath string, lazyCache ...bool) (task.TaskInfoWithCreator, error) {
 	srcStorage, srcObjActualPath, err := op.GetStorageAndActualPath(srcObjPath)
 	if err != nil {
 		return nil, errors.WithMessage(err, "failed get src storage")
@@ -92,7 +93,11 @@ func _copy(ctx context.Context, srcObjPath, dstDirPath string, lazyCache ...bool
 		}
 	}
 	// not in the same storage
+	taskCreator, _ := ctx.Value("user").(*model.User) // taskCreator is nil when convert failed
 	t := &CopyTask{
+		TaskWithCreator: task.TaskWithCreator{
+			Creator: taskCreator,
+		},
 		srcStorage:   srcStorage,
 		dstStorage:   dstStorage,
 		SrcObjPath:   srcObjActualPath,
@@ -123,6 +128,9 @@ func copyBetween2Storages(t *CopyTask, srcStorage, dstStorage driver.Driver, src
 			srcObjPath := stdpath.Join(srcObjPath, obj.GetName())
 			dstObjPath := stdpath.Join(dstDirPath, srcObj.GetName())
 			CopyTaskManager.Add(&CopyTask{
+				TaskWithCreator: task.TaskWithCreator{
+					Creator: t.Creator,
+				},
 				srcStorage:   srcStorage,
 				dstStorage:   dstStorage,
 				SrcObjPath:   srcObjPath,

internal/fs/fs.go

@@ -5,8 +5,8 @@ import (
 	"github.com/alist-org/alist/v3/internal/driver"
 	"github.com/alist-org/alist/v3/internal/model"
 	"github.com/alist-org/alist/v3/internal/op"
+	"github.com/alist-org/alist/v3/internal/task"
 	log "github.com/sirupsen/logrus"
-	"github.com/xhofe/tache"
 )
 
 // the param named path of functions in this package is a mount path
@@ -69,7 +69,7 @@ func Move(ctx context.Context, srcPath, dstDirPath string, lazyCache ...bool) er
 	return err
 }
 
-func Copy(ctx context.Context, srcObjPath, dstDirPath string, lazyCache ...bool) (tache.TaskWithInfo, error) {
+func Copy(ctx context.Context, srcObjPath, dstDirPath string, lazyCache ...bool) (task.TaskInfoWithCreator, error) {
 	res, err := _copy(ctx, srcObjPath, dstDirPath, lazyCache...)
 	if err != nil {
 		log.Errorf("failed copy %s to %s: %+v", srcObjPath, dstDirPath, err)
@@ -101,8 +101,8 @@ func PutDirectly(ctx context.Context, dstDirPath string, file model.FileStreamer
 	return err
 }
 
-func PutAsTask(dstDirPath string, file model.FileStreamer) (tache.TaskWithInfo, error) {
-	t, err := putAsTask(dstDirPath, file)
+func PutAsTask(ctx context.Context, dstDirPath string, file model.FileStreamer) (task.TaskInfoWithCreator, error) {
+	t, err := putAsTask(ctx, dstDirPath, file)
 	if err != nil {
 		log.Errorf("failed put %s: %+v", dstDirPath, err)
 	}

internal/fs/put.go

@@ -7,12 +7,13 @@ import (
 	"github.com/alist-org/alist/v3/internal/errs"
 	"github.com/alist-org/alist/v3/internal/model"
 	"github.com/alist-org/alist/v3/internal/op"
+	"github.com/alist-org/alist/v3/internal/task"
 	"github.com/pkg/errors"
 	"github.com/xhofe/tache"
 )
 
 type UploadTask struct {
-	tache.Base
+	task.TaskWithCreator
 	storage          driver.Driver
 	dstDirActualPath string
 	file             model.FileStreamer
@@ -33,7 +34,7 @@ func (t *UploadTask) Run() error {
 var UploadTaskManager *tache.Manager[*UploadTask]
 
