test: add comprehensive test suite for cache, config, logger, and retry functionalities

Signed-off-by: Noooste <83548733+Noooste@users.noreply.github.com>

.gitignore

@@ -60,4 +60,5 @@ meta/
 garage.toml
 
 backend/docs/
-config.yaml
+config.yaml
+docs/**/*.md

backend/internal/auth/auth.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"crypto/subtle"
 	"encoding/base64"
+	"encoding/json"
 	"fmt"
 	"strings"
 
@@ -227,6 +228,36 @@ func (a *Service) GetUserInfo(ctx context.Context, token *oauth2.Token) (*UserIn
 	return userInfo, nil
 }
 
+// ExtractRolesFromAccessToken parses the access token JWT payload and extracts
+// roles using the configured role_attribute_path. Keycloak emits resource_access
+// claims only in the access token by default, so this is required to support
+// the common Keycloak client-role setup without extra mapper configuration.
+//
+// The access token was obtained via a verified code exchange with the provider,
+// so parsing its claims without re-verifying the signature is safe here.
+func (a *Service) ExtractRolesFromAccessToken(accessToken string) []string {
+	if accessToken == "" || a.authConfig.OIDC.RoleAttributePath == "" {
+		return nil
+	}
+
+	parts := strings.Split(accessToken, ".")
+	if len(parts) < 2 {
+		return nil
+	}
+
+	payload, err := base64.RawURLEncoding.DecodeString(parts[1])
+	if err != nil {
+		return nil
+	}
+
+	var claims map[string]interface{}
+	if err := json.Unmarshal(payload, &claims); err != nil {
+		return nil
+	}
+
+	return extractRoles(claims, a.authConfig.OIDC.RoleAttributePath)
+}
+
 // IsAdmin checks if the user has admin role
 func (a *Service) IsAdmin(userInfo *UserInfo) bool {
 	if a.authConfig.OIDC.AdminRole == "" {
@@ -325,9 +356,18 @@ func (a *Service) ValidateAndConsumeState(token string) bool {
 	return a.jwtService.ValidateAndConsumeState(token)
 }
 
-// GenerateSessionToken generates a JWT session token for the user
+// GenerateSessionToken generates a JWT session token for the user.
+//
+// SessionMaxAge lives under the OIDC config block, but the JWT is shared with
+// admin-only deployments that never set it. Treat a non-positive value as
+// "not configured" and fall back to 24h so the token isn't issued already
+// expired (which would make every subsequent request fail with 401).
 func (a *Service) GenerateSessionToken(userInfo *UserInfo) (string, error) {
-	return a.jwtService.GenerateToken(userInfo, a.authConfig.OIDC.SessionMaxAge)
+	maxAge := a.authConfig.OIDC.SessionMaxAge
+	if maxAge <= 0 {
+		maxAge = 86400
+	}
+	return a.jwtService.GenerateToken(userInfo, maxAge)
 }
 
 // ValidateSessionToken validates a JWT session token and returns user info

backend/internal/auth/auth_test.go

@@ -0,0 +1,98 @@
+package auth
+
+import (
+	"encoding/base64"
+	"encoding/json"
+	"testing"
+
+	"Noooste/garage-ui/internal/config"
+)
+
+func TestExtractRolesFromAccessToken_Keycloak(t *testing.T) {
+	payload := map[string]interface{}{
+		"resource_access": map[string]interface{}{
+			"GarageAdminUi": map[string]interface{}{
+				"roles": []interface{}{"admin"},
+			},
+			"account": map[string]interface{}{
+				"roles": []interface{}{"view-profile"},
+			},
+		},
+	}
+	raw, err := json.Marshal(payload)
+	if err != nil {
+		t.Fatal(err)
+	}
+	token := "header." + base64.RawURLEncoding.EncodeToString(raw) + ".sig"
+
+	svc := &Service{
+		authConfig: &config.AuthConfig{
+			OIDC: config.OIDCConfig{
+				RoleAttributePath: "resource_access.GarageAdminUi.roles",
+			},
+		},
+	}
+
+	roles := svc.ExtractRolesFromAccessToken(token)
+	if len(roles) != 1 || roles[0] != "admin" {
+		t.Fatalf("expected [admin], got %v", roles)
+	}
+}
+
+func TestExtractRolesFromAccessToken_NoRoleClaim(t *testing.T) {
+	payload := map[string]interface{}{"sub": "user"}
+	raw, _ := json.Marshal(payload)
+	token := "header." + base64.RawURLEncoding.EncodeToString(raw) + ".sig"
+
+	svc := &Service{
+		authConfig: &config.AuthConfig{
+			OIDC: config.OIDCConfig{RoleAttributePath: "resource_access.GarageAdminUi.roles"},
+		},
+	}
+
+	if roles := svc.ExtractRolesFromAccessToken(token); roles != nil {
+		t.Fatalf("expected nil, got %v", roles)
+	}
+}
+
+func TestExtractRolesFromAccessToken_Malformed(t *testing.T) {
+	svc := &Service{
+		authConfig: &config.AuthConfig{
+			OIDC: config.OIDCConfig{RoleAttributePath: "resource_access.GarageAdminUi.roles"},
+		},
+	}
+	if roles := svc.ExtractRolesFromAccessToken("not-a-jwt"); roles != nil {
+		t.Fatalf("expected nil for malformed token, got %v", roles)
+	}
+	if roles := svc.ExtractRolesFromAccessToken(""); roles != nil {
+		t.Fatalf("expected nil for empty token, got %v", roles)
+	}
+}
+
+// Regression for issue #16: admin-only deployments never set
+// OIDC.SessionMaxAge, leaving it at 0. Before the fix, that produced a JWT
+// whose exp == iat, so every request after /auth/login was rejected as
+// expired and the client saw UNAUTHORIZED.
+func TestGenerateSessionToken_ZeroSessionMaxAge_IsNotImmediatelyExpired(t *testing.T) {
+	jwtSvc, err := NewJWTService()
+	if err != nil {
+		t.Fatalf("NewJWTService: %v", err)
+	}
+
+	svc := &Service{
+		authConfig: &config.AuthConfig{
+			Admin: config.AdminAuthConfig{Enabled: true, Username: "admin", Password: "pw"},
+			// OIDC disabled; SessionMaxAge left at zero value.
+		},
+		jwtService: jwtSvc,
+	}
+
+	token, err := svc.GenerateSessionToken(&UserInfo{Username: "admin"})
+	if err != nil {
+		t.Fatalf("GenerateSessionToken: %v", err)
+	}
+
+	if _, err := svc.ValidateSessionToken(token); err != nil {
+		t.Fatalf("freshly issued admin session token failed validation: %v", err)
+	}
+}

