Initial commit

backend/src/routes/auth.rs

@@ -0,0 +1,267 @@
+use axum::{
+    extract::State,
+    http::{header::SET_COOKIE, HeaderMap, HeaderValue, StatusCode},
+    Json,
+};
+use axum_extra::{headers::Cookie, typed_header::TypedHeader};
+use chrono::{Duration as ChronoDuration, Utc};
+use diesel::prelude::*;
+use rand::{rngs::OsRng, RngCore};
+use serde::{Deserialize, Serialize};
+use sha2::{Digest, Sha256};
+use uuid::Uuid;
+
+use crate::{
+    auth::{password, AuthenticatedUser},
+    error::{AppError, AppResult},
+    models::{NewRefreshToken, RefreshToken, User},
+    schema::{refresh_tokens, users::dsl},
+    state::AppState,
+};
+
+use crate::schema::refresh_tokens::dsl as refresh_dsl;
+
+const REFRESH_COOKIE_NAME: &str = "refresh_token";
+
+#[derive(Deserialize)]
+pub struct LoginRequest {
+    pub username: String,
+    pub password: String,
+}
+
+#[derive(Serialize)]
+pub struct LoginResponse {
+    pub access_token: String,
+    pub token_type: String,
+    pub expires_in: i64,
+}
+
+pub async fn login(
+    State(state): State<AppState>,
+    Json(payload): Json<LoginRequest>,
+) -> AppResult<(HeaderMap, Json<LoginResponse>)> {
+    let mut conn = state.db()?;
+
+    let user: User = dsl::users
+        .filter(dsl::username.eq(&payload.username))
+        .first(&mut conn)?;
+
+    let valid = password::verify_password(&payload.password, &user.password_hash)
+        .map_err(|_| AppError::unauthorized())?;
+
+    if !valid {
+        return Err(AppError::unauthorized());
+    }
+
+    let access_token = state
+        .jwt
+        .generate_token(user.id, &user.username, &user.role)
+        .map_err(AppError::from)?;
+
+    let now = Utc::now();
+    let refresh_value = generate_refresh_token();
+    let refresh_hash = hash_refresh_token(&refresh_value);
+    let refresh_expires_at = now + ChronoDuration::days(state.config.refresh_token_expiry_days);
+
+    let new_refresh = NewRefreshToken {
+        id: Uuid::new_v4(),
+        user_id: user.id,
+        token_hash: refresh_hash,
+        issued_at: now.naive_utc(),
+        expires_at: refresh_expires_at.naive_utc(),
+    };
+
+    diesel::insert_into(refresh_tokens::table)
+        .values(&new_refresh)
+        .execute(&mut conn)?;
+
+    let mut headers = HeaderMap::new();
+    headers.insert(
+        SET_COOKIE,
+        build_refresh_cookie(&state, &refresh_value, refresh_expires_at),
+    );
+
+    Ok((
+        headers,
+        Json(LoginResponse {
+            access_token,
+            token_type: "Bearer".to_string(),
+            expires_in: state.config.jwt_expiry_minutes * 60,
+        }),
+    ))
+}
+
+pub async fn refresh(
+    State(state): State<AppState>,
+    jar: Option<TypedHeader<Cookie>>,
+) -> AppResult<(HeaderMap, Json<LoginResponse>)> {
+    let cookies = jar.ok_or_else(AppError::unauthorized)?;
+    let refresh_value = cookies
+        .get(REFRESH_COOKIE_NAME)
+        .ok_or_else(AppError::unauthorized)?;
+
+    let hashed = hash_refresh_token(refresh_value);
+    let mut conn = state.db()?;
+    let now = Utc::now();
+    let now_naive = now.naive_utc();
+
+    let token = match refresh_dsl::refresh_tokens
+        .filter(refresh_dsl::token_hash.eq(&hashed))
+        .filter(refresh_dsl::revoked_at.is_null())
+        .filter(refresh_dsl::expires_at.gt(now_naive))
+        .first::<RefreshToken>(&mut conn)
+    {
+        Ok(token) => token,
+        Err(diesel::result::Error::NotFound) => return Err(AppError::unauthorized()),
+        Err(err) => return Err(AppError::from(err)),
+    };
+
+    diesel::update(refresh_dsl::refresh_tokens.filter(refresh_dsl::id.eq(token.id)))
+        .set((
+            refresh_dsl::revoked_at.eq(now_naive),
+            refresh_dsl::updated_at.eq(now_naive),
+        ))
+        .execute(&mut conn)?;
+
+    let user: User = dsl::users
+        .find(token.user_id)
+        .first(&mut conn)
+        .map_err(AppError::from)?;
+
+    let access_token = state
+        .jwt
+        .generate_token(user.id, &user.username, &user.role)
+        .map_err(AppError::from)?;
+
+    let new_refresh_value = generate_refresh_token();
+    let new_refresh_hash = hash_refresh_token(&new_refresh_value);
+    let new_refresh_expires = now + ChronoDuration::days(state.config.refresh_token_expiry_days);
+
+    let new_refresh = NewRefreshToken {
+        id: Uuid::new_v4(),
+        user_id: user.id,
+        token_hash: new_refresh_hash,
+        issued_at: now_naive,
+        expires_at: new_refresh_expires.naive_utc(),
+    };
+
+    diesel::insert_into(refresh_tokens::table)
+        .values(&new_refresh)
+        .execute(&mut conn)?;
+
+    let mut headers = HeaderMap::new();
+    headers.insert(
+        SET_COOKIE,
+        build_refresh_cookie(&state, &new_refresh_value, new_refresh_expires),
+    );
+
+    Ok((
+        headers,
+        Json(LoginResponse {
+            access_token,
+            token_type: "Bearer".to_string(),
+            expires_in: state.config.jwt_expiry_minutes * 60,
+        }),
+    ))
+}
+
+pub async fn logout(
+    State(state): State<AppState>,
+    user: AuthenticatedUser,
+    jar: Option<TypedHeader<Cookie>>,
+) -> AppResult<(HeaderMap, StatusCode)> {
+    let mut conn = state.db()?;
+    let now = Utc::now().naive_utc();
+    let mut rows_affected = 0;
+
+    if let Some(cookies) = jar {
+        if let Some(value) = cookies.get(REFRESH_COOKIE_NAME) {
+            let hashed = hash_refresh_token(value);
+            rows_affected = diesel::update(
+                refresh_dsl::refresh_tokens
+                    .filter(refresh_dsl::token_hash.eq(hashed))
+                    .filter(refresh_dsl::user_id.eq(user.user_id))
+                    .filter(refresh_dsl::revoked_at.is_null()),
+            )
+            .set((
+                refresh_dsl::revoked_at.eq(now),
+                refresh_dsl::updated_at.eq(now),
+            ))
+            .execute(&mut conn)
+            .unwrap_or(0);
+        }
+    }
+
+    if rows_affected == 0 {
+        let _ = diesel::update(
+            refresh_dsl::refresh_tokens
+                .filter(refresh_dsl::user_id.eq(user.user_id))
+                .filter(refresh_dsl::revoked_at.is_null()),
+        )
+        .set((
+            refresh_dsl::revoked_at.eq(now),
+            refresh_dsl::updated_at.eq(now),
+        ))
+        .execute(&mut conn);
+    }
+
+    let mut headers = HeaderMap::new();
+    headers.insert(SET_COOKIE, build_clear_refresh_cookie(&state));
+    Ok((headers, StatusCode::NO_CONTENT))
+}
+
+pub async fn me(user: AuthenticatedUser) -> Json<AuthenticatedUser> {
+    Json(user)
+}
+
+fn hash_refresh_token(token: &str) -> String {
+    let mut hasher = Sha256::new();
+    hasher.update(token.as_bytes());
+    hex::encode(hasher.finalize())
+}
+
+fn generate_refresh_token() -> String {
+    let mut bytes = [0u8; 32];
+    OsRng.fill_bytes(&mut bytes);
+    hex::encode(bytes)
+}
+
+fn build_refresh_cookie(
+    state: &AppState,
+    token: &str,
+    expires_at: chrono::DateTime<Utc>,
+) -> HeaderValue {
+    let max_age = ChronoDuration::days(state.config.refresh_token_expiry_days).num_seconds();
+
+    let mut parts = vec![format!("{}={}", REFRESH_COOKIE_NAME, token)];
+    parts.push("Path=/".into());
+    parts.push("HttpOnly".into());
+    parts.push("SameSite=Strict".into());
+    parts.push(format!("Max-Age={}", max_age));
+    parts.push(format!("Expires={}", expires_at.to_rfc2822()));
+    if state.config.refresh_cookie_secure {
+        parts.push("Secure".into());
+    }
+    if let Some(domain) = &state.config.refresh_cookie_domain {
+        parts.push(format!("Domain={}", domain));