 // putAsTask add as a put task and return immediately
-func putAsTask(dstDirPath string, file model.FileStreamer) (tache.TaskWithInfo, error) {
+func putAsTask(ctx context.Context, dstDirPath string, file model.FileStreamer) (task.TaskInfoWithCreator, error) {
 	storage, dstDirActualPath, err := op.GetStorageAndActualPath(dstDirPath)
 	if err != nil {
 		return nil, errors.WithMessage(err, "failed get storage")
@@ -49,7 +50,11 @@ func putAsTask(dstDirPath string, file model.FileStreamer) (tache.TaskWithInfo,
 		//file.SetReader(tempFile)
 		//file.SetTmpFile(tempFile)
 	}
+	taskCreator, _ := ctx.Value("user").(*model.User) // taskCreator is nil when convert failed
 	t := &UploadTask{
+		TaskWithCreator: task.TaskWithCreator{
+			Creator: taskCreator,
+		},
 		storage:          storage,
 		dstDirActualPath: dstDirActualPath,
 		file:             file,

internal/offline_download/tool/add.go

@@ -2,6 +2,8 @@ package tool
 
 import (
 	"context"
+	"github.com/alist-org/alist/v3/internal/model"
+	"github.com/alist-org/alist/v3/internal/task"
 	"path/filepath"
 
 	"github.com/alist-org/alist/v3/internal/conf"
@@ -9,7 +11,6 @@ import (
 	"github.com/alist-org/alist/v3/internal/op"
 	"github.com/google/uuid"
 	"github.com/pkg/errors"
-	"github.com/xhofe/tache"
 )
 
 type DeletePolicy string
@@ -28,7 +29,7 @@ type AddURLArgs struct {
 	DeletePolicy DeletePolicy
 }
 
-func AddURL(ctx context.Context, args *AddURLArgs) (tache.TaskWithInfo, error) {
+func AddURL(ctx context.Context, args *AddURLArgs) (task.TaskInfoWithCreator, error) {
 	// get tool
 	tool, err := Tools.Get(args.Tool)
 	if err != nil {
@@ -77,8 +78,12 @@ func AddURL(ctx context.Context, args *AddURLArgs) (tache.TaskWithInfo, error) {
 		// 防止将下载好的文件删除
 		deletePolicy = DeleteNever
 	}
-	
+
+	taskCreator, _ := ctx.Value("user").(*model.User) // taskCreator is nil when convert failed
 	t := &DownloadTask{
+		TaskWithCreator: task.TaskWithCreator{
+			Creator: taskCreator,
+		},
 		Url:          args.URL,
 		DstDirPath:   args.DstDirPath,
 		TempDir:      tempDir,

internal/offline_download/tool/download.go

@@ -7,13 +7,14 @@ import (
 	"github.com/alist-org/alist/v3/internal/conf"
 	"github.com/alist-org/alist/v3/internal/errs"
 	"github.com/alist-org/alist/v3/internal/setting"
+	"github.com/alist-org/alist/v3/internal/task"
 	"github.com/pkg/errors"
 	log "github.com/sirupsen/logrus"
 	"github.com/xhofe/tache"
 )
 
 type DownloadTask struct {
-	tache.Base
+	task.TaskWithCreator
 	Url               string       `json:"url"`
 	DstDirPath        string       `json:"dst_dir_path"`
 	TempDir           string       `json:"temp_dir"`
@@ -171,6 +172,9 @@ func (t *DownloadTask) Complete() error {
 	for i := range files {
 		file := files[i]
 		TransferTaskManager.Add(&TransferTask{
+			TaskWithCreator: task.TaskWithCreator{
+				Creator: t.Creator,
+			},
 			file:         file,
 			DstDirPath:   t.DstDirPath,
 			TempDir:      t.TempDir,