backend/internal/config/config.go

@@ -244,6 +244,13 @@ func (c *Config) Validate() error {
 		if len(c.Auth.OIDC.Scopes) == 0 {
 			return fmt.Errorf("oidc scopes are required when oidc is enabled")
 		}
+		// Every authenticated route on this service grants full admin
+		// access — there is no separate authorization layer. An empty
+		// admin_role would therefore promote every user in the IdP realm
+		// to cluster admin. Require operators to opt in explicitly.
+		if c.Auth.OIDC.AdminRole == "" {
+			return fmt.Errorf("oidc admin_role is required when oidc is enabled: leaving it empty would grant cluster-admin access to any authenticated IdP user")
+		}
 	}
 
 	return nil

backend/internal/config/config_test.go

@@ -0,0 +1,396 @@
+package config
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/spf13/viper"
+)
+
+// writeConfigFile writes yaml content to a temp path and returns it.
+func writeConfigFile(t *testing.T, yaml string) string {
+	t.Helper()
+	dir := t.TempDir()
+	path := filepath.Join(dir, "config.yaml")
+	if err := os.WriteFile(path, []byte(yaml), 0600); err != nil {
+		t.Fatalf("write config: %v", err)
+	}
+	return path
+}
+
+// resetViper clears all global viper state between tests.
+func resetViper(t *testing.T) {
+	t.Helper()
+	viper.Reset()
+}
+
+// minimalValidYAML is the smallest configuration that passes Validate.
+const minimalValidYAML = `
+server:
+  host: "0.0.0.0"
+  port: 8080
+  environment: development
+garage:
+  endpoint: http://garage:3900
+  admin_endpoint: http://garage:3903
+  admin_token: supersecret
+`
+
+func TestLoad_YAMLOnly(t *testing.T) {
+	resetViper(t)
+	path := writeConfigFile(t, minimalValidYAML)
+
+	cfg, err := Load(path)
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if cfg.Server.Host != "0.0.0.0" {
+		t.Errorf("Server.Host = %q, want 0.0.0.0", cfg.Server.Host)
+	}
+	if cfg.Server.Port != 8080 {
+		t.Errorf("Server.Port = %d, want 8080", cfg.Server.Port)
+	}
+	if cfg.Server.Environment != "development" {
+		t.Errorf("Server.Environment = %q, want development", cfg.Server.Environment)
+	}
+	if cfg.Garage.Endpoint != "http://garage:3900" {
+		t.Errorf("Garage.Endpoint = %q", cfg.Garage.Endpoint)
+	}
+	if cfg.Garage.AdminToken != "supersecret" {
+		t.Errorf("Garage.AdminToken = %q", cfg.Garage.AdminToken)
+	}
+}
+
+func TestLoad_EnvOnly_MissingFile(t *testing.T) {
+	resetViper(t)
+	// Point at a path that definitely does not exist. Load tolerates missing
+	// files and falls back to env + viper defaults.
+	missing := filepath.Join(t.TempDir(), "does-not-exist.yaml")
+
+	// Every required field provided via env.
+	t.Setenv("GARAGE_UI_SERVER_PORT", "9090")
+	t.Setenv("GARAGE_UI_GARAGE_ENDPOINT", "http://g:3900")
+	t.Setenv("GARAGE_UI_GARAGE_ADMIN_ENDPOINT", "http://g:3903")
+	t.Setenv("GARAGE_UI_GARAGE_ADMIN_TOKEN", "env-token")
+
+	cfg, err := Load(missing)
+	if err != nil {
+		t.Fatalf("Load with env-only: %v", err)
+	}
+	if cfg.Server.Port != 9090 {
+		t.Errorf("Server.Port = %d, want 9090 (from env)", cfg.Server.Port)
+	}
+	if cfg.Garage.AdminToken != "env-token" {
+		t.Errorf("Garage.AdminToken = %q, want env-token", cfg.Garage.AdminToken)
+	}
+}
+
+func TestLoad_EnvOverridesYAML(t *testing.T) {
+	resetViper(t)
+	path := writeConfigFile(t, minimalValidYAML)
+
+	// YAML has port=8080; env should win.
+	t.Setenv("GARAGE_UI_SERVER_PORT", "9090")
+	t.Setenv("GARAGE_UI_GARAGE_ADMIN_TOKEN", "env-wins")
+
+	cfg, err := Load(path)
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if cfg.Server.Port != 9090 {
+		t.Errorf("Server.Port = %d, want 9090 (env override)", cfg.Server.Port)
+	}
+	if cfg.Garage.AdminToken != "env-wins" {
+		t.Errorf("Garage.AdminToken = %q, want env-wins", cfg.Garage.AdminToken)
+	}
+	// Host was not overridden; YAML value should persist.
+	if cfg.Server.Host != "0.0.0.0" {
+		t.Errorf("Server.Host = %q, want 0.0.0.0 (from YAML)", cfg.Server.Host)
+	}
+}
+
+func TestLoad_MalformedYAMLReturnsError(t *testing.T) {
+	resetViper(t)
+	// Deliberately broken YAML: unindented key after a mapping start.
+	path := writeConfigFile(t, "server:\n  port: 8080\n:: not: valid ::\n")
+
+	_, err := Load(path)
+	if err == nil {
+		t.Fatal("expected error for malformed YAML, got nil")
+	}
+	if !strings.Contains(err.Error(), "error reading config file") {
+		t.Errorf("unexpected error: %v", err)
+	}
+}
+
+func TestLoad_ValidationFailurePropagates(t *testing.T) {
+	resetViper(t)
+	// Valid YAML syntax but Garage.Endpoint is blank → Validate must fail.
+	path := writeConfigFile(t, `
+server:
+  port: 8080
+garage:
+  endpoint: ""
+  admin_endpoint: http://g:3903
+  admin_token: t
+`)
+
+	_, err := Load(path)
+	if err == nil {
+		t.Fatal("expected validation error, got nil")
+	}
+	if !strings.Contains(err.Error(), "invalid configuration") {
+		t.Errorf("expected wrapped invalid-config error, got %v", err)
+	}
+	if !strings.Contains(err.Error(), "garage endpoint is required") {
+		t.Errorf("expected endpoint-required message, got %v", err)
+	}
+}
+
+// validBaseConfig returns a deep copy of a minimal Config that passes Validate.
+func validBaseConfig() Config {
+	return Config{
+		Server: ServerConfig{Port: 8080},
+		Garage: GarageConfig{
+			Endpoint:      "http://g:3900",
+			AdminEndpoint: "http://g:3903",
+			AdminToken:    "t",
+		},
+	}
+}
+
+// applyValidOIDC fills OIDC with all required fields.
+func applyValidOIDC(c *Config) {
+	c.Auth.OIDC.Enabled = true
+	c.Auth.OIDC.ClientID = "client-xyz"
+	c.Auth.OIDC.IssuerURL = "https://idp.example/realms/test"
+	c.Auth.OIDC.Scopes = []string{"openid"}
+	c.Auth.OIDC.AdminRole = "admin"
+	c.Server.RootURL = "https://garage-ui.example"
+}
+
+// Note on spec coverage: spec/2026-04-17-backend-test-suite-design.md lists
+// "invalid log level/format" as a Validate case, but the current Validate does