+    }
+
+    HeaderValue::from_str(&parts.join("; ")).expect("valid refresh cookie")
+}
+
+fn build_clear_refresh_cookie(state: &AppState) -> HeaderValue {
+    let mut parts = vec![format!("{}=", REFRESH_COOKIE_NAME)];
+    parts.push("Path=/".into());
+    parts.push("HttpOnly".into());
+    parts.push("SameSite=Strict".into());
+    parts.push("Max-Age=0".into());
+    parts.push("Expires=Thu, 01 Jan 1970 00:00:00 GMT".into());
+    if state.config.refresh_cookie_secure {
+        parts.push("Secure".into());
+    }
+    if let Some(domain) = &state.config.refresh_cookie_domain {
+        parts.push(format!("Domain={}", domain));
+    }
+
+    HeaderValue::from_str(&parts.join("; ")).expect("valid refresh cookie")
+}

backend/src/routes/correspondents.rs

@@ -0,0 +1,259 @@
+use std::collections::{BTreeMap, HashMap};
+
+use axum::{
+    extract::{Path, State},
+    http::StatusCode,
+    response::IntoResponse,
+    Json,
+};
+use chrono::Utc;
+use diesel::{dsl::count_star, prelude::*, result::DatabaseErrorKind, PgConnection};
+use serde::{Deserialize, Serialize};
+use serde_json::Value;
+use uuid::Uuid;
+
+use crate::{
+    error::{AppError, AppResult},
+    models::{Correspondent, NewCorrespondent},
+    schema::{correspondents, document_correspondents},
+    state::AppState,
+};
+
+use super::documents::to_iso;
+
+#[derive(Serialize)]
+pub struct CorrespondentUsage {
+    pub total: i64,
+    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
+    pub by_role: BTreeMap<String, i64>,
+}
+
+#[derive(Serialize)]
+pub struct CorrespondentSummary {
+    pub id: Uuid,
+    pub name: String,
+    pub metadata: Value,
+    pub created_at: String,
+    pub updated_at: String,
+    pub usage: CorrespondentUsage,
+}
+
+#[derive(Deserialize)]
+pub struct CreateCorrespondentRequest {
+    pub name: String,
+    #[serde(default)]
+    pub metadata: Option<Value>,
+}
+
+#[derive(Deserialize)]
+pub struct UpdateCorrespondentRequest {
+    pub name: Option<String>,
+    pub metadata: Option<Value>,
+}
+
+#[derive(AsChangeset, Default)]
+#[diesel(table_name = correspondents)]
+struct CorrespondentChangeset<'a> {
+    name: Option<&'a str>,
+    metadata: Option<&'a Value>,
+}
+
+pub async fn list_correspondents(
+    State(state): State<AppState>,
+) -> AppResult<Json<Vec<CorrespondentSummary>>> {
+    let mut conn = state.db()?;
+
+    let correspondents_list: Vec<Correspondent> = correspondents::table
+        .order(correspondents::name.asc())
+        .load(&mut conn)?;
+
+    let usage_rows: Vec<(Uuid, String, i64)> = document_correspondents::table
+        .group_by((
+            document_correspondents::correspondent_id,
+            document_correspondents::role,
+        ))
+        .select((
+            document_correspondents::correspondent_id,
+            document_correspondents::role,
+            count_star(),
+        ))
+        .load(&mut conn)?;
+
+    let mut usage_map: HashMap<Uuid, BTreeMap<String, i64>> = HashMap::new();
+    for (correspondent_id, role, count) in usage_rows {
+        usage_map
+            .entry(correspondent_id)
+            .or_default()
+            .insert(role, count);
+    }
+
+    let mut response = Vec::with_capacity(correspondents_list.len());
+    for correspondent in correspondents_list {
+        let role_counts = usage_map.remove(&correspondent.id).unwrap_or_default();
+        response.push(build_summary(correspondent, role_counts));
+    }
+
+    Ok(Json(response))
+}
+
+pub async fn create_correspondent(
+    State(state): State<AppState>,
+    Json(payload): Json<CreateCorrespondentRequest>,
+) -> AppResult<Json<CorrespondentSummary>> {
+    let name = payload.name.trim();
+    if name.is_empty() {
+        return Err(AppError::bad_request("name must not be empty"));
+    }
+
+    let metadata_value = normalize_metadata(payload.metadata);
+    let new_id = Uuid::new_v4();
+    let new_correspondent = NewCorrespondent {
+        id: new_id,
+        name: name.to_string(),
+        metadata: metadata_value,
+    };
+
+    let mut conn = state.db()?;
+    match diesel::insert_into(correspondents::table)
+        .values(&new_correspondent)
+        .execute(&mut conn)
+    {
+        Ok(_) => {}
+        Err(diesel::result::Error::DatabaseError(DatabaseErrorKind::UniqueViolation, _)) => {
+            return Err(AppError::bad_request("correspondent name already exists"));
+        }
+        Err(err) => return Err(AppError::from(err)),
+    }
+
+    let correspondent: Correspondent = correspondents::table.find(new_id).first(&mut conn)?;
+    Ok(Json(build_summary(correspondent, BTreeMap::new())))
+}
+
+pub async fn update_correspondent(
+    State(state): State<AppState>,
+    Path(correspondent_id): Path<Uuid>,
+    Json(payload): Json<UpdateCorrespondentRequest>,
+) -> AppResult<Json<CorrespondentSummary>> {
+    let mut conn = state.db()?;
+    let existing: Correspondent = correspondents::table
+        .find(correspondent_id)
+        .first(&mut conn)?;
+
+    let mut new_name: Option<String> = None;
+    if let Some(ref candidate) = payload.name {
+        let trimmed = candidate.trim();
+        if trimmed.is_empty() {
+            return Err(AppError::bad_request("name must not be empty"));
+        }
+        if trimmed != existing.name {
+            let duplicate = correspondents::table
+                .filter(correspondents::name.eq(trimmed))
+                .filter(correspondents::id.ne(correspondent_id))
+                .first::<Correspondent>(&mut conn)
+                .optional()?;
+            if duplicate.is_some() {
+                return Err(AppError::bad_request("correspondent name already exists"));
+            }
+            new_name = Some(trimmed.to_string());
+        }
+    }
+
+    let mut new_metadata: Option<Value> = None;
+    if let Some(metadata) = payload.metadata.clone() {
+        let candidate = normalize_metadata(Some(metadata));
+        if candidate != existing.metadata {
+            new_metadata = Some(candidate);
+        }
+    }
+
+    if new_name.is_none() && new_metadata.is_none() {
+        let usage = load_usage_for_correspondent(&mut conn, correspondent_id)?;
+        return Ok(Json(build_summary(existing.clone(), usage)));
+    }
+
+    let mut changeset = CorrespondentChangeset::default();
+    if let Some(ref name) = new_name {
+        changeset.name = Some(name.as_str());
+    }
+    if let Some(ref metadata) = new_metadata {
+        changeset.metadata = Some(metadata);
+    }
+
+    let now = Utc::now().naive_utc();
+    diesel::update(correspondents::table.find(correspondent_id))
+        .set((&changeset, correspondents::updated_at.eq(now)))
+        .execute(&mut conn)?;
+
+    let updated: Correspondent = correspondents::table
+        .find(correspondent_id)
+        .first(&mut conn)?;
+    let usage = load_usage_for_correspondent(&mut conn, correspondent_id)?;
+    Ok(Json(build_summary(updated, usage)))
+}
+
+pub async fn delete_correspondent(
+    State(state): State<AppState>,
+    Path(correspondent_id): Path<Uuid>,
+) -> AppResult<impl IntoResponse> {
+    let mut conn = state.db()?;
+
+    let usage: i64 = document_correspondents::table
+        .filter(document_correspondents::correspondent_id.eq(correspondent_id))
+        .select(count_star())
+        .first(&mut conn)?;
+
+    if usage > 0 {
+        return Err(AppError::bad_request(
+            "cannot delete correspondent that is still assigned to documents",
+        ));
+    }
+
+    let deleted =
+        diesel::delete(correspondents::table.find(correspondent_id)).execute(&mut conn)?;
+    if deleted == 0 {