internal/offline_download/tool/transfer.go

@@ -8,6 +8,7 @@ import (
 	"github.com/alist-org/alist/v3/internal/model"
 	"github.com/alist-org/alist/v3/internal/op"
 	"github.com/alist-org/alist/v3/internal/stream"
+	"github.com/alist-org/alist/v3/internal/task"
 	"github.com/alist-org/alist/v3/pkg/utils"
 	"github.com/pkg/errors"
 	log "github.com/sirupsen/logrus"
@@ -15,7 +16,7 @@ import (
 )
 
 type TransferTask struct {
-	tache.Base
+	task.TaskWithCreator
 	FileDir      string       `json:"file_dir"`
 	DstDirPath   string       `json:"dst_dir_path"`
 	TempDir      string       `json:"temp_dir"`

internal/task/base.go

@@ -0,0 +1,26 @@
+package task
+
+import (
+	"github.com/alist-org/alist/v3/internal/model"
+	"github.com/xhofe/tache"
+)
+
+type TaskWithCreator struct {
+	tache.Base
+	Creator *model.User
+}
+
+func (t *TaskWithCreator) SetCreator(creator *model.User) {
+	t.Creator = creator
+	t.Persist()
+}
+
+func (t *TaskWithCreator) GetCreator() *model.User {
+	return t.Creator
+}
+
+type TaskInfoWithCreator interface {
+	tache.TaskWithInfo
+	SetCreator(creator *model.User)
+	GetCreator() *model.User
+}

server/handles/fsmanage.go

@@ -2,7 +2,7 @@ package handles
 
 import (
 	"fmt"
-	"github.com/xhofe/tache"
+	"github.com/alist-org/alist/v3/internal/task"
 	"io"
 	stdpath "path"
 
@@ -121,7 +121,7 @@ func FsCopy(c *gin.Context) {
 		common.ErrorResp(c, err, 403)
 		return
 	}
-	var addedTasks []tache.TaskWithInfo
+	var addedTasks []task.TaskInfoWithCreator
 	for i, name := range req.Names {
 		t, err := fs.Copy(c, stdpath.Join(srcDir, name), dstDir, len(req.Names) > i+1)
 		if t != nil {

server/handles/fsup.go

@@ -1,17 +1,16 @@
 package handles
 
 import (
-	"github.com/xhofe/tache"
+	"github.com/alist-org/alist/v3/internal/task"
 	"io"
 	"net/url"
 	stdpath "path"
 	"strconv"
 	"time"
 
-	"github.com/alist-org/alist/v3/internal/stream"
-
 	"github.com/alist-org/alist/v3/internal/fs"
 	"github.com/alist-org/alist/v3/internal/model"
+	"github.com/alist-org/alist/v3/internal/stream"
 	"github.com/alist-org/alist/v3/server/common"
 	"github.com/gin-gonic/gin"
 )
@@ -58,9 +57,9 @@ func FsStream(c *gin.Context) {
 		Mimetype:     c.GetHeader("Content-Type"),
 		WebPutAsTask: asTask,
 	}
-	var t tache.TaskWithInfo
+	var t task.TaskInfoWithCreator
 	if asTask {
-		t, err = fs.PutAsTask(dir, s)
+		t, err = fs.PutAsTask(c, dir, s)
 	} else {
 		err = fs.PutDirectly(c, dir, s, true)
 	}
@@ -123,12 +122,12 @@ func FsForm(c *gin.Context) {
 		Mimetype:     file.Header.Get("Content-Type"),
 		WebPutAsTask: asTask,
 	}
-	var t tache.TaskWithInfo
+	var t task.TaskInfoWithCreator
 	if asTask {
 		s.Reader = struct {
 			io.Reader
 		}{f}
-		t, err = fs.PutAsTask(dir, &s)
+		t, err = fs.PutAsTask(c, dir, &s)
 	} else {
 		ss, err := stream.NewSeekableStream(s, nil)
 		if err != nil {

