Feat/paperless attachement links

backend/app/api/handlers/v1/controller.go

@@ -15,6 +15,7 @@ import (
 	"github.com/sysadminsmedia/homebox/backend/internal/core/services/reporting/eventbus"
 	"github.com/sysadminsmedia/homebox/backend/internal/data/repo"
 	"github.com/sysadminsmedia/homebox/backend/internal/sys/config"
+	"github.com/sysadminsmedia/homebox/backend/internal/sys/validate"
 
 	"github.com/olahol/melody"
 )
@@ -78,18 +79,19 @@ func WithURL(url string) func(*V1Controller) {
 }
 
 type V1Controller struct {
-	cookieSecure      bool
-	repo              *repo.AllRepos
-	svc               *services.AllServices
-	maxUploadSize     int64
-	maxImportSize     int64
-	maxParseMemory    int64
-	isDemo            bool
-	allowRegistration bool
-	bus               *eventbus.EventBus
-	url               string
-	config            *config.Config
-	oidcProvider      *providers.OIDCProvider
+	cookieSecure              bool
+	repo                      *repo.AllRepos
+	svc                       *services.AllServices
+	maxUploadSize             int64
+	maxImportSize             int64
+	maxParseMemory            int64
+	isDemo                    bool
+	allowRegistration         bool
+	bus                       *eventbus.EventBus
+	url                       string
+	config                    *config.Config
+	oidcProvider              *providers.OIDCProvider
+	integrationProxyTransport *http.Transport
 }
 
 type (
@@ -129,11 +131,12 @@ type (
 
 func NewControllerV1(svc *services.AllServices, repos *repo.AllRepos, bus *eventbus.EventBus, config *config.Config, options ...func(*V1Controller)) *V1Controller {
 	ctrl := &V1Controller{
-		repo:              repos,
-		svc:               svc,
-		allowRegistration: true,
-		bus:               bus,
-		config:            config,
+		repo:                      repos,
+		svc:                       svc,
+		allowRegistration:         true,
+		bus:                       bus,
+		config:                    config,
+		integrationProxyTransport: validate.NewOutboundHTTPTransport(&config.Notifier),
 	}
 