+        return Err(AppError::not_found());
+    }
+    Ok(StatusCode::NO_CONTENT)
+}
+
+fn build_summary(
+    correspondent: Correspondent,
+    role_counts: BTreeMap<String, i64>,
+) -> CorrespondentSummary {
+    let total = role_counts.values().copied().sum();
+    CorrespondentSummary {
+        id: correspondent.id,
+        name: correspondent.name,
+        metadata: correspondent.metadata,
+        created_at: to_iso(correspondent.created_at),
+        updated_at: to_iso(correspondent.updated_at),
+        usage: CorrespondentUsage {
+            total,
+            by_role: role_counts,
+        },
+    }
+}
+
+fn normalize_metadata(input: Option<Value>) -> Value {
+    match input {
+        None | Some(Value::Null) => Value::Object(Default::default()),
+        Some(value) => value,
+    }
+}
+
+fn load_usage_for_correspondent(
+    conn: &mut PgConnection,
+    correspondent_id: Uuid,
+) -> AppResult<BTreeMap<String, i64>> {
+    let rows: Vec<(String, i64)> = document_correspondents::table
+        .filter(document_correspondents::correspondent_id.eq(correspondent_id))
+        .group_by(document_correspondents::role)
+        .select((document_correspondents::role, count_star()))
+        .load(conn)?;
+
+    let mut map = BTreeMap::new();
+    for (role, count) in rows {
+        map.insert(role, count);
+    }
+    Ok(map)
+}

backend/src/routes/folders.rs

@@ -0,0 +1,401 @@
+use axum::{
+    extract::{Json, Path, Query, State},
+    http::StatusCode,
+};
+use diesel::{dsl::exists, prelude::*, PgConnection};
+use serde::{Deserialize, Serialize};
+use uuid::Uuid;
+
+use crate::models::{Document, Folder, NewFolder};
+use crate::schema::{documents, folders};
+use crate::state::AppState;
+use crate::{
+    auth::AuthenticatedUser,
+    error::{AppError, AppResult},
+};
+
+use super::documents::{
+    load_correspondents_for_documents, load_primary_assets, load_tags_for_documents,
+    to_document_response, to_iso, DocumentResponse,
+};
+
+#[derive(Deserialize)]
+pub struct CreateFolderRequest {
+    pub name: String,
+    pub parent_id: Option<Uuid>,
+}
+
+#[derive(Deserialize)]
+pub struct EnsureFolderPathRequest {
+    pub parent_id: Option<Uuid>,
+    pub segments: Vec<String>,
+}
+
+#[derive(Deserialize)]
+pub struct UpdateFolderRequest {
+    #[serde(default)]
+    pub parent_id: Option<Option<Uuid>>,
+    pub name: Option<String>,
+}
+
+#[derive(Serialize)]
+pub struct FolderResponse {
+    pub folder: FolderInfo,
+}
+
+#[derive(Serialize)]
+pub struct FolderContentsResponse {
+    pub folder: Option<FolderInfo>,
+    pub subfolders: Vec<FolderInfo>,
+    pub documents: Vec<DocumentResponse>,
+}
+
+#[derive(Deserialize)]
+pub struct FolderContentsQuery {
+    #[serde(default = "default_include_documents")]
+    pub include_documents: bool,
+}
+
+const fn default_include_documents() -> bool {
+    true
+}
+
+#[derive(Serialize)]
+pub struct FolderInfo {
+    pub id: Uuid,
+    pub name: String,
+    pub parent_id: Option<Uuid>,
+    pub created_at: String,
+    pub updated_at: String,
+}
+
+pub async fn ensure_folder_path(
+    State(state): State<AppState>,
+    Json(payload): Json<EnsureFolderPathRequest>,
+) -> AppResult<Json<FolderResponse>> {
+    if payload.segments.is_empty() {
+        return Err(AppError::bad_request("segments must not be empty"));
+    }
+
+    let mut conn = state.db()?;
+
+    let target_folder = conn.transaction::<Folder, AppError, _>(|conn| {
+        let mut current_parent = payload.parent_id;
+        let mut last_folder: Option<Folder> = None;
+
+        for raw_name in &payload.segments {
+            let name = raw_name.trim();
+            if name.is_empty() {
+                return Err(AppError::bad_request("folder names must not be empty"));
+            }
+
+            let existing: Option<Folder> = if let Some(parent_id) = current_parent {
+                folders::table
+                    .filter(folders::parent_id.eq(Some(parent_id)))
+                    .filter(folders::name.eq(name))
+                    .first(conn)
+                    .optional()?
+            } else {
+                folders::table
+                    .filter(folders::parent_id.is_null())
+                    .filter(folders::name.eq(name))
+                    .first(conn)
+                    .optional()?
+            };
+
+            let folder = if let Some(folder) = existing {
+                folder
+            } else {
+                let new_folder = NewFolder {
+                    id: Uuid::new_v4(),
+                    name: name.to_string(),
+                    parent_id: current_parent,
+                };
+
+                diesel::insert_into(folders::table)
+                    .values(&new_folder)
+                    .execute(conn)?;
+
+                folders::table.find(new_folder.id).first(conn)?
+            };
+
+            current_parent = Some(folder.id);
+            last_folder = Some(folder);
+        }
+
+        last_folder.ok_or_else(|| AppError::internal("failed to resolve folder path".to_string()))
+    })?;
+
+    Ok(Json(FolderResponse {
+        folder: folder_to_info(target_folder),
+    }))
+}
+
+pub async fn create_folder(
+    State(state): State<AppState>,
+    Json(payload): Json<CreateFolderRequest>,
+) -> AppResult<Json<FolderResponse>> {
+    if payload.name.trim().is_empty() {
+        return Err(AppError::bad_request("name must not be empty"));
+    }
+
+    let mut conn = state.db()?;
+
+    let new_folder = NewFolder {
+        id: Uuid::new_v4(),
+        name: payload.name.trim().to_string(),
+        parent_id: payload.parent_id,
+    };
+
+    diesel::insert_into(folders::table)
+        .values(&new_folder)
+        .execute(&mut conn)?;
+
+    let folder: Folder = folders::table.find(new_folder.id).first(&mut conn)?;
+    Ok(Json(FolderResponse {
+        folder: folder_to_info(folder),
+    }))
+}
+
+pub async fn list_folder_contents(
+    State(state): State<AppState>,
+    Path(folder_identifier): Path<String>,
+    Query(query): Query<FolderContentsQuery>,
+    user: AuthenticatedUser,
+) -> AppResult<Json<FolderContentsResponse>> {
+    let mut conn = state.db()?;
+
+    let folder_id = if folder_identifier.eq_ignore_ascii_case("root") {
+        None
+    } else {
+        Some(
+            Uuid::parse_str(&folder_identifier)
+                .map_err(|_| AppError::bad_request("folder identifier must be 'root' or a UUID"))?,
+        )
+    };
+
+    let folder = match folder_id {
+        Some(id) => Some(folder_to_info(
+            folders::table.find(id).first::<Folder>(&mut conn)?,
+        )),
+        None => None,
+    };
+
+    let child_folders: Vec<Folder> = if let Some(parent_id) = folder_id {
+        folders::table
+            .filter(folders::parent_id.eq(parent_id))
+            .order(folders::name.asc())
+            .load(&mut conn)?
+    } else {
+        folders::table
+            .filter(folders::parent_id.is_null())
+            .order(folders::name.asc())
+            .load(&mut conn)?
+    };
+    let subfolders = child_folders.into_iter().map(folder_to_info).collect();
+
+    let documents = if query.include_documents {
+        let docs_query = documents::table
+            .filter(documents::deleted_at.is_null())
+            .order(documents::uploaded_at.desc());
+
+        let docs: Vec<Document> = if let Some(current_folder) = folder_id {
+            docs_query
+                .filter(documents::folder_id.eq(current_folder))
+                .load(&mut conn)?
+        } else {
+            docs_query
+                .filter(documents::folder_id.is_null())
+                .load(&mut conn)?
