Initial gh-pages

backend/internal/auth/auth.go

@@ -0,0 +1,339 @@
+package auth
+
+import (
+	"context"
+	"crypto/subtle"
+	"encoding/base64"
+	"fmt"
+	"strings"
+
+	"Noooste/garage-ui/internal/config"
+
+	"github.com/coreos/go-oidc/v3/oidc"
+	"golang.org/x/oauth2"
+)
+
+// AuthService handles authentication operations
+type AuthService struct {
+	config       *config.AuthConfig
+	oidcProvider *oidc.Provider
+	oidcVerifier *oidc.IDTokenVerifier
+	oauth2Config *oauth2.Config
+	jwtService   *JWTService
+}
+
+// UserInfo represents authenticated user information
+type UserInfo struct {
+	Username string
+	Email    string
+	Name     string
+	Roles    []string
+}
+
+// NewAuthService creates a new authentication service
+func NewAuthService(cfg *config.AuthConfig) (*AuthService, error) {
+	jwtService, err := NewJWTService()
+	if err != nil {
+		return nil, fmt.Errorf("failed to initialize JWT service: %w", err)
+	}
+
+	service := &AuthService{
+		config:     cfg,
+		jwtService: jwtService,
+	}
+
+	// Initialize OIDC if enabled
+	if cfg.Mode == "oidc" && cfg.OIDC.Enabled {
+		if err := service.initOIDC(); err != nil {
+			return nil, fmt.Errorf("failed to initialize OIDC: %w", err)
+		}
+	}
+
+	return service, nil
+}
+
+// initOIDC initializes the OIDC provider and configuration
+func (a *AuthService) initOIDC() error {
+	ctx := context.Background()
+
+	// Create OIDC provider
+	provider, err := oidc.NewProvider(ctx, a.config.OIDC.IssuerURL)
+	if err != nil {
+		return fmt.Errorf("failed to create OIDC provider: %w", err)
+	}
+
+	a.oidcProvider = provider
+
+	// Create ID token verifier
+	verifierConfig := &oidc.Config{
+		ClientID:        a.config.OIDC.ClientID,
+		SkipIssuerCheck: a.config.OIDC.SkipIssuerCheck,
+		SkipExpiryCheck: a.config.OIDC.SkipExpiryCheck,
+	}
+	a.oidcVerifier = provider.Verifier(verifierConfig)
+
+	// Create OAuth2 config
+	a.oauth2Config = &oauth2.Config{
+		ClientID:     a.config.OIDC.ClientID,
+		ClientSecret: a.config.OIDC.ClientSecret,
+		Endpoint:     provider.Endpoint(),
+		Scopes:       a.config.OIDC.Scopes,
+	}
+
+	return nil
+}
+
+// ValidateBasicAuth validates basic authentication credentials
+func (a *AuthService) ValidateBasicAuth(username, password string) bool {
+	// Use constant-time comparison to prevent timing attacks
+	usernameMatch := subtle.ConstantTimeCompare(
+		[]byte(username),
+		[]byte(a.config.Basic.Username),
+	) == 1
+
+	passwordMatch := subtle.ConstantTimeCompare(
+		[]byte(password),
+		[]byte(a.config.Basic.Password),
+	) == 1
+
+	return usernameMatch && passwordMatch
+}
+
+// ParseBasicAuth parses the Authorization header for basic auth
+func ParseBasicAuth(authHeader string) (username, password string, ok bool) {
+	if authHeader == "" {
+		return "", "", false
+	}
+
+	// Check if it's a Basic auth header
+	const prefix = "Basic "
+	if !strings.HasPrefix(authHeader, prefix) {
+		return "", "", false
+	}
+
+	// Decode base64 credentials
+	encoded := authHeader[len(prefix):]
+	decoded, err := base64.StdEncoding.DecodeString(encoded)
+	if err != nil {
+		return "", "", false
+	}
+
+	// Split username:password
+	credentials := string(decoded)
+	parts := strings.SplitN(credentials, ":", 2)
+	if len(parts) != 2 {
+		return "", "", false
+	}
+
+	return parts[0], parts[1], true
+}
+
+// GetAuthorizationURL returns the OIDC authorization URL for login
+func (a *AuthService) GetAuthorizationURL(state string) (string, error) {
+	if a.oauth2Config == nil {
+		return "", fmt.Errorf("OIDC not initialized")
+	}
+
+	return a.oauth2Config.AuthCodeURL(state), nil
+}
+
+// ExchangeCode exchanges an authorization code for tokens
+func (a *AuthService) ExchangeCode(ctx context.Context, code string) (*oauth2.Token, error) {
+	if a.oauth2Config == nil {
+		return nil, fmt.Errorf("OIDC not initialized")
+	}
+
+	token, err := a.oauth2Config.Exchange(ctx, code)
+	if err != nil {
+		return nil, fmt.Errorf("failed to exchange code: %w", err)
+	}
+
+	return token, nil
+}
+
+// VerifyIDToken verifies an OIDC ID token and extracts user info
+func (a *AuthService) VerifyIDToken(ctx context.Context, rawIDToken string) (*UserInfo, error) {
+	if a.oidcVerifier == nil {
+		return nil, fmt.Errorf("OIDC not initialized")
+	}
+
+	// Verify the ID token
+	idToken, err := a.oidcVerifier.Verify(ctx, rawIDToken)
+	if err != nil {
+		return nil, fmt.Errorf("failed to verify ID token: %w", err)
+	}
+
+	// Extract claims
+	var claims map[string]interface{}
+	if err := idToken.Claims(&claims); err != nil {
+		return nil, fmt.Errorf("failed to parse claims: %w", err)
+	}
+
+	// Extract user information using configured attributes
+	userInfo := &UserInfo{
+		Username: extractClaim(claims, a.config.OIDC.UsernameAttribute),
+		Email:    extractClaim(claims, a.config.OIDC.EmailAttribute),
+		Name:     extractClaim(claims, a.config.OIDC.NameAttribute),
+	}
+
+	// Extract roles if configured
+	if a.config.OIDC.RoleAttributePath != "" {
+		userInfo.Roles = extractRoles(claims, a.config.OIDC.RoleAttributePath)
+	}
+
+	return userInfo, nil
+}
+
+// GetUserInfo retrieves user information from the OIDC provider
+func (a *AuthService) GetUserInfo(ctx context.Context, token *oauth2.Token) (*UserInfo, error) {
+	if a.oidcProvider == nil {
+		return nil, fmt.Errorf("OIDC not initialized")
+	}
+
+	// Create OAuth2 token source
+	tokenSource := a.oauth2Config.TokenSource(ctx, token)
+
+	// Get user info from the provider
+	userInfoEndpoint, err := a.oidcProvider.UserInfo(ctx, tokenSource)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get user info: %w", err)
+	}
+
+	// Extract claims
+	var claims map[string]interface{}
+	if err := userInfoEndpoint.Claims(&claims); err != nil {
+		return nil, fmt.Errorf("failed to parse user info claims: %w", err)
+	}
+
+	// Build user info
+	userInfo := &UserInfo{
+		Username: extractClaim(claims, a.config.OIDC.UsernameAttribute),
+		Email:    extractClaim(claims, a.config.OIDC.EmailAttribute),
+		Name:     extractClaim(claims, a.config.OIDC.NameAttribute),
+	}
+
+	// Extract roles if configured
+	if a.config.OIDC.RoleAttributePath != "" {
+		userInfo.Roles = extractRoles(claims, a.config.OIDC.RoleAttributePath)
+	}
+
+	return userInfo, nil
+}
+
+// IsAdmin checks if the user has admin role
+func (a *AuthService) IsAdmin(userInfo *UserInfo) bool {
+	if a.config.OIDC.AdminRole == "" {
+		return false
+	}
+
+	for _, role := range userInfo.Roles {
+		if role == a.config.OIDC.AdminRole {
+			return true
+		}
+	}
+
+	return false
+}
+
+// Helper functions
+
+// extractClaim extracts a string claim from the claims map
+func extractClaim(claims map[string]interface{}, key string) string {
+	if key == "" {
+		return ""
+	}
+
+	value, ok := claims[key]
+	if !ok {
+		return ""
+	}
+
+	str, ok := value.(string)
+	if !ok {
+		return ""
+	}
+
+	return str
+}
+
+// extractRoles extracts roles from nested claim path (e.g., "resource_access.garage-ui.roles")
+func extractRoles(claims map[string]interface{}, path string) []string {
+	if path == "" {
+		return nil
+	}
+
+	// Split the path by dots to navigate nested claims
+	parts := strings.Split(path, ".")
+
+	current := claims
+	for i, part := range parts {
+		value, ok := current[part]
+		if !ok {
+			return nil
+		}
+
+		if i == len(parts)-1 {
+			return extractStringArray(value)
+		}
+
+		// Navigate to next level
+		next, ok := value.(map[string]interface{})
+		if !ok {
+			return nil
+		}
+		current = next
+	}
+
+	return nil
+}
+
+// extractStringArray converts an interface{} to []string if possible
+func extractStringArray(value interface{}) []string {
+	// Try direct string array
+	if strArray, ok := value.([]string); ok {
+		return strArray
+	}
+
+	// Try interface array and convert to strings
+	if array, ok := value.([]interface{}); ok {
+		result := make([]string, 0, len(array))
+		for _, item := range array {
+			if str, ok := item.(string); ok {
+				result = append(result, str)
+			}
+		}
+		return result
+	}
+
+	return nil
+}
+
+// GenerateStateToken generates a secure CSRF state token
+func (a *AuthService) GenerateStateToken() (string, error) {
+	return a.jwtService.GenerateStateToken()
+}
+
+// ValidateAndConsumeState validates and consumes a CSRF state token
+func (a *AuthService) ValidateAndConsumeState(token string) bool {
+	return a.jwtService.ValidateAndConsumeState(token)
+}
+
+// GenerateSessionToken generates a JWT session token for the user
+func (a *AuthService) GenerateSessionToken(userInfo *UserInfo) (string, error) {
+	return a.jwtService.GenerateToken(userInfo, a.config.OIDC.SessionMaxAge)
+}
+
+// ValidateSessionToken validates a JWT session token and returns user info
+func (a *AuthService) ValidateSessionToken(tokenString string) (*UserInfo, error) {
+	claims, err := a.jwtService.ValidateToken(tokenString)
+	if err != nil {
+		return nil, err
+	}
+
+	return &UserInfo{
+		Username: claims.Username,
+		Email:    claims.Email,
+		Name:     claims.Name,
+		Roles:    claims.Roles,
+	}, nil
+}

backend/internal/auth/jwt.go

@@ -0,0 +1,163 @@
+package auth
+
+import (
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/x509"
+	"encoding/base64"
+	"encoding/pem"
+	"fmt"
+	"sync"
+	"time"
+
+	"github.com/golang-jwt/jwt/v5"
+)
+
+type JWTService struct {
+	privateKey *rsa.PrivateKey
+	publicKey  *rsa.PublicKey
+	stateStore *StateStore
+}
+
+type StateStore struct {
+	mu     sync.RWMutex
+	states map[string]StateData
+}
+
+type StateData struct {
+	Created   time.Time
+	ExpiresAt time.Time
+}
+
+type SessionClaims struct {
+	Username string   `json:"username"`
+	Email    string   `json:"email"`
+	Name     string   `json:"name"`
+	Roles    []string `json:"roles"`
+	jwt.RegisteredClaims
+}
+
+func NewJWTService() (*JWTService, error) {
+	privateKey, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		return nil, fmt.Errorf("failed to generate RSA key: %w", err)
+	}
+
+	return &JWTService{
+		privateKey: privateKey,
+		publicKey:  &privateKey.PublicKey,
+		stateStore: &StateStore{
+			states: make(map[string]StateData),
+		},
+	}, nil
+}
+
+func (j *JWTService) GenerateStateToken() (string, error) {
+	tokenBytes := make([]byte, 32)
+	if _, err := rand.Read(tokenBytes); err != nil {
+		return "", fmt.Errorf("failed to generate state token: %w", err)
+	}
+
+	token := base64.URLEncoding.EncodeToString(tokenBytes)
+
+	j.stateStore.mu.Lock()
+	defer j.stateStore.mu.Unlock()
+
+	now := time.Now()
+	j.stateStore.states[token] = StateData{
+		Created:   now,
+		ExpiresAt: now.Add(10 * time.Minute),
+	}
+
+	go j.cleanupExpiredStates()
+
+	return token, nil
+}
+
+func (j *JWTService) ValidateAndConsumeState(token string) bool {
+	j.stateStore.mu.Lock()
+	defer j.stateStore.mu.Unlock()
+
+	state, exists := j.stateStore.states[token]
+	if !exists {
+		return false
+	}
+
+	if time.Now().After(state.ExpiresAt) {
+		delete(j.stateStore.states, token)
+		return false
+	}
+
+	delete(j.stateStore.states, token)
+	return true
+}
+
+func (j *JWTService) cleanupExpiredStates() {
+	j.stateStore.mu.Lock()
+	defer j.stateStore.mu.Unlock()
+
+	now := time.Now()
+	for token, state := range j.stateStore.states {
+		if now.After(state.ExpiresAt) {
+			delete(j.stateStore.states, token)
+		}
+	}
+}
+
+func (j *JWTService) GenerateToken(userInfo *UserInfo, sessionMaxAge int) (string, error) {
+	now := time.Now()
+	expiresAt := now.Add(time.Duration(sessionMaxAge) * time.Second)
+
+	claims := SessionClaims{
+		Username: userInfo.Username,
+		Email:    userInfo.Email,
+		Name:     userInfo.Name,
+		Roles:    userInfo.Roles,
+		RegisteredClaims: jwt.RegisteredClaims{
+			IssuedAt:  jwt.NewNumericDate(now),
+			ExpiresAt: jwt.NewNumericDate(expiresAt),
+			NotBefore: jwt.NewNumericDate(now),
+		},
+	}
+
+	token := jwt.NewWithClaims(jwt.SigningMethodRS256, claims)
+	tokenString, err := token.SignedString(j.privateKey)
+	if err != nil {
+		return "", fmt.Errorf("failed to sign token: %w", err)
+	}
+
+	return tokenString, nil
+}
+
+func (j *JWTService) ValidateToken(tokenString string) (*SessionClaims, error) {
+	token, err := jwt.ParseWithClaims(tokenString, &SessionClaims{}, func(token *jwt.Token) (interface{}, error) {
+		if _, ok := token.Method.(*jwt.SigningMethodRSA); !ok {
+			return nil, fmt.Errorf("unexpected signing method: %v", token.Header["alg"])
+		}
+		return j.publicKey, nil
+	})
+
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse token: %w", err)
+	}
+
+	if claims, ok := token.Claims.(*SessionClaims); ok && token.Valid {
+		return claims, nil
+	}
+
+	return nil, fmt.Errorf("invalid token")
+}
+
+func (j *JWTService) GetPublicKeyPEM() (string, error) {
+	pubKeyBytes, err := x509.MarshalPKIXPublicKey(j.publicKey)
+	if err != nil {
+		return "", fmt.Errorf("failed to marshal public key: %w", err)
+	}
+
+	pubKeyPEM := pem.EncodeToMemory(&pem.Block{
+		Type:  "RSA PUBLIC KEY",
+		Bytes: pubKeyBytes,
+	})
+
+	return string(pubKeyPEM), nil
+}