+// not check Logging.Level or Logging.Format. That's a code-vs-spec gap to
+// resolve in a follow-up plan; Stage 2 tests the current behavior only.
+func TestValidate(t *testing.T) {
+	tests := []struct {
+		name            string
+		mutate          func(*Config)
+		wantErrContains string // empty = expect no error
+	}{
+		{
+			name:   "valid minimal config",
+			mutate: func(c *Config) {},
+		},
+		{
+			name:            "port zero is invalid",
+			mutate:          func(c *Config) { c.Server.Port = 0 },
+			wantErrContains: "invalid server port",
+		},
+		{
+			name:            "port negative is invalid",
+			mutate:          func(c *Config) { c.Server.Port = -1 },
+			wantErrContains: "invalid server port",
+		},
+		{
+			name:            "port above 65535 is invalid",
+			mutate:          func(c *Config) { c.Server.Port = 70000 },
+			wantErrContains: "invalid server port",
+		},
+		{
+			name:            "port at 65535 is valid",
+			mutate:          func(c *Config) { c.Server.Port = 65535 },
+			wantErrContains: "",
+		},
+		{
+			name:            "missing garage endpoint",
+			mutate:          func(c *Config) { c.Garage.Endpoint = "" },
+			wantErrContains: "garage endpoint is required",
+		},
+		{
+			name:            "missing garage admin_endpoint",
+			mutate:          func(c *Config) { c.Garage.AdminEndpoint = "" },
+			wantErrContains: "admin_endpoint is required",
+		},
+		{
+			name:            "missing garage admin_token",
+			mutate:          func(c *Config) { c.Garage.AdminToken = "" },
+			wantErrContains: "admin_token is required",
+		},
+		{
+			name: "admin auth enabled without username",
+			mutate: func(c *Config) {
+				c.Auth.Admin.Enabled = true
+				c.Auth.Admin.Password = "p"
+			},
+			wantErrContains: "admin auth username and password are required",
+		},
+		{
+			name: "admin auth enabled without password",
+			mutate: func(c *Config) {
+				c.Auth.Admin.Enabled = true
+				c.Auth.Admin.Username = "u"
+			},
+			wantErrContains: "admin auth username and password are required",
+		},
+		{
+			name: "admin auth enabled with both set is valid",
+			mutate: func(c *Config) {
+				c.Auth.Admin.Enabled = true
+				c.Auth.Admin.Username = "u"
+				c.Auth.Admin.Password = "p"
+			},
+			wantErrContains: "",
+		},
+		{
+			name: "admin auth disabled ignores missing credentials",
+			mutate: func(c *Config) {
+				c.Auth.Admin.Enabled = false
+				c.Auth.Admin.Username = ""
+				c.Auth.Admin.Password = ""
+			},
+			wantErrContains: "",
+		},
+		{
+			name: "oidc enabled without client_id",
+			mutate: func(c *Config) {
+				applyValidOIDC(c)
+				c.Auth.OIDC.ClientID = ""
+			},
+			wantErrContains: "oidc client_id is required",
+		},
+		{
+			name: "oidc enabled without issuer_url",
+			mutate: func(c *Config) {
+				applyValidOIDC(c)
+				c.Auth.OIDC.IssuerURL = ""
+			},
+			wantErrContains: "oidc issuer_url is required",
+		},
+		{
+			name: "oidc enabled without server.root_url",
+			mutate: func(c *Config) {
+				applyValidOIDC(c)
+				c.Server.RootURL = ""
+			},
+			wantErrContains: "server.root_url is required",
+		},
+		{
+			name: "oidc enabled without scopes",
+			mutate: func(c *Config) {
+				applyValidOIDC(c)
+				c.Auth.OIDC.Scopes = nil
+			},
+			wantErrContains: "oidc scopes are required",
+		},
+		{
+			name: "oidc enabled without admin_role rejected for safety",
+			mutate: func(c *Config) {
+				applyValidOIDC(c)
+				c.Auth.OIDC.AdminRole = ""
+			},
+			wantErrContains: "oidc admin_role is required",
+		},
+		{
+			name:            "oidc fully configured is valid",
+			mutate:          applyValidOIDC,
+			wantErrContains: "",
+		},
+		{
+			name: "oidc disabled ignores missing client_id",
+			mutate: func(c *Config) {
+				c.Auth.OIDC.Enabled = false
+				c.Auth.OIDC.ClientID = ""
+			},
+			wantErrContains: "",
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			cfg := validBaseConfig()
+			tc.mutate(&cfg)
+			err := cfg.Validate()
+
+			if tc.wantErrContains == "" {
+				if err != nil {
+					t.Errorf("expected no error, got %v", err)
+				}
+				return
+			}
+
+			if err == nil {
+				t.Fatalf("expected error containing %q, got nil", tc.wantErrContains)
+			}
+			if !strings.Contains(err.Error(), tc.wantErrContains) {
+				t.Errorf("error %q does not contain %q", err.Error(), tc.wantErrContains)
+			}
+		})
+	}
+}
+
+func TestGetAddress(t *testing.T) {
+	tests := []struct {
+		host string
+		port int
+		want string
+	}{
+		{"localhost", 8080, "localhost:8080"},
+		{"0.0.0.0", 80, "0.0.0.0:80"},
+		{"", 443, ":443"},
+	}
+	for _, tc := range tests {
+		t.Run(tc.want, func(t *testing.T) {
+			cfg := &Config{Server: ServerConfig{Host: tc.host, Port: tc.port}}
+			if got := cfg.GetAddress(); got != tc.want {
+				t.Errorf("GetAddress() = %q, want %q", got, tc.want)
+			}
+		})
+	}
+}
+
+func TestIsDevelopment(t *testing.T) {
+	tests := []struct {
+		env  string
+		want bool
+	}{
+		{"development", true},
+		{"production", false},
+		{"", false},
+		// Case-sensitive per current impl; lock in that behavior.
+		{"Development", false},
+		{"DEV", false},
+	}
+	for _, tc := range tests {
+		t.Run(tc.env, func(t *testing.T) {
+			cfg := &Config{Server: ServerConfig{Environment: tc.env}}
+			if got := cfg.IsDevelopment(); got != tc.want {
+				t.Errorf("IsDevelopment(%q) = %v, want %v", tc.env, got, tc.want)
+			}
+		})
+	}
+}
+
+func TestIsProduction(t *testing.T) {
+	tests := []struct {
+		env  string
+		want bool
+	}{
+		{"production", true},
+		{"development", false},
+		{"", false},
+		{"Production", false},
+		{"PROD", false},
+	}
+	for _, tc := range tests {
+		t.Run(tc.env, func(t *testing.T) {
+			cfg := &Config{Server: ServerConfig{Environment: tc.env}}
+			if got := cfg.IsProduction(); got != tc.want {
+				t.Errorf("IsProduction(%q) = %v, want %v", tc.env, got, tc.want)
+			}
+		})
+	}
+}