 	for _, opt := range options {

backend/app/api/handlers/v1/v1_ctrl_integration_proxy.go

@@ -0,0 +1,181 @@
+package v1
+
+import (
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"path"
+	"regexp"
+	"strings"
+	"time"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/hay-kot/httpkit/errchain"
+	"github.com/rs/zerolog/log"
+	"github.com/sysadminsmedia/homebox/backend/internal/core/services"
+	"github.com/sysadminsmedia/homebox/backend/internal/sys/validate"
+	"go.opentelemetry.io/otel/attribute"
+)
+
+// validIntegrationName restricts integration names to safe lower-case identifiers,
+// preventing settings-key injection (e.g. "../../evil").
+var validIntegrationName = regexp.MustCompile(`^[a-z][a-z0-9_-]{0,31}$`)
+
+func (ctrl *V1Controller) integrationProxyHTTPClient() *http.Client {
+	transport := ctrl.integrationProxyTransport
+	if transport == nil {
+		transport = validate.NewOutboundHTTPTransport(&ctrl.config.Notifier)
+	}
+
+	return &http.Client{
+		Timeout:   30 * time.Second,
+		Transport: transport,
+		CheckRedirect: func(req *http.Request, _ []*http.Request) error {
+			if err := validate.ValidateOutboundHTTPURLWithContext(req.Context(), req.URL.String(), &ctrl.config.Notifier); err != nil {
+				return fmt.Errorf("integration proxy redirect blocked: %w", err)
+			}
+			return nil
+		},
+	}
+}
+
+// HandleIntegrationProxy godoc
+//
+//	@Summary		Integration Reverse Proxy
+//	@Description	Proxies a single GET request to a configured external integration.
+//				The integration's credentials (base URL + API token) are read from
+//				user settings ({name}_url / {name}_token) and never exposed to the
+//				frontend. The current frontend uses this for Paperless-style token
+//				authentication.
+//	@Tags			Integrations
+//	@Produce		*/*
+//	@Param			name	path	string	true	"Integration name, e.g. paperless"
+//	@Param			path	query	string	true	"Relative API path on the upstream service, must start with /"
+//	@Success		200
+//	@Failure		400	{object}	validate.ErrorResponse
+//	@Failure		502	{object}	validate.ErrorResponse
+//	@Router			/v1/integrations/{name}/proxy [GET]
+//	@Security		Bearer
+func (ctrl *V1Controller) HandleIntegrationProxy() errchain.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) error {
+		spanCtx, span := startEntityCtrlSpan(r.Context(), "controller.V1.HandleIntegrationProxy")
+		defer span.End()
+
+		name := chi.URLParam(r, "name")
+		if !validIntegrationName.MatchString(name) {
+			return validate.NewRequestError(fmt.Errorf("invalid integration name"), http.StatusBadRequest)
+		}
+
+		rawPath := r.URL.Query().Get("path")
+		if rawPath == "" {
+			return validate.NewRequestError(fmt.Errorf("path query parameter is required"), http.StatusBadRequest)
+		}
+		if !strings.HasPrefix(rawPath, "/") || strings.Contains(rawPath, "://") {
+			return validate.NewRequestError(fmt.Errorf("path must be a relative path starting with /"), http.StatusBadRequest)
+		}
+
+		// Normalise to prevent directory traversal while preserving trailing slash
+		// (many REST APIs treat /foo/1/ and /foo/1 differently).
+		cleanPath := path.Clean(rawPath)
+		if !strings.HasPrefix(cleanPath, "/") {
+			return validate.NewRequestError(fmt.Errorf("invalid path after normalisation"), http.StatusBadRequest)
+		}
+		if strings.HasSuffix(rawPath, "/") && !strings.HasSuffix(cleanPath, "/") {
+			cleanPath += "/"
+		}
+
+		span.SetAttributes(
+			attribute.String("integration.name", name),
+			attribute.String("integration.path", cleanPath),
+		)
+
+		ctx := services.NewContext(spanCtx)
+		settings, svcErr := ctrl.svc.User.GetSettings(ctx.Context, services.UseUserCtx(ctx.Context).ID)
+		if svcErr != nil {
+			return validate.NewRequestError(svcErr, http.StatusInternalServerError)
+		}
+
+		baseURL, _ := settings[name+"_url"].(string)
+		if baseURL == "" {
+			return validate.NewRequestError(
+				fmt.Errorf("%s_url not configured – add it in Settings", name),
+				http.StatusBadRequest,
+			)
+		}
+
+		upstream := strings.TrimRight(baseURL, "/") + cleanPath
+		if err := validate.ValidateOutboundHTTPURLWithContext(r.Context(), upstream, &ctrl.config.Notifier); err != nil {
+			return validate.NewRequestError(err, http.StatusBadRequest)
+		}
+
+		token, _ := settings[name+"_token"].(string)
+		if token == "" {
+			return validate.NewRequestError(
+				fmt.Errorf("%s_token not configured – add it in Settings", name),
+				http.StatusBadRequest,
+			)
+		}
+
+		req, err := http.NewRequestWithContext(r.Context(), http.MethodGet, upstream, nil)
+		if err != nil {
+			return validate.NewRequestError(err, http.StatusBadRequest)
+		}
+		req.Header.Set("Authorization", "Token "+token)
+
+		resp, err := ctrl.integrationProxyHTTPClient().Do(req)
+		if err != nil {
+			// Log only host+path to avoid leaking query strings or embedded credentials.
+			var safeURL string
+			if u, parseErr := url.Parse(upstream); parseErr == nil {
+				safeURL = u.Host + u.Path
+			}
+			log.Err(err).Str("integration", name).Str("upstream", safeURL).Msg("integration proxy: upstream request failed")
+			return validate.NewRequestError(err, http.StatusBadGateway)
+		}
+		defer func() { _ = resp.Body.Close() }()
+
+		if resp.StatusCode == http.StatusNotFound {
+			return validate.NewRequestError(fmt.Errorf("resource not found at upstream"), http.StatusNotFound)
+		}
+		if resp.StatusCode >= 400 {
+			return validate.NewRequestError(
+				fmt.Errorf("upstream returned %d", resp.StatusCode),
+				http.StatusBadGateway,
+			)
+		}
+
+		const maxResponseSize int64 = 10 * 1024 * 1024 // 10 MB
+
+		// Reject known-oversized responses before writing any bytes to the client.
+		if resp.ContentLength > maxResponseSize {
+			return validate.NewRequestError(
+				fmt.Errorf("upstream response too large (%d bytes)", resp.ContentLength),
+				http.StatusBadGateway,
+			)
+		}
+
+		// Buffer up to maxResponseSize+1 bytes so we can detect true truncation
+		// and return a clean 502 rather than a partial 200 with invalid JSON.
+		buf, readErr := io.ReadAll(io.LimitReader(resp.Body, maxResponseSize+1))
+		if readErr != nil {
+			log.Err(readErr).Str("integration", name).Msg("integration proxy: failed to read response")
+			return validate.NewRequestError(fmt.Errorf("failed to read upstream response"), http.StatusBadGateway)
+		}
+		if int64(len(buf)) > maxResponseSize {
+			log.Warn().Str("integration", name).Msg("integration proxy: upstream response exceeded 10 MB limit")
+			return validate.NewRequestError(
+				fmt.Errorf("upstream response exceeds 10 MB limit"),
+				http.StatusBadGateway,
+			)
+		}
+
+		if ct := resp.Header.Get("Content-Type"); ct != "" {
+			w.Header().Set("Content-Type", ct)
+		}
+		if _, writeErr := w.Write(buf); writeErr != nil {
+			log.Err(writeErr).Str("integration", name).Msg("integration proxy: failed to write response")
+		}
+		return nil
+	}
+}