backend/internal/config/config.go

@@ -0,0 +1,252 @@
+package config
+
+import (
+	"fmt"
+	"os"
+	"strings"
+
+	"github.com/spf13/viper"
+)
+
+// Config represents the application configuration
+type Config struct {
+	Server  ServerConfig  `mapstructure:"server"`
+	Garage  GarageConfig  `mapstructure:"garage"`
+	Auth    AuthConfig    `mapstructure:"auth"`
+	CORS    CORSConfig    `mapstructure:"cors"`
+	Logging LoggingConfig `mapstructure:"logging"`
+}
+
+// ServerConfig contains server-related configuration
+type ServerConfig struct {
+	Host         string `mapstructure:"host"`
+	Port         int    `mapstructure:"port"`
+	Environment  string `mapstructure:"environment"`
+	FrontendPath string `mapstructure:"frontend_path"` // Path to frontend dist directory
+}
+
+// GarageConfig contains Garage S3 connection settings
+type GarageConfig struct {
+	Endpoint       string `mapstructure:"endpoint"`
+	Region         string `mapstructure:"region"`
+	UseSSL         bool   `mapstructure:"use_ssl"`
+	ForcePathStyle bool   `mapstructure:"force_path_style"`
+	AdminEndpoint  string `mapstructure:"admin_endpoint"`
+	AdminToken     string `mapstructure:"admin_token"`
+}
+
+// AuthConfig contains authentication configuration
+type AuthConfig struct {
+	Mode  string          `mapstructure:"mode"` // "none", "basic", or "oidc"
+	Basic BasicAuthConfig `mapstructure:"basic"`
+	OIDC  OIDCConfig      `mapstructure:"oidc"`
+}
+
+// BasicAuthConfig contains basic authentication settings
+type BasicAuthConfig struct {
+	Username string `mapstructure:"username"`
+	Password string `mapstructure:"password"`
+}
+
+// OIDCConfig contains OIDC authentication settings
+type OIDCConfig struct {
+	Enabled           bool     `mapstructure:"enabled"`
+	ProviderName      string   `mapstructure:"provider_name"`
+	ClientID          string   `mapstructure:"client_id"`
+	ClientSecret      string   `mapstructure:"client_secret"`
+	Scopes            []string `mapstructure:"scopes"`
+	IssuerURL         string   `mapstructure:"issuer_url"`
+	AuthURL           string   `mapstructure:"auth_url"`
+	TokenURL          string   `mapstructure:"token_url"`
+	UserinfoURL       string   `mapstructure:"userinfo_url"`
+	SkipIssuerCheck   bool     `mapstructure:"skip_issuer_check"`
+	SkipExpiryCheck   bool     `mapstructure:"skip_expiry_check"`
+	EmailAttribute    string   `mapstructure:"email_attribute"`
+	UsernameAttribute string   `mapstructure:"username_attribute"`
+	NameAttribute     string   `mapstructure:"name_attribute"`
+	RoleAttributePath string   `mapstructure:"role_attribute_path"`
+	AdminRole         string   `mapstructure:"admin_role"`
+	TLSSkipVerify     bool     `mapstructure:"tls_skip_verify"`
+	SessionMaxAge     int      `mapstructure:"session_max_age"`
+	CookieName        string   `mapstructure:"cookie_name"`
+	CookieSecure      bool     `mapstructure:"cookie_secure"`
+	CookieHTTPOnly    bool     `mapstructure:"cookie_http_only"`
+	CookieSameSite    string   `mapstructure:"cookie_same_site"`
+}
+
+// CORSConfig contains CORS settings for frontend communication
+type CORSConfig struct {
+	Enabled          bool     `mapstructure:"enabled"`
+	AllowedOrigins   []string `mapstructure:"allowed_origins"`
+	AllowedMethods   []string `mapstructure:"allowed_methods"`
+	AllowedHeaders   []string `mapstructure:"allowed_headers"`
+	AllowCredentials bool     `mapstructure:"allow_credentials"`
+	MaxAge           int      `mapstructure:"max_age"`
+}
+
+// LoggingConfig contains logging configuration
+type LoggingConfig struct {
+	Level  string `mapstructure:"level"`
+	Format string `mapstructure:"format"`
+}
+
+// Load reads the configuration from the specified file
+func Load(configPath string) (*Config, error) {
+	// Set default config file name if not specified
+	if configPath == "" {
+		configPath = "config.yaml"
+	}
+
+	// Configure viper to read the config file
+	viper.SetConfigFile(configPath)
+	viper.SetConfigType("yaml")
+
+	// Allow environment variables to override config values
+	// Environment variables take precedence over config file
+	viper.AutomaticEnv()
+	viper.SetEnvPrefix("GARAGE_UI")
+	viper.SetEnvKeyReplacer(strings.NewReplacer(".", "_"))
+
+	// Bind environment variables to config keys
+	// This ensures env vars override config file values
+	bindEnvVars()
+
+	// Read the config file (optional - will use defaults and env vars if not found)
+	if _, err := os.Stat(configPath); err == nil {
+		if err := viper.ReadInConfig(); err != nil {
+			return nil, fmt.Errorf("error reading config file: %w", err)
+		}
+	}
+
+	// Unmarshal the config into the Config struct
+	var cfg Config
+	if err := viper.Unmarshal(&cfg); err != nil {
+		return nil, fmt.Errorf("error unmarshaling config: %w", err)
+	}
+
+	// Validate the configuration
+	if err := cfg.Validate(); err != nil {
+		return nil, fmt.Errorf("invalid configuration: %w", err)
+	}
+
+	return &cfg, nil
+}
+
+// bindEnvVars binds all environment variables to their corresponding config keys
+func bindEnvVars() {
+	// Server config
+	viper.BindEnv("server.host", "GARAGE_UI_SERVER_HOST")
+	viper.BindEnv("server.port", "GARAGE_UI_SERVER_PORT")
+	viper.BindEnv("server.environment", "GARAGE_UI_SERVER_ENVIRONMENT")
+	viper.BindEnv("server.frontend_path", "GARAGE_UI_SERVER_FRONTEND_PATH")
+
+	// Garage config
+	viper.BindEnv("garage.endpoint", "GARAGE_UI_GARAGE_ENDPOINT")
+	viper.BindEnv("garage.region", "GARAGE_UI_GARAGE_REGION")
+	viper.BindEnv("garage.use_ssl", "GARAGE_UI_GARAGE_USE_SSL")
+	viper.BindEnv("garage.force_path_style", "GARAGE_UI_GARAGE_FORCE_PATH_STYLE")
+	viper.BindEnv("garage.admin_endpoint", "GARAGE_UI_GARAGE_ADMIN_ENDPOINT")
+	viper.BindEnv("garage.admin_token", "GARAGE_UI_GARAGE_ADMIN_TOKEN")
+
+	// Auth config
+	viper.BindEnv("auth.mode", "GARAGE_UI_AUTH_MODE")
+	viper.BindEnv("auth.basic.username", "GARAGE_UI_AUTH_BASIC_USERNAME")
+	viper.BindEnv("auth.basic.password", "GARAGE_UI_AUTH_BASIC_PASSWORD")
+
+	// OIDC config
+	viper.BindEnv("auth.oidc.enabled", "GARAGE_UI_AUTH_OIDC_ENABLED")
+	viper.BindEnv("auth.oidc.provider_name", "GARAGE_UI_AUTH_OIDC_PROVIDER_NAME")
+	viper.BindEnv("auth.oidc.client_id", "GARAGE_UI_AUTH_OIDC_CLIENT_ID")
+	viper.BindEnv("auth.oidc.client_secret", "GARAGE_UI_AUTH_OIDC_CLIENT_SECRET")
+	viper.BindEnv("auth.oidc.scopes", "GARAGE_UI_AUTH_OIDC_SCOPES")
+	viper.BindEnv("auth.oidc.issuer_url", "GARAGE_UI_AUTH_OIDC_ISSUER_URL")
+	viper.BindEnv("auth.oidc.auth_url", "GARAGE_UI_AUTH_OIDC_AUTH_URL")
+	viper.BindEnv("auth.oidc.token_url", "GARAGE_UI_AUTH_OIDC_TOKEN_URL")
+	viper.BindEnv("auth.oidc.userinfo_url", "GARAGE_UI_AUTH_OIDC_USERINFO_URL")
+	viper.BindEnv("auth.oidc.skip_issuer_check", "GARAGE_UI_AUTH_OIDC_SKIP_ISSUER_CHECK")
+	viper.BindEnv("auth.oidc.skip_expiry_check", "GARAGE_UI_AUTH_OIDC_SKIP_EXPIRY_CHECK")
+	viper.BindEnv("auth.oidc.email_attribute", "GARAGE_UI_AUTH_OIDC_EMAIL_ATTRIBUTE")
+	viper.BindEnv("auth.oidc.username_attribute", "GARAGE_UI_AUTH_OIDC_USERNAME_ATTRIBUTE")
+	viper.BindEnv("auth.oidc.name_attribute", "GARAGE_UI_AUTH_OIDC_NAME_ATTRIBUTE")
+	viper.BindEnv("auth.oidc.role_attribute_path", "GARAGE_UI_AUTH_OIDC_ROLE_ATTRIBUTE_PATH")
+	viper.BindEnv("auth.oidc.admin_role", "GARAGE_UI_AUTH_OIDC_ADMIN_ROLE")
+	viper.BindEnv("auth.oidc.tls_skip_verify", "GARAGE_UI_AUTH_OIDC_TLS_SKIP_VERIFY")
+	viper.BindEnv("auth.oidc.session_max_age", "GARAGE_UI_AUTH_OIDC_SESSION_MAX_AGE")
+	viper.BindEnv("auth.oidc.cookie_name", "GARAGE_UI_AUTH_OIDC_COOKIE_NAME")
+	viper.BindEnv("auth.oidc.cookie_secure", "GARAGE_UI_AUTH_OIDC_COOKIE_SECURE")
+	viper.BindEnv("auth.oidc.cookie_http_only", "GARAGE_UI_AUTH_OIDC_COOKIE_HTTP_ONLY")
+	viper.BindEnv("auth.oidc.cookie_same_site", "GARAGE_UI_AUTH_OIDC_COOKIE_SAME_SITE")
+
+	// CORS config
+	viper.BindEnv("cors.enabled", "GARAGE_UI_CORS_ENABLED")
+	viper.BindEnv("cors.allowed_origins", "GARAGE_UI_CORS_ALLOWED_ORIGINS")
+	viper.BindEnv("cors.allowed_methods", "GARAGE_UI_CORS_ALLOWED_METHODS")
+	viper.BindEnv("cors.allowed_headers", "GARAGE_UI_CORS_ALLOWED_HEADERS")
+	viper.BindEnv("cors.allow_credentials", "GARAGE_UI_CORS_ALLOW_CREDENTIALS")
+	viper.BindEnv("cors.max_age", "GARAGE_UI_CORS_MAX_AGE")
+
+	// Logging config
+	viper.BindEnv("logging.level", "GARAGE_UI_LOGGING_LEVEL")
+	viper.BindEnv("logging.format", "GARAGE_UI_LOGGING_FORMAT")
+}
+
+// Validate checks if the configuration is valid
+func (c *Config) Validate() error {
+	// Validate server config
+	if c.Server.Port <= 0 || c.Server.Port > 65535 {
+		return fmt.Errorf("invalid server port: %d", c.Server.Port)
+	}
+
+	// Validate Garage config
+	if c.Garage.Endpoint == "" {
+		return fmt.Errorf("garage endpoint is required")
+	}
+	if c.Garage.AdminEndpoint == "" {
+		return fmt.Errorf("garage admin_endpoint is required")
+	}
+	if c.Garage.AdminToken == "" {
+		return fmt.Errorf("garage admin_token is required")
+	}
+
+	// Validate auth mode
+	if c.Auth.Mode != "none" && c.Auth.Mode != "basic" && c.Auth.Mode != "oidc" {
+		return fmt.Errorf("auth mode must be 'none', 'basic', or 'oidc', got: %s", c.Auth.Mode)
+	}
+
+	// Validate basic auth if enabled
+	if c.Auth.Mode == "basic" {
+		if c.Auth.Basic.Username == "" || c.Auth.Basic.Password == "" {
+			return fmt.Errorf("basic auth username and password are required when auth mode is 'basic'")
+		}
+	}
+
+	// Validate OIDC config if enabled
+	if c.Auth.Mode == "oidc" {
+		if c.Auth.OIDC.ClientID == "" {
+			return fmt.Errorf("oidc client_id is required when auth mode is 'oidc'")
+		}
+		if c.Auth.OIDC.IssuerURL == "" {
+			return fmt.Errorf("oidc issuer_url is required when auth mode is 'oidc'")
+		}
+		if len(c.Auth.OIDC.Scopes) == 0 {
+			return fmt.Errorf("oidc scopes are required when auth mode is 'oidc'")
+		}
+	}
+
+	return nil
+}
+
+// GetAddress returns the full server address (host:port)
+func (c *Config) GetAddress() string {
+	return fmt.Sprintf("%s:%d", c.Server.Host, c.Server.Port)
+}
+
+// IsDevelopment returns true if running in development mode
+func (c *Config) IsDevelopment() bool {
+	return c.Server.Environment == "development"
+}
+
+// IsProduction returns true if running in production mode
+func (c *Config) IsProduction() bool {
+	return c.Server.Environment == "production"
+}

backend/internal/handlers/buckets.go

@@ -0,0 +1,316 @@
+package handlers
+
+import (
+	"Noooste/garage-ui/internal/models"
+	"Noooste/garage-ui/internal/services"
+
+	"github.com/gofiber/fiber/v3"
+)
+
+// BucketHandler handles bucket-related operations
+type BucketHandler struct {
+	adminService *services.GarageAdminService
+	s3Service    *services.S3Service
+}
+
+// NewBucketHandler creates a new bucket handler
+func NewBucketHandler(adminService *services.GarageAdminService, s3Service *services.S3Service) *BucketHandler {
+	return &BucketHandler{
+		adminService: adminService,
+		s3Service:    s3Service,
+	}
+}
+
+// ListBuckets lists all buckets
+//
+//	@Summary		List all buckets
+//	@Description	Retrieves a list of all buckets in the Garage storage system with object count and size
+//	@Tags			Buckets
+//	@Accept			json
+//	@Produce		json
+//	@Success		200	{object}	models.APIResponse{data=models.BucketListResponse}	"Successfully retrieved list of buckets"
+//	@Failure		500	{object}	models.APIResponse{error=models.APIError}			"Failed to list buckets"
+//	@Router			/api/v1/buckets [get]
+func (h *BucketHandler) ListBuckets(c fiber.Ctx) error {
+	ctx := c.Context()
+
+	// List all buckets from Garage Admin API
+	adminBuckets, err := h.adminService.ListBuckets(ctx)
+	if err != nil {
+		return c.Status(fiber.StatusInternalServerError).JSON(
+			models.ErrorResponse(models.ErrCodeListFailed, "Failed to list buckets: "+err.Error()),
+		)
+	}
+
+	// Convert admin bucket response to BucketInfo
+	buckets := make([]models.BucketInfo, 0, len(adminBuckets))
+	for _, adminBucket := range adminBuckets {
+		// Get the bucket name from global aliases
+		var bucketName string
+		if len(adminBucket.GlobalAliases) > 0 {
+			bucketName = adminBucket.GlobalAliases[0]
+		} else {
+			// Skip buckets without global aliases
+			continue
+		}
+
+		bucketInfo := models.BucketInfo{
+			Name:         bucketName,
+			CreationDate: adminBucket.Created,
+			Region:       "", // Garage doesn't have regions
+		}
+
+		// Try to get bucket statistics (object count and size)
+		// This is done asynchronously to avoid blocking the response
+		// If it fails, we still return the bucket info without stats
+		stats, err := h.s3Service.GetBucketStatistics(ctx, bucketName)
+		if err == nil && stats != nil {
+			bucketInfo.ObjectCount = &stats.ObjectCount
+			bucketInfo.Size = &stats.TotalSize
+		}
+
+		buckets = append(buckets, bucketInfo)
+	}
+
+	response := models.BucketListResponse{
+		Buckets: buckets,
+		Count:   len(buckets),
+	}
+
+	return c.JSON(models.SuccessResponse(response))
+}
+
+// CreateBucket creates a new bucket
+//
+//	@Summary		Create a new bucket
+//	@Description	Creates a new bucket in the Garage storage system
+//	@Tags			Buckets
+//	@Accept			json
+//	@Produce		json
+//	@Param			payload	body		models.CreateBucketRequest										true	"Bucket creation payload"
+//	@Success		201		{object}	models.APIResponse{data=object{bucket=string,message=string}}	"Bucket created successfully"
+//	@Failure		400		{object}	models.APIResponse{error=models.APIError}						"Invalid request body or bucket name is required"
+//	@Failure		409		{object}	models.APIResponse{error=models.APIError}						"Bucket already exists"
+//	@Failure		500		{object}	models.APIResponse{error=models.APIError}						"Failed to create bucket"
+//	@Router			/api/v1/buckets [post]
+func (h *BucketHandler) CreateBucket(c fiber.Ctx) error {
+	ctx := c.Context()
+
+	// Parse request body
+	var req models.CreateBucketRequest
+	if err := c.Bind().JSON(&req); err != nil {
+		return c.Status(fiber.StatusBadRequest).JSON(
+			models.ErrorResponse(models.ErrCodeBadRequest, "Invalid request body: "+err.Error()),
+		)
+	}
+
+	// Validate bucket name
+	if req.Name == "" {
+		return c.Status(fiber.StatusBadRequest).JSON(
+			models.ErrorResponse(models.ErrCodeBadRequest, "Bucket name is required"),
+		)
+	}
+
+	// Check if bucket already exists
+	bucketInfo, err := h.adminService.GetBucketInfoByAlias(ctx, req.Name)
+	if err != nil {
+		return c.Status(fiber.StatusInternalServerError).JSON(
+			models.ErrorResponse(models.ErrCodeInternalError, "Failed to check bucket existence: "+err.Error()),
+		)
+	}
+
+	if bucketInfo != nil {
+		return c.Status(fiber.StatusConflict).JSON(
+			models.ErrorResponse(models.ErrCodeBucketExists, "Bucket already exists"),
+		)
+	}
+
+	// Create the bucket
+	createBucketReq := models.CreateBucketAdminRequest{
+		GlobalAlias: &req.Name,
+	}
+	if bucketInfo, err = h.adminService.CreateBucket(ctx, createBucketReq); err != nil {
+		return c.Status(fiber.StatusInternalServerError).JSON(
+			models.ErrorResponse(models.ErrCodeInternalError, "Failed to create bucket: "+err.Error()),
+		)
+	}
+
+	// Return success response
+	response := map[string]interface{}{
+		"bucket":  req.Name,
+		"message": "Bucket created successfully",
+	}
+
+	return c.Status(fiber.StatusCreated).JSON(models.SuccessResponse(response))
+}
+
+// DeleteBucket deletes a bucket
+//
+//	@Summary		Delete a bucket
+//	@Description	Deletes an existing bucket from the Garage storage system. The bucket must be empty before deletion.
+//	@Tags			Buckets
+//	@Accept			json
+//	@Produce		json
+//	@Param			name	path		string															true	"Name of the bucket to delete"
+//	@Success		200		{object}	models.APIResponse{data=object{bucket=string,message=string}}	"Bucket deleted successfully"
+//	@Failure		400		{object}	models.APIResponse{error=models.APIError}						"Bucket name is required"
+//	@Failure		404		{object}	models.APIResponse{error=models.APIError}						"Bucket does not exist"
+//	@Failure		500		{object}	models.APIResponse{error=models.APIError}						"Failed to delete bucket"
+//	@Router			/api/v1/buckets/{name} [delete]
+func (h *BucketHandler) DeleteBucket(c fiber.Ctx) error {
+	ctx := c.Context()
+
+	// Get bucket name from URL parameter
+	bucketName := c.Params("name")
+	if bucketName == "" {
+		return c.Status(fiber.StatusBadRequest).JSON(
+			models.ErrorResponse(models.ErrCodeBadRequest, "Bucket name is required"),
+		)
+	}
+
+	// Check if bucket already exists
+	bucketInfo, err := h.adminService.GetBucketInfoByAlias(ctx, bucketName)
+	if err != nil {
+		return c.Status(fiber.StatusInternalServerError).JSON(
+			models.ErrorResponse(models.ErrCodeInternalError, "Failed to check bucket existence: "+err.Error()),
+		)
+	}
+
+	if bucketInfo == nil {
+		return c.Status(fiber.StatusNotFound).JSON(
+			models.ErrorResponse(models.ErrCodeBucketNotFound, "Bucket does not exist"),
+		)
+	}
+
+	// Delete the bucket
+	if err := h.adminService.DeleteBucket(ctx, bucketInfo.ID); err != nil {
+		return c.Status(fiber.StatusInternalServerError).JSON(
+			models.ErrorResponse(models.ErrCodeDeleteFailed, "Failed to delete bucket: "+err.Error()),
+		)
+	}
+
+	// Return success response
+	response := map[string]interface{}{
+		"bucket":  bucketName,
+		"message": "Bucket deleted successfully",
+	}
+
+	return c.JSON(models.SuccessResponse(response))
+}
+
+// GetBucketInfo returns information about a specific bucket
+//
+//	@Summary		Get bucket information
+//	@Description	Retrieves detailed information about a specific bucket including creation date and region
+//	@Tags			Buckets
+//	@Accept			json
+//	@Produce		json
+//	@Param			name	path		string										true	"Name of the bucket to retrieve information for"
+//	@Success		200		{object}	models.APIResponse{data=models.BucketInfo}	"Successfully retrieved bucket information"
+//	@Failure		400		{object}	models.APIResponse{error=models.APIError}	"Bucket name is required"
+//	@Failure		404		{object}	models.APIResponse{error=models.APIError}	"Bucket does not exist"
+//	@Failure		500		{object}	models.APIResponse{error=models.APIError}	"Failed to retrieve bucket information"
+//	@Router			/api/v1/buckets/{name} [get]
+func (h *BucketHandler) GetBucketInfo(c fiber.Ctx) error {
+	ctx := c.Context()
+
+	// Get bucket name from URL parameter
+	bucketName := c.Params("name")
+	if bucketName == "" {
+		return c.Status(fiber.StatusBadRequest).JSON(
+			models.ErrorResponse(models.ErrCodeBadRequest, "Bucket name is required"),
+		)
+	}
+
+	// Check if bucket already exists
+	bucketInfo, err := h.adminService.GetBucketInfoByAlias(ctx, bucketName)
+	if err != nil {
+		return c.Status(fiber.StatusInternalServerError).JSON(
+			models.ErrorResponse(models.ErrCodeInternalError, "Failed to check bucket existence: "+err.Error()),
+		)
+	}
+
+	if bucketInfo == nil {
+		return c.Status(fiber.StatusNotFound).JSON(
+			models.ErrorResponse(models.ErrCodeBucketNotFound, "Bucket does not exist"),
+		)
+	}
+
+	return c.JSON(models.SuccessResponse(bucketInfo))
+}
+
+// GrantBucketPermission grants permissions for an access key on a bucket
+//
+//	@Summary		Grant bucket permissions
+//	@Description	Grants read/write/owner permissions for an access key on a specific bucket
+//	@Tags			Buckets
+//	@Accept			json
+//	@Produce		json
+//	@Param			name	path		string												true	"Name of the bucket"
+//	@Param			request	body		models.GrantBucketPermissionRequest					true	"Permission grant request"
+//	@Success		200		{object}	models.APIResponse{data=models.GarageBucketInfo}	"Permissions granted successfully"
+//	@Failure		400		{object}	models.APIResponse{error=models.APIError}			"Invalid request"
+//	@Failure		404		{object}	models.APIResponse{error=models.APIError}			"Bucket not found"
+//	@Failure		500		{object}	models.APIResponse{error=models.APIError}			"Failed to grant permissions"
+//	@Router			/api/v1/buckets/{name}/permissions [post]
+func (h *BucketHandler) GrantBucketPermission(c fiber.Ctx) error {
+	ctx := c.Context()
+
+	// Get bucket name from URL parameter
+	bucketName := c.Params("name")
+	if bucketName == "" {
+		return c.Status(fiber.StatusBadRequest).JSON(
+			models.ErrorResponse(models.ErrCodeBadRequest, "Bucket name is required"),
+		)
+	}
+
+	// Parse request body
+	var req models.GrantBucketPermissionRequest
+	if err := c.Bind().JSON(&req); err != nil {
+		return c.Status(fiber.StatusBadRequest).JSON(
+			models.ErrorResponse(models.ErrCodeBadRequest, "Invalid request body: "+err.Error()),
+		)
+	}
+
+	// Validate access key ID
+	if req.AccessKeyID == "" {
+		return c.Status(fiber.StatusBadRequest).JSON(
+			models.ErrorResponse(models.ErrCodeBadRequest, "Access key ID is required"),
+		)
+	}
+
+	// Get bucket info to retrieve bucket ID
+	bucketInfo, err := h.adminService.GetBucketInfoByAlias(ctx, bucketName)
+	if err != nil {
+		return c.Status(fiber.StatusInternalServerError).JSON(
+			models.ErrorResponse(models.ErrCodeInternalError, "Failed to get bucket info: "+err.Error()),
+		)
+	}
+
+	if bucketInfo == nil {
+		return c.Status(fiber.StatusNotFound).JSON(
+			models.ErrorResponse(models.ErrCodeBucketNotFound, "Bucket does not exist"),
+		)
+	}
+
+	// Build the permission request for Garage Admin API
+	permRequest := models.BucketKeyPermRequest{
+		BucketID:    bucketInfo.ID,
+		AccessKeyID: req.AccessKeyID,
+		Permissions: models.BucketKeyPermission{
+			Read:  req.Permissions.Read,
+			Write: req.Permissions.Write,
+			Owner: req.Permissions.Owner,
+		},
+	}
+
+	// Grant permissions using Garage Admin API
+	result, err := h.adminService.AllowBucketKey(ctx, permRequest)
+	if err != nil {
+		return c.Status(fiber.StatusInternalServerError).JSON(
+			models.ErrorResponse(models.ErrCodeInternalError, "Failed to grant permissions: "+err.Error()),
+		)
+	}
+
+	return c.JSON(models.SuccessResponse(result))
+}