backend/internal/handlers/buckets.go

@@ -7,14 +7,14 @@ import (
 	"github.com/gofiber/fiber/v3"
 )
 
-// BucketHandler handles bucket-related operations
+// BucketHandler handles bucket-related HTTP requests.
 type BucketHandler struct {
-	adminService *services.GarageAdminService
-	s3Service    *services.S3Service
+	adminService services.AdminService
+	s3Service    services.S3Storage
 }
 
-// NewBucketHandler creates a new bucket handler
-func NewBucketHandler(adminService *services.GarageAdminService, s3Service *services.S3Service) *BucketHandler {
+// NewBucketHandler creates a new bucket handler.
+func NewBucketHandler(adminService services.AdminService, s3Service services.S3Storage) *BucketHandler {
 	return &BucketHandler{
 		adminService: adminService,
 		s3Service:    s3Service,

backend/internal/handlers/cluster.go

@@ -7,13 +7,13 @@ import (
 	"github.com/gofiber/fiber/v3"
 )
 
-// ClusterHandler handles cluster management operations
+// ClusterHandler handles cluster-status HTTP requests.
 type ClusterHandler struct {
-	adminService *services.GarageAdminService
+	adminService services.AdminService
 }
 
-// NewClusterHandler creates a new cluster handler
-func NewClusterHandler(adminService *services.GarageAdminService) *ClusterHandler {
+// NewClusterHandler creates a new cluster handler.
+func NewClusterHandler(adminService services.AdminService) *ClusterHandler {
 	return &ClusterHandler{
 		adminService: adminService,
 	}

backend/internal/handlers/monitoring.go

@@ -7,14 +7,14 @@ import (
 	"github.com/gofiber/fiber/v3"
 )
 
-// MonitoringHandler handles monitoring operations
+// MonitoringHandler handles metrics and dashboard HTTP requests.
 type MonitoringHandler struct {
-	adminService *services.GarageAdminService
-	s3Service    *services.S3Service
+	adminService services.AdminService
+	s3Service    services.S3Storage
 }
 
-// NewMonitoringHandler creates a new monitoring handler
-func NewMonitoringHandler(adminService *services.GarageAdminService, s3Service *services.S3Service) *MonitoringHandler {
+// NewMonitoringHandler creates a new monitoring handler.
+func NewMonitoringHandler(adminService services.AdminService, s3Service services.S3Storage) *MonitoringHandler {
 	return &MonitoringHandler{
 		adminService: adminService,
 		s3Service:    s3Service,

backend/internal/handlers/objects.go

@@ -3,7 +3,10 @@ package handlers
 import (
 	"bufio"
 	"io"
+	"net/url"
+	"path"
 	"strconv"
+	"strings"
 	"time"
 
 	"Noooste/garage-ui/internal/models"
@@ -12,13 +15,66 @@ import (
 	"github.com/gofiber/fiber/v3"
 )
 
-// ObjectHandler handles object-related operations
-type ObjectHandler struct {
-	s3Service *services.S3Service
+// unsafeInlineContentTypes are MIME types that a browser can execute as
+// JavaScript in the response's origin when rendered inline. Since the SPA is
+// served from the same origin as the API, any uploader could otherwise plant
+// stored XSS by uploading a file with one of these Content-Types.
+var unsafeInlineContentTypes = map[string]struct{}{
+	"text/html":             {},
+	"application/xhtml+xml": {},
+	"image/svg+xml":         {},
+	"application/xml":       {},
+	"text/xml":              {},
+	"application/javascript": {},
+	"text/javascript":       {},
 }
 
-// NewObjectHandler creates a new object handler
-func NewObjectHandler(s3Service *services.S3Service) *ObjectHandler {
+// safeContentType rewrites Content-Types that the browser would treat as
+// executable to application/octet-stream.
+func safeContentType(ct string) string {
+	base := strings.TrimSpace(strings.ToLower(ct))
+	if i := strings.IndexByte(base, ';'); i >= 0 {
+		base = strings.TrimSpace(base[:i])
+	}
+	if _, bad := unsafeInlineContentTypes[base]; bad {
+		return "application/octet-stream"
+	}
+	return ct
+}
+
+// contentDispositionHeader builds an RFC 6266 / RFC 5987 Content-Disposition
+// header value with the user-controlled object key safely encoded. Strips
+// path components and control characters before emitting the ASCII fallback,
+// then appends the percent-encoded UTF-8 filename*= for full fidelity.
+func contentDispositionHeader(disposition, key string) string {
+	name := path.Base(key)
+	if name == "." || name == "/" || name == "" {
+		name = "download"
+	}
+	// ASCII-safe fallback: drop anything that could break the quoted value.
+	var asciiFallback strings.Builder
+	for _, r := range name {
+		if r < 0x20 || r == 0x7f || r == '"' || r == '\\' || r > 0x7e {
+			asciiFallback.WriteByte('_')
+			continue
+		}
+		asciiFallback.WriteRune(r)
+	}
+	fallback := asciiFallback.String()
+	if fallback == "" {
+		fallback = "download"
+	}
+	encoded := url.PathEscape(name)
+	return disposition + "; filename=\"" + fallback + "\"; filename*=UTF-8''" + encoded
+}
+
+// ObjectHandler handles object-related HTTP requests.
+type ObjectHandler struct {
+	s3Service services.S3Storage
+}
+
+// NewObjectHandler creates a new object handler.
+func NewObjectHandler(s3Service services.S3Storage) *ObjectHandler {
 	return &ObjectHandler{
 		s3Service: s3Service,
 	}
@@ -178,16 +234,22 @@ func (h *ObjectHandler) GetObject(c fiber.Ctx) error {
 		)
 	}
 