+        };
+
+        let doc_ids: Vec<Uuid> = docs.iter().map(|doc| doc.id).collect();
+        let tags_map = load_tags_for_documents(&mut conn, &doc_ids)?;
+        let mut correspondents_map = load_correspondents_for_documents(&mut conn, &doc_ids)?;
+        drop(conn);
+
+        let primary_versions = load_primary_assets(&state, &docs).await?;
+
+        let mut documents = Vec::with_capacity(doc_ids.len());
+        for doc in docs {
+            let tags = tags_map.get(&doc.id).cloned();
+            let correspondents = correspondents_map.remove(&doc.id).unwrap_or_default();
+            let current_version = primary_versions.get(&doc.id).cloned();
+            documents.push(to_document_response(
+                &state,
+                user.user_id,
+                doc,
+                tags,
+                correspondents,
+                current_version,
+            )?);
+        }
+
+        documents
+    } else {
+        Vec::new()
+    };
+
+    Ok(Json(FolderContentsResponse {
+        folder,
+        subfolders,
+        documents,
+    }))
+}
+
+pub async fn delete_folder(
+    State(state): State<AppState>,
+    Path(folder_id): Path<Uuid>,
+) -> AppResult<StatusCode> {
+    let mut conn = state.db()?;
+
+    conn.transaction::<_, AppError, _>(|conn| {
+        folders::table.find(folder_id).first::<Folder>(conn)?;
+
+        let has_child_folders: bool = diesel::select(exists(
+            folders::table.filter(folders::parent_id.eq(Some(folder_id))),
+        ))
+        .get_result(conn)?;
+
+        if has_child_folders {
+            return Err(AppError::bad_request(
+                "folder must be empty before deletion",
+            ));
+        }
+
+        let has_documents: bool = diesel::select(exists(
+            documents::table
+                .filter(documents::folder_id.eq(Some(folder_id)))
+                .filter(documents::deleted_at.is_null()),
+        ))
+        .get_result(conn)?;
+
+        if has_documents {
+            return Err(AppError::bad_request(
+                "folder must be empty before deletion",
+            ));
+        }
+
+        diesel::delete(folders::table.find(folder_id)).execute(conn)?;
+
+        Ok(())
+    })?;
+
+    Ok(StatusCode::NO_CONTENT)
+}
+
+pub async fn update_folder(
+    State(state): State<AppState>,
+    Path(folder_id): Path<Uuid>,
+    Json(payload): Json<UpdateFolderRequest>,
+) -> AppResult<StatusCode> {
+    let mut conn = state.db()?;
+
+    conn.transaction::<(), AppError, _>(|conn| {
+        let folder: Folder = folders::table.find(folder_id).first(conn)?;
+
+        let mut next_parent = folder.parent_id;
+        let mut parent_changed = false;
+
+        if let Some(parent_request) = payload.parent_id {
+            if parent_request == Some(folder_id) {
+                return Err(AppError::bad_request("folder cannot be its own parent"));
+            }
+
+            if let Some(parent_id) = parent_request {
+                let _parent: Folder = folders::table.find(parent_id).first(conn)?;
+
+                let descendant_ids = gather_descendant_folder_ids(conn, folder_id)?;
+                if descendant_ids.contains(&parent_id) {
+                    return Err(AppError::bad_request(
+                        "cannot move folder into itself or a descendant",
+                    ));
+                }
+            }
+
+            parent_changed = parent_request != folder.parent_id;
+            next_parent = parent_request;
+        }
+
+        let mut new_name = folder.name.clone();
+        let mut name_changed = false;
+
+        if let Some(name) = payload.name {
+            let trimmed = name.trim();
+            if trimmed.is_empty() {
+                return Err(AppError::bad_request("name must not be empty"));
+            }
+
+            if trimmed != folder.name {
+                new_name = trimmed.to_string();
+                name_changed = true;
+            }
+        }
+
+        if !parent_changed && !name_changed {
+            return Ok(());
+        }
+
+        let conflict = if let Some(parent_id) = next_parent {
+            folders::table
+                .filter(folders::parent_id.eq(Some(parent_id)))
+                .filter(folders::name.eq(&new_name))
+                .filter(folders::id.ne(folder_id))
+                .first::<Folder>(conn)
+                .optional()?
+        } else {
+            folders::table
+                .filter(folders::parent_id.is_null())
+                .filter(folders::name.eq(&new_name))
+                .filter(folders::id.ne(folder_id))
+                .first::<Folder>(conn)
+                .optional()?
+        };
+
+        if conflict.is_some() {
+            return Err(AppError::bad_request(
+                "a folder with the same name already exists in the target",
+            ));
+        }
+
+        diesel::update(folders::table.find(folder_id))
+            .set((
+                folders::parent_id.eq(next_parent),
+                folders::name.eq(&new_name),
+            ))
+            .execute(conn)?;
+
+        Ok(())
+    })?;
+
+    Ok(StatusCode::NO_CONTENT)
+}
+
+fn folder_to_info(folder: Folder) -> FolderInfo {
+    FolderInfo {
+        id: folder.id,
+        name: folder.name,
+        parent_id: folder.parent_id,
+        created_at: to_iso(folder.created_at),
+        updated_at: to_iso(folder.updated_at),
+    }
+}
+
+pub(super) fn gather_descendant_folder_ids(
+    conn: &mut PgConnection,
+    folder_id: Uuid,
+) -> AppResult<Vec<Uuid>> {
+    let mut ids = vec![folder_id];
+    let mut queue = vec![folder_id];
+
+    while let Some(current) = queue.pop() {
+        let child_ids: Vec<Uuid> = folders::table
+            .filter(folders::parent_id.eq(Some(current)))
+            .select(folders::id)
+            .load(conn)?;
+        queue.extend(child_ids.iter().copied());
+        ids.extend(child_ids);
+    }
+
+    Ok(ids)
+}

backend/src/routes/health.rs

@@ -0,0 +1,6 @@
+use axum::{http::StatusCode, response::Json};
+use serde_json::json;
+
+pub async fn health_check() -> (StatusCode, Json<serde_json::Value>) {
+    (StatusCode::OK, Json(json!({ "status": "ok" })))
+}

backend/src/routes/mod.rs

@@ -0,0 +1,138 @@
+use axum::http::HeaderValue;
+use axum::{
+    extract::DefaultBodyLimit,
+    middleware,
+    routing::{delete, get, patch, post},
+    Router,
+};
+use tower_http::cors::{AllowOrigin, CorsLayer};
+
+use crate::{auth::AuthenticatedUser, state::AppState};
+
+pub mod auth;
+pub mod correspondents;
+pub mod documents;
+pub mod folders;
+pub mod health;
+pub mod tags;
+pub mod webdav;
+
+pub fn create_router(state: AppState) -> Router<()> {
+    let cors = if let Some(origins) = state.config.cors_allowed_origin.as_ref() {
+        let headers: Vec<HeaderValue> = origins
+            .split(',')
+            .filter_map(|value| {
+                let trimmed = value.trim();
+                (!trimmed.is_empty()).then(|| {
+                    trimmed
+                        .parse::<HeaderValue>()
+                        .expect("invalid CORS allowed origin")
+                })
+            })
+            .collect();
+
+        let allow_origin = AllowOrigin::list(headers);
+
+        CorsLayer::new()
+            .allow_origin(allow_origin)
+            .allow_methods(tower_http::cors::AllowMethods::mirror_request())
+            .allow_headers(tower_http::cors::AllowHeaders::mirror_request())
+            .allow_credentials(true)
+    } else {
+        CorsLayer::new()
+            .allow_origin(AllowOrigin::mirror_request())
+            .allow_methods(tower_http::cors::AllowMethods::mirror_request())
+            .allow_headers(tower_http::cors::AllowHeaders::mirror_request())
+            .allow_credentials(true)
+    };
+
+    let auth_routes = Router::new()
+        .route("/login", post(auth::login))
+        .route("/refresh", post(auth::refresh))
+        .route("/logout", post(auth::logout))
+        .route("/me", get(auth::me));
+
+    let documents_routes = Router::new()
+        .route(
+            "/",
+            get(documents::list_documents).post(documents::upload_document),
+        )
+        .route("/reanalyze", post(documents::reanalyze_all_documents))
+        .route("/bulk/move", post(documents::bulk_move_documents))
+        .route("/bulk/tags", post(documents::bulk_update_tags))
+        .route(
+            "/bulk/correspondents",
+            post(documents::bulk_assign_correspondents),
+        )
+        .route(
+            "/bulk/reanalyze",
+            post(documents::reanalyze_selected_documents),
+        )
+        .route(
+            "/:id",
+            get(documents::get_document)
+                .delete(documents::delete_document)
+                .patch(documents::update_document),
+        )
+        .route("/:id/download", get(documents::download_document))
+        .route("/:id/assets/:asset_id", get(documents::get_document_asset))