backend/internal/handlers/cluster.go

@@ -0,0 +1,145 @@
+package handlers
+
+import (
+	"Noooste/garage-ui/internal/models"
+	"Noooste/garage-ui/internal/services"
+
+	"github.com/gofiber/fiber/v3"
+)
+
+// ClusterHandler handles cluster management operations
+type ClusterHandler struct {
+	adminService *services.GarageAdminService
+}
+
+// NewClusterHandler creates a new cluster handler
+func NewClusterHandler(adminService *services.GarageAdminService) *ClusterHandler {
+	return &ClusterHandler{
+		adminService: adminService,
+	}
+}
+
+// GetHealth returns the health status of the cluster
+//
+//	@Summary		Get cluster health
+//	@Description	Retrieves the overall health status of the Garage storage cluster
+//	@Tags			Cluster
+//	@Accept			json
+//	@Produce		json
+//	@Success		200	{object}	models.APIResponse{data=object}				"Successfully retrieved cluster health"
+//	@Failure		500	{object}	models.APIResponse{error=models.APIError}	"Failed to get cluster health"
+//	@Router			/api/v1/cluster/health [get]
+func (h *ClusterHandler) GetHealth(c fiber.Ctx) error {
+	ctx := c.Context()
+
+	health, err := h.adminService.GetClusterHealth(ctx)
+	if err != nil {
+		return c.Status(fiber.StatusInternalServerError).JSON(
+			models.ErrorResponse(models.ErrCodeInternalError, "Failed to get cluster health: "+err.Error()),
+		)
+	}
+
+	return c.JSON(models.SuccessResponse(health))
+}
+
+// GetStatus returns the status of the cluster
+//
+//	@Summary		Get cluster status
+//	@Description	Retrieves the current status of the Garage storage cluster
+//	@Tags			Cluster
+//	@Accept			json
+//	@Produce		json
+//	@Success		200	{object}	models.APIResponse{data=object}				"Successfully retrieved cluster status"
+//	@Failure		500	{object}	models.APIResponse{error=models.APIError}	"Failed to get cluster status"
+//	@Router			/api/v1/cluster/status [get]
+func (h *ClusterHandler) GetStatus(c fiber.Ctx) error {
+	ctx := c.Context()
+
+	status, err := h.adminService.GetClusterStatus(ctx)
+	if err != nil {
+		return c.Status(fiber.StatusInternalServerError).JSON(
+			models.ErrorResponse(models.ErrCodeInternalError, "Failed to get cluster status: "+err.Error()),
+		)
+	}
+
+	return c.JSON(models.SuccessResponse(status))
+}
+
+// GetStatistics returns global cluster statistics
+// GET /api/v1/cluster/statistics
+func (h *ClusterHandler) GetStatistics(c fiber.Ctx) error {
+	ctx := c.Context()
+
+	stats, err := h.adminService.GetClusterStatistics(ctx)
+	if err != nil {
+		return c.Status(fiber.StatusInternalServerError).JSON(
+			models.ErrorResponse(models.ErrCodeInternalError, "Failed to get cluster statistics: "+err.Error()),
+		)
+	}
+
+	return c.JSON(models.SuccessResponse(stats))
+}
+
+// GetNodeInfo returns information about a specific node
+//
+//	@Summary		Get node information
+//	@Description	Retrieves detailed information about a specific node in the Garage storage cluster
+//	@Tags			Cluster
+//	@Accept			json
+//	@Produce		json
+//	@Param			node_id	path		string										true	"ID of the node to retrieve information for"
+//	@Success		200		{object}	models.APIResponse{data=object}				"Successfully retrieved node information"
+//	@Failure		400		{object}	models.APIResponse{error=models.APIError}	"Node ID is required"
+//	@Failure		500		{object}	models.APIResponse{error=models.APIError}	"Failed to get node information"
+//	@Router			/api/v1/cluster/nodes/{node_id} [get]
+func (h *ClusterHandler) GetNodeInfo(c fiber.Ctx) error {
+	ctx := c.Context()
+	nodeID := c.Params("node_id")
+
+	if nodeID == "" {
+		return c.Status(fiber.StatusBadRequest).JSON(
+			models.ErrorResponse(models.ErrCodeBadRequest, "Node ID is required"),
+		)
+	}
+
+	info, err := h.adminService.GetNodeInfo(ctx, nodeID)
+	if err != nil {
+		return c.Status(fiber.StatusInternalServerError).JSON(
+			models.ErrorResponse(models.ErrCodeInternalError, "Failed to get node info: "+err.Error()),
+		)
+	}
+
+	return c.JSON(models.SuccessResponse(info))
+}
+
+// GetNodeStatistics returns statistics for a specific node
+//
+//	@Summary		Get node statistics
+//	@Description	Retrieves performance statistics and metrics for a specific node in the Garage storage cluster
+//	@Tags			Cluster
+//	@Accept			json
+//	@Produce		json
+//	@Param			node_id	path		string										true	"ID of the node to retrieve statistics for"
+//	@Success		200		{object}	models.APIResponse{data=object}				"Successfully retrieved node statistics"
+//	@Failure		400		{object}	models.APIResponse{error=models.APIError}	"Node ID is required"
+//	@Failure		500		{object}	models.APIResponse{error=models.APIError}	"Failed to get node statistics"
+//	@Router			/api/v1/cluster/nodes/{node_id}/statistics [get]
+func (h *ClusterHandler) GetNodeStatistics(c fiber.Ctx) error {
+	ctx := c.Context()
+	nodeID := c.Params("node_id")
+
+	if nodeID == "" {
+		return c.Status(fiber.StatusBadRequest).JSON(
+			models.ErrorResponse(models.ErrCodeBadRequest, "Node ID is required"),
+		)
+	}
+
+	stats, err := h.adminService.GetNodeStatistics(ctx, nodeID)
+	if err != nil {
+		return c.Status(fiber.StatusInternalServerError).JSON(
+			models.ErrorResponse(models.ErrCodeInternalError, "Failed to get node statistics: "+err.Error()),
+		)
+	}
+
+	return c.JSON(models.SuccessResponse(stats))
+}

backend/internal/handlers/health.go

@@ -0,0 +1,40 @@
+package handlers
+
+import (
+	"time"
+
+	"Noooste/garage-ui/internal/models"
+
+	"github.com/gofiber/fiber/v3"
+)
+
+// HealthHandler handles health check requests
+type HealthHandler struct {
+	version string
+}
+
+// NewHealthHandler creates a new health check handler
+func NewHealthHandler(version string) *HealthHandler {
+	return &HealthHandler{
+		version: version,
+	}
+}
+
+// Check returns the health status of the service
+//
+//	@Summary		Health check
+//	@Description	Returns the health status of the API service along with version information
+//	@Tags			Health
+//	@Accept			json
+//	@Produce		json
+//	@Success		200	{object}	models.APIResponse{data=models.HealthResponse}	"Service is healthy"
+//	@Router			/api/v1/health [get]
+func (h *HealthHandler) Check(c fiber.Ctx) error {
+	response := models.HealthResponse{
+		Status:    "healthy",
+		Timestamp: time.Now(),
+		Version:   h.version,
+	}
+
+	return c.JSON(models.SuccessResponse(response))
+}

backend/internal/handlers/monitoring.go

@@ -0,0 +1,145 @@
+package handlers
+
+import (
+	"Noooste/garage-ui/internal/models"
+	"Noooste/garage-ui/internal/services"
+
+	"github.com/gofiber/fiber/v3"
+)
+
+// MonitoringHandler handles monitoring operations
+type MonitoringHandler struct {
+	adminService *services.GarageAdminService
+	s3Service    *services.S3Service
+}
+
+// NewMonitoringHandler creates a new monitoring handler
+func NewMonitoringHandler(adminService *services.GarageAdminService, s3Service *services.S3Service) *MonitoringHandler {
+	return &MonitoringHandler{
+		adminService: adminService,
+		s3Service:    s3Service,
+	}
+}
+
+// GetMetrics retrieves system metrics from the Admin API
+//
+//	@Summary		Get system metrics
+//	@Description	Retrieves system metrics from the Garage Admin API for monitoring purposes
+//	@Tags			Monitoring
+//	@Accept			json
+//	@Produce		text/plain
+//	@Success		200	{string}	string										"System metrics in plain text format"
+//	@Failure		500	{object}	models.APIResponse{error=models.APIError}	"Failed to retrieve metrics"
+//	@Router			/api/v1/monitoring/metrics [get]
+func (h *MonitoringHandler) GetMetrics(c fiber.Ctx) error {
+	ctx := c.Context()
+
+	metrics, err := h.adminService.GetMetrics(ctx)
+	if err != nil {
+		return c.Status(fiber.StatusInternalServerError).JSON(
+			models.ErrorResponse(models.ErrCodeInternalError, "Failed to get metrics: "+err.Error()),
+		)
+	}
+
+	// Return metrics as plain text
+	c.Set("Content-Type", "text/plain; charset=utf-8")
+	return c.SendString(metrics)
+}
+
+// CheckAdminHealth checks if the Admin API is reachable
+//
+//	@Summary		Check Admin API health
+//	@Description	Performs a health check on the Garage Admin API to verify connectivity and availability
+//	@Tags			Monitoring
+//	@Accept			json
+//	@Produce		json
+//	@Success		200	{object}	models.APIResponse{data=object{status=string,message=string}}	"Admin API is healthy"
+//	@Failure		503	{object}	models.APIResponse{error=models.APIError}						"Admin API health check failed"
+//	@Router			/api/v1/monitoring/admin-health [get]
+func (h *MonitoringHandler) CheckAdminHealth(c fiber.Ctx) error {
+	ctx := c.Context()
+
+	err := h.adminService.HealthCheck(ctx)
+	if err != nil {
+		return c.Status(fiber.StatusServiceUnavailable).JSON(
+			models.ErrorResponse(models.ErrCodeInternalError, "Admin API health check failed: "+err.Error()),
+		)
+	}
+
+	return c.JSON(models.SuccessResponse(map[string]interface{}{
+		"status":  "healthy",
+		"message": "Admin API is reachable",
+	}))
+}
+
+// GetDashboardMetrics retrieves aggregated dashboard metrics
+//
+//	@Summary		Get dashboard metrics
+//	@Description	Retrieves aggregated metrics for the dashboard including storage, buckets, and request metrics
+//	@Tags			Monitoring
+//	@Accept			json
+//	@Produce		json
+//	@Success		200	{object}	models.APIResponse{data=models.DashboardMetrics}	"Successfully retrieved dashboard metrics"
+//	@Failure		500	{object}	models.APIResponse{error=models.APIError}			"Failed to get dashboard metrics"
+//	@Router			/api/v1/monitoring/dashboard [get]
+func (h *MonitoringHandler) GetDashboardMetrics(c fiber.Ctx) error {
+	ctx := c.Context()
+
+	// Get bucket list
+	buckets, err := h.adminService.ListBuckets(ctx)
+	if err != nil {
+		return c.Status(fiber.StatusInternalServerError).JSON(
+			models.ErrorResponse(models.ErrCodeInternalError, "Failed to get buckets: "+err.Error()),
+		)
+	}
+
+	// Calculate aggregated metrics
+	var totalSize int64
+	var totalObjects int64
+	usageByBucket := make([]models.BucketUsage, 0)
+
+	for _, bucket := range buckets {
+		// Get bucket info to calculate size and object count
+		bucketInfo, err := h.adminService.GetBucketInfo(ctx, bucket.ID)
+		if err != nil {
+			continue // Skip buckets we can't access
+		}
+
+		// Get size and object count from bucket info
+		bucketSize := bucketInfo.Bytes
+		objectCount := bucketInfo.Objects
+
+		totalSize += bucketSize
+		totalObjects += objectCount
+
+		// Get bucket name from aliases
+		bucketName := bucket.ID
+		if len(bucket.LocalAliases) > 0 {
+			bucketName = bucket.LocalAliases[0].Alias
+		} else if len(bucket.GlobalAliases) > 0 {
+			bucketName = bucket.GlobalAliases[0]
+		}
+
+		usageByBucket = append(usageByBucket, models.BucketUsage{
+			BucketName:  bucketName,
+			Size:        bucketSize,
+			ObjectCount: objectCount,
+		})
+	}
+
+	// Calculate percentages
+	for i := range usageByBucket {
+		if totalSize > 0 {
+			usageByBucket[i].Percentage = float64(usageByBucket[i].Size) / float64(totalSize) * 100
+		}
+	}
+
+	dashboardMetrics := models.DashboardMetrics{
+		TotalSize:     totalSize,
+		ObjectCount:   totalObjects,
+		BucketCount:   len(buckets),
+		UsageByBucket: usageByBucket,
+	}
+
+	return c.JSON(models.SuccessResponse(dashboardMetrics))
+}