-	// Set response headers
-	c.Set("Content-Type", objectInfo.ContentType)
+	// The uploader controls Content-Type. Rewrite executable MIME types to
+	// application/octet-stream and always disable sniffing so stored HTML/SVG
+	// cannot run as XSS in the SPA origin when fetched inline.
+	c.Set("Content-Type", safeContentType(objectInfo.ContentType))
+	c.Set("X-Content-Type-Options", "nosniff")
 	c.Set("Content-Length", strconv.FormatInt(objectInfo.Size, 10))
 	c.Set("ETag", objectInfo.ETag)
 	c.Set("Last-Modified", objectInfo.LastModified.Format(time.RFC1123))
 
-	// Check if client wants to download or view inline
+	// The object key is attacker-controlled — build the header via the safe
+	// RFC 6266 helper to avoid quote/semicolon injection into filename=.
+	disposition := "inline"
 	if c.Query("download") == "true" {
-		c.Set("Content-Disposition", "attachment; filename=\""+key+"\"")
+		disposition = "attachment"
 	}
+	c.Set("Content-Disposition", contentDispositionHeader(disposition, key))
 
 	// Stream the object body to the client without buffering the entire file
 	return c.SendStreamWriter(func(w *bufio.Writer) {

backend/internal/handlers/users.go

@@ -9,13 +9,13 @@ import (
 	"github.com/gofiber/fiber/v3"
 )
 
-// UserHandler handles user/key management operations using Garage Admin API
+// UserHandler handles user and access key HTTP requests.
 type UserHandler struct {
-	adminService *services.GarageAdminService
+	adminService services.AdminService
 }
 
-// NewUserHandler creates a new user handler
-func NewUserHandler(adminService *services.GarageAdminService) *UserHandler {
+// NewUserHandler creates a new user handler.
+func NewUserHandler(adminService services.AdminService) *UserHandler {
 	return &UserHandler{
 		adminService: adminService,
 	}

backend/internal/middleware/cors.go

@@ -1,6 +1,7 @@
 package middleware
 
 import (
+	"strconv"
 	"strings"
 
 	"Noooste/garage-ui/internal/config"
@@ -20,10 +21,14 @@ func CORSMiddleware(cfg *config.CORSConfig) fiber.Handler {
 	return func(c fiber.Ctx) error {
 		origin := c.Get("Origin")
 
-		// Check if origin is allowed
-		if origin != "" && isAllowedOrigin(origin, cfg.AllowedOrigins) {
+		// Check if origin is allowed. When credentials are allowed we refuse
+		// to treat "*" as a match: reflecting an arbitrary Origin alongside
+		// Access-Control-Allow-Credentials: true lets any site read responses
+		// cross-origin with the user's session cookie.
+		if origin != "" && isAllowedOrigin(origin, cfg.AllowedOrigins, cfg.AllowCredentials) {
 			// Set CORS headers
 			c.Set("Access-Control-Allow-Origin", origin)
+			c.Set("Vary", "Origin")
 
 			if cfg.AllowCredentials {
 				c.Set("Access-Control-Allow-Credentials", "true")
@@ -41,7 +46,7 @@ func CORSMiddleware(cfg *config.CORSConfig) fiber.Handler {
 
 			// Set max age for preflight cache
 			if cfg.MaxAge > 0 {
-				c.Set("Access-Control-Max-Age", string(rune(cfg.MaxAge)))
+				c.Set("Access-Control-Max-Age", strconv.Itoa(cfg.MaxAge))
 			}
 		}
 
@@ -54,10 +59,14 @@ func CORSMiddleware(cfg *config.CORSConfig) fiber.Handler {
 	}
 }
 
-// isAllowedOrigin checks if an origin is in the allowed list
-func isAllowedOrigin(origin string, allowedOrigins []string) bool {
+// isAllowedOrigin checks if an origin is in the allowed list.
+// When allowCredentials is true, "*" is NOT honored — exact match is required.
+func isAllowedOrigin(origin string, allowedOrigins []string, allowCredentials bool) bool {
 	for _, allowed := range allowedOrigins {
-		if allowed == "*" || allowed == origin {
+		if allowed == origin {
+			return true
+		}
+		if allowed == "*" && !allowCredentials {
 			return true
 		}
 	}

backend/internal/routes/routes.go

@@ -242,6 +242,35 @@ func SetupRoutes(
 					})
 				}
 
+				// Enforce admin role if configured. Roles are often absent from the
+				// ID token and the userinfo endpoint (Keycloak emits resource_access
+				// only in the access token by default), so fall back to the access
+				// token and then the userinfo endpoint before denying access.
+				if cfg.Auth.OIDC.AdminRole != "" {
+					if !authService.IsAdmin(userInfo) {
+						if roles := authService.ExtractRolesFromAccessToken(token.AccessToken); len(roles) > 0 {
+							userInfo.Roles = roles
+						}
+					}
+					if !authService.IsAdmin(userInfo) {
+						if uiFromUserinfo, uiErr := authService.GetUserInfo(ctx, token); uiErr == nil {
+							if len(uiFromUserinfo.Roles) > 0 {
+								userInfo.Roles = uiFromUserinfo.Roles
+							}
+						}
+					}
+					if !authService.IsAdmin(userInfo) {
+						logger.Warn().
+							Str("username", userInfo.Username).
+							Str("required_role", cfg.Auth.OIDC.AdminRole).
+							Strs("roles", userInfo.Roles).
+							Msg("OIDC login denied: user does not have required admin role")
+						return c.Status(fiber.StatusForbidden).JSON(fiber.Map{
+							"error": "User does not have the required admin role",
+						})
+					}
+				}
+
 				// Generate JWT session token
 				sessionToken, err := authService.GenerateSessionToken(userInfo)
 				if err != nil {