+        .route(
+            "/:id/assets",
+            get(documents::list_document_assets).post(documents::request_document_assets),
+        )
+        .route("/:id/folder", patch(documents::move_document))
+        .route("/:id/tags", post(documents::assign_tags))
+        .route("/:id/tags/:tag_id", delete(documents::remove_tag))
+        .route(
+            "/:id/correspondents",
+            post(documents::assign_correspondents),
+        )
+        .route(
+            "/:id/correspondents/:correspondent_id",
+            delete(documents::remove_correspondent),
+        );
+
+    let download_routes =
+        Router::new().route("/download/:token", get(documents::download_with_token));
+
+    let folders_routes = Router::new()
+        .route("/", post(folders::create_folder))
+        .route("/path", post(folders::ensure_folder_path))
+        .route(
+            "/:id",
+            delete(folders::delete_folder).patch(folders::update_folder),
+        )
+        .route("/:id/contents", get(folders::list_folder_contents));
+
+    let tags_routes = Router::new()
+        .route("/", get(tags::list_tags).post(tags::create_tag))
+        .route("/:id", patch(tags::update_tag).delete(tags::delete_tag));
+
+    let correspondents_routes = Router::new()
+        .route(
+            "/",
+            get(correspondents::list_correspondents).post(correspondents::create_correspondent),
+        )
+        .route(
+            "/:id",
+            patch(correspondents::update_correspondent)
+                .delete(correspondents::delete_correspondent),
+        );
+
+    let protected_state = state.clone();
+    let protected_routes = Router::new()
+        .nest("/api/documents", documents_routes)
+        .nest("/api/folders", folders_routes)
+        .nest("/api/tags", tags_routes)
+        .nest("/api/correspondents", correspondents_routes)
+        .layer(middleware::from_extractor_with_state::<AuthenticatedUser, _>(protected_state));
+
+    Router::new()
+        .merge(download_routes)
+        .merge(protected_routes)
+        .nest("/api/auth", auth_routes)
+        .route("/api/health", get(health::health_check))
+        .with_state(state)
+        .layer(cors)
+        .layer(DefaultBodyLimit::max(1024 * 1024 * 512))
+}

backend/src/routes/tags.rs

@@ -0,0 +1,235 @@
+use crate::utils::json::{classify_nullable, NullableValue};
+use axum::{
+    extract::{Path, State},
+    http::StatusCode,
+    Json,
+};
+use diesel::{dsl::count_star, prelude::*};
+use serde::{Deserialize, Serialize};
+use serde_json::Value;
+use std::collections::HashMap;
+use uuid::Uuid;
+
+use crate::error::{AppError, AppResult};
+use crate::models::{NewTag, Tag};
+use crate::schema::{document_tags, tags};
+use crate::state::AppState;
+
+#[derive(Deserialize)]
+pub struct CreateTagRequest {
+    pub label: String,
+    pub color: Option<String>,
+}
+
+#[derive(AsChangeset, Default)]
+#[diesel(table_name = tags)]
+struct UpdateTagChangeset<'a> {
+    label: Option<&'a str>,
+    color: Option<Option<&'a str>>,
+}
+
+#[derive(Serialize)]
+pub struct TagCatalogEntry {
+    pub id: Uuid,
+    pub label: String,
+    pub color: Option<String>,
+    pub usage_count: i64,
+}
+
+pub async fn list_tags(State(state): State<AppState>) -> AppResult<Json<Vec<TagCatalogEntry>>> {
+    let mut conn = state.db()?;
+
+    let tag_list: Vec<Tag> = tags::table.order(tags::label.asc()).load(&mut conn)?;
+
+    let usage_rows: Vec<(Uuid, i64)> = document_tags::table
+        .group_by(document_tags::tag_id)
+        .select((document_tags::tag_id, count_star()))
+        .load(&mut conn)?;
+
+    let usage_map: HashMap<Uuid, i64> = usage_rows.into_iter().collect();
+
+    let response = tag_list
+        .into_iter()
+        .map(|tag| TagCatalogEntry {
+            id: tag.id,
+            label: tag.label,
+            color: tag.color,
+            usage_count: *usage_map.get(&tag.id).unwrap_or(&0),
+        })
+        .collect();
+
+    Ok(Json(response))
+}
+
+pub async fn create_tag(
+    State(state): State<AppState>,
+    Json(payload): Json<CreateTagRequest>,
+) -> AppResult<Json<TagCatalogEntry>> {
+    if payload.label.trim().is_empty() {
+        return Err(AppError::bad_request("label must not be empty"));
+    }
+
+    let mut conn = state.db()?;
+    let new_tag = NewTag {
+        id: Uuid::new_v4(),
+        label: payload.label.trim().to_string(),
+        color: payload.color,
+    };
+
+    match diesel::insert_into(tags::table)
+        .values(&new_tag)
+        .execute(&mut conn)
+    {
+        Ok(_) => {}
+        Err(diesel::result::Error::DatabaseError(
+            diesel::result::DatabaseErrorKind::UniqueViolation,
+            _,
+        )) => {
+            return Err(AppError::bad_request("tag label already exists"));
+        }
+        Err(err) => return Err(AppError::from(err)),
+    }
+
+    let tag: Tag = tags::table.find(new_tag.id).first(&mut conn)?;
+    Ok(Json(TagCatalogEntry {
+        id: tag.id,
+        label: tag.label,
+        color: tag.color,
+        usage_count: 0,
+    }))
+}
+
+pub async fn update_tag(
+    State(state): State<AppState>,
+    Path(tag_id): Path<Uuid>,
+    Json(body): Json<Value>,
+) -> AppResult<Json<TagCatalogEntry>> {
+    let mut conn = state.db()?;
+    let existing: Tag = tags::table.find(tag_id).first(&mut conn)?;
+    let label_class = classify_nullable(body.get("label")).map_err(AppError::bad_request)?;
+    let color_class = classify_nullable(body.get("color")).map_err(AppError::bad_request)?;
+
+    if matches!(label_class, NullableValue::Omitted)
+        && matches!(color_class, NullableValue::Omitted)
+    {
+        let usage_count: i64 = document_tags::table
+            .filter(document_tags::tag_id.eq(tag_id))
+            .select(count_star())
+            .first(&mut conn)?;
+        return Ok(Json(TagCatalogEntry {
+            id: existing.id,
+            label: existing.label.clone(),
+            color: existing.color.clone(),
+            usage_count,
+        }));
+    }
+
+    let mut new_label: Option<String> = None;
+    let mut label_changed = false;
+    match label_class {
+        NullableValue::Omitted => {}
+        NullableValue::Null => {
+            return Err(AppError::bad_request("label cannot be null"));
+        }
+        NullableValue::String(value) => {
+            let trimmed = value.trim();
+            if trimmed.is_empty() {
+                return Err(AppError::bad_request("label must not be empty"));
+            }
+            if trimmed != existing.label {
+                let duplicate = tags::table
+                    .filter(tags::label.eq(trimmed))
+                    .filter(tags::id.ne(tag_id))
+                    .first::<Tag>(&mut conn)
+                    .optional()?;
+                if duplicate.is_some() {
+                    return Err(AppError::bad_request("tag label already exists"));
+                }
+                new_label = Some(trimmed.to_string());
+                label_changed = true;
+            }
+        }
+    }
+
+    let mut color_change: Option<Option<String>> = None;
+    let mut color_changed = false;
+    match color_class {
+        NullableValue::Omitted => {}
+        NullableValue::Null => {
+            color_change = Some(None);
+            color_changed = true;
+        }
+        NullableValue::String(value) => {
+            let trimmed = value.trim();
+            if trimmed.is_empty() {
+                return Err(AppError::bad_request("color must not be empty"));
+            }
+            if existing.color.as_deref() != Some(trimmed) {
+                color_change = Some(Some(trimmed.to_string()));
+                color_changed = true;
+            }
+        }
+    }
+
+    if !label_changed && !color_changed {
+        let usage_count: i64 = document_tags::table
+            .filter(document_tags::tag_id.eq(tag_id))
+            .select(count_star())
+            .first(&mut conn)?;
+        return Ok(Json(TagCatalogEntry {
+            id: existing.id,
+            label: existing.label.clone(),
+            color: existing.color.clone(),
+            usage_count,
+        }));
+    }
+
+    let changeset = UpdateTagChangeset {
+        label: new_label.as_deref(),
+        color: color_change
+            .as_ref()
+            .map(|opt| opt.as_ref().map(|value| value.as_str())),
+    };
+
+    diesel::update(tags::table.find(tag_id))
+        .set(&changeset)
+        .execute(&mut conn)?;
+
+    let updated: Tag = tags::table.find(tag_id).first(&mut conn)?;
+    let usage_count: i64 = document_tags::table
+        .filter(document_tags::tag_id.eq(tag_id))
+        .select(count_star())
+        .first(&mut conn)?;
+
+    Ok(Json(TagCatalogEntry {
+        id: updated.id,
+        label: updated.label,
+        color: updated.color,
+        usage_count,
+    }))
+}
+
+pub async fn delete_tag(
+    State(state): State<AppState>,