backend/internal/handlers/objects.go

@@ -0,0 +1,541 @@
+package handlers
+
+import (
+	"io"
+	"strconv"
+	"time"
+
+	"Noooste/garage-ui/internal/models"
+	"Noooste/garage-ui/internal/services"
+
+	"github.com/gofiber/fiber/v3"
+)
+
+// ObjectHandler handles object-related operations
+type ObjectHandler struct {
+	s3Service *services.S3Service
+}
+
+// NewObjectHandler creates a new object handler
+func NewObjectHandler(s3Service *services.S3Service) *ObjectHandler {
+	return &ObjectHandler{
+		s3Service: s3Service,
+	}
+}
+
+// ListObjects lists objects in a bucket with optional filtering and pagination
+//
+//	@Summary		List objects in a bucket
+//	@Description	Retrieves a list of objects and prefixes (folders) stored in the specified bucket, with optional filtering by prefix, pagination support, and max keys
+//	@Tags			Objects
+//	@Accept			json
+//	@Produce		json
+//	@Param			bucket				path		string												true	"Name of the bucket to list objects from"
+//	@Param			prefix				query		string												false	"Filter objects by prefix"
+//	@Param			max_keys			query		int													false	"Maximum number of objects to return (default: 100)"
+//	@Param			continuation_token	query		string												false	"Token for pagination to retrieve next page of results"
+//	@Success		200					{object}	models.APIResponse{data=models.ObjectListResponse}	"Successfully retrieved list of objects and prefixes"
+//	@Failure		400					{object}	models.APIResponse{error=models.APIError}			"Invalid request parameters"
+//	@Failure		404					{object}	models.APIResponse{error=models.APIError}			"Bucket not found"
+//	@Failure		500					{object}	models.APIResponse{error=models.APIError}			"Failed to list objects"
+//	@Router			/api/v1/buckets/{bucket}/objects [get]
+func (h *ObjectHandler) ListObjects(c fiber.Ctx) error {
+	ctx := c.Context()
+
+	// Get bucket name from URL parameter
+	bucketName := c.Params("bucket")
+	if bucketName == "" {
+		return c.Status(fiber.StatusBadRequest).JSON(
+			models.ErrorResponse(models.ErrCodeBadRequest, "Bucket name is required"),
+		)
+	}
+
+	// Get query parameters for filtering and pagination
+	prefix := c.Query("prefix", "")
+	continuationToken := c.Query("continuation_token", "")
+
+	maxKeysStr := c.Query("max_keys", "100")
+	maxKeys, err := strconv.Atoi(maxKeysStr)
+	if err != nil || maxKeys <= 0 {
+		return c.Status(fiber.StatusBadRequest).JSON(
+			models.ErrorResponse(models.ErrCodeBadRequest, "Invalid max_keys parameter"),
+		)
+	}
+
+	// List objects in the bucket
+	objects, err := h.s3Service.ListObjects(ctx, bucketName, prefix, maxKeys, continuationToken)
+	if err != nil {
+		return c.Status(fiber.StatusInternalServerError).JSON(
+			models.ErrorResponse(models.ErrCodeListFailed, "Failed to list objects: "+err.Error()),
+		)
+	}
+
+	return c.JSON(models.SuccessResponse(objects))
+}
+
+// UploadObject uploads an object to a bucket
+//
+//	@Summary		Upload object to bucket
+//	@Description	Uploads an object to the specified bucket using multipart/form-data
+//	@Tags			Objects
+//	@Accept			multipart/form-data
+//	@Produce		json
+//	@Param			bucket	path		string													true	"Name of the bucket to upload the object to"
+//	@Param			file	formData	file													true	"File to upload"
+//	@Param			key		formData	string													false	"Object key (path in bucket). If not provided, the filename will be used"
+//	@Success		201		{object}	models.APIResponse{data=models.ObjectUploadResponse}	"Object uploaded successfully"
+//	@Failure		400		{object}	models.APIResponse{error=models.APIError}				"Invalid request parameters"
+//	@Failure		404		{object}	models.APIResponse{error=models.APIError}				"Bucket not found"
+//	@Failure		500		{object}	models.APIResponse{error=models.APIError}				"Failed to upload object"
+//	@Router			/api/v1/buckets/{bucket}/objects [post]
+func (h *ObjectHandler) UploadObject(c fiber.Ctx) error {
+	ctx := c.Context()
+
+	// Get bucket name from URL parameter
+	bucketName := c.Params("bucket")
+	if bucketName == "" {
+		return c.Status(fiber.StatusBadRequest).JSON(
+			models.ErrorResponse(models.ErrCodeBadRequest, "Bucket name is required"),
+		)
+	}
+
+	// Get file from multipart form
+	file, err := c.FormFile("file")
+	if err != nil {
+		return c.Status(fiber.StatusBadRequest).JSON(
+			models.ErrorResponse(models.ErrCodeBadRequest, "File is required: "+err.Error()),
+		)
+	}
+
+	// Get object key (path in bucket)
+	key := c.FormValue("key")
+	if key == "" {
+		// Use filename as key if not provided
+		key = file.Filename
+	}
+
+	// Open the uploaded file
+	fileHandle, err := file.Open()
+	if err != nil {
+		return c.Status(fiber.StatusInternalServerError).JSON(
+			models.ErrorResponse(models.ErrCodeUploadFailed, "Failed to open uploaded file: "+err.Error()),
+		)
+	}
+	defer fileHandle.Close()
+
+	// Get content type
+	contentType := file.Header.Get("Content-Type")
+
+	// Upload to Garage
+	uploadResult, err := h.s3Service.UploadObject(ctx, bucketName, key, fileHandle, contentType)
+	if err != nil {
+		return c.Status(fiber.StatusInternalServerError).JSON(
+			models.ErrorResponse(models.ErrCodeUploadFailed, "Failed to upload object: "+err.Error()),
+		)
+	}
+
+	return c.Status(fiber.StatusCreated).JSON(models.SuccessResponse(uploadResult))
+}
+
+// GetObject retrieves an object from a bucket
+//
+//	@Summary		Get object from bucket
+//	@Description	Retrieves an object stored in the specified bucket
+//	@Tags			Objects
+//	@Accept			json
+//	@Produce		application/octet-stream
+//	@Param			bucket		path		string										true	"Name of the bucket containing the object"
+//	@Param			key			path		string										true	"Key (path) of the object"
+//	@Param			download	query		bool										false	"Set to true to download the object as an attachment"
+//	@Success		200			{file}		binary										"Successfully retrieved the object"
+//	@Failure		400			{object}	models.APIResponse{error=models.APIError}	"Bucket name and object key are required"
+//	@Failure		404			{object}	models.APIResponse{error=models.APIError}	"Object not found"
+//	@Router			/api/v1/buckets/{bucket}/objects/{key} [get]
+func (h *ObjectHandler) GetObject(c fiber.Ctx) error {
+	ctx := c.Context()
+
+	// Get bucket name and object key from URL parameters
+	bucketName := c.Params("bucket")
+	key := c.Params("key")
+
+	if bucketName == "" || key == "" {
+		return c.Status(fiber.StatusBadRequest).JSON(
+			models.ErrorResponse(models.ErrCodeBadRequest, "Bucket name and object key are required"),
+		)
+	}
+
+	// Get object from Garage
+	body, objectInfo, err := h.s3Service.GetObject(ctx, bucketName, key)
+	if err != nil {
+		return c.Status(fiber.StatusNotFound).JSON(
+			models.ErrorResponse(models.ErrCodeObjectNotFound, "Object not found: "+err.Error()),
+		)
+	}
+	defer body.Close()
+
+	// Set response headers
+	c.Set("Content-Type", objectInfo.ContentType)
+	c.Set("Content-Length", string(rune(objectInfo.Size)))
+	c.Set("ETag", objectInfo.ETag)
+	c.Set("Last-Modified", objectInfo.LastModified.Format(time.RFC1123))
+
+	// Check if client wants to download or view inline
+	if c.Query("download") == "true" {
+		c.Set("Content-Disposition", "attachment; filename=\""+key+"\"")
+	}
+
+	// Stream the object body to the client
+	return c.SendStream(body)
+}
+
+// DeleteObject deletes an object from a bucket
+//
+//	@Summary		Delete object from bucket
+//	@Description	Deletes an object stored in the specified bucket
+//	@Tags			Objects
+//	@Accept			json
+//	@Produce		json
+//	@Param			bucket	path		string													true	"Name of the bucket containing the object"
+//	@Param			key		path		string													true	"Key (path) of the object"
+//	@Success		200		{object}	models.APIResponse{data=models.ObjectDeleteResponse}	"Successfully deleted the object"
+//	@Failure		400		{object}	models.APIResponse{error=models.APIError}				"Bucket name and object key are required"
+//	@Failure		404		{object}	models.APIResponse{error=models.APIError}				"Object not found"
+//	@Failure		500		{object}	models.APIResponse{error=models.APIError}				"Failed to delete object"
+//	@Router			/api/v1/buckets/{bucket}/objects/{key} [delete]
+func (h *ObjectHandler) DeleteObject(c fiber.Ctx) error {
+	ctx := c.Context()
+
+	// Get bucket name and object key from URL parameters
+	bucketName := c.Params("bucket")
+	key := c.Params("key")
+
+	if bucketName == "" || key == "" {
+		return c.Status(fiber.StatusBadRequest).JSON(
+			models.ErrorResponse(models.ErrCodeBadRequest, "Bucket name and object key are required"),
+		)
+	}
+
+	// Check if object exists
+	exists, err := h.s3Service.ObjectExists(ctx, bucketName, key)
+	if err != nil {
+		return c.Status(fiber.StatusInternalServerError).JSON(
+			models.ErrorResponse(models.ErrCodeInternalError, "Failed to check object existence: "+err.Error()),
+		)
+	}
+
+	if !exists {
+		return c.Status(fiber.StatusNotFound).JSON(
+			models.ErrorResponse(models.ErrCodeObjectNotFound, "Object not found"),
+		)
+	}
+
+	// Delete the object
+	if err := h.s3Service.DeleteObject(ctx, bucketName, key); err != nil {
+		return c.Status(fiber.StatusInternalServerError).JSON(
+			models.ErrorResponse(models.ErrCodeDeleteFailed, "Failed to delete object: "+err.Error()),
+		)
+	}
+
+	// Return success response
+	response := models.ObjectDeleteResponse{
+		Bucket:  bucketName,
+		Key:     key,
+		Deleted: true,
+	}
+
+	return c.JSON(models.SuccessResponse(response))
+}
+
+// GetObjectMetadata returns metadata for an object without downloading it
+//
+//	@Summary		Get object metadata
+//	@Description	Retrieves metadata information about an object without downloading the actual content
+//	@Tags			Objects
+//	@Accept			json
+//	@Produce		json
+//	@Param			bucket	path		string										true	"Name of the bucket containing the object"
+//	@Param			key		path		string										true	"Key (path) of the object"
+//	@Success		200		{object}	models.APIResponse{data=models.ObjectInfo}	"Successfully retrieved object metadata"
+//	@Failure		400		{object}	models.APIResponse{error=models.APIError}	"Bucket name and object key are required"
+//	@Failure		404		{object}	models.APIResponse{error=models.APIError}	"Object not found"
+//	@Router			/api/v1/buckets/{bucket}/objects/{key}/metadata [get]
+func (h *ObjectHandler) GetObjectMetadata(c fiber.Ctx) error {
+	ctx := c.Context()
+
+	// Get bucket name and object key from URL parameters
+	bucketName := c.Params("bucket")
+	key := c.Params("key")
+
+	if bucketName == "" || key == "" {
+		return c.Status(fiber.StatusBadRequest).JSON(
+			models.ErrorResponse(models.ErrCodeBadRequest, "Bucket name and object key are required"),
+		)
+	}
+
+	// Get object metadata
+	metadata, err := h.s3Service.GetObjectMetadata(ctx, bucketName, key)
+	if err != nil {
+		return c.Status(fiber.StatusNotFound).JSON(
+			models.ErrorResponse(models.ErrCodeObjectNotFound, "Object not found: "+err.Error()),
+		)
+	}
+
+	return c.JSON(models.SuccessResponse(metadata))
+}
+
+// GetPresignedURL generates a pre-signed URL for accessing an object
+//
+//	@Summary		Get pre-signed URL for object
+//	@Description	Generates a pre-signed URL that allows temporary access to the specified object
+//	@Tags			Objects
+//	@Accept			json
+//	@Produce		json
+//	@Param			bucket		path		string													true	"Name of the bucket containing the object"
+//	@Param			key			path		string													true	"Key (path) of the object"
+//	@Param			expires_in	query		int														false	"Expiration time in seconds for the pre-signed URL (default: 3600 seconds)"
+//	@Success		200			{object}	models.APIResponse{data=models.PresignedURLResponse}	"Successfully generated pre-signed URL"
+//	@Failure		400			{object}	models.APIResponse{error=models.APIError}				"Invalid request parameters"
+//	@Failure		404			{object}	models.APIResponse{error=models.APIError}				"Object not found"
+//	@Failure		500			{object}	models.APIResponse{error=models.APIError}				"Failed to generate pre-signed URL"
+//	@Router			/api/v1/buckets/{bucket}/objects/{key}/presigned-url [get]
+func (h *ObjectHandler) GetPresignedURL(c fiber.Ctx) error {
+	ctx := c.Context()
+
+	// Get bucket name and object key from URL parameters
+	bucketName := c.Params("bucket")
+	key := c.Params("key")
+
+	if bucketName == "" || key == "" {
+		return c.Status(fiber.StatusBadRequest).JSON(
+			models.ErrorResponse(models.ErrCodeBadRequest, "Bucket name and object key are required"),
+		)
+	}
+
+	// Get expiration time from query parameter (default: 1 hour)
+	expiresInStr := c.Query("expires_in", "3600")
+	expiresIn, err := strconv.ParseInt(expiresInStr, 10, 64)
+	if err != nil {
+		return c.Status(fiber.StatusBadRequest).JSON(
+			models.ErrorResponse(models.ErrCodeBadRequest, "Invalid expiration time: "+err.Error()),
+		)
+	}
+
+	// Validate expiration time (1 second to 7 days)
+	if expiresIn <= 0 || expiresIn > 604800 { // Max 7 days
+		return c.Status(fiber.StatusBadRequest).JSON(
+			models.ErrorResponse(models.ErrCodeBadRequest, "Invalid expiration time (must be between 1 and 604800 seconds)"),
+		)
+	}
+
+	// Check if object exists
+	exists, err := h.s3Service.ObjectExists(ctx, bucketName, key)
+	if err != nil {
+		return c.Status(fiber.StatusInternalServerError).JSON(
+			models.ErrorResponse(models.ErrCodeInternalError, "Failed to check object existence: "+err.Error()),
+		)
+	}
+
+	if !exists {
+		return c.Status(fiber.StatusNotFound).JSON(
+			models.ErrorResponse(models.ErrCodeObjectNotFound, "Object not found"),
+		)
+	}
+
+	// Generate pre-signed URL
+	url, err := h.s3Service.GetPresignedURL(ctx, bucketName, key, time.Duration(expiresIn)*time.Second)
+	if err != nil {
+		return c.Status(fiber.StatusInternalServerError).JSON(
+			models.ErrorResponse(models.ErrCodeInternalError, "Failed to generate pre-signed URL: "+err.Error()),
+		)
+	}
+
+	response := models.PresignedURLResponse{
+		URL:       url,
+		ExpiresIn: expiresIn,
+		Bucket:    bucketName,
+		Key:       key,
+	}
+
+	return c.JSON(models.SuccessResponse(response))
+}
+
+// DeleteMultipleObjects deletes multiple objects from a bucket
+//
+//	@Summary		Delete multiple objects from bucket
+//	@Description	Deletes multiple objects stored in the specified bucket
+//	@Tags			Objects
+//	@Accept			json
+//	@Produce		json
+//	@Param			bucket	path		string															true	"Name of the bucket containing the objects"
+//	@Param			request	body		object{keys=[]string,prefix=string}								true	"List of object keys to delete and optional prefix for path context"
+//	@Success		200		{object}	models.APIResponse{data=models.ObjectDeleteMultipleResponse}	"Successfully deleted the objects"
+//	@Failure		400		{object}	models.APIResponse{error=models.APIError}						"Invalid request parameters"
+//	@Failure		404		{object}	models.APIResponse{error=models.APIError}						"Bucket not found"
+//	@Failure		500		{object}	models.APIResponse{error=models.APIError}						"Failed to delete objects"
+//	@Router			/api/v1/buckets/{bucket}/objects/delete-multiple [post]
+func (h *ObjectHandler) DeleteMultipleObjects(c fiber.Ctx) error {
+	ctx := c.Context()
+
+	// Get bucket name from URL parameter
+	bucketName := c.Params("bucket")
+	if bucketName == "" {
+		return c.Status(fiber.StatusBadRequest).JSON(
+			models.ErrorResponse(models.ErrCodeBadRequest, "Bucket name is required"),
+		)
+	}
+
+	// Parse request body to get keys and optional prefix
+	var req struct {
+		Keys   []string `json:"keys"`
+		Prefix string   `json:"prefix,omitempty"`
+	}
+	if err := c.Bind().JSON(&req); err != nil {
+		return c.Status(fiber.StatusBadRequest).JSON(
+			models.ErrorResponse(models.ErrCodeBadRequest, "Invalid request body: "+err.Error()),
+		)
+	}
+
+	if len(req.Keys) == 0 {
+		return c.Status(fiber.StatusBadRequest).JSON(
+			models.ErrorResponse(models.ErrCodeBadRequest, "At least one key is required"),
+		)
+	}
+
+	// Delete multiple objects
+	if err := h.s3Service.DeleteMultipleObjects(ctx, bucketName, req.Keys); err != nil {
+		return c.Status(fiber.StatusInternalServerError).JSON(
+			models.ErrorResponse(models.ErrCodeDeleteFailed, "Failed to delete objects: "+err.Error()),
+		)
+	}
+
+	response := models.ObjectDeleteMultipleResponse{
+		Bucket:  bucketName,
+		Deleted: len(req.Keys),
+		Keys:    req.Keys,
+	}
+
+	return c.JSON(models.SuccessResponse(response))
+}
+
+// UploadMultipleObjects uploads multiple objects to a bucket
+//
+//	@Summary		Upload multiple objects to bucket
+//	@Description	Uploads multiple objects to the specified bucket using multipart/form-data. Accepts unlimited number of files and handles them in a loop.
+//	@Tags			Objects
+//	@Accept			multipart/form-data
+//	@Produce		json
+//	@Param			bucket	path		string															true	"Name of the bucket to upload the objects to"
+//	@Param			files	formData	file															true	"Files to upload (can be multiple)"
+//	@Success		201		{object}	models.APIResponse{data=models.ObjectUploadMultipleResponse}	"Objects uploaded successfully (including partial failures)"
+//	@Failure		400		{object}	models.APIResponse{error=models.APIError}						"Invalid request parameters"
+//	@Failure		404		{object}	models.APIResponse{error=models.APIError}						"Bucket not found"
+//	@Failure		500		{object}	models.APIResponse{error=models.APIError}						"Failed to upload objects"
+//	@Router			/api/v1/buckets/{bucket}/objects/upload-multiple [post]
+func (h *ObjectHandler) UploadMultipleObjects(c fiber.Ctx) error {
+	ctx := c.Context()
+
+	// Get bucket name from URL parameter
+	bucketName := c.Params("bucket")
+	if bucketName == "" {
+		return c.Status(fiber.StatusBadRequest).JSON(
+			models.ErrorResponse(models.ErrCodeBadRequest, "Bucket name is required"),
+		)
+	}
+
+	// Parse multipart form to get all files
+	form, err := c.MultipartForm()
+	if err != nil {
+		return c.Status(fiber.StatusBadRequest).JSON(
+			models.ErrorResponse(models.ErrCodeBadRequest, "Failed to parse multipart form: "+err.Error()),
+		)
+	}
+
+	files := form.File["files"]
+	if len(files) == 0 {
+		return c.Status(fiber.StatusBadRequest).JSON(
+			models.ErrorResponse(models.ErrCodeBadRequest, "At least one file is required"),
+		)
+	}
+
+	// Prepare upload data structure
+	uploadFiles := make([]struct {
+		Key         string
+		Body        io.Reader
+		ContentType string
+	}, len(files))
+
+	// Open all files and prepare for upload
+	for i, fileHeader := range files {
+		file, err := fileHeader.Open()
+		if err != nil {
+			return c.Status(fiber.StatusInternalServerError).JSON(
+				models.ErrorResponse(models.ErrCodeUploadFailed, "Failed to open file "+fileHeader.Filename+": "+err.Error()),
+			)
+		}
+		defer file.Close()
+
+		// Use filename as the key
+		key := fileHeader.Filename
+		contentType := fileHeader.Header.Get("Content-Type")
+		if contentType == "" {
+			contentType = "application/octet-stream"
+		}
+
+		uploadFiles[i] = struct {
+			Key         string
+			Body        io.Reader
+			ContentType string
+		}{
+			Key:         key,
+			Body:        file,
+			ContentType: contentType,
+		}
+	}
+
+	// Upload all files using the service method
+	results := h.s3Service.UploadMultipleObjects(ctx, bucketName, uploadFiles)
+
+	// Process results and categorize successes and failures
+	var successFiles []models.ObjectUploadResult
+	var failedFiles []models.ObjectUploadFailedResult
+	successCount := 0
+	failureCount := 0
+
+	for _, result := range results {
+		if result.Success {
+			successCount++
+			successFiles = append(successFiles, models.ObjectUploadResult{
+				Key:         result.Key,
+				ETag:        result.ETag,
+				Size:        result.Size,
+				ContentType: result.ContentType,
+			})
+		} else {
+			failureCount++
+			failedFiles = append(failedFiles, models.ObjectUploadFailedResult{
+				Key:         result.Key,
+				Error:       result.Error.Error(),
+				ContentType: result.ContentType,
+			})
+		}
+	}
+
+	response := models.ObjectUploadMultipleResponse{
+		Bucket:       bucketName,
+		TotalFiles:   len(files),
+		SuccessCount: successCount,
+		FailureCount: failureCount,
+		SuccessFiles: successFiles,
+		FailedFiles:  failedFiles,
+	}
+
+	// Return 201 if all succeeded, 207 (Multi-Status) if partial success, 500 if all failed
+	statusCode := fiber.StatusCreated
+	if failureCount > 0 && successCount > 0 {
+		statusCode = fiber.StatusMultiStatus // 207
+	} else if failureCount > 0 && successCount == 0 {
+		statusCode = fiber.StatusInternalServerError
+	}
+
+	return c.Status(statusCode).JSON(models.SuccessResponse(response))
+}