backend/internal/services/interfaces.go

@@ -0,0 +1,68 @@
+package services
+
+import (
+	"context"
+	"io"
+	"time"
+
+	"Noooste/garage-ui/internal/models"
+)
+
+// AdminService is the set of Garage Admin API operations used by HTTP handlers.
+// It is implemented by *GarageAdminService in admin.go. Kept narrow so that
+// hand-rolled mocks in tests don't need to cover admin methods the handlers
+// never call.
+type AdminService interface {
+	// Access keys
+	ListKeys(ctx context.Context) ([]models.ListKeysResponseItem, error)
+	CreateKey(ctx context.Context, req models.CreateKeyRequest) (*models.GarageKeyInfo, error)
+	GetKeyInfo(ctx context.Context, keyID string, showSecret bool) (*models.GarageKeyInfo, error)
+	UpdateKey(ctx context.Context, keyID string, req models.UpdateKeyRequest) (*models.GarageKeyInfo, error)
+	DeleteKey(ctx context.Context, keyID string) error
+
+	// Buckets
+	ListBuckets(ctx context.Context) ([]models.ListBucketsResponseItem, error)
+	GetBucketInfo(ctx context.Context, bucketID string) (*models.GarageBucketInfo, error)
+	GetBucketInfoByAlias(ctx context.Context, globalAlias string) (*models.GarageBucketInfo, error)
+	CreateBucket(ctx context.Context, req models.CreateBucketAdminRequest) (*models.GarageBucketInfo, error)
+	UpdateBucket(ctx context.Context, bucketID string, req models.UpdateBucketRequest) (*models.GarageBucketInfo, error)
+	DeleteBucket(ctx context.Context, bucketID string) error
+	AllowBucketKey(ctx context.Context, req models.BucketKeyPermRequest) (*models.GarageBucketInfo, error)
+
+	// Cluster
+	GetClusterHealth(ctx context.Context) (*models.ClusterHealth, error)
+	GetClusterStatus(ctx context.Context) (*models.ClusterStatus, error)
+	GetClusterStatistics(ctx context.Context) (*models.ClusterStatistics, error)
+	GetNodeInfo(ctx context.Context, nodeID string) (*models.MultiNodeResponse, error)
+	GetNodeStatistics(ctx context.Context, nodeID string) (*models.MultiNodeResponse, error)
+
+	// Monitoring
+	HealthCheck(ctx context.Context) error
+	GetMetrics(ctx context.Context) (string, error)
+}
+
+// S3Storage is the set of S3 operations used by HTTP handlers. It is
+// implemented by *S3Service in s3.go. Methods on *S3Service that are not
+// called by handlers (ListBuckets, CreateBucket, DeleteBucket,
+// GetBucketStatistics) are intentionally excluded.
+type S3Storage interface {
+	ListObjects(ctx context.Context, bucketName, prefix string, maxKeys int, continuationToken string) (*models.ObjectListResponse, error)
+	UploadObject(ctx context.Context, bucketName, key string, body io.Reader, contentType string) (*models.ObjectUploadResponse, error)
+	GetObject(ctx context.Context, bucketName, key string) (io.ReadCloser, *models.ObjectInfo, error)
+	ObjectExists(ctx context.Context, bucketName, key string) (bool, error)
+	DeleteObject(ctx context.Context, bucketName, key string) error
+	GetObjectMetadata(ctx context.Context, bucketName, key string) (*models.ObjectInfo, error)
+	GetPresignedURL(ctx context.Context, bucketName, key string, expiresIn time.Duration) (string, error)
+	DeleteMultipleObjects(ctx context.Context, bucketName string, keys []string) error
+	UploadMultipleObjects(ctx context.Context, bucketName string, files []struct {
+		Key         string
+		Body        io.Reader
+		ContentType string
+	}) []UploadResult
+}
+
+// Compile-time guarantees that the concrete services implement the interfaces.
+var (
+	_ AdminService = (*GarageAdminService)(nil)
+	_ S3Storage    = (*S3Service)(nil)
+)