+    Path(tag_id): Path<Uuid>,
+) -> AppResult<impl axum::response::IntoResponse> {
+    let mut conn = state.db()?;
+
+    let usage: i64 = document_tags::table
+        .filter(document_tags::tag_id.eq(tag_id))
+        .select(count_star())
+        .first(&mut conn)?;
+
+    if usage > 0 {
+        return Err(AppError::bad_request(
+            "cannot delete tag that is still assigned to documents",
+        ));
+    }
+
+    let deleted = diesel::delete(tags::table.find(tag_id)).execute(&mut conn)?;
+    if deleted == 0 {
+        return Err(AppError::not_found());
+    }
+
+    Ok(StatusCode::NO_CONTENT)
+}

backend/src/routes/webdav/mod.rs

@@ -0,0 +1,808 @@
+use std::time::Duration;
+
+use axum::body::Body;
+use axum::extract::State;
+use axum::http::{header, HeaderMap, Method, StatusCode};
+use axum::response::Response;
+use axum::Router;
+use base64::engine::general_purpose::STANDARD as BASE64;
+use base64::Engine;
+use diesel::prelude::*;
+use diesel::PgConnection;
+use futures_util::StreamExt;
+use percent_encoding::{percent_decode_str, utf8_percent_encode, NON_ALPHANUMERIC};
+use quick_xml::events::{BytesDecl, BytesEnd, BytesStart, BytesText, Event};
+use quick_xml::Writer;
+use uuid::Uuid;
+
+use crate::auth::password;
+use crate::error::{AppError, AppResult};
+use crate::models::{Document, DocumentVersion, Folder, User};
+use crate::schema::{
+    document_versions::dsl as document_versions_dsl, documents::dsl as documents_dsl,
+    folders::dsl as folders_dsl, users::dsl as users_dsl,
+};
+use crate::state::AppState;
+
+const REALM: &str = "Papercrate WebDAV";
+const DOWNLOAD_URL_TTL_SECONDS: u64 = 300;
+
+#[derive(Clone, Debug)]
+struct WebDavUser {
+    _user_id: Uuid,
+    _username: String,
+}
+
+pub fn create_router() -> Router<AppState> {
+    Router::new().fallback(webdav_entrypoint)
+}
+
+async fn webdav_entrypoint(
+    State(state): State<AppState>,
+    req: axum::http::Request<axum::body::Body>,
+) -> Result<Response, AppError> {
+    let method = req.method().clone();
+    let headers = req.headers().clone();
+    let path = req.uri().path().trim_start_matches('/').to_string();
+
+    tracing::debug!(method = %method, %path, "webdav entrypoint" );
+
+    match method {
+        ref m if m == Method::OPTIONS => Ok(handle_options()),
+        ref m if m == Method::GET => handle_get_or_head(&state, &path, headers, Method::GET).await,
+        ref m if m == Method::HEAD => {
+            handle_get_or_head(&state, &path, headers, Method::HEAD).await
+        }
+        _ => {
+            if method.as_str() == "PROPFIND" {
+                handle_propfind(&state, &path, headers).await
+            } else {
+                Ok(method_not_allowed())
+            }
+        }
+    }
+}
+
+async fn handle_propfind(
+    state: &AppState,
+    path: &str,
+    headers: HeaderMap,
+) -> Result<Response, AppError> {
+    let _user = match authenticate(state, &headers)? {
+        Some(user) => user,
+        None => return Ok(unauthorized_response()),
+    };
+
+    let depth = match parse_depth(&headers) {
+        Ok(value) => value,
+        Err(response) => return Ok(response),
+    };
+
+    let segments = parse_segments(path)?;
+    let resolution = match resolve_path(state, &segments)? {
+        Some(resolved) => resolved,
+        None => return Ok(not_found_response()),
+    };
+
+    let resources = match resolution {
+        ResolvedPath::Root => {
+            let contents = fetch_folder_contents(state, None)?;
+            build_resources_for_folder(None, &[], &contents, depth)
+        }
+        ResolvedPath::Folder { folder, chain } => {
+            let contents = fetch_folder_contents(state, Some(folder.id))?;
+            build_resources_for_folder(Some(&folder), &chain, &contents, depth)
+        }
+        ResolvedPath::Document {
+            document,
+            version,
+            chain,
+        } => build_resources_for_document(&chain, &document, &version),
+    };
+
+    let body = render_multistatus(&resources)
+        .map_err(|err| AppError::internal(format!("failed to render WebDAV response: {err}")))?;
+
+    let response = Response::builder()
+        .status(multi_status())
+        .header(header::CONTENT_TYPE, "application/xml; charset=utf-8")
+        .body(Body::from(body))
+        .expect("valid response");
+
+    Ok(response)
+}
+
+async fn handle_get_or_head(
+    state: &AppState,
+    path: &str,
+    headers: HeaderMap,
+    method: Method,
+) -> Result<Response, AppError> {
+    let _user = match authenticate(state, &headers)? {
+        Some(user) => user,
+        None => return Ok(unauthorized_response()),
+    };
+
+    let segments = parse_segments(path)?;
+    let resolution = match resolve_path(state, &segments)? {
+        Some(resolved) => resolved,
+        None => return Ok(not_found_response()),
+    };
+
+    let (document, version, chain) = match resolution {
+        ResolvedPath::Document {
+            document,
+            version,
+            chain,
+        } => (document, version, chain),
+        _ => return Ok(method_not_allowed()),
+    };
+
+    stream_document(state, &document, &version, &chain, headers, method).await
+}
+
+fn handle_options() -> Response {
+    Response::builder()
+        .status(StatusCode::OK)
+        .header("DAV", "1,2")
+        .header(header::ALLOW, "OPTIONS, PROPFIND, GET, HEAD")
+        .header("Accept-Ranges", "bytes")
+        .body(Body::empty())
+        .expect("valid OPTIONS response")
+}
+
+fn method_not_allowed() -> Response {
+    Response::builder()
+        .status(StatusCode::METHOD_NOT_ALLOWED)
+        .body(Body::empty())
+        .expect("valid response")
+}
+
+fn not_found_response() -> Response {
+    Response::builder()
+        .status(StatusCode::NOT_FOUND)
+        .body(Body::empty())
+        .expect("valid response")
+}
+
+fn unauthorized_response() -> Response {
+    Response::builder()
+        .status(StatusCode::UNAUTHORIZED)
+        .header(
+            header::WWW_AUTHENTICATE,
+            format!("Basic realm=\"{REALM}\", charset=\"UTF-8\""),
+        )
+        .body(Body::empty())
+        .expect("valid response")
+}
+
+fn multi_status() -> StatusCode {
+    StatusCode::from_u16(207).expect("valid multi-status")
+}
+
+fn parse_depth(headers: &HeaderMap) -> Result<u8, Response> {
+    match headers.get("Depth") {
+        None => Ok(1),
+        Some(value) => match value.to_str() {
+            Ok("0") => Ok(0),
+            Ok("1") => Ok(1),
+            Ok("infinity") => Err(Response::builder()
+                .status(StatusCode::FORBIDDEN)
+                .body(Body::empty())
+                .expect("valid response")),
+            _ => Err(Response::builder()
+                .status(StatusCode::BAD_REQUEST)
+                .body(Body::empty())
+                .expect("valid response")),
+        },
+    }
+}
+
+fn parse_segments(path: &str) -> AppResult<Vec<String>> {
+    if path.trim_matches('/').is_empty() {
+        return Ok(vec![]);
+    }
+
+    let segments = path
+        .split('/')
+        .filter(|segment| !segment.is_empty())
+        .map(|segment| {
+            percent_decode_str(segment)
+                .decode_utf8()
+                .map(|cow| cow.into_owned())
+                .map_err(|_| AppError::bad_request("invalid UTF-8 in path"))
+        })
+        .collect::<Result<Vec<_>, _>>()?;
+
+    Ok(segments)
+}
+
+fn fetch_folder_contents(
+    state: &AppState,
+    folder_id: Option<Uuid>,
+) -> AppResult<WebDavFolderContents> {
+    let mut conn = state.db()?;
+
+    let folder = match folder_id {
+        Some(id) => Some(folders_dsl::folders.find(id).first::<Folder>(&mut conn)?),
+        None => None,
+    };
+
+    let subfolders: Vec<Folder> = match folder_id {
+        Some(id) => folders_dsl::folders
+            .filter(folders_dsl::parent_id.eq(Some(id)))
+            .order(folders_dsl::name.asc())
+            .load(&mut conn)?,
+        None => folders_dsl::folders
+            .filter(folders_dsl::parent_id.is_null())
+            .order(folders_dsl::name.asc())
+            .load(&mut conn)?,
+    };
+
+    let mut docs_query = documents_dsl::documents
+        .filter(documents_dsl::deleted_at.is_null())
+        .into_boxed();
+
+    docs_query = match folder_id {
+        Some(id) => docs_query.filter(documents_dsl::folder_id.eq(Some(id))),
+        None => docs_query.filter(documents_dsl::folder_id.is_null()),
+    };
+
+    let documents: Vec<Document> = docs_query
+        .order(documents_dsl::uploaded_at.desc())
+        .load(&mut conn)?;
+
+    let version_ids: Vec<Uuid> = documents.iter().map(|doc| doc.current_version_id).collect();
+    let versions: Vec<DocumentVersion> = if version_ids.is_empty() {
+        Vec::new()
+    } else {
+        document_versions_dsl::document_versions
+            .filter(document_versions_dsl::id.eq_any(&version_ids))
+            .load(&mut conn)?