backend/app/api/handlers/v1/v1_ctrl_integration_proxy_test.go

@@ -0,0 +1,29 @@
+package v1
+
+import (
+	"net/http"
+	"testing"
+
+	"github.com/sysadminsmedia/homebox/backend/internal/sys/config"
+)
+
+func TestIntegrationProxyHTTPClientValidatesRedirectTargets(t *testing.T) {
+	ctrl := &V1Controller{
+		config: &config.Config{
+			Notifier: config.NotifierConf{
+				BlockCloudMetadata: true,
+				Dns64Nets:          []string{"64:ff9b::/96", "64:ff9b:1::/48"},
+			},
+		},
+	}
+
+	client := ctrl.integrationProxyHTTPClient()
+	req, err := http.NewRequest(http.MethodGet, "http://169.254.169.254/latest/meta-data", nil)
+	if err != nil {
+		t.Fatalf("failed to build redirect request: %v", err)
+	}
+
+	if err := client.CheckRedirect(req, nil); err == nil {
+		t.Fatal("expected redirect to cloud metadata endpoint to be blocked")
+	}
+}

backend/app/api/routes.go

@@ -218,6 +218,9 @@ func (a *app) mountRoutes(r *chi.Mux, chain *errchain.ErrChain, repos *repo.AllR
 		r.Delete("/notifiers/{id}", chain.ToHandlerFunc(v1Ctrl.HandleDeleteNotifier(), userMW...))
 		r.Post("/notifiers/test", chain.ToHandlerFunc(v1Ctrl.HandlerNotifierTest(), append(userMW, a.notifierTestLimiter.middleware)...))
 
+		// Integration proxy endpoints
+		r.Get("/integrations/{name}/proxy", chain.ToHandlerFunc(v1Ctrl.HandleIntegrationProxy(), userMW...))
+
 		// Asset-Like endpoints
 		assetMW := []errchain.Middleware{
 			a.mwAuthToken,

backend/go.sum

@@ -133,6 +133,8 @@ github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1x
 github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5 h1:6xNmx7iTtyBRev0+D/Tv1FZd4SCg8axKApyNyRsAt/w=
+github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5/go.mod h1:KdCmV+x/BuvyMxRnYBlmVaq4OLiKW6iRQfvC62cvdkI=
 github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2 h1:aBangftG7EVZoUb69Os8IaYg++6uMOdKK83QtkkvJik=
 github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2/go.mod h1:qwXFYgsP6T7XnJtbKlf1HP8AjxZZyzxMmc+Lq5GjlU4=
 github.com/coder/websocket v1.8.14 h1:9L0p0iKiNOibykf283eHkKUHHrpG7f65OE3BhhO7v9g=

backend/internal/core/services/main_test.go

@@ -58,15 +58,24 @@ func MainNoExit(m *testing.M) int {
 		log.Fatalf("failed opening connection to sqlite: %v", err)
 	}
 