server/handles/offline_download.go

@@ -5,9 +5,9 @@ import (
 	"github.com/alist-org/alist/v3/internal/model"
 	"github.com/alist-org/alist/v3/internal/offline_download/tool"
 	"github.com/alist-org/alist/v3/internal/op"
+	"github.com/alist-org/alist/v3/internal/task"
 	"github.com/alist-org/alist/v3/server/common"
 	"github.com/gin-gonic/gin"
-	"github.com/xhofe/tache"
 )
 
 type SetAria2Req struct {
@@ -133,7 +133,7 @@ func AddOfflineDownload(c *gin.Context) {
 		common.ErrorResp(c, err, 403)
 		return
 	}
-	var tasks []tache.TaskWithInfo
+	var tasks []task.TaskInfoWithCreator
 	for _, url := range req.Urls {
 		t, err := tool.AddURL(c, &tool.AddURLArgs{
 			URL:          url,

server/handles/task.go

@@ -1,6 +1,8 @@
 package handles
 
 import (
+	"github.com/alist-org/alist/v3/internal/model"
+	"github.com/alist-org/alist/v3/internal/task"
 	"math"
 
 	"github.com/alist-org/alist/v3/internal/fs"
@@ -12,15 +14,17 @@ import (
 )
 
 type TaskInfo struct {
-	ID       string      `json:"id"`
-	Name     string      `json:"name"`
-	State    tache.State `json:"state"`
-	Status   string      `json:"status"`
-	Progress float64     `json:"progress"`
-	Error    string      `json:"error"`
+	ID          string      `json:"id"`
+	Name        string      `json:"name"`
+	Creator     string      `json:"creator"`
+	CreatorRole int         `json:"creator_role"`
+	State       tache.State `json:"state"`
+	Status      string      `json:"status"`
+	Progress    float64     `json:"progress"`
+	Error       string      `json:"error"`
 }
 
-func getTaskInfo[T tache.TaskWithInfo](task T) TaskInfo {
+func getTaskInfo[T task.TaskInfoWithCreator](task T) TaskInfo {
 	errMsg := ""
 	if task.GetErr() != nil {
 		errMsg = task.GetErr().Error()
@@ -30,62 +34,142 @@ func getTaskInfo[T tache.TaskWithInfo](task T) TaskInfo {
 	if math.IsNaN(progress) {
 		progress = 100
 	}
+	creatorName := ""
+	creatorRole := -1
+	if task.GetCreator() != nil {
+		creatorName = task.GetCreator().Username
+		creatorRole = task.GetCreator().Role
+	}
 	return TaskInfo{
-		ID:       task.GetID(),
-		Name:     task.GetName(),
-		State:    task.GetState(),
-		Status:   task.GetStatus(),
-		Progress: progress,
-		Error:    errMsg,
+		ID:          task.GetID(),
+		Name:        task.GetName(),
+		Creator:     creatorName,
+		CreatorRole: creatorRole,
+		State:       task.GetState(),
+		Status:      task.GetStatus(),
+		Progress:    progress,
+		Error:       errMsg,
 	}
 }
 
-func getTaskInfos[T tache.TaskWithInfo](tasks []T) []TaskInfo {
+func getTaskInfos[T task.TaskInfoWithCreator](tasks []T) []TaskInfo {
 	return utils.MustSliceConvert(tasks, getTaskInfo[T])
 }
 