backend/pkg/logger/logger_test.go

@@ -0,0 +1,239 @@
+package logger
+
+import (
+	"bufio"
+	"encoding/json"
+	"io"
+	"os"
+	"strings"
+	"sync"
+	"testing"
+)
+
+// serializeLoggerTests guards the global mutations (os.Stdout, globalLogger,
+// zerolog global). These tests cannot run in parallel with each other.
+var serializeLoggerTests sync.Mutex
+
+// captureStdout swaps os.Stdout for a pipe, calls fn, restores stdout, and
+// returns everything written during fn.
+func captureStdout(t *testing.T, fn func()) string {
+	t.Helper()
+
+	r, w, err := os.Pipe()
+	if err != nil {
+		t.Fatalf("os.Pipe: %v", err)
+	}
+
+	old := os.Stdout
+	os.Stdout = w
+	t.Cleanup(func() { os.Stdout = old })
+
+	// Run fn and close writer so the reader unblocks.
+	doneWrite := make(chan struct{})
+	go func() {
+		fn()
+		_ = w.Close()
+		close(doneWrite)
+	}()
+
+	var buf strings.Builder
+	scanner := bufio.NewScanner(r)
+	scanner.Buffer(make([]byte, 64*1024), 1024*1024)
+	for scanner.Scan() {
+		buf.WriteString(scanner.Text())
+		buf.WriteByte('\n')
+	}
+	// Drain any residual (shouldn't happen after Close, but safe):
+	_, _ = io.Copy(io.Discard, r)
+	<-doneWrite
+	return buf.String()
+}
+
+func TestInit_JSONFormatProducesParseableOutput(t *testing.T) {
+	serializeLoggerTests.Lock()
+	defer serializeLoggerTests.Unlock()
+
+	out := captureStdout(t, func() {
+		Init(Config{Level: "info", Format: "json"})
+		Info().Str("user", "alice").Msg("hello")
+	})
+
+	// Find the first non-empty line; parse as JSON.
+	var line string
+	for l := range strings.SplitSeq(out, "\n") {
+		if strings.TrimSpace(l) != "" {
+			line = l
+			break
+		}
+	}
+	if line == "" {
+		t.Fatalf("no log output captured; stdout = %q", out)
+	}
+
+	var parsed map[string]any
+	if err := json.Unmarshal([]byte(line), &parsed); err != nil {
+		t.Fatalf("log line is not valid JSON: %v\nline: %s", err, line)
+	}
+
+	// Field assertions — zerolog uses "message" for the msg and "level" for level.
+	if got, _ := parsed["message"].(string); got != "hello" {
+		t.Errorf("message = %v, want hello", parsed["message"])
+	}
+	if got, _ := parsed["user"].(string); got != "alice" {
+		t.Errorf("user field = %v, want alice", parsed["user"])
+	}
+	if got, _ := parsed["level"].(string); got != "info" {
+		t.Errorf("level = %v, want info", parsed["level"])
+	}
+	if _, ok := parsed["time"]; !ok {
+		t.Errorf("expected time field; got keys %v", keysOf(parsed))
+	}
+	if _, ok := parsed["caller"]; !ok {
+		t.Errorf("expected caller field; got keys %v", keysOf(parsed))
+	}
+}
+
+func TestInit_LevelFilterDropsBelowThreshold(t *testing.T) {
+	serializeLoggerTests.Lock()
+	defer serializeLoggerTests.Unlock()
+
+	out := captureStdout(t, func() {
+		Init(Config{Level: "warn", Format: "json"})
+		Debug().Msg("debug-dropped")
+		Info().Msg("info-dropped")
+		Warn().Msg("warn-kept")
+		Error().Msg("error-kept")
+	})
+
+	if strings.Contains(out, "debug-dropped") {
+		t.Errorf("debug event leaked through warn filter: %s", out)
+	}
+	if strings.Contains(out, "info-dropped") {
+		t.Errorf("info event leaked through warn filter: %s", out)
+	}
+	if !strings.Contains(out, "warn-kept") {
+		t.Errorf("warn event missing: %s", out)
+	}
+	if !strings.Contains(out, "error-kept") {
+		t.Errorf("error event missing: %s", out)
+	}
+}
+
+func TestInit_UnknownLevelDefaultsToInfo(t *testing.T) {
+	serializeLoggerTests.Lock()
+	defer serializeLoggerTests.Unlock()
+
+	out := captureStdout(t, func() {
+		Init(Config{Level: "gibberish", Format: "json"})
+		Debug().Msg("debug-should-be-dropped")
+		Info().Msg("info-should-appear")
+	})
+
+	if strings.Contains(out, "debug-should-be-dropped") {
+		t.Errorf("debug leaked at default info level: %s", out)
+	}
+	if !strings.Contains(out, "info-should-appear") {
+		t.Errorf("info missing at default info level: %s", out)
+	}
+}
+
+func TestInit_TextFormatDoesNotCrashAndIsNotJSON(t *testing.T) {
+	serializeLoggerTests.Lock()
+	defer serializeLoggerTests.Unlock()
+
+	out := captureStdout(t, func() {
+		Init(Config{Level: "info", Format: "text"})
+		Info().Str("k", "v").Msg("plain")
+	})
+
+	if !strings.Contains(out, "plain") {
+		t.Errorf("text output missing message: %s", out)
+	}
+	// Console writer output is ANSI-colored key=value form, not JSON.
+	var parsed map[string]any
+	if json.Unmarshal([]byte(strings.Split(out, "\n")[0]), &parsed) == nil {
+		t.Errorf("text format unexpectedly parsed as JSON: %s", out)
+	}
+}
+
+func TestGet_AutoInitializesWhenUnused(t *testing.T) {
+	serializeLoggerTests.Lock()
+	defer serializeLoggerTests.Unlock()
+
+	// Forcibly clear the global so Get() hits the lazy-init branch.
+	globalLogger = nil
+
+	l := Get()
+	if l == nil {
+		t.Fatal("Get() returned nil; lazy init did not run")
+	}
+	if globalLogger == nil {
+		t.Fatal("globalLogger still nil after Get()")
+	}
+}
+
+func TestWithComponent_AddsComponentField(t *testing.T) {
+	serializeLoggerTests.Lock()
+	defer serializeLoggerTests.Unlock()
+
+	out := captureStdout(t, func() {
+		Init(Config{Level: "info", Format: "json"})
+		comp := WithComponent("buckets")
+		comp.Info().Msg("tagged")
+	})
+
+	line := firstNonEmptyLine(out)
+	var parsed map[string]any
+	if err := json.Unmarshal([]byte(line), &parsed); err != nil {
+		t.Fatalf("not JSON: %v — %s", err, line)
+	}
+	if got, _ := parsed["component"].(string); got != "buckets" {
+		t.Errorf("component = %v, want buckets", parsed["component"])
+	}
+}
+
+func TestLogger_WithContext_AddsFields(t *testing.T) {
+	serializeLoggerTests.Lock()
+	defer serializeLoggerTests.Unlock()
+
+	out := captureStdout(t, func() {
+		Init(Config{Level: "info", Format: "json"})
+		l := Get().WithContext(map[string]any{
+			"request_id": "req-42",
+			"attempt":    2,
+		})
+		l.Info().Msg("ctx")
+	})
+
+	line := firstNonEmptyLine(out)
+	var parsed map[string]any
+	if err := json.Unmarshal([]byte(line), &parsed); err != nil {
+		t.Fatalf("not JSON: %v — %s", err, line)
+	}
+	if parsed["request_id"] != "req-42" {
+		t.Errorf("request_id = %v", parsed["request_id"])
+	}
+	// JSON numbers decode to float64.
+	if got, _ := parsed["attempt"].(float64); got != 2 {
+		t.Errorf("attempt = %v, want 2", parsed["attempt"])
+	}
+}
+
+// --- helpers ---
+
+func firstNonEmptyLine(s string) string {
+	for l := range strings.SplitSeq(s, "\n") {
+		if strings.TrimSpace(l) != "" {
+			return l
+		}
+	}
+	return ""
+}
+
+func keysOf(m map[string]any) []string {
+	out := make([]string, 0, len(m))
+	for k := range m {
+		out = append(out, k)
+	}
+	return out
+}