-	go func() {
-		_ = tbus.Run(context.Background())
-	}()
-
 	err = client.Schema.Create(context.Background())
 	if err != nil {
 		log.Fatalf("failed creating schema resources: %v", err)
 	}
 
+	busCtx, cancelBus := context.WithCancel(context.Background())
+	busErr := make(chan error, 1)
+	go func() {
+		busErr <- tbus.Run(busCtx)
+	}()
+	defer func() {
+		cancelBus()
+		if err := <-busErr; err != nil {
+			log.Printf("event bus error: %v", err)
+		}
+		_ = client.Close()
+	}()
+
 	tClient = client
 	tRepos = repo.New(tClient, tbus, config.Storage{
 		PrefixPath: "/",
@@ -93,8 +102,6 @@ func MainNoExit(m *testing.M) int {
 			ConnString: "file://" + os.TempDir(),
 		}, "mem://{{ .Topic }}", "sqlite3"),
 	)
-	defer func() { _ = client.Close() }()
-
 	bootstrap()
 	tCtx = Context{
 		Context: context.Background(),

backend/internal/core/services/service_group.go

@@ -34,18 +34,11 @@ func (svc *GroupService) CreateGroup(ctx Context, name string) (repo.Group, erro
 		return repo.Group{}, errors.New("user ID cannot be empty when creating a group")
 	}
 
-	group, err := svc.repos.Groups.GroupCreate(ctx.Context, name, ctx.UID)
+	group, err := svc.repos.Groups.GroupCreateWithEntityTypeDefaults(ctx.Context, name, ctx.UID)
 	if err != nil {
 		return repo.Group{}, err
 	}
 
-	// Unlike registration, this path doesn't seed default locations/tags, so
-	// nothing would lazily create the entity types — leaving the collection
-	// unable to create items or locations until a type was added by hand.
-	if err := ensureDefaultEntityTypes(ctx.Context, svc.repos, group.ID); err != nil {
-		return repo.Group{}, err
-	}
-
 	return group, nil
 }
 

backend/internal/core/services/service_items_attachments.go

@@ -2,8 +2,12 @@ package services
 
 import (
 	"context"
+	"crypto/sha256"
+	"encoding/hex"
 	"fmt"
 	"io"
+	"net/url"
+	"strings"
 
 	"github.com/google/uuid"
 	"github.com/rs/zerolog/log"
@@ -14,6 +18,23 @@ import (
 	"go.opentelemetry.io/otel/trace"
 )
 
+func redactExternalIdentifierForTrace(sourceType, externalID string) string {
+	if sourceType != "link" {
+		return externalID
+	}
+
+	u, err := url.Parse(strings.TrimSpace(externalID))
+	if err != nil {
+		return ""
+	}
+	u.User = nil
+	u.RawQuery = ""
+	u.Fragment = ""
+
+	pathHash := sha256.Sum256([]byte(u.EscapedPath()))
+	return fmt.Sprintf("%s://%s/path:%s", u.Scheme, u.Host, hex.EncodeToString(pathHash[:8]))
+}
+
 func (svc *EntityService) AttachmentPath(ctx context.Context, gid uuid.UUID, attachmentID uuid.UUID) (*ent.Attachment, error) {
 	ctx, span := entityServiceTracer().Start(ctx, "service.EntityService.AttachmentPath",
 		trace.WithAttributes(
@@ -120,7 +141,7 @@ func (svc *EntityService) AttachmentAddExternalLink(ctx Context, entityID uuid.U
 			attribute.String("group.id", ctx.GID.String()),
 			attribute.String("entity.id", entityID.String()),
 			attribute.String("integration.source_type", sourceType),
-			attribute.String("integration.external_id", externalID),
+			attribute.String("integration.external_id", redactExternalIdentifierForTrace(sourceType, externalID)),
 		))
 	defer span.End()
 	ctx.Context = spanCtx