-func taskRoute[T tache.TaskWithInfo](g *gin.RouterGroup, manager *tache.Manager[T]) {
-	g.GET("/undone", func(c *gin.Context) {
-		common.SuccessResp(c, getTaskInfos(manager.GetByState(tache.StatePending, tache.StateRunning,
-			tache.StateCanceling, tache.StateErrored, tache.StateFailing, tache.StateWaitingRetry, tache.StateBeforeRetry)))
-	})
-	g.GET("/done", func(c *gin.Context) {
-		common.SuccessResp(c, getTaskInfos(manager.GetByState(tache.StateCanceled, tache.StateFailed, tache.StateSucceeded)))
-	})
-	g.POST("/info", func(c *gin.Context) {
-		tid := c.Query("tid")
-		task, ok := manager.GetByID(tid)
+func argsContains[T comparable](v T, slice ...T) bool {
+	return utils.SliceContains(slice, v)
+}
+
+func getUserInfo(c *gin.Context) (bool, uint, bool) {
+	if user, ok := c.Value("user").(*model.User); ok {
+		return user.IsAdmin(), user.ID, true
+	} else {
+		return false, 0, false
+	}
+}
+
+func getTargetedHandler[T task.TaskInfoWithCreator](manager *tache.Manager[T], callback func(c *gin.Context, task T)) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		isAdmin, uid, ok := getUserInfo(c)
+		if !ok {
+			// if there is no bug, here is unreachable
+			common.ErrorStrResp(c, "user invalid", 401)
+			return
+		}
+		t, ok := manager.GetByID(c.Query("tid"))
 		if !ok {
 			common.ErrorStrResp(c, "task not found", 404)
 			return
 		}
+		if !isAdmin && uid != t.GetCreator().ID {
+			// to avoid an attacker using error messages to guess valid TID, return a 404 rather than a 403
+			common.ErrorStrResp(c, "task not found", 404)
+			return
+		}
+		callback(c, t)
+	}
+}
+
+func taskRoute[T task.TaskInfoWithCreator](g *gin.RouterGroup, manager *tache.Manager[T]) {
+	g.GET("/undone", func(c *gin.Context) {
+		isAdmin, uid, ok := getUserInfo(c)
+		if !ok {
+			// if there is no bug, here is unreachable
+			common.ErrorStrResp(c, "user invalid", 401)
+			return
+		}
+		common.SuccessResp(c, getTaskInfos(manager.GetByCondition(func(task T) bool {
+			// avoid directly passing the user object into the function to reduce closure size
+			return (isAdmin || uid == task.GetCreator().ID) &&
+				argsContains(task.GetState(), tache.StatePending, tache.StateRunning, tache.StateCanceling,
+					tache.StateErrored, tache.StateFailing, tache.StateWaitingRetry, tache.StateBeforeRetry)
+		})))
+	})
+	g.GET("/done", func(c *gin.Context) {
+		isAdmin, uid, ok := getUserInfo(c)
+		if !ok {
+			// if there is no bug, here is unreachable
+			common.ErrorStrResp(c, "user invalid", 401)
+			return
+		}
+		common.SuccessResp(c, getTaskInfos(manager.GetByCondition(func(task T) bool {
+			return (isAdmin || uid == task.GetCreator().ID) &&
+				argsContains(task.GetState(), tache.StateCanceled, tache.StateFailed, tache.StateSucceeded)
+		})))
+	})
+	g.POST("/info", getTargetedHandler(manager, func(c *gin.Context, task T) {
 		common.SuccessResp(c, getTaskInfo(task))
-	})
-	g.POST("/cancel", func(c *gin.Context) {
-		tid := c.Query("tid")
-		manager.Cancel(tid)
+	}))
+	g.POST("/cancel", getTargetedHandler(manager, func(c *gin.Context, task T) {
+		manager.Cancel(task.GetID())
 		common.SuccessResp(c)
-	})
-	g.POST("/delete", func(c *gin.Context) {
-		tid := c.Query("tid")
-		manager.Remove(tid)
+	}))
+	g.POST("/delete", getTargetedHandler(manager, func(c *gin.Context, task T) {
+		manager.Remove(task.GetID())
 		common.SuccessResp(c)
-	})
-	g.POST("/retry", func(c *gin.Context) {
-		tid := c.Query("tid")
-		manager.Retry(tid)
+	}))
+	g.POST("/retry", getTargetedHandler(manager, func(c *gin.Context, task T) {
+		manager.Retry(task.GetID())
 		common.SuccessResp(c)
-	})
+	}))
 	g.POST("/clear_done", func(c *gin.Context) {
-		manager.RemoveByState(tache.StateCanceled, tache.StateFailed, tache.StateSucceeded)
+		isAdmin, uid, ok := getUserInfo(c)
+		if !ok {
+			// if there is no bug, here is unreachable
+			common.ErrorStrResp(c, "user invalid", 401)
+			return
+		}
+		manager.RemoveByCondition(func(task T) bool {
+			return (isAdmin || uid == task.GetCreator().ID) &&
+				argsContains(task.GetState(), tache.StateCanceled, tache.StateFailed, tache.StateSucceeded)
+		})
 		common.SuccessResp(c)
 	})
 	g.POST("/clear_succeeded", func(c *gin.Context) {
-		manager.RemoveByState(tache.StateSucceeded)
+		isAdmin, uid, ok := getUserInfo(c)
+		if !ok {
+			// if there is no bug, here is unreachable
+			common.ErrorStrResp(c, "user invalid", 401)
+			return
+		}
+		manager.RemoveByCondition(func(task T) bool {
+			return (isAdmin || uid == task.GetCreator().ID) && task.GetState() == tache.StateSucceeded
+		})
 		common.SuccessResp(c)
 	})
 	g.POST("/retry_failed", func(c *gin.Context) {
-		manager.RetryAllFailed()
+		isAdmin, uid, ok := getUserInfo(c)
+		if !ok {
+			// if there is no bug, here is unreachable
+			common.ErrorStrResp(c, "user invalid", 401)
+			return
+		}
+		tasks := manager.GetByCondition(func(task T) bool {
+			return (isAdmin || uid == task.GetCreator().ID) && task.GetState() == tache.StateFailed
+		})
+		for _, t := range tasks {
+			manager.Retry(t.GetID())
+		}
 		common.SuccessResp(c)
 	})
 }