backend/pkg/utils/cache_test.go

@@ -0,0 +1,129 @@
+package utils
+
+import (
+	"fmt"
+	"sync"
+	"testing"
+	"time"
+)
+
+func TestCache_GetMissReturnsNil(t *testing.T) {
+	c := NewCache()
+	if v := c.Get("nope"); v != nil {
+		t.Errorf("expected nil for missing key, got %v", v)
+	}
+}
+
+func TestCache_SetThenGetReturnsValue(t *testing.T) {
+	c := NewCache()
+	c.Set("k", "v", time.Minute)
+	got := c.Get("k")
+	if got != "v" {
+		t.Errorf("Get(k) = %v, want v", got)
+	}
+}
+
+func TestCache_SetWithDifferentTypes(t *testing.T) {
+	c := NewCache()
+	c.Set("str", "hello", time.Minute)
+	c.Set("int", 42, time.Minute)
+	c.Set("slice", []int{1, 2, 3}, time.Minute)
+
+	if got := c.Get("str"); got != "hello" {
+		t.Errorf("str: got %v", got)
+	}
+	if got := c.Get("int"); got != 42 {
+		t.Errorf("int: got %v", got)
+	}
+	if got, ok := c.Get("slice").([]int); !ok || len(got) != 3 {
+		t.Errorf("slice: got %v", c.Get("slice"))
+	}
+}
+
+func TestCache_GetExpiredReturnsNil(t *testing.T) {
+	c := NewCache()
+	c.Set("k", "v", 10*time.Millisecond)
+	time.Sleep(25 * time.Millisecond)
+	if got := c.Get("k"); got != nil {
+		t.Errorf("expected nil after TTL, got %v", got)
+	}
+}
+
+func TestCache_DeleteRemovesItem(t *testing.T) {
+	c := NewCache()
+	c.Set("k", "v", time.Minute)
+	c.Delete("k")
+	if got := c.Get("k"); got != nil {
+		t.Errorf("expected nil after Delete, got %v", got)
+	}
+}
+
+func TestCache_DeleteMissingKeyIsNoOp(t *testing.T) {
+	c := NewCache()
+	// Should not panic or error.
+	c.Delete("never-set")
+}
+
+func TestCache_ClearRemovesAllItems(t *testing.T) {
+	c := NewCache()
+	c.Set("a", 1, time.Minute)
+	c.Set("b", 2, time.Minute)
+	c.Set("c", 3, time.Minute)
+
+	c.Clear()
+
+	if c.Get("a") != nil || c.Get("b") != nil || c.Get("c") != nil {
+		t.Errorf("expected all items cleared")
+	}
+}
+
+func TestCache_SetOverwrites(t *testing.T) {
+	c := NewCache()
+	c.Set("k", "v1", time.Minute)
+	c.Set("k", "v2", time.Minute)
+	if got := c.Get("k"); got != "v2" {
+		t.Errorf("expected v2 after overwrite, got %v", got)
+	}
+}
+
+// TestCache_ConcurrentAccess exercises the RWMutex under load. Run with
+// `go test -race` to catch data races. Uses bounded concurrency so the test
+// stays deterministic.
+func TestCache_ConcurrentAccess(t *testing.T) {
+	c := NewCache()
+	const goroutines = 50
+	const opsPerGoroutine = 100
+
+	var wg sync.WaitGroup
+	wg.Add(goroutines)
+
+	for g := range goroutines {
+		go func(id int) {
+			defer wg.Done()
+			for i := range opsPerGoroutine {
+				key := fmt.Sprintf("k%d", (id+i)%10)
+				c.Set(key, i, time.Minute)
+				_ = c.Get(key)
+				if i%10 == 0 {
+					c.Delete(key)
+				}
+			}
+		}(g)
+	}
+
+	wg.Wait()
+	// If we got here without a panic and `-race` is clean, the RWMutex is
+	// protecting the map correctly.
+}
+
+// TestGlobalCache_IsUsable is a smoke test for the package-level var.
+// It doesn't Clear() afterwards because the global is shared state that
+// other packages may depend on at test time.
+func TestGlobalCache_IsUsable(t *testing.T) {
+	key := "stage2-smoke-key"
+	GlobalCache.Set(key, "x", time.Minute)
+	t.Cleanup(func() { GlobalCache.Delete(key) })
+	if got := GlobalCache.Get(key); got != "x" {
+		t.Errorf("GlobalCache.Get = %v, want x", got)
+	}
+}

backend/pkg/utils/retry_test.go

@@ -0,0 +1,268 @@
+package utils
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"strings"
+	"syscall"
+	"testing"
+	"time"
+)
+
+func TestIsConnectionRefused(t *testing.T) {
+	tests := []struct {
+		name string
+		err  error
+		want bool
+	}{
+		{
+			name: "nil error returns false",
+			err:  nil,
+			want: false,
+		},
+		{
+			name: "unrelated error returns false",
+			err:  errors.New("something else went wrong"),
+			want: false,
+		},
+		{
+			name: "bare ECONNREFUSED returns true (fallback errors.Is branch)",
+			err:  syscall.ECONNREFUSED,
+			want: true,
+		},
+		{
+			name: "wrapped ECONNREFUSED returns true (fallback errors.Is branch)",
+			err:  fmt.Errorf("context: %w", syscall.ECONNREFUSED),
+			want: true,
+		},
+		{
+			name: "OpError dial+ECONNREFUSED returns true (primary branch)",
+			err: &net.OpError{
+				Op:  "dial",
+				Net: "tcp",
+				Err: syscall.ECONNREFUSED,
+			},
+			want: true,
+		},
+		{
+			name: "OpError read+ECONNREFUSED returns true (primary branch)",
+			err: &net.OpError{
+				Op:  "read",
+				Net: "tcp",
+				Err: syscall.ECONNREFUSED,
+			},
+			want: true,
+		},
+		{
+			name: "OpError dial+ETIMEDOUT returns false (primary branch, wrong errno)",
+			err: &net.OpError{
+				Op:  "dial",
+				Net: "tcp",
+				Err: syscall.ETIMEDOUT,
+			},
+			want: false,
+		},
+		{
+			name: "OpError dial+plain error falls through to errors.Is and returns false (inner As miss)",
+			err: &net.OpError{
+				Op:  "dial",
+				Net: "tcp",
+				Err: errors.New("not a syscall errno"),
+			},
+			want: false,
+		},
+		{
+			name: "OpError write+ECONNREFUSED returns true via fallback errors.Is",
+			err: &net.OpError{
+				Op:  "write",
+				Net: "tcp",
+				Err: syscall.ECONNREFUSED,
+			},
+			want: true,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := IsConnectionRefused(tc.err); got != tc.want {
+				t.Errorf("IsConnectionRefused(%v) = %v, want %v", tc.err, got, tc.want)
+			}
+		})
+	}
+}
+
+// fastRetryConfig keeps test runtime in the low-millisecond range.
+func fastRetryConfig() RetryConfig {
+	return RetryConfig{
+		MaxRetries:     3,
+		InitialBackoff: 1 * time.Millisecond,
+		MaxBackoff:     5 * time.Millisecond,
+		BackoffFactor:  2.0,
+	}
+}
+
+func TestRetryWithBackoff_SuccessOnFirstAttempt(t *testing.T) {
+	calls := 0
+	err := RetryWithBackoff(context.Background(), fastRetryConfig(), func() error {
+		calls++
+		return nil
+	})
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if calls != 1 {
+		t.Errorf("want 1 call, got %d", calls)
+	}
+}
+
+func TestRetryWithBackoff_NonRetryableErrorReturnedImmediately(t *testing.T) {
+	sentinel := errors.New("boom")
+	calls := 0
+	err := RetryWithBackoff(context.Background(), fastRetryConfig(