backend/internal/handlers/users.go

@@ -0,0 +1,341 @@
+package handlers
+
+import (
+	"time"
+
+	"Noooste/garage-ui/internal/models"
+	"Noooste/garage-ui/internal/services"
+
+	"github.com/gofiber/fiber/v3"
+)
+
+// UserHandler handles user/key management operations using Garage Admin API
+type UserHandler struct {
+	adminService *services.GarageAdminService
+}
+
+// NewUserHandler creates a new user handler
+func NewUserHandler(adminService *services.GarageAdminService) *UserHandler {
+	return &UserHandler{
+		adminService: adminService,
+	}
+}
+
+// ListUsers lists all users/access keys
+//
+//	@Summary		List all users
+//	@Description	Retrieves a list of all users/access keys
+//	@Tags			Users
+//	@Produce		json
+//	@Success		200	{object}	models.APIResponse{data=models.UserListResponse}	"List of users retrieved successfully"
+//	@Failure		500	{object}	models.APIResponse{error=models.APIError}			"Failed to list users"
+//	@Router			/api/v1/users [get]
+func (h *UserHandler) ListUsers(c fiber.Ctx) error {
+	ctx := c.Context()
+
+	keys, err := h.adminService.ListKeys(ctx)
+	if err != nil {
+		return c.Status(fiber.StatusInternalServerError).JSON(
+			models.ErrorResponse(models.ErrCodeInternalError, "Failed to list users: "+err.Error()),
+		)
+	}
+
+	// Convert to UserInfo format
+	users := make([]models.UserInfo, 0, len(keys))
+	for _, key := range keys {
+		// Get full key info to retrieve bucket permissions
+		keyInfo, err := h.adminService.GetKeyInfo(ctx, key.ID, false)
+		if err != nil {
+			// If we can't get full info, skip this key or use basic info
+			continue
+		}
+
+		// Convert bucket permissions to frontend format
+		bucketPermissions := convertBucketPermissionsToBucketPermissions(keyInfo.Buckets)
+
+		// Determine status based on expiration
+		status := "active"
+		if keyInfo.Expired {
+			status = "inactive"
+		}
+
+		users = append(users, models.UserInfo{
+			AccessKeyID:       keyInfo.AccessKeyID,
+			Name:              keyInfo.Name,
+			CreatedAt:         keyInfo.Created,
+			Status:            status,
+			BucketPermissions: bucketPermissions,
+			Expiration:        keyInfo.Expiration,
+			Expired:           keyInfo.Expired,
+		})
+	}
+
+	return c.JSON(models.SuccessResponse(models.UserListResponse{
+		Users: users,
+		Count: len(users),
+	}))
+}
+
+// convertBucketPermissionsToBucketPermissions converts Garage bucket permissions to frontend BucketPermission format
+func convertBucketPermissionsToBucketPermissions(buckets []models.KeyBucketInfo) []models.BucketPermission {
+	permissions := make([]models.BucketPermission, 0, len(buckets))
+
+	for _, bucket := range buckets {
+		// Get bucket name from aliases
+		var bucketName string
+		if len(bucket.GlobalAliases) > 0 {
+			bucketName = bucket.GlobalAliases[0]
+		} else if len(bucket.LocalAliases) > 0 {
+			bucketName = bucket.LocalAliases[0]
+		} else {
+			bucketName = bucket.ID
+		}
+
+		// Create bucket permission with simple read/write/owner flags
+		permissions = append(permissions, models.BucketPermission{
+			BucketID:   bucket.ID,
+			BucketName: bucketName,
+			Read:       bucket.Permissions.Read,
+			Write:      bucket.Permissions.Write,
+			Owner:      bucket.Permissions.Owner,
+		})
+	}
+
+	return permissions
+}
+
+// CreateUser creates a new user/access key
+//
+//	@Summary		Create a new user
+//	@Description	Creates a new user/access key with optional name
+//	@Tags			Users
+//	@Accept			json
+//	@Produce		json
+//	@Param			request	body		models.CreateUserRequest					true	"User creation request"
+//	@Success		201		{object}	models.APIResponse{data=models.UserInfo}	"User created successfully"
+//	@Failure		400		{object}	models.APIResponse{error=models.APIError}	"Invalid request body"
+//	@Failure		500		{object}	models.APIResponse{error=models.APIError}	"Failed to create user"
+//	@Router			/api/v1/users [post]
+func (h *UserHandler) CreateUser(c fiber.Ctx) error {
+	ctx := c.Context()
+
+	var req models.CreateUserRequest
+	if err := c.Bind().JSON(&req); err != nil {
+		return c.Status(fiber.StatusBadRequest).JSON(
+			models.ErrorResponse(models.ErrCodeBadRequest, "Invalid request body: "+err.Error()),
+		)
+	}
+
+	// Prepare create key request
+	createReq := models.CreateKeyRequest{}
+	if req.Name != "" {
+		createReq.Name = &req.Name
+	}
+
+	// Create the key
+	keyInfo, err := h.adminService.CreateKey(ctx, createReq)
+	if err != nil {
+		return c.Status(fiber.StatusInternalServerError).JSON(
+			models.ErrorResponse(models.ErrCodeInternalError, "Failed to create user: "+err.Error()),
+		)
+	}
+
+	// Convert bucket permissions to frontend format
+	bucketPermissions := convertBucketPermissionsToBucketPermissions(keyInfo.Buckets)
+
+	// Determine status
+	status := "active"
+	if keyInfo.Expired {
+		status = "inactive"
+	}
+
+	// Convert to UserInfo format
+	userInfo := models.UserInfo{
+		AccessKeyID:       keyInfo.AccessKeyID,
+		SecretKey:         keyInfo.SecretAccessKey,
+		Name:              keyInfo.Name,
+		CreatedAt:         keyInfo.Created,
+		Status:            status,
+		BucketPermissions: bucketPermissions,
+		Expiration:        keyInfo.Expiration,
+		Expired:           keyInfo.Expired,
+	}
+
+	return c.Status(fiber.StatusCreated).JSON(models.SuccessResponse(userInfo))
+}
+
+// DeleteUser deletes a user/access key
+//
+//	@Summary		Delete a user
+//	@Description	Deletes a specific user/access key
+//	@Tags			Users
+//	@Produce		json
+//	@Param			access_key	path		string											true	"Access key of the user to delete"
+//	@Success		200			{object}	models.APIResponse{data=map[string]interface{}}	"User deleted successfully"
+//	@Failure		400			{object}	models.APIResponse{error=models.APIError}		"Access key is required"
+//	@Failure		500			{object}	models.APIResponse{error=models.APIError}		"Failed to delete user"
+//	@Router			/api/v1/users/{access_key} [delete]
+func (h *UserHandler) DeleteUser(c fiber.Ctx) error {
+	ctx := c.Context()
+	accessKey := c.Params("access_key")
+
+	if accessKey == "" {
+		return c.Status(fiber.StatusBadRequest).JSON(
+			models.ErrorResponse(models.ErrCodeBadRequest, "Access key is required"),
+		)
+	}
+
+	// Delete the key
+	err := h.adminService.DeleteKey(ctx, accessKey)
+	if err != nil {
+		return c.Status(fiber.StatusInternalServerError).JSON(
+			models.ErrorResponse(models.ErrCodeInternalError, "Failed to delete user: "+err.Error()),
+		)
+	}
+
+	return c.JSON(models.SuccessResponse(map[string]interface{}{
+		"access_key": accessKey,
+		"deleted":    true,
+	}))
+}
+
+// GetUser retrieves information about a specific user/access key
+//
+//	@Summary		Get user information
+//	@Description	Retrieves information about a specific user/access key
+//	@Tags			Users
+//	@Produce		json
+//	@Param			access_key	path		string										true	"Access key of the user to retrieve"
+//	@Success		200			{object}	models.APIResponse{data=models.UserInfo}	"User information retrieved successfully"
+//	@Failure		400			{object}	models.APIResponse{error=models.APIError}	"Access key is required"
+//	@Failure		500			{object}	models.APIResponse{error=models.APIError}	"Failed to get user info"
+//	@Router			/api/v1/users/{access_key} [get]
+func (h *UserHandler) GetUser(c fiber.Ctx) error {
+	ctx := c.Context()
+	accessKey := c.Params("access_key")
+
+	if accessKey == "" {
+		return c.Status(fiber.StatusBadRequest).JSON(
+			models.ErrorResponse(models.ErrCodeBadRequest, "Access key is required"),
+		)
+	}
+
+	// Get key information (without secret key)
+	keyInfo, err := h.adminService.GetKeyInfo(ctx, accessKey, false)
+	if err != nil {
+		return c.Status(fiber.StatusInternalServerError).JSON(
+			models.ErrorResponse(models.ErrCodeInternalError, "Failed to get user info: "+err.Error()),
+		)
+	}
+
+	// Convert bucket permissions to frontend format
+	bucketPermissions := convertBucketPermissionsToBucketPermissions(keyInfo.Buckets)
+
+	// Determine status
+	status := "active"
+	if keyInfo.Expired {
+		status = "inactive"
+	}
+
+	// Convert to UserInfo format
+	userInfo := models.UserInfo{
+		AccessKeyID:       keyInfo.AccessKeyID,
+		Name:              keyInfo.Name,
+		CreatedAt:         keyInfo.Created,
+		Status:            status,
+		BucketPermissions: bucketPermissions,
+		Expiration:        keyInfo.Expiration,
+		Expired:           keyInfo.Expired,
+	}
+
+	return c.JSON(models.SuccessResponse(userInfo))
+}
+
+// UpdateUserPermissions updates user permissions
+//
+//	@Summary		Update user permissions
+//	@Description	Updates the permissions and settings for a specific user/access key
+//	@Tags			Users
+//	@Accept			json
+//	@Produce		json
+//	@Param			access_key	path		string										true	"Access key of the user to update"
+//	@Param			request		body		models.UpdateUserRequest					true	"User update request with new permissions"
+//	@Success		200			{object}	models.APIResponse{data=models.UserInfo}	"User updated successfully"
+//	@Failure		400			{object}	models.APIResponse{error=models.APIError}	"Access key is required or invalid request body"
+//	@Failure		500			{object}	models.APIResponse{error=models.APIError}	"Failed to update user"
+//	@Router			/api/v1/users/{access_key} [patch]
+func (h *UserHandler) UpdateUserPermissions(c fiber.Ctx) error {
+	ctx := c.Context()
+	accessKey := c.Params("access_key")
+
+	if accessKey == "" {
+		return c.Status(fiber.StatusBadRequest).JSON(
+			models.ErrorResponse(models.ErrCodeBadRequest, "Access key is required"),
+		)
+	}
+
+	var req models.UpdateUserRequest
+	if err := c.Bind().JSON(&req); err != nil {
+		return c.Status(fiber.StatusBadRequest).JSON(
+			models.ErrorResponse(models.ErrCodeBadRequest, "Invalid request body: "+err.Error()),
+		)
+	}
+
+	// Prepare update request
+	updateReq := models.UpdateKeyRequest{}
+
+	// Handle status change (activate/deactivate)
+	if req.Status != nil {
+		if *req.Status == "inactive" {
+			// Deactivate by setting expiration to the past
+			pastTime := time.Now().Add(-24 * time.Hour)
+			updateReq.Expiration = &pastTime
+			updateReq.NeverExpires = false
+		} else if *req.Status == "active" {
+			// Activate by removing expiration (set to never expire)
+			updateReq.NeverExpires = true
+		}
+	}
+
+	// Handle explicit expiration date setting
+	if req.Expiration != nil && *req.Expiration != "" {
+		expirationTime, err := time.Parse(time.RFC3339, *req.Expiration)
+		if err != nil {
+			return c.Status(fiber.StatusBadRequest).JSON(
+				models.ErrorResponse(models.ErrCodeBadRequest, "Invalid expiration date format: "+err.Error()),
+			)
+		}
+		updateReq.Expiration = &expirationTime
+		updateReq.NeverExpires = false
+	}
+
+	// Update the key
+	keyInfo, err := h.adminService.UpdateKey(ctx, accessKey, updateReq)
+	if err != nil {
+		return c.Status(fiber.StatusInternalServerError).JSON(
+			models.ErrorResponse(models.ErrCodeInternalError, "Failed to update user: "+err.Error()),
+		)
+	}
+
+	// Convert bucket permissions to frontend format
+	bucketPermissions := convertBucketPermissionsToBucketPermissions(keyInfo.Buckets)
+
+	// Determine status
+	status := "active"
+	if keyInfo.Expired {
+		status = "inactive"
+	}
+
+	// Convert to UserInfo format
+	userInfo := models.UserInfo{
+		AccessKeyID:       keyInfo.AccessKeyID,
+		Name:              keyInfo.Name,
+		CreatedAt:         keyInfo.Created,
+		Status:            status,
+		BucketPermissions: bucketPermissions,
+		Expiration:        keyInfo.Expiration,
+		Expired:           keyInfo.Expired,
+	}
+
+	return c.JSON(models.SuccessResponse(userInfo))
+}

backend/internal/middleware/auth.go

@@ -0,0 +1,133 @@
+package middleware
+
+import (
+	"Noooste/garage-ui/internal/auth"
+	"Noooste/garage-ui/internal/config"
+	"Noooste/garage-ui/internal/models"
+
+	"github.com/gofiber/fiber/v3"
+)
+
+// AuthMiddleware returns a Fiber middleware for authentication
+// It handles different auth modes: none, basic, and OIDC
+func AuthMiddleware(cfg *config.AuthConfig, authService *auth.AuthService) fiber.Handler {
+	return func(c fiber.Ctx) error {
+		// If auth mode is "none", allow all requests
+		if cfg.Mode == "none" {
+			return c.Next()
+		}
+
+		// Handle basic authentication
+		if cfg.Mode == "basic" {
+			return handleBasicAuth(c, authService)
+		}
+
+		// Handle OIDC authentication
+		if cfg.Mode == "oidc" {
+			return handleOIDCAuth(c, authService, &cfg.OIDC)
+		}
+
+		// Unknown auth mode - deny access
+		return c.Status(fiber.StatusUnauthorized).JSON(
+			models.ErrorResponse(models.ErrCodeUnauthorized, "Invalid authentication mode"),
+		)
+	}
+}
+
+// handleBasicAuth validates basic authentication credentials
+func handleBasicAuth(c fiber.Ctx, authService *auth.AuthService) error {
+	// Get Authorization header
+	authHeader := c.Get("Authorization")
+	if authHeader == "" {
+		c.Set("WWW-Authenticate", `Basic realm="Restricted"`)
+		return c.Status(fiber.StatusUnauthorized).JSON(
+			models.ErrorResponse(models.ErrCodeUnauthorized, "Authorization header required"),
+		)
+	}
+
+	// Parse basic auth credentials
+	username, password, ok := auth.ParseBasicAuth(authHeader)
+	if !ok {
+		c.Set("WWW-Authenticate", `Basic realm="Restricted"`)
+		return c.Status(fiber.StatusUnauthorized).JSON(
+			models.ErrorResponse(models.ErrCodeUnauthorized, "Invalid Authorization header format"),
+		)
+	}
+
+	// Validate credentials
+	if !authService.ValidateBasicAuth(username, password) {
+		c.Set("WWW-Authenticate", `Basic realm="Restricted"`)
+		return c.Status(fiber.StatusUnauthorized).JSON(
+			models.ErrorResponse(models.ErrCodeUnauthorized, "Invalid credentials"),
+		)
+	}
+
+	// Store username in context for later use
+	c.Locals("username", username)
+
+	return c.Next()
+}
+
+// handleOIDCAuth validates OIDC session/token
+func handleOIDCAuth(c fiber.Ctx, authService *auth.AuthService, oidcCfg *config.OIDCConfig) error {
+	// Get session cookie
+	sessionCookie := c.Cookies(oidcCfg.CookieName)
+	if sessionCookie == "" {
+		return c.Status(fiber.StatusUnauthorized).JSON(
+			models.ErrorResponse(models.ErrCodeUnauthorized, "Authentication required"),
+		)
+	}
+
+	// Validate JWT session token
+	userInfo, err := authService.ValidateSessionToken(sessionCookie)
+	if err != nil {
+		return c.Status(fiber.StatusUnauthorized).JSON(
+			models.ErrorResponse(models.ErrCodeUnauthorized, "Invalid or expired session"),
+		)
+	}
+
+	// Store user info in context for handlers to use
+	c.Locals("userInfo", userInfo)
+	c.Locals("username", userInfo.Username)
+	c.Locals("email", userInfo.Email)
+
+	return c.Next()
+}
+
+func RequireAuth(cfg *config.AuthConfig) fiber.Handler {
+	return func(c fiber.Ctx) error {
+		if cfg.Mode == "none" {
+			return c.Status(fiber.StatusForbidden).JSON(
+				models.ErrorResponse(models.ErrCodeForbidden, "Authentication is required but not configured"),
+			)
+		}
+		return c.Next()
+	}
+}
+
+func RequireAdmin(authService *auth.AuthService) fiber.Handler {
+	return func(c fiber.Ctx) error {
+		userInfoInterface := c.Locals("userInfo")
+		if userInfoInterface == nil {
+			return c.Status(fiber.StatusForbidden).JSON(
+				models.ErrorResponse(models.ErrCodeForbidden, "Admin access required"),
+			)
+		}
+
+		userInfo, ok := userInfoInterface.(*auth.UserInfo)
+		if !ok {
+			return c.Status(fiber.StatusForbidden).JSON(
+				models.ErrorResponse(models.ErrCodeForbidden, "Admin access required"),
+			)
+		}
+
+		// Check if user has admin role
+		if !authService.IsAdmin(userInfo) {
+			return c.Status(fiber.StatusForbidden).JSON(
+				models.ErrorResponse(models.ErrCodeForbidden, "Admin role required"),
+			)
+		}
+
+		return c.Next()
+	}
+}

backend/internal/middleware/cors.go

@@ -0,0 +1,65 @@
+package middleware
+
+import (
+	"strings"
+
+	"Noooste/garage-ui/internal/config"
+
+	"github.com/gofiber/fiber/v3"
+)
+
+// CORSMiddleware creates a CORS middleware from configuration
+func CORSMiddleware(cfg *config.CORSConfig) fiber.Handler {
+	// If CORS is disabled, return a no-op middleware
+	if !cfg.Enabled {
+		return func(c fiber.Ctx) error {
+			return c.Next()
+		}
+	}
+
+	return func(c fiber.Ctx) error {
+		origin := c.Get("Origin")
+
+		// Check if origin is allowed
+		if origin != "" && isAllowedOrigin(origin, cfg.AllowedOrigins) {
+			// Set CORS headers
+			c.Set("Access-Control-Allow-Origin", origin)
+
+			if cfg.AllowCredentials {
+				c.Set("Access-Control-Allow-Credentials", "true")
+			}
+
+			// Set allowed methods
+			if len(cfg.AllowedMethods) > 0 {
+				c.Set("Access-Control-Allow-Methods", strings.Join(cfg.AllowedMethods, ", "))
+			}
+
+			// Set allowed headers
+			if len(cfg.AllowedHeaders) > 0 {
+				c.Set("Access-Control-Allow-Headers", strings.Join(cfg.AllowedHeaders, ", "))
+			}
+
+			// Set max age for preflight cache
+			if cfg.MaxAge > 0 {
+				c.Set("Access-Control-Max-Age", string(rune(cfg.MaxAge)))
+			}
+		}
+
+		// Handle preflight requests
+		if c.Method() == "OPTIONS" {
+			return c.SendStatus(fiber.StatusNoContent)
+		}
+
+		return c.Next()
+	}
+}
+
+// isAllowedOrigin checks if an origin is in the allowed list
+func isAllowedOrigin(origin string, allowedOrigins []string) bool {
+	for _, allowed := range allowedOrigins {
+		if allowed == "*" || allowed == origin {
+			return true
+		}
+	}
+	return false
+}

