[REQUEST] Per-folder authentication

[Porco-Rosso]

Is your feature request related to a problem? Please describe.
I would like to be able to set different passwords for different folders. As I understand, at the moment this can only be done globally.

Describe the solution you'd like
the .ivfi dotfile should be able to set a username and password that overides the global config settings for the folder and subfolders it resides in.

Describe alternatives you've considered
A less elegant way would be to put multiple authentication blocks in the config file, each specifying a specifc folder, however this would make adding new protected folders a pain, as the config file would need to be edited each time.

Additional context
No additional comments to add, apart from saying this indexer is pretty slick and I appreciate the documentation and ease of setup, even in php-based settings are easy to mess up.

[sixem]

Hi, thanks for the suggestion, and sorry for the late reply!

I like this idea, I'm just a bit uncertain of how it can be implemented. Problem is that .ivfi is often publicly accessible, so having to opportunity to go looking around there for a password, or even just a restricted username can be problematic.

I can think a bit about it. Maybe a way to declare users (and passwords) in the main configuration, and then having some sort of identifier set to each one of them, and then those IDs can be freely used as the scope of users in .ivfi... I'll think a bit about it!

Any further ideas are very much welcome.

[Porco-Rosso]

While that is a possible approach, for me personally it would defeat the intended purpose of being able to easily set passwords to folders.

In my use case, I often have images or files I want to share in a directory, but only to some people. I want to keep the friction as low as possible for both myself and for the recipient.
AKA: Create a folder, set a password for that folder and then be able to share a link.

If I need to go into the main config file everytime I add a folder and then need to define a new user and password, it will just be a headache.

The problem with the current [protected] folder mechanism is that you can only define a single password for all the protected folders, so segmentation is impossible.

How do .htaccess files work? Are they visible and only work for passwords by referring to password files outside of the webserver directory? or is there some way to stop nginx/apache from listing/serving certain files?

[Porco-Rosso]

Maybe it would be possible to use a hash of the password in .ivfi? or in the folder name (and then cut the hash from displaying on the folder listing?)
I'm not looking to protect the files from the NSA, so I'm not too concerned about people trying to brute-force a hash. Besides other tools like nextcloud are probably riddled with vulnerabilities anyway...