server/middlewares/auth.go

@@ -127,6 +127,16 @@ func Authn(c *gin.Context) {
 	c.Next()
 }
 
+func AuthNotGuest(c *gin.Context) {
+	user := c.MustGet("user").(*model.User)
+	if user.IsGuest() {
+		common.ErrorStrResp(c, "You are a guest", 403)
+		c.Abort()
+	} else {
+		c.Next()
+	}
+}
+
 func AuthAdmin(c *gin.Context) {
 	user := c.MustGet("user").(*model.User)
 	if !user.IsAdmin() {

server/router.go

@@ -76,6 +76,7 @@ func Init(e *gin.Engine) {
 	public.Any("/offline_download_tools", handles.OfflineDownloadTools)
 
 	_fs(auth.Group("/fs"))
+	_task(auth.Group("/task", middlewares.AuthNotGuest))
 	admin(auth.Group("/admin", middlewares.AuthAdmin))
 	if flags.Debug || flags.Dev {
 		debug(g.Group("/debug"))
@@ -127,8 +128,8 @@ func admin(g *gin.RouterGroup) {
 	setting.POST("/set_qbit", handles.SetQbittorrent)
 	setting.POST("/set_transmission", handles.SetTransmission)
 
-	task := g.Group("/task")
-	handles.SetupTaskRoute(task)
+	// retain /admin/task API to ensure compatibility with legacy automation scripts
+	_task(g.Group("/task"))
 
 	ms := g.Group("/message")
 	ms.POST("/get", message.HttpInstance.GetHandle)
@@ -166,6 +167,10 @@ func _fs(g *gin.RouterGroup) {
 	g.POST("/add_offline_download", handles.AddOfflineDownload)
 }
 
+func _task(g *gin.RouterGroup) {
+	handles.SetupTaskRoute(g)
+}
+
 func Cors(r *gin.Engine) {
 	config := cors.DefaultConfig()
 	// config.AllowAllOrigins = true