backend/internal/models/garage_admin.go

@@ -0,0 +1,263 @@
+package models
+
+import "time"
+
+// ====================================
+// Access Key Models
+// ====================================
+
+// GarageKeyInfo represents detailed information about a Garage access key
+type GarageKeyInfo struct {
+	AccessKeyID     string          `json:"accessKeyId"`
+	Name            string          `json:"name"`
+	Expired         bool            `json:"expired"`
+	SecretAccessKey *string         `json:"secretAccessKey,omitempty"`
+	Permissions     KeyPermissions  `json:"permissions"`
+	Buckets         []KeyBucketInfo `json:"buckets"`
+	Created         *time.Time      `json:"created,omitempty"`
+	Expiration      *time.Time      `json:"expiration,omitempty"`
+}
+
+// KeyPermissions represents permissions for an access key
+type KeyPermissions struct {
+	CreateBucket bool `json:"createBucket"`
+}
+
+// KeyBucketInfo represents bucket information associated with a key
+type KeyBucketInfo struct {
+	ID            string              `json:"id"`
+	GlobalAliases []string            `json:"globalAliases"`
+	LocalAliases  []string            `json:"localAliases"`
+	Permissions   BucketKeyPermission `json:"permissions"`
+}
+
+// BucketKeyPermission represents permissions a key has on a specific bucket
+type BucketKeyPermission struct {
+	Read  bool `json:"read"`
+	Write bool `json:"write"`
+	Owner bool `json:"owner"`
+}
+
+// CreateKeyRequest represents the request to create a new access key
+type CreateKeyRequest struct {
+	Name         *string         `json:"name,omitempty"`
+	Expiration   *time.Time      `json:"expiration,omitempty"`
+	NeverExpires bool            `json:"neverExpires,omitempty"`
+	Allow        *KeyPermissions `json:"allow,omitempty"`
+	Deny         *KeyPermissions `json:"deny,omitempty"`
+}
+
+// UpdateKeyRequest represents the request to update an access key
+type UpdateKeyRequest struct {
+	Name         *string         `json:"name,omitempty"`
+	Expiration   *time.Time      `json:"expiration,omitempty"`
+	NeverExpires bool            `json:"neverExpires,omitempty"`
+	Allow        *KeyPermissions `json:"allow,omitempty"`
+	Deny         *KeyPermissions `json:"deny,omitempty"`
+}
+
+// ImportKeyRequest represents the request to import an existing key
+type ImportKeyRequest struct {
+	AccessKeyID     string  `json:"accessKeyId"`
+	SecretAccessKey string  `json:"secretAccessKey"`
+	Name            *string `json:"name,omitempty"`
+}
+
+// ListKeysResponseItem represents a single key in the list response
+type ListKeysResponseItem struct {
+	ID         string     `json:"id"`
+	Name       string     `json:"name"`
+	Expired    bool       `json:"expired"`
+	Created    *time.Time `json:"created,omitempty"`
+	Expiration *time.Time `json:"expiration,omitempty"`
+}
+
+// ====================================
+// Bucket Models (Admin API)
+// ====================================
+
+// GarageBucketInfo represents detailed information about a bucket from Admin API
+type GarageBucketInfo struct {
+	ID                             string               `json:"id"`
+	Created                        time.Time            `json:"created"`
+	GlobalAliases                  []string             `json:"globalAliases"`
+	WebsiteAccess                  bool                 `json:"websiteAccess"`
+	WebsiteConfig                  *BucketWebsiteConfig `json:"websiteConfig,omitempty"`
+	Keys                           []BucketKeyInfo      `json:"keys"`
+	Objects                        int64                `json:"objects"`
+	Bytes                          int64                `json:"bytes"`
+	UnfinishedUploads              int64                `json:"unfinishedUploads"`
+	UnfinishedMultipartUploads     int64                `json:"unfinishedMultipartUploads"`
+	UnfinishedMultipartUploadParts int64                `json:"unfinishedMultipartUploadParts"`
+	UnfinishedMultipartUploadBytes int64                `json:"unfinishedMultipartUploadBytes"`
+	Quotas                         *BucketQuotas        `json:"quotas,omitempty"`
+}
+
+// BucketWebsiteConfig represents website configuration for a bucket
+type BucketWebsiteConfig struct {
+	IndexDocument string  `json:"indexDocument"`
+	ErrorDocument *string `json:"errorDocument,omitempty"`
+}
+
+// BucketQuotas represents quota settings for a bucket
+type BucketQuotas struct {
+	MaxSize    *int64 `json:"maxSize,omitempty"`
+	MaxObjects *int64 `json:"maxObjects,omitempty"`
+}
+
+// BucketKeyInfo represents key information associated with a bucket
+type BucketKeyInfo struct {
+	AccessKeyID        string              `json:"accessKeyId"`
+	Name               string              `json:"name"`
+	Permissions        BucketKeyPermission `json:"permissions"`
+	BucketLocalAliases []string            `json:"bucketLocalAliases"`
+}
+
+// CreateBucketAdminRequest represents the request to create a bucket via Admin API
+type CreateBucketAdminRequest struct {
+	GlobalAlias *string                 `json:"globalAlias,omitempty"`
+	LocalAlias  *CreateBucketLocalAlias `json:"localAlias,omitempty"`
+}
+
+// CreateBucketLocalAlias represents local alias configuration when creating a bucket
+type CreateBucketLocalAlias struct {
+	AccessKeyID string               `json:"accessKeyId"`
+	Alias       string               `json:"alias"`
+	Allow       *BucketKeyPermission `json:"allow,omitempty"`
+}
+
+// UpdateBucketRequest represents the request to update bucket settings
+type UpdateBucketRequest struct {
+	WebsiteAccess *UpdateBucketWebsiteAccess `json:"websiteAccess,omitempty"`
+	Quotas        *BucketQuotas              `json:"quotas,omitempty"`
+}
+
+// UpdateBucketWebsiteAccess represents website access settings update
+type UpdateBucketWebsiteAccess struct {
+	Enabled       bool    `json:"enabled"`
+	IndexDocument *string `json:"indexDocument,omitempty"`
+	ErrorDocument *string `json:"errorDocument,omitempty"`
+}
+
+// ListBucketsResponseItem represents a single bucket in the list response
+type ListBucketsResponseItem struct {
+	ID            string             `json:"id"`
+	Created       time.Time          `json:"created"`
+	GlobalAliases []string           `json:"globalAliases"`
+	LocalAliases  []BucketLocalAlias `json:"localAliases"`
+}
+
+// BucketLocalAlias represents a local alias for a bucket
+type BucketLocalAlias struct {
+	AccessKeyID string `json:"accessKeyId"`
+	Alias       string `json:"alias"`
+}
+
+// ====================================
+// Bucket Alias Models
+// ====================================
+
+// AddBucketAliasRequest represents the request to add a bucket alias
+type AddBucketAliasRequest struct {
+	BucketID    string  `json:"bucketId"`
+	GlobalAlias *string `json:"globalAlias,omitempty"`
+	LocalAlias  *string `json:"localAlias,omitempty"`
+	AccessKeyID *string `json:"accessKeyId,omitempty"`
+}
+
+// RemoveBucketAliasRequest represents the request to remove a bucket alias
+type RemoveBucketAliasRequest struct {
+	BucketID    string  `json:"bucketId"`
+	GlobalAlias *string `json:"globalAlias,omitempty"`
+	LocalAlias  *string `json:"localAlias,omitempty"`
+	AccessKeyID *string `json:"accessKeyId,omitempty"`
+}
+
+// ====================================
+// Permission Models
+// ====================================
+
+// BucketKeyPermRequest represents a request to change bucket-key permissions
+type BucketKeyPermRequest struct {
+	BucketID    string              `json:"bucketId"`
+	AccessKeyID string              `json:"accessKeyId"`
+	Permissions BucketKeyPermission `json:"permissions"`
+}
+
+// ====================================
+// Cluster Models
+// ====================================
+
+// ClusterHealth represents the health status of the cluster
+type ClusterHealth struct {
+	Status           string `json:"status"`
+	KnownNodes       int    `json:"knownNodes"`
+	ConnectedNodes   int    `json:"connectedNodes"`
+	StorageNodes     int    `json:"storageNodes"`
+	StorageNodesUp   int    `json:"storageNodesUp"`
+	Partitions       int    `json:"partitions"`
+	PartitionsQuorum int    `json:"partitionsQuorum"`
+	PartitionsAllOk  int    `json:"partitionsAllOk"`
+}
+
+// ClusterStatus represents the current status of the cluster
+type ClusterStatus struct {
+	LayoutVersion int        `json:"layoutVersion"`
+	Nodes         []NodeInfo `json:"nodes"`
+}
+
+// ClusterStatistics represents global cluster statistics
+type ClusterStatistics struct {
+	Freeform string `json:"freeform"`
+}
+
+// ====================================
+// Node Models
+// ====================================
+
+// NodeInfo represents information about a cluster node
+type NodeInfo struct {
+	ID                string         `json:"id"`
+	IsUp              bool           `json:"isUp"`
+	LastSeenSecsAgo   *int64         `json:"lastSeenSecsAgo,omitempty"`
+	Hostname          *string        `json:"hostname,omitempty"`
+	Addr              *string        `json:"addr,omitempty"`
+	GarageVersion     *string        `json:"garageVersion,omitempty"`
+	Role              *NodeRole      `json:"role,omitempty"`
+	Draining          bool           `json:"draining"`
+	DataPartition     *FreeSpaceInfo `json:"dataPartition,omitempty"`
+	MetadataPartition *FreeSpaceInfo `json:"metadataPartition,omitempty"`
+}
+
+// NodeRole represents the role assigned to a node
+type NodeRole struct {
+	Zone     string   `json:"zone"`
+	Capacity *int64   `json:"capacity,omitempty"`
+	Tags     []string `json:"tags"`
+}
+
+// FreeSpaceInfo represents disk space information
+type FreeSpaceInfo struct {
+	Available int64 `json:"available"`
+	Total     int64 `json:"total"`
+}
+
+// NodeInfoResponse represents the response for GetNodeInfo
+type NodeInfoResponse struct {
+	NodeID         string   `json:"nodeId"`
+	GarageVersion  string   `json:"garageVersion"`
+	RustVersion    string   `json:"rustVersion"`
+	DBEngine       string   `json:"dbEngine"`
+	GarageFeatures []string `json:"garageFeatures,omitempty"`
+}
+
+// NodeStatisticsResponse represents the response for GetNodeStatistics
+type NodeStatisticsResponse struct {
+	Freeform string `json:"freeform"`
+}
+
+// MultiNodeResponse represents responses from multiple nodes
+type MultiNodeResponse struct {
+	Success map[string]interface{} `json:"success"`
+	Error   map[string]string      `json:"error"`
+}

backend/internal/models/requests.go

@@ -0,0 +1,61 @@
+package models
+
+// CreateBucketRequest represents a request to create a new bucket
+type CreateBucketRequest struct {
+	Name   string `json:"name" validate:"required"`
+	Region string `json:"region,omitempty"`
+}
+
+// GrantBucketPermissionRequest represents a request to grant permissions on a bucket
+type GrantBucketPermissionRequest struct {
+	AccessKeyID string              `json:"accessKeyId" validate:"required"`
+	Permissions BucketKeyPermission `json:"permissions" validate:"required"`
+}
+
+// DeleteBucketRequest represents a request to delete a bucket
+type DeleteBucketRequest struct {
+	Name string `json:"name" validate:"required"`
+}
+
+// ListObjectsRequest represents a request to list objects in a bucket
+type ListObjectsRequest struct {
+	Bucket  string `json:"bucket" validate:"required"`
+	Prefix  string `json:"prefix,omitempty"`
+	MaxKeys int    `json:"max_keys,omitempty"`
+	Marker  string `json:"marker,omitempty"`
+}
+
+// UploadObjectRequest represents metadata for an object upload
+type UploadObjectRequest struct {
+	Bucket      string `json:"bucket" validate:"required"`
+	Key         string `json:"key" validate:"required"`
+	ContentType string `json:"content_type,omitempty"`
+}
+
+// DeleteObjectRequest represents a request to delete an object
+type DeleteObjectRequest struct {
+	Bucket string `json:"bucket" validate:"required"`
+	Key    string `json:"key" validate:"required"`
+}
+
+// GetObjectRequest represents a request to get/download an object
+type GetObjectRequest struct {
+	Bucket string `json:"bucket" validate:"required"`
+	Key    string `json:"key" validate:"required"`
+}
+
+// CreateUserRequest represents a request to create a new user/key
+type CreateUserRequest struct {
+	Name string `json:"name,omitempty"`
+}
+
+// DeleteUserRequest represents a request to delete a user/key
+type DeleteUserRequest struct {
+	AccessKey string `json:"access_key" validate:"required"`
+}
+
+// UpdateUserRequest represents a request to update user permissions
+type UpdateUserRequest struct {
+	Status     *string `json:"status,omitempty"`     // "active" or "inactive"
+	Expiration *string `json:"expiration,omitempty"` // ISO 8601 date string
+}

backend/internal/models/responses.go

@@ -0,0 +1,204 @@
+package models
+
+import "time"
+
+// DashboardMetrics represents aggregated metrics for the dashboard
+type DashboardMetrics struct {
+	TotalSize     int64         `json:"totalSize"`
+	ObjectCount   int64         `json:"objectCount"`
+	BucketCount   int           `json:"bucketCount"`
+	UsageByBucket []BucketUsage `json:"usageByBucket"`
+}
+
+// BucketUsage represents storage usage for a single bucket
+type BucketUsage struct {
+	BucketName  string  `json:"bucketName"`
+	Size        int64   `json:"size"`
+	ObjectCount int64   `json:"objectCount"`
+	Percentage  float64 `json:"percentage"`
+}
+
+// APIResponse is the standard response structure for all API endpoints
+type APIResponse struct {
+	Success bool        `json:"success"`
+	Data    interface{} `json:"data,omitempty"`
+	Error   *APIError   `json:"error,omitempty"`
+}
+
+// APIError represents an error in the API response
+type APIError struct {
+	Code    string `json:"code"`
+	Message string `json:"message"`
+}
+
+// HealthResponse represents the health check response
+type HealthResponse struct {
+	Status    string    `json:"status"`
+	Timestamp time.Time `json:"timestamp"`
+	Version   string    `json:"version"`
+}
+
+// BucketInfo represents information about a bucket
+type BucketInfo struct {
+	Name         string    `json:"name"`
+	CreationDate time.Time `json:"creation_date"`
+	ObjectCount  *int64    `json:"object_count,omitempty"`
+	Size         *int64    `json:"size,omitempty"`
+	Region       string    `json:"region,omitempty"`
+}
+
+// BucketListResponse represents a list of buckets
+type BucketListResponse struct {
+	Buckets []BucketInfo `json:"buckets"`
+	Count   int          `json:"count"`
+}
+
+// ObjectInfo represents information about an object
+type ObjectInfo struct {
+	Key          string    `json:"key"`
+	Size         int64     `json:"size"`
+	LastModified time.Time `json:"last_modified"`
+	ETag         string    `json:"etag"`
+	ContentType  string    `json:"content_type,omitempty"`
+	StorageClass string    `json:"storage_class,omitempty"`
+}
+
+// ObjectListResponse represents a list of objects in a bucket
+type ObjectListResponse struct {
+	Bucket                string       `json:"bucket"`
+	Objects               []ObjectInfo `json:"objects"`
+	Prefixes              []string     `json:"prefixes"`
+	Count                 int          `json:"count"`
+	IsTruncated           bool         `json:"is_truncated"`
+	NextContinuationToken string       `json:"next_continuation_token,omitempty"`
+}
+
+// ObjectUploadResponse represents the response after uploading an object
+type ObjectUploadResponse struct {
+	Bucket      string `json:"bucket"`
+	Key         string `json:"key"`
+	ETag        string `json:"etag"`
+	Size        int64  `json:"size"`
+	ContentType string `json:"content_type"`
+}
+
+// ObjectUploadMultipleResponse represents the response after uploading multiple objects
+type ObjectUploadMultipleResponse struct {
+	Bucket       string                     `json:"bucket"`
+	TotalFiles   int                        `json:"total_files"`
+	SuccessCount int                        `json:"success_count"`
+	FailureCount int                        `json:"failure_count"`
+	SuccessFiles []ObjectUploadResult       `json:"success_files"`
+	FailedFiles  []ObjectUploadFailedResult `json:"failed_files,omitempty"`
+}
+
+// ObjectUploadResult represents a successful upload result
+type ObjectUploadResult struct {
+	Key         string `json:"key"`
+	ETag        string `json:"etag"`
+	Size        int64  `json:"size"`
+	ContentType string `json:"content_type,omitempty"`
+}
+
+// ObjectUploadFailedResult represents a failed upload result
+type ObjectUploadFailedResult struct {
+	Key         string `json:"key"`
+	Error       string `json:"error"`
+	ContentType string `json:"content_type,omitempty"`
+}
+
+// ObjectDeleteResponse represents the response after deleting an object
+type ObjectDeleteResponse struct {
+	Bucket  string `json:"bucket"`
+	Key     string `json:"key"`
+	Deleted bool   `json:"deleted"`
+}
+
+// UserInfo represents information about a Garage user (key pair)
+type UserInfo struct {
+	AccessKeyID       string             `json:"accessKeyId"`
+	Name              string             `json:"name"`
+	SecretKey         *string            `json:"secretKey,omitempty"`
+	CreatedAt         *time.Time         `json:"createdAt,omitempty"`
+	LastUsed          *time.Time         `json:"lastUsed,omitempty"`
+	Status            string             `json:"status"`      // "active" or "inactive"
+	BucketPermissions []BucketPermission `json:"permissions"` // Array of bucket permissions
+	Expiration        *time.Time         `json:"expiration,omitempty"`
+	Expired           bool               `json:"expired"`
+}
+
+// BucketPermission represents permissions for a specific bucket
+type BucketPermission struct {
+	BucketID   string `json:"bucketId"`
+	BucketName string `json:"bucketName"`
+	Read       bool   `json:"read"`
+	Write      bool   `json:"write"`
+	Owner      bool   `json:"owner"`
+}
+
+// Permission represents a permission entry for access control (legacy/deprecated)
+type Permission struct {
+	Resource string   `json:"resource"`
+	Actions  []string `json:"actions"`
+	Effect   string   `json:"effect"` // "Allow" or "Deny"
+}
+
+type PresignedURLResponse struct {
+	URL       string `json:"url"`
+	ExpiresIn int64  `json:"expires_in"` // in seconds
+	Bucket    string `json:"bucket"`
+	Key       string `json:"key"`
+}
+
+type ObjectDeleteMultipleResponse struct {
+	Bucket  string   `json:"bucket"`
+	Deleted int      `json:"deleted"`
+	Keys    []string `json:"keys"`
+}
+
+// UserListResponse represents a list of users/keys
+type UserListResponse struct {
+	Users []UserInfo `json:"users"`
+	Count int        `json:"count"`
+}
+
+// Helper functions to create standard responses
+
+// SuccessResponse creates a successful API response
+func SuccessResponse(data interface{}) APIResponse {
+	return APIResponse{
+		Success: true,
+		Data:    data,
+		Error:   nil,
+	}
+}
+
+// ErrorResponse creates an error API response
+func ErrorResponse(code, message string) APIResponse {
+	return APIResponse{
+		Success: false,
+		Data:    nil,
+		Error: &APIError{
+			Code:    code,
+			Message: message,
+		},
+	}
+}
+
+// Common error codes
+const (
+	ErrCodeBadRequest        = "BAD_REQUEST"
+	ErrCodeUnauthorized      = "UNAUTHORIZED"
+	ErrCodeForbidden         = "FORBIDDEN"
+	ErrCodeNotFound          = "NOT_FOUND"
+	ErrCodeConflict          = "CONFLICT"
+	ErrCodeInternalError     = "INTERNAL_ERROR"
+	ErrCodeBucketExists      = "BUCKET_ALREADY_EXISTS"
+	ErrCodeBucketNotFound    = "BUCKET_NOT_FOUND"
+	ErrCodeObjectNotFound    = "OBJECT_NOT_FOUND"
+	ErrCodeInvalidBucketName = "INVALID_BUCKET_NAME"
+	ErrCodeInvalidObjectKey  = "INVALID_OBJECT_KEY"
+	ErrCodeUploadFailed      = "UPLOAD_FAILED"
+	ErrCodeDeleteFailed      = "DELETE_FAILED"
+	ErrCodeListFailed        = "LIST_FAILED"
+)