+    };
+
+    let mut version_map = versions
+        .into_iter()
+        .map(|version| (version.id, version))
+        .collect::<std::collections::HashMap<_, _>>();
+
+    let mut entries = Vec::with_capacity(documents.len());
+    for document in documents {
+        if let Some(version) = version_map.remove(&document.current_version_id) {
+            entries.push(DocumentEntry { document, version });
+        }
+    }
+
+    Ok(WebDavFolderContents {
+        _folder: folder,
+        subfolders,
+        documents: entries,
+    })
+}
+
+async fn stream_document(
+    state: &AppState,
+    document: &Document,
+    version: &DocumentVersion,
+    _chain: &[String],
+    headers: HeaderMap,
+    method: Method,
+) -> Result<Response, AppError> {
+    let range_header = headers.get(header::RANGE).cloned();
+
+    let url = state
+        .storage
+        .presign_get_object(
+            &version.s3_key,
+            Duration::from_secs(DOWNLOAD_URL_TTL_SECONDS),
+        )
+        .await
+        .map_err(|err| AppError::internal(format!("failed to presign document download: {err}")))?;
+
+    let client = reqwest::Client::new();
+    let mut request = client.request(method.clone(), url.clone());
+
+    if let Some(range) = range_header.clone() {
+        request = request.header(header::RANGE, range.clone());
+    }
+
+    let upstream = request
+        .send()
+        .await
+        .map_err(|err| AppError::internal(format!("failed to fetch document stream: {err}")))?;
+
+    let status =
+        StatusCode::from_u16(upstream.status().as_u16()).unwrap_or(StatusCode::BAD_GATEWAY);
+
+    if !(status.is_success() || status == StatusCode::PARTIAL_CONTENT) {
+        return Err(AppError::internal(format!(
+            "upstream download returned status {status}"
+        )));
+    }
+
+    let mut builder = Response::builder().status(status);
+
+    if let Some(content_type) = upstream.headers().get(header::CONTENT_TYPE) {
+        builder = builder.header(header::CONTENT_TYPE, content_type);
+    } else if let Some(ref typ) = document.content_type {
+        builder = builder.header(header::CONTENT_TYPE, typ);
+    }
+
+    if let Some(content_length) = upstream.headers().get(header::CONTENT_LENGTH) {
+        builder = builder.header(header::CONTENT_LENGTH, content_length);
+    }
+
+    if let Some(range) = upstream.headers().get(header::CONTENT_RANGE) {
+        builder = builder.header(header::CONTENT_RANGE, range);
+    }
+
+    builder = builder.header("Accept-Ranges", "bytes");
+
+    if let Some(disposition) = content_disposition(&document.filename) {
+        builder = builder.header(header::CONTENT_DISPOSITION, disposition);
+    }
+
+    builder = builder.header(header::ETAG, format!("\"{}\"", version.id));
+
+    if method == Method::HEAD {
+        return builder
+            .body(Body::empty())
+            .map_err(|err| AppError::internal(format!("failed to build response: {err}")));
+    }
+
+    let stream = upstream
+        .bytes_stream()
+        .map(|chunk| chunk.map_err(|err| std::io::Error::new(std::io::ErrorKind::Other, err)));
+    let body = Body::from_stream(stream);
+
+    builder
+        .body(body)
+        .map_err(|err| AppError::internal(format!("failed to build response: {err}")))
+}
+
+fn authenticate(state: &AppState, headers: &HeaderMap) -> Result<Option<WebDavUser>, AppError> {
+    tracing::debug!("webdav authenticate invoked");
+    let authorization = match headers.get(header::AUTHORIZATION) {
+        Some(value) => match value.to_str() {
+            Ok(header) if header.starts_with("Basic ") => {
+                tracing::debug!("authorization header present");
+                &header[6..]
+            }
+            Ok(other) => {
+                tracing::warn!(header = %other, "non-basic authorization header");
+                return Ok(None);
+            }
+            Err(err) => {
+                tracing::warn!(error = %err, "invalid authorization header");
+                return Ok(None);
+            }
+        },
+        None => {
+            tracing::debug!("no authorization header");
+            return Ok(None);
+        }
+    };
+
+    let decoded = match BASE64.decode(authorization) {
+        Ok(bytes) => bytes,
+        Err(err) => {
+            tracing::warn!(error = %err, "failed to decode basic credentials");
+            return Ok(None);
+        }
+    };
+
+    let credential_str = match String::from_utf8(decoded) {
+        Ok(value) => value,
+        Err(err) => {
+            tracing::warn!(error = %err, "invalid utf-8 basic credentials");
+            return Ok(None);
+        }
+    };
+
+    let (username, password) = match credential_str.split_once(':') {
+        Some((username, password)) if !username.is_empty() => (username, password),
+        _ => return Ok(None),
+    };
+
+    tracing::debug!(%username, "attempting webdav login");
+    let mut conn = state.db()?;
+
+    let user: User = match users_dsl::users
+        .filter(users_dsl::username.eq(username))
+        .first(&mut conn)
+    {
+        Ok(user) => user,
+        Err(diesel::result::Error::NotFound) => {
+            tracing::warn!(%username, "webdav user not found");
+            return Ok(None);
+        }
+        Err(err) => return Err(AppError::from(err)),
+    };
+
+    let valid = password::verify_password(password, &user.password_hash)
+        .map_err(|_| AppError::internal("failed to verify password"))?;
+
+    if !valid {
+        tracing::warn!(%username, "webdav password invalid");
+        return Ok(None);
+    }
+
+    tracing::debug!(%username, "webdav login success");
+    Ok(Some(WebDavUser {
+        _user_id: user.id,
+        _username: user.username,
+    }))
+}
+
+fn build_resources_for_folder(
+    folder: Option<&Folder>,
+    chain: &[String],
+    contents: &WebDavFolderContents,
+    depth: u8,
+) -> Vec<DavResource> {
+    let mut resources = Vec::new();
+
+    let display_name = folder
+        .map(|folder| folder.name.clone())
+        .unwrap_or_else(|| "/".to_string());
+
+    let href = build_href(chain, true);
+    let last_modified = folder.map(|folder| format_http_date(folder.updated_at));
+
+    resources.push(DavResource {
+        href,
+        display_name,
+        is_collection: true,
+        content_length: None,
+        content_type: None,
+        last_modified,
+    });
+
+    if depth == 0 {
+        return resources;
+    }
+
+    for subfolder in &contents.subfolders {
+        let mut child_chain = chain.to_vec();
+        child_chain.push(subfolder.name.clone());
+        resources.push(DavResource {
+            href: build_href(&child_chain, true),
+            display_name: subfolder.name.clone(),
+            is_collection: true,
+            content_length: None,
+            content_type: None,
+            last_modified: Some(format_http_date(subfolder.updated_at)),
+        });
+    }
+
+    for entry in &contents.documents {
+        let mut child_chain = chain.to_vec();
+        child_chain.push(entry.document.filename.clone());
+        resources.push(document_to_resource(
+            &child_chain,
+            &entry.document,
+            &entry.version,
+        ));
+    }
+
+    resources
+}
+
+fn build_resources_for_document(
+    chain: &[String],
+    document: &Document,
+    version: &DocumentVersion,
+) -> Vec<DavResource> {
+    vec![document_to_resource(chain, document, version)]
+}
+
+fn document_to_resource(
+    chain: &[String],
+    document: &Document,
+    version: &DocumentVersion,
+) -> DavResource {
+    let href = build_href(chain, false);
+
+    DavResource {
+        href,
+        display_name: document.title.clone(),
+        is_collection: false,
+        content_length: Some(version.size_bytes),
+        content_type: document.content_type.clone(),
+        last_modified: Some(format_http_date(document.updated_at)),
+    }
+}
+
+fn build_href(names: &[String], is_collection: bool) -> String {
+    if names.is_empty() {
+        return "/".to_string();
+    }
+
+    let encoded = names
+        .iter()
+        .map(|name| utf8_percent_encode(name, NON_ALPHANUMERIC).to_string())
+        .collect::<Vec<_>>();
+
+    let mut path = format!("/{}", encoded.join("/"));
+    if is_collection && !path.ends_with('/') {
+        path.push('/');
+    }
+    path
+}
+
+fn render_multistatus(resources: &[DavResource]) -> Result<Vec<u8>, quick_xml::Error> {
+    let mut writer = Writer::new(Vec::new());
+    writer.write_event(Event::Decl(BytesDecl::new("1.0", Some("UTF-8"), None)))?;
+
+    let mut multistatus = BytesStart::new("D:multistatus");
+    multistatus.push_attribute(("xmlns:D", "DAV:"));
+    writer.write_event(Event::Start(multistatus))?;
+
+    for resource in resources {
+        writer.write_event(Event::Start(BytesStart::new("D:response")))?;
+
+        writer.write_event(Event::Start(BytesStart::new("D:href")))?;