backend/internal/routes/routes.go

@@ -0,0 +1,246 @@
+package routes
+
+import (
+	"Noooste/garage-ui/internal/auth"
+	"Noooste/garage-ui/internal/config"
+	"Noooste/garage-ui/internal/handlers"
+	"Noooste/garage-ui/internal/middleware"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/gofiber/fiber/v3"
+	// Swagger imports
+	_ "Noooste/garage-ui/docs"
+
+	"github.com/Noooste/swagger"
+)
+
+// SetupRoutes configures all API routes
+func SetupRoutes(
+	app *fiber.App,
+	cfg *config.Config,
+	authService *auth.AuthService,
+	healthHandler *handlers.HealthHandler,
+	bucketHandler *handlers.BucketHandler,
+	objectHandler *handlers.ObjectHandler,
+	userHandler *handlers.UserHandler,
+	clusterHandler *handlers.ClusterHandler,
+	monitoringHandler *handlers.MonitoringHandler,
+) {
+	// Apply CORS middleware globally
+	app.Use(middleware.CORSMiddleware(&cfg.CORS))
+
+	// Health check endpoint (no auth required)
+	app.Get("/health", healthHandler.Check)
+	app.Get("/api/v1/health", healthHandler.Check)
+
+	// Swagger documentation endpoint (no auth required)
+	app.Get("/docs/*", swagger.HandlerDefault)
+
+	// API v1 group
+	api := app.Group("/api/v1")
+
+	// Apply authentication middleware to all API routes
+	api.Use(middleware.AuthMiddleware(&cfg.Auth, authService))
+
+	// Bucket routes
+	buckets := api.Group("/buckets")
+	{
+		buckets.Get("/", bucketHandler.ListBuckets)                             // List all buckets
+		buckets.Post("/", bucketHandler.CreateBucket)                           // Create a new bucket
+		buckets.Get("/:name", bucketHandler.GetBucketInfo)                      // Get bucket info
+		buckets.Delete("/:name", bucketHandler.DeleteBucket)                    // Delete a bucket
+		buckets.Post("/:name/permissions", bucketHandler.GrantBucketPermission) // Grant bucket permissions
+	}
+
+	// Object routes
+	objects := api.Group("/buckets/:bucket/objects")
+	{
+		objects.Get("/", objectHandler.ListObjects)                           // List objects in bucket
+		objects.Post("/", objectHandler.UploadObject)                         // Upload object (multipart)
+		objects.Post("/upload-multiple", objectHandler.UploadMultipleObjects) // Upload multiple objects
+		objects.Post("/delete-multiple", objectHandler.DeleteMultipleObjects) // Delete multiple objects
+		objects.Get("/:key", objectHandler.GetObject)                         // Download object
+		objects.Delete("/:key", objectHandler.DeleteObject)                   // Delete object
+		objects.Head("/:key", objectHandler.GetObjectMetadata)                // Get object metadata
+		objects.Post("/:key/presign", objectHandler.GetPresignedURL)          // Generate pre-signed URL
+	}
+
+	// User/Key management routes
+	users := api.Group("/users")
+	{
+		users.Get("/", userHandler.ListUsers)                          // List all users/keys
+		users.Post("/", userHandler.CreateUser)                        // Create new user/key
+		users.Get("/:access_key", userHandler.GetUser)                 // Get user info
+		users.Delete("/:access_key", userHandler.DeleteUser)           // Delete user/key
+		users.Patch("/:access_key", userHandler.UpdateUserPermissions) // Update user permissions
+	}
+
+	// Cluster management routes
+	cluster := api.Group("/cluster")
+	{
+		cluster.Get("/health", clusterHandler.GetHealth)                            // Get cluster health
+		cluster.Get("/status", clusterHandler.GetStatus)                            // Get cluster status
+		cluster.Get("/statistics", clusterHandler.GetStatistics)                    // Get cluster statistics
+		cluster.Get("/nodes/:node_id", clusterHandler.GetNodeInfo)                  // Get node info
+		cluster.Get("/nodes/:node_id/statistics", clusterHandler.GetNodeStatistics) // Get node statistics
+	}
+
+	// Monitoring routes
+	monitoring := api.Group("/monitoring")
+	{
+		monitoring.Get("/metrics", monitoringHandler.GetMetrics)            // Get Prometheus metrics
+		monitoring.Get("/admin-health", monitoringHandler.CheckAdminHealth) // Check Admin API health
+		monitoring.Get("/dashboard", monitoringHandler.GetDashboardMetrics) // Get dashboard metrics
+	}
+
+	// OIDC authentication routes (only if OIDC is enabled)
+	if cfg.Auth.Mode == "oidc" && cfg.Auth.OIDC.Enabled {
+		authRoutes := app.Group("/auth")
+		{
+			// Login endpoint - redirects to OIDC provider
+			authRoutes.Get("/login", func(c fiber.Ctx) error {
+				state, err := authService.GenerateStateToken()
+				if err != nil {
+					return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{
+						"error": "Failed to generate state token",
+					})
+				}
+
+				authURL, err := authService.GetAuthorizationURL(state)
+				if err != nil {
+					return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{
+						"error": "Failed to generate login URL",
+					})
+				}
+				return c.Redirect().To(authURL)
+			})
+
+			// Callback endpoint - handles OIDC redirect after login
+			authRoutes.Get("/callback", func(c fiber.Ctx) error {
+				// Get and validate state token
+				state := c.Query("state")
+				if !authService.ValidateAndConsumeState(state) {
+					return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{
+						"error": "Invalid or expired state token",
+					})
+				}
+
+				// Get authorization code from query
+				code := c.Query("code")
+				if code == "" {
+					return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{
+						"error": "Authorization code is required",
+					})
+				}
+
+				// Exchange code for tokens
+				ctx := c.Context()
+				token, err := authService.ExchangeCode(ctx, code)
+				if err != nil {
+					return c.Status(fiber.StatusUnauthorized).JSON(fiber.Map{
+						"error": "Failed to exchange authorization code",
+					})
+				}
+
+				// Extract ID token from OAuth2 token
+				rawIDToken, ok := token.Extra("id_token").(string)
+				if !ok {
+					return c.Status(fiber.StatusUnauthorized).JSON(fiber.Map{
+						"error": "No ID token in response",
+					})
+				}
+
+				// Verify ID token and get user info
+				userInfo, err := authService.VerifyIDToken(ctx, rawIDToken)
+				if err != nil {
+					return c.Status(fiber.StatusUnauthorized).JSON(fiber.Map{
+						"error": "Invalid ID token",
+					})
+				}
+
+				// Generate JWT session token
+				sessionToken, err := authService.GenerateSessionToken(userInfo)
+				if err != nil {
+					return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{
+						"error": "Failed to create session",
+					})
+				}
+
+				// Set JWT session token as secure cookie
+				c.Cookie(&fiber.Cookie{
+					Name:     cfg.Auth.OIDC.CookieName,
+					Value:    sessionToken,
+					MaxAge:   cfg.Auth.OIDC.SessionMaxAge,
+					Secure:   cfg.Auth.OIDC.CookieSecure,
+					HTTPOnly: cfg.Auth.OIDC.CookieHTTPOnly,
+					SameSite: cfg.Auth.OIDC.CookieSameSite,
+				})
+
+				return c.JSON(fiber.Map{
+					"success": true,
+					"user":    userInfo,
+				})
+			})
+
+			// Logout endpoint
+			authRoutes.Post("/logout", func(c fiber.Ctx) error {
+				// Clear session cookie
+				c.Cookie(&fiber.Cookie{
+					Name:   cfg.Auth.OIDC.CookieName,
+					Value:  "",
+					MaxAge: -1,
+				})
+
+				return c.JSON(fiber.Map{
+					"success": true,
+					"message": "Logged out successfully",
+				})
+			})
+
+			// User info endpoint
+			authRoutes.Get("/me", middleware.AuthMiddleware(&cfg.Auth, authService), func(c fiber.Ctx) error {
+				userInfo := c.Locals("userInfo")
+				if userInfo == nil {
+					return c.Status(fiber.StatusUnauthorized).JSON(fiber.Map{
+						"error": "Not authenticated",
+					})
+				}
+
+				return c.JSON(fiber.Map{
+					"success": true,
+					"user":    userInfo,
+				})
+			})
+		}
+	}
+
+	// Check if frontend path exists
+	if _, err := os.Stat(cfg.Server.FrontendPath); err == nil {
+		fmt.Println("Serving frontend from:", cfg.Server.FrontendPath)
+
+		// SPA fallback - serve index.html for all non-API routes
+		app.Use(func(c fiber.Ctx) error {
+			path := c.Path()
+
+			if strings.HasPrefix(path, "/api/") ||
+				strings.HasPrefix(path, "/health") ||
+				strings.HasPrefix(path, "/docs") {
+				fmt.Println("API or health check route, skipping SPA fallback:", path)
+				return c.Next()
+			}
+
+			// Try to serve static files first
+			filePath := filepath.Join(cfg.Server.FrontendPath, path)
+			if info, err := os.Stat(filePath); err == nil && !info.IsDir() {
+				return c.SendFile(filePath)
+			}
+
+			// If no static file exists, serve index.html for SPA routing
+			indexPath := filepath.Join(cfg.Server.FrontendPath, "index.html")
+			return c.SendFile(indexPath)
+		})
+	}
+}

backend/internal/services/garage_admin.go

@@ -0,0 +1,460 @@
+package services
+
+import (
+	"Noooste/garage-ui/internal/config"
+	"Noooste/garage-ui/internal/models"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+
+	"github.com/Noooste/azuretls-client"
+)
+
+// GarageAdminService handles interactions with the Garage Admin API
+type GarageAdminService struct {
+	baseURL    string
+	token      string
+	httpClient *azuretls.Session
+}
+
+// NewGarageAdminService creates a new Garage Admin API service
+func NewGarageAdminService(cfg *config.GarageConfig) *GarageAdminService {
+	session := azuretls.NewSession()
+	session.Log()
+
+	return &GarageAdminService{
+		baseURL:    cfg.AdminEndpoint,
+		token:      cfg.AdminToken,
+		httpClient: session,
+	}
+}
+
+// doRequest performs an HTTP request to the Admin API
+func (s *GarageAdminService) doRequest(ctx context.Context, method, path string, body interface{}) (*azuretls.Response, error) {
+	return s.httpClient.Do(&azuretls.Request{
+		Method:     method,
+		Url:        s.baseURL + path,
+		Body:       body,
+		IgnoreBody: true, // decodeResponse will handle body reading
+		OrderedHeaders: azuretls.OrderedHeaders{
+			{"Authorization", fmt.Sprintf("Bearer %s", s.token)},
+		},
+	}, ctx)
+}
+
+// decodeResponse decodes a JSON response into the target structure
+func decodeResponse(resp *azuretls.Response, target interface{}) error {
+	defer resp.RawBody.Close()
+
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		bodyBytes, _ := io.ReadAll(resp.RawBody)
+		return fmt.Errorf("API returned status %d: %s", resp.StatusCode, string(bodyBytes))
+	}
+
+	if target != nil {
+		if err := json.NewDecoder(resp.RawBody).Decode(target); err != nil {
+			return fmt.Errorf("failed to decode response: %w", err)
+		}
+	}
+
+	return nil
+}
+
+// ====================================
+// Access Key Operations
+// ====================================
+
+// ListKeys returns all access keys in the cluster
+func (s *GarageAdminService) ListKeys(ctx context.Context) ([]models.ListKeysResponseItem, error) {
+	resp, err := s.doRequest(ctx, http.MethodGet, "/v2/ListKeys", nil)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+
+	var result []models.ListKeysResponseItem
+	if err := decodeResponse(resp, &result); err != nil {
+		return nil, fmt.Errorf("failed to decode response: %w", err)
+	}
+
+	return result, nil
+}
+
+// CreateKey creates a new API access key
+func (s *GarageAdminService) CreateKey(ctx context.Context, req models.CreateKeyRequest) (*models.GarageKeyInfo, error) {
+	resp, err := s.doRequest(ctx, http.MethodPost, "/v2/CreateKey", req)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+
+	var result models.GarageKeyInfo
+	if err := decodeResponse(resp, &result); err != nil {
+		return nil, fmt.Errorf("failed to decode response: %w", err)
+	}
+
+	return &result, nil
+}
+
+// GetKeyInfo returns information about a specific access key
+func (s *GarageAdminService) GetKeyInfo(ctx context.Context, keyID string, showSecret bool) (*models.GarageKeyInfo, error) {
+	path := fmt.Sprintf("/v2/GetKeyInfo?id=%s", keyID)
+	if showSecret {
+		path += "&showSecretKey=true"
+	}
+
+	resp, err := s.doRequest(ctx, http.MethodGet, path, nil)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+
+	var result models.GarageKeyInfo
+	if err := decodeResponse(resp, &result); err != nil {
+		return nil, fmt.Errorf("failed to decode response: %w", err)
+	}
+
+	return &result, nil
+}
+
+// UpdateKey updates information about an access key
+func (s *GarageAdminService) UpdateKey(ctx context.Context, keyID string, req models.UpdateKeyRequest) (*models.GarageKeyInfo, error) {
+	path := fmt.Sprintf("/v2/UpdateKey?id=%s", keyID)
+
+	resp, err := s.doRequest(ctx, http.MethodPost, path, req)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+
+	var result models.GarageKeyInfo
+	if err := decodeResponse(resp, &result); err != nil {
+		return nil, fmt.Errorf("failed to decode response: %w", err)
+	}
+
+	return &result, nil
+}
+
+// DeleteKey deletes an access key from the cluster
+func (s *GarageAdminService) DeleteKey(ctx context.Context, keyID string) error {
+	path := fmt.Sprintf("/v2/DeleteKey?id=%s", keyID)
+
+	resp, err := s.doRequest(ctx, http.MethodPost, path, nil)
+	if err != nil {
+		return fmt.Errorf("request failed: %w", err)
+	}
+
+	if err := decodeResponse(resp, nil); err != nil {
+		return fmt.Errorf("failed to process response: %w", err)
+	}
+
+	return nil
+}
+
+// ImportKey imports an existing API access key
+func (s *GarageAdminService) ImportKey(ctx context.Context, req models.ImportKeyRequest) (*models.GarageKeyInfo, error) {
+	resp, err := s.doRequest(ctx, http.MethodPost, "/v2/ImportKey", req)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+
+	var result models.GarageKeyInfo
+	if err := decodeResponse(resp, &result); err != nil {
+		return nil, fmt.Errorf("failed to decode response: %w", err)
+	}
+
+	return &result, nil
+}
+
+// ====================================
+// Bucket Operations (Admin API)
+// ====================================
+
+// ListBuckets returns all buckets in the cluster
+func (s *GarageAdminService) ListBuckets(ctx context.Context) ([]models.ListBucketsResponseItem, error) {
+	resp, err := s.doRequest(ctx, http.MethodGet, "/v2/ListBuckets", nil)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+
+	var result []models.ListBucketsResponseItem
+	if err := decodeResponse(resp, &result); err != nil {
+		return nil, fmt.Errorf("failed to decode response: %w", err)
+	}
+
+	return result, nil
+}
+
+// GetBucketInfo returns detailed information about a bucket by ID
+func (s *GarageAdminService) GetBucketInfo(ctx context.Context, bucketID string) (*models.GarageBucketInfo, error) {
+	path := fmt.Sprintf("/v2/GetBucketInfo?id=%s", bucketID)
+
+	resp, err := s.doRequest(ctx, http.MethodGet, path, nil)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+
+	var result models.GarageBucketInfo
+	if err := decodeResponse(resp, &result); err != nil {
+		return nil, fmt.Errorf("failed to decode response: %w", err)
+	}
+
+	return &result, nil
+}
+
+// GetBucketInfoByAlias returns detailed information about a bucket by its global alias
+func (s *GarageAdminService) GetBucketInfoByAlias(ctx context.Context, globalAlias string) (*models.GarageBucketInfo, error) {
+	path := fmt.Sprintf("/v2/GetBucketInfo?globalAlias=%s", globalAlias)
+
+	resp, err := s.doRequest(ctx, http.MethodGet, path, nil)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+
+	var result models.GarageBucketInfo
+	if err := decodeResponse(resp, &result); err != nil {
+		return nil, fmt.Errorf("failed to decode response: %w", err)
+	}
+
+	return &result, nil
+}
+
+// CreateBucket creates a new bucket via the Admin API
+func (s *GarageAdminService) CreateBucket(ctx context.Context, req models.CreateBucketAdminRequest) (*models.GarageBucketInfo, error) {
+	resp, err := s.doRequest(ctx, http.MethodPost, "/v2/CreateBucket", req)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+
+	var result models.GarageBucketInfo
+	if err := decodeResponse(resp, &result); err != nil {
+		return nil, fmt.Errorf("failed to decode response: %w", err)
+	}
+
+	return &result, nil
+}
+
+// UpdateBucket updates bucket settings
+func (s *GarageAdminService) UpdateBucket(ctx context.Context, bucketID string, req models.UpdateBucketRequest) (*models.GarageBucketInfo, error) {
+	path := fmt.Sprintf("/v2/UpdateBucket?id=%s", bucketID)
+
+	resp, err := s.doRequest(ctx, http.MethodPost, path, req)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+
+	var result models.GarageBucketInfo
+	if err := decodeResponse(resp, &result); err != nil {
+		return nil, fmt.Errorf("failed to decode response: %w", err)
+	}
+
+	return &result, nil
+}
+
+// DeleteBucket deletes a bucket
+func (s *GarageAdminService) DeleteBucket(ctx context.Context, bucketID string) error {
+	path := fmt.Sprintf("/v2/DeleteBucket?id=%s", bucketID)
+
+	resp, err := s.doRequest(ctx, http.MethodPost, path, nil)
+	if err != nil {
+		return fmt.Errorf("request failed: %w", err)
+	}
+
+	if err := decodeResponse(resp, nil); err != nil {
+		return fmt.Errorf("failed to process response: %w", err)
+	}
+
+	return nil
+}
+
+// ====================================
+// Bucket Alias Operations
+// ====================================
+
+// AddBucketAlias adds an alias to a bucket
+func (s *GarageAdminService) AddBucketAlias(ctx context.Context, req models.AddBucketAliasRequest) (*models.GarageBucketInfo, error) {
+	resp, err := s.doRequest(ctx, http.MethodPost, "/v2/AddBucketAlias", req)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+
+	var result models.GarageBucketInfo
+	if err := decodeResponse(resp, &result); err != nil {
+		return nil, fmt.Errorf("failed to decode response: %w", err)
+	}
+
+	return &result, nil
+}
+
+// RemoveBucketAlias removes an alias from a bucket
+func (s *GarageAdminService) RemoveBucketAlias(ctx context.Context, req models.RemoveBucketAliasRequest) (*models.GarageBucketInfo, error) {
+	resp, err := s.doRequest(ctx, http.MethodPost, "/v2/RemoveBucketAlias", req)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+
+	var result models.GarageBucketInfo
+	if err := decodeResponse(resp, &result); err != nil {
+		return nil, fmt.Errorf("failed to decode response: %w", err)
+	}
+
+	return &result, nil
+}
+
+// ====================================
+// Permission Operations
+// ====================================
+
+// AllowBucketKey grants permissions for a key on a bucket
+func (s *GarageAdminService) AllowBucketKey(ctx context.Context, req models.BucketKeyPermRequest) (*models.GarageBucketInfo, error) {
+	resp, err := s.doRequest(ctx, http.MethodPost, "/v2/AllowBucketKey", req)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+
+	var result models.GarageBucketInfo
+	if err := decodeResponse(resp, &result); err != nil {
+		return nil, fmt.Errorf("failed to decode response: %w", err)
+	}
+
+	return &result, nil
+}
+
+// DenyBucketKey revokes permissions for a key on a bucket
+func (s *GarageAdminService) DenyBucketKey(ctx context.Context, req models.BucketKeyPermRequest) (*models.GarageBucketInfo, error) {
+	resp, err := s.doRequest(ctx, http.MethodPost, "/v2/DenyBucketKey", req)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+
+	var result models.GarageBucketInfo
+	if err := decodeResponse(resp, &result); err != nil {
+		return nil, fmt.Errorf("failed to decode response: %w", err)
+	}
+
+	return &result, nil
+}
+
+// ====================================
+// Cluster Operations
+// ====================================
+
+// GetClusterHealth returns the health status of the cluster
+func (s *GarageAdminService) GetClusterHealth(ctx context.Context) (*models.ClusterHealth, error) {
+	resp, err := s.doRequest(ctx, http.MethodGet, "/v2/GetClusterHealth", nil)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+
+	var result models.ClusterHealth
+	if err := decodeResponse(resp, &result); err != nil {
+		return nil, fmt.Errorf("failed to decode response: %w", err)
+	}
+
+	return &result, nil
+}
+
+// GetClusterStatus returns the current status of the cluster
+func (s *GarageAdminService) GetClusterStatus(ctx context.Context) (*models.ClusterStatus, error) {
+	resp, err := s.doRequest(ctx, http.MethodGet, "/v2/GetClusterStatus", nil)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+
+	var result models.ClusterStatus
+	if err := decodeResponse(resp, &result); err != nil {
+		return nil, fmt.Errorf("failed to decode response: %w", err)
+	}
+
+	return &result, nil
+}
+
+// GetClusterStatistics returns global cluster statistics
+func (s *GarageAdminService) GetClusterStatistics(ctx context.Context) (*models.ClusterStatistics, error) {
+	resp, err := s.doRequest(ctx, http.MethodGet, "/v2/GetClusterStatistics", nil)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+
+	var result models.ClusterStatistics
+	if err := decodeResponse(resp, &result); err != nil {
+		return nil, fmt.Errorf("failed to decode response: %w", err)
+	}
+
+	return &result, nil
+}
+
+// ====================================
+// Node Operations
+// ====================================
+
+// GetNodeInfo returns information about a specific node
+func (s *GarageAdminService) GetNodeInfo(ctx context.Context, nodeID string) (*models.MultiNodeResponse, error) {
+	path := fmt.Sprintf("/v2/GetNodeInfo?node=%s", nodeID)
+
+	resp, err := s.doRequest(ctx, http.MethodGet, path, nil)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+
+	var result models.MultiNodeResponse
+	if err := decodeResponse(resp, &result); err != nil {
+		return nil, fmt.Errorf("failed to decode response: %w", err)
+	}
+
+	return &result, nil
+}
+
+// GetNodeStatistics returns statistics for a specific node
+func (s *GarageAdminService) GetNodeStatistics(ctx context.Context, nodeID string) (*models.MultiNodeResponse, error) {
+	path := fmt.Sprintf("/v2/GetNodeStatistics?node=%s", nodeID)
+
+	resp, err := s.doRequest(ctx, http.MethodGet, path, nil)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+
+	var result models.MultiNodeResponse
+	if err := decodeResponse(resp, &result); err != nil {
+		return nil, fmt.Errorf("failed to decode response: %w", err)
+	}
+
+	return &result, nil
+}
+
+// ====================================
+// Monitoring Operations
+// ====================================
+
+// HealthCheck checks if the Admin API is reachable
+func (s *GarageAdminService) HealthCheck(ctx context.Context) error {
+	resp, err := s.doRequest(ctx, http.MethodGet, "/health", nil)
+	if err != nil {
+		return fmt.Errorf("health check failed: %w", err)
+	}
+
+	if err := decodeResponse(resp, nil); err != nil {
+		return fmt.Errorf("health check returned error: %w", err)
+	}
+
+	return nil
+}
+
+// GetMetrics returns Prometheus metrics from the Admin API
+func (s *GarageAdminService) GetMetrics(ctx context.Context) (string, error) {
+	resp, err := s.doRequest(ctx, http.MethodGet, "/metrics", nil)
+	if err != nil {
+		return "", fmt.Errorf("request failed: %w", err)
+	}
+	defer resp.RawBody.Close()
+
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		bodyBytes, _ := io.ReadAll(resp.RawBody)
+		return "", fmt.Errorf("API returned status %d: %s", resp.StatusCode, string(bodyBytes))
+	}
+
+	bodyBytes, err := io.ReadAll(resp.RawBody)
+	if err != nil {
+		return "", fmt.Errorf("failed to read response: %w", err)
+	}
+
+	return string(bodyBytes), nil
+}

backend/internal/services/s3.go

@@ -0,0 +1,500 @@
+package services
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"time"
+
+	"Noooste/garage-ui/internal/config"
+	"Noooste/garage-ui/internal/models"
+	"Noooste/garage-ui/pkg/utils"
+
+	"github.com/minio/minio-go/v7"
+	"github.com/minio/minio-go/v7/pkg/credentials"
+)
+
+// S3Service handles all S3 operations with Garage using MinIO SDK
+type S3Service struct {
+	client       *minio.Client
+	config       *config.GarageConfig
+	adminService *GarageAdminService
+}
+
+// NewS3Service creates a new S3 service instance using MinIO SDK
+func NewS3Service(cfg *config.GarageConfig, adminService *GarageAdminService) *S3Service {
+	// Create MinIO client for Garage
+	client, err := minio.New(cfg.Endpoint, &minio.Options{
+		//Creds:  credentials.NewStaticV4(cfg.AccessKey, cfg.SecretKey, ""),
+		Secure: cfg.UseSSL,
+	})
+	if err != nil {
+		panic(fmt.Errorf("failed to create MinIO client: %w", err))
+	}
+
+	return &S3Service{
+		client:       client,
+		config:       cfg,
+		adminService: adminService,
+	}
+}
+
+// getBucketCredentials retrieves credentials for a specific bucket
+// It checks the cache first, then queries the Garage Admin API
+func (s *S3Service) getBucketCredentials(ctx context.Context, bucketName string) (*credentials.Credentials, error) {
+	cacheKey := fmt.Sprintf("key:%s", bucketName)
+	cacheData := utils.GlobalCache.Get(cacheKey)
+
+	if cacheData != nil {
+		return cacheData.(*credentials.Credentials), nil
+	}
+
+	// Get bucket info from Garage Admin API
+	bucketInfo, err := s.adminService.GetBucketInfoByAlias(ctx, bucketName)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get bucket info: %w", err)
+	}
+
+	// Find a key with read and write permissions
+	var accessKeyID, secretAccessKey string
+	for _, keyInfo := range bucketInfo.Keys {
+		if !keyInfo.Permissions.Read || !keyInfo.Permissions.Write {
+			continue
+		}
+
+		// Get key details with secret
+		keyDetails, err := s.adminService.GetKeyInfo(ctx, keyInfo.AccessKeyID, true)
+		if err != nil {
+			return nil, fmt.Errorf("failed to get key info: %w", err)
+		}
+
+		if keyDetails.SecretAccessKey != nil {
+			accessKeyID = keyDetails.AccessKeyID
+			secretAccessKey = *keyDetails.SecretAccessKey
+			break
+		}
+	}
+
+	if accessKeyID == "" || secretAccessKey == "" {
+		return nil, fmt.Errorf("no valid credentials found for bucket %s", bucketName)
+	}
+
+	// Create credentials
+	creds := credentials.NewStaticV4(accessKeyID, secretAccessKey, "")
+
+	// Cache credentials for 1 hour
+	utils.GlobalCache.Set(cacheKey, creds, time.Hour)
+
+	return creds, nil
+}
+
+// getMinioClient creates a MinIO client for a specific bucket with dynamic credentials
+func (s *S3Service) getMinioClient(ctx context.Context, bucketName string) (*minio.Client, error) {
+	creds, err := s.getBucketCredentials(ctx, bucketName)
+	if err != nil {
+		return nil, fmt.Errorf("cannot get credentials for bucket %s: %w", bucketName, err)
+	}
+
+	// Create MinIO client with bucket-specific credentials
+	client, err := minio.New(s.config.Endpoint, &minio.Options{
+		Creds:  creds,
+		Secure: s.config.UseSSL,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("failed to create MinIO client for bucket %s: %w", bucketName, err)
+	}
+
+	return client, nil
+}
+
+// ListBuckets retrieves all buckets from Garage
+func (s *S3Service) ListBuckets(ctx context.Context) (*models.BucketListResponse, error) {
+	// Call MinIO ListBuckets API
+	bucketInfos, err := s.client.ListBuckets(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("failed to list buckets: %w", err)
+	}
+
+	// Convert MinIO buckets to our model
+	buckets := make([]models.BucketInfo, 0, len(bucketInfos))
+	for _, bucket := range bucketInfos {
+		buckets = append(buckets, models.BucketInfo{
+			Name:         bucket.Name,
+			CreationDate: bucket.CreationDate,
+		})
+	}
+
+	return &models.BucketListResponse{
+		Buckets: buckets,
+		Count:   len(buckets),
+	}, nil
+}
+
+// CreateBucket creates a new bucket in Garage
+func (s *S3Service) CreateBucket(ctx context.Context, bucketName string) error {
+	client, err := s.getMinioClient(ctx, bucketName)
+	if err != nil {
+		return fmt.Errorf("failed to get MinIO client for bucket %s: %w", bucketName, err)
+	}
+
+	// Call MinIO MakeBucket API
+	err = client.MakeBucket(ctx, bucketName, minio.MakeBucketOptions{
+		Region: s.config.Region,
+	})
+	if err != nil {
+		return fmt.Errorf("failed to create bucket %s: %w", bucketName, err)
+	}
+
+	return nil
+}
+
+// DeleteBucket deletes a bucket from Garage
+func (s *S3Service) DeleteBucket(ctx context.Context, bucketName string) error {
+	client, err := s.getMinioClient(ctx, bucketName)
+	if err != nil {
+		return fmt.Errorf("failed to get MinIO client for bucket %s: %w", bucketName, err)
+	}
+
+	// Call MinIO RemoveBucket API
+	err = client.RemoveBucket(ctx, bucketName)
+	if err != nil {
+		return fmt.Errorf("failed to delete bucket %s: %w", bucketName, err)
+	}
+
+	return nil
+}
+
+// ListObjects lists objects in a bucket with optional prefix filter and pagination
+func (s *S3Service) ListObjects(ctx context.Context, bucketName, prefix string, maxKeys int, continuationToken string) (*models.ObjectListResponse, error) {
+	// Get bucket-specific MinIO client
+	client, err := s.getMinioClient(ctx, bucketName)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get MinIO client for bucket %s: %w", bucketName, err)
+	}
+
+	// Set default max keys if not specified
+	if maxKeys <= 0 {
+		maxKeys = 1000
+	}
+
+	// Use ListObjectsV2 for proper pagination support
+	opts := minio.ListObjectsOptions{
+		Prefix:     prefix,
+		Recursive:  false,
+		MaxKeys:    maxKeys,
+		StartAfter: continuationToken,
+		UseV1:      false,
+	}
+
+	objects := make([]models.ObjectInfo, 0)
+	prefixesMap := make(map[string]bool)
+
+	var lastKey string
+	isTruncated := false
+	itemCount := 0
+
+	// List objects using the channel-based API
+	for object := range client.ListObjects(ctx, bucketName, opts) {
+		if object.Err != nil {
+			return nil, fmt.Errorf("failed to list objects in bucket %s: %w", bucketName, object.Err)
+		}
+
+		// Check if this is a prefix (directory)
+		if len(object.Key) > 0 && object.Key[len(object.Key)-1:] == "/" && object.Size == 0 {
+			prefixesMap[object.Key] = true
+			continue
+		}
+
+		// Track the last key for pagination
+		lastKey = object.Key
+
+		// Add to objects list
+		objects = append(objects, models.ObjectInfo{
+			Key:          object.Key,
+			Size:         object.Size,
+			LastModified: object.LastModified,
+			ETag:         object.ETag,
+			ContentType:  object.ContentType,
+			StorageClass: object.StorageClass,
+		})
+
+		itemCount++
+		if itemCount >= maxKeys {
+			isTruncated = true
+			break
+		}
+	}
+
+	// Convert prefixes map to slice
+	prefixList := make([]string, 0, len(prefixesMap))
+	for p := range prefixesMap {
+		prefixList = append(prefixList, p)
+	}
+
+	// Prepare next continuation token
+	var nextToken string
+	if isTruncated && lastKey != "" {
+		nextToken = lastKey
+	}
+
+	return &models.ObjectListResponse{
+		Bucket:                bucketName,
+		Objects:               objects,
+		Prefixes:              prefixList,
+		Count:                 len(objects),
+		IsTruncated:           isTruncated,
+		NextContinuationToken: nextToken,
+	}, nil
+}
+
+// UploadObject uploads an object to a bucket
+func (s *S3Service) UploadObject(ctx context.Context, bucketName, key string, body io.Reader, contentType string) (*models.ObjectUploadResponse, error) {
+	// Get bucket-specific MinIO client
+	client, err := s.getMinioClient(ctx, bucketName)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get MinIO client for bucket %s: %w", bucketName, err)
+	}
+
+	// Upload options
+	opts := minio.PutObjectOptions{
+		ContentType: contentType,
+	}
+
+	// Call MinIO PutObject API
+	info, err := client.PutObject(ctx, bucketName, key, body, -1, opts)
+	if err != nil {
+		return nil, fmt.Errorf("failed to upload object %s to bucket %s: %w", key, bucketName, err)
+	}
+
+	return &models.ObjectUploadResponse{
+		Bucket:      bucketName,
+		Key:         key,
+		ETag:        info.ETag,
+		Size:        info.Size,
+		ContentType: contentType,
+	}, nil
+}
+
+// GetObject retrieves an object from a bucket
+func (s *S3Service) GetObject(ctx context.Context, bucketName, key string) (io.ReadCloser, *models.ObjectInfo, error) {
+	// Call MinIO GetObject API
+	object, err := s.client.GetObject(ctx, bucketName, key, minio.GetObjectOptions{})
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to get object %s from bucket %s: %w", key, bucketName, err)
+	}
+
+	// Get object info
+	stat, err := object.Stat()
+	if err != nil {
+		object.Close()
+		return nil, nil, fmt.Errorf("failed to get object info for %s in bucket %s: %w", key, bucketName, err)
+	}
+
+	// Create object info
+	objectInfo := &models.ObjectInfo{
+		Key:          key,
+		Size:         stat.Size,
+		LastModified: stat.LastModified,
+		ETag:         stat.ETag,
+		ContentType:  stat.ContentType,
+	}
+
+	return object, objectInfo, nil
+}
+
+// DeleteObject deletes an object from a bucket
+func (s *S3Service) DeleteObject(ctx context.Context, bucketName, key string) error {
+	// Call MinIO RemoveObject API
+	err := s.client.RemoveObject(ctx, bucketName, key, minio.RemoveObjectOptions{})
+	if err != nil {
+		return fmt.Errorf("failed to delete object %s from bucket %s: %w", key, bucketName, err)
+	}
+
+	return nil
+}
+
+// ObjectExists checks if an object exists in a bucket
+func (s *S3Service) ObjectExists(ctx context.Context, bucketName, key string) (bool, error) {
+	// Get bucket-specific MinIO client
+	client, err := s.getMinioClient(ctx, bucketName)
+	if err != nil {
+		return false, fmt.Errorf("failed to get MinIO client for bucket %s: %w", bucketName, err)
+	}
+
+	_, err = client.StatObject(ctx, bucketName, key, minio.StatObjectOptions{})
+	if err != nil {
+		// Check if error is "object not found"
+		errResponse := minio.ToErrorResponse(err)
+		if errResponse.Code == "NoSuchKey" {
+			return false, nil
+		}
+		return false, fmt.Errorf("failed to check if object exists: %w", err)
+	}
+	return true, nil
+}
+
+// GetObjectMetadata retrieves metadata for an object without downloading it
+func (s *S3Service) GetObjectMetadata(ctx context.Context, bucketName, key string) (*models.ObjectInfo, error) {
+	// Get bucket-specific MinIO client
+	client, err := s.getMinioClient(ctx, bucketName)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get MinIO client for bucket %s: %w", bucketName, err)
+	}
+
+	stat, err := client.StatObject(ctx, bucketName, key, minio.StatObjectOptions{})
+	if err != nil {
+		return nil, fmt.Errorf("failed to get metadata for object %s in bucket %s: %w", key, bucketName, err)
+	}
+
+	return &models.ObjectInfo{
+		Key:          key,
+		Size:         stat.Size,
+		LastModified: stat.LastModified,
+		ETag:         stat.ETag,
+		ContentType:  stat.ContentType,
+	}, nil
+}
+
+// DeleteMultipleObjects deletes multiple objects from a bucket
+func (s *S3Service) DeleteMultipleObjects(ctx context.Context, bucketName string, keys []string) error {
+	if len(keys) == 0 {
+		return nil
+	}
+
+	// Get bucket-specific MinIO client
+	client, err := s.getMinioClient(ctx, bucketName)
+	if err != nil {
+		return fmt.Errorf("failed to get MinIO client for bucket %s: %w", bucketName, err)
+	}
+
+	// Create channel for objects to delete
+	objectsCh := make(chan minio.ObjectInfo)
+
+	// Send objects to delete in a goroutine
+	go func() {
+		defer close(objectsCh)
+		for _, key := range keys {
+			objectsCh <- minio.ObjectInfo{
+				Key: key,
+			}
+		}
+	}()
+
+	// Call MinIO RemoveObjects API (batch delete)
+	errorCh := client.RemoveObjects(ctx, bucketName, objectsCh, minio.RemoveObjectsOptions{})
+
+	// Check for errors
+	for err := range errorCh {
+		if err.Err != nil {
+			return fmt.Errorf("failed to delete object %s from bucket %s: %w", err.ObjectName, bucketName, err.Err)
+		}
+	}
+
+	return nil
+}
+
+// GetPresignedURL generates a pre-signed URL for temporary access to an object
+// This is useful for sharing files without exposing credentials
+func (s *S3Service) GetPresignedURL(ctx context.Context, bucketName, key string, expiresIn time.Duration) (string, error) {
+	// Get bucket-specific MinIO client
+	client, err := s.getMinioClient(ctx, bucketName)
+	if err != nil {
+		return "", fmt.Errorf("failed to get MinIO client for bucket %s: %w", bucketName, err)
+	}
+
+	// Generate presigned GET URL
+	presignedURL, err := client.PresignedGetObject(ctx, bucketName, key, expiresIn, nil)
+	if err != nil {
+		return "", fmt.Errorf("failed to generate presigned URL for %s/%s: %w", bucketName, key, err)
+	}
+
+	return presignedURL.String(), nil
+}
+
+// UploadResult represents the result of a single file upload
+type UploadResult struct {
+	Key         string
+	Success     bool
+	Error       error
+	ETag        string
+	Size        int64
+	ContentType string
+}
+
+// UploadMultipleObjects uploads multiple objects to a bucket
+// It handles uploads in batches to respect any S3/Garage limits
+// Returns results for each file, including both successes and failures
+func (s *S3Service) UploadMultipleObjects(ctx context.Context, bucketName string, files []struct {
+	Key         string
+	Body        io.Reader
+	ContentType string
+}) []UploadResult {
+	results := make([]UploadResult, len(files))
+
+	// Get bucket-specific MinIO client once for all uploads
+	client, err := s.getMinioClient(ctx, bucketName)
+	if err != nil {
+		// If we can't get the client, all uploads fail
+		for i := range files {
+			results[i] = UploadResult{
+				Key:     files[i].Key,
+				Success: false,
+				Error:   fmt.Errorf("failed to get MinIO client for bucket %s: %w", bucketName, err),
+			}
+		}
+		return results
+	}
+
+	// Upload each file
+	for i, file := range files {
+		// Upload options
+		opts := minio.PutObjectOptions{
+			ContentType: file.ContentType,
+		}
+
+		// Attempt upload
+		info, err := client.PutObject(ctx, bucketName, file.Key, file.Body, -1, opts)
+		if err != nil {
+			results[i] = UploadResult{
+				Key:         file.Key,
+				Success:     false,
+				Error:       fmt.Errorf("failed to upload object %s: %w", file.Key, err),
+				ContentType: file.ContentType,
+			}
+			continue
+		}
+
+		results[i] = UploadResult{
+			Key:         file.Key,
+			Success:     true,
+			Error:       nil,
+			ETag:        info.ETag,
+			Size:        info.Size,
+			ContentType: file.ContentType,
+		}
+	}
+
+	return results
+}
+
+// BucketStatistics holds statistical information about a bucket
+type BucketStatistics struct {
+	ObjectCount int64
+	TotalSize   int64
+}
+
+// GetBucketStatistics retrieves bucket statistics from Garage Admin API
+// This is much more efficient than iterating through all objects
+func (s *S3Service) GetBucketStatistics(ctx context.Context, bucketName string) (*BucketStatistics, error) {
+	// Get bucket info from Garage Admin API which includes object count and size
+	bucketInfo, err := s.adminService.GetBucketInfoByAlias(ctx, bucketName)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get bucket info for %s: %w", bucketName, err)
+	}
+
+	// Return statistics from Admin API
+	return &BucketStatistics{
+		ObjectCount: bucketInfo.Objects,
+		TotalSize:   bucketInfo.Bytes,
+	}, nil
+}