+        writer.write_event(Event::Text(BytesText::new(&resource.href)))?;
+        writer.write_event(Event::End(BytesEnd::new("D:href")))?;
+
+        writer.write_event(Event::Start(BytesStart::new("D:propstat")))?;
+        writer.write_event(Event::Start(BytesStart::new("D:prop")))?;
+
+        writer.write_event(Event::Start(BytesStart::new("D:displayname")))?;
+        writer.write_event(Event::Text(BytesText::new(&resource.display_name)))?;
+        writer.write_event(Event::End(BytesEnd::new("D:displayname")))?;
+
+        writer.write_event(Event::Start(BytesStart::new("D:resourcetype")))?;
+        if resource.is_collection {
+            writer.write_event(Event::Empty(BytesStart::new("D:collection")))?;
+        }
+        writer.write_event(Event::End(BytesEnd::new("D:resourcetype")))?;
+
+        if let Some(length) = resource.content_length {
+            writer.write_event(Event::Start(BytesStart::new("D:getcontentlength")))?;
+            writer.write_event(Event::Text(BytesText::new(&length.to_string())))?;
+            writer.write_event(Event::End(BytesEnd::new("D:getcontentlength")))?;
+        }
+
+        if let Some(content_type) = &resource.content_type {
+            writer.write_event(Event::Start(BytesStart::new("D:getcontenttype")))?;
+            writer.write_event(Event::Text(BytesText::new(content_type)))?;
+            writer.write_event(Event::End(BytesEnd::new("D:getcontenttype")))?;
+        }
+
+        if let Some(last_modified) = &resource.last_modified {
+            writer.write_event(Event::Start(BytesStart::new("D:getlastmodified")))?;
+            writer.write_event(Event::Text(BytesText::new(last_modified)))?;
+            writer.write_event(Event::End(BytesEnd::new("D:getlastmodified")))?;
+        }
+
+        writer.write_event(Event::End(BytesEnd::new("D:prop")))?;
+
+        writer.write_event(Event::Start(BytesStart::new("D:status")))?;
+        writer.write_event(Event::Text(BytesText::new("HTTP/1.1 200 OK")))?;
+        writer.write_event(Event::End(BytesEnd::new("D:status")))?;
+
+        writer.write_event(Event::End(BytesEnd::new("D:propstat")))?;
+        writer.write_event(Event::End(BytesEnd::new("D:response")))?;
+    }
+
+    writer.write_event(Event::End(BytesEnd::new("D:multistatus")))?;
+    Ok(writer.into_inner())
+}
+
+fn format_http_date(value: chrono::NaiveDateTime) -> String {
+    let datetime = chrono::DateTime::<chrono::Utc>::from_naive_utc_and_offset(value, chrono::Utc);
+    datetime.format("%a, %d %b %Y %H:%M:%S GMT").to_string()
+}
+
+fn content_disposition(filename: &str) -> Option<String> {
+    if filename.is_empty() {
+        return None;
+    }
+
+    let sanitized: String = filename
+        .chars()
+        .map(|ch| match ch {
+            '"' | '\\' => '_',
+            _ => ch,
+        })
+        .collect();
+
+    let encoded =
+        percent_encoding::utf8_percent_encode(&sanitized, percent_encoding::NON_ALPHANUMERIC);
+    Some(format!(
+        "inline; filename=\"{}\"; filename*=UTF-8''{}",
+        sanitized, encoded
+    ))
+}
+
+struct WebDavFolderContents {
+    _folder: Option<Folder>,
+    subfolders: Vec<Folder>,
+    documents: Vec<DocumentEntry>,
+}
+
+struct DocumentEntry {
+    document: Document,
+    version: DocumentVersion,
+}
+
+struct DavResource {
+    href: String,
+    display_name: String,
+    is_collection: bool,
+    content_length: Option<i64>,
+    content_type: Option<String>,
+    last_modified: Option<String>,
+}
+
+enum ResolvedPath {
+    Root,
+    Folder {
+        folder: Folder,
+        chain: Vec<String>,
+    },
+    Document {
+        document: Document,
+        version: DocumentVersion,
+        chain: Vec<String>,
+    },
+}
+
+fn resolve_path(state: &AppState, segments: &[String]) -> AppResult<Option<ResolvedPath>> {
+    if segments.is_empty() {
+        return Ok(Some(ResolvedPath::Root));
+    }
+
+    let mut conn = state.db()?;
+    let mut parent_id: Option<Uuid> = None;
+    let mut chain: Vec<String> = Vec::new();
+    let mut current_folder: Option<Folder> = None;
+
+    for (index, segment) in segments.iter().enumerate() {
+        let is_last = index == segments.len() - 1;
+
+        match find_folder_by_name(&mut conn, parent_id, segment)? {
+            Some(folder) => {
+                if is_last {
+                    chain.push(folder.name.clone());
+                    return Ok(Some(ResolvedPath::Folder { folder, chain }));
+                }
+
+                parent_id = Some(folder.id);
+                chain.push(folder.name.clone());
+                current_folder = Some(folder);
+                continue;
+            }
+            None => {}
+        }
+
+        if is_last {
+            if let Some((document, version)) =
+                find_document_by_filename(&mut conn, parent_id, segment)?
+            {
+                chain.push(document.filename.clone());
+                return Ok(Some(ResolvedPath::Document {
+                    document,
+                    version,
+                    chain,
+                }));
+            }
+        }
+
+        if let Ok(uuid) = Uuid::parse_str(segment) {
+            if let Some(folder) = folders_dsl::folders
+                .find(uuid)
+                .first::<Folder>(&mut conn)
+                .optional()?
+            {
+                if folder.parent_id != parent_id {
+                    return Ok(None);
+                }
+                if !is_last {
+                    parent_id = Some(folder.id);
+                    chain.push(folder.name.clone());
+                    current_folder = Some(folder);
+                    continue;
+                } else {
+                    chain.push(folder.name.clone());
+                    return Ok(Some(ResolvedPath::Folder { folder, chain }));
+                }
+            }
+
+            if let Some((document, version)) = find_document_by_id(&mut conn, uuid)? {
+                if document.folder_id != parent_id {
+                    return Ok(None);
+                }
+                chain.push(document.filename.clone());
+                return Ok(Some(ResolvedPath::Document {
+                    document,
+                    version,
+                    chain,
+                }));
+            }
+        }
+
+        if is_last {
+            if let Some((document, version)) =
+                find_document_by_filename(&mut conn, parent_id, segment)?
+            {
+                chain.push(document.filename.clone());
+                return Ok(Some(ResolvedPath::Document {
+                    document,
+                    version,
+                    chain,
+                }));
+            }
+        }
+
+        return Ok(None);
+    }
+
+    Ok(current_folder.map(|folder| ResolvedPath::Folder { folder, chain }))
+}
+
+fn find_folder_by_name(
+    conn: &mut PgConnection,
+    parent_id: Option<Uuid>,
+    name: &str,
+) -> AppResult<Option<Folder>> {
+    let result = match parent_id {
+        Some(parent) => folders_dsl::folders
+            .filter(folders_dsl::parent_id.eq(Some(parent)))
+            .filter(folders_dsl::name.eq(name))
+            .first::<Folder>(conn)
+            .optional()?,
+        None => folders_dsl::folders
+            .filter(folders_dsl::parent_id.is_null())
+            .filter(folders_dsl::name.eq(name))
+            .first::<Folder>(conn)
+            .optional()?,
+    };
+
+    Ok(result)
+}
+
+fn find_document_by_filename(
+    conn: &mut PgConnection,
+    parent_id: Option<Uuid>,
+    filename: &str,
+) -> AppResult<Option<(Document, DocumentVersion)>> {
+    let mut query = documents_dsl::documents
+        .filter(documents_dsl::deleted_at.is_null())
+        .filter(documents_dsl::filename.eq(filename))
+        .into_boxed();
+
+    query = match parent_id {
+        Some(parent) => query.filter(documents_dsl::folder_id.eq(Some(parent))),
+        None => query.filter(documents_dsl::folder_id.is_null()),
+    };
+
+    if let Some(document) = query.first::<Document>(conn).optional()? {
+        let version = document_versions_dsl::document_versions
+            .find(document.current_version_id)
+            .first::<DocumentVersion>(conn)?;
+        return Ok(Some((document, version)));
+    }
+
+    Ok(None)
+}
+
+fn find_document_by_id(
+    conn: &mut PgConnection,
+    document_id: Uuid,
+) -> AppResult<Option<(Document, DocumentVersion)>> {
+    if let Some(document) = documents_dsl::documents
+        .filter(documents_dsl::deleted_at.is_null())
+        .find(document_id)
+        .first::<Document>(conn)
+        .optional()?
+    {
+        let version = document_versions_dsl::document_versions
+            .find(document.current_version_id)
+            .first::<DocumentVersion>(conn)?;
+        return Ok(Some((document, version)));
+    }
+
+    Ok(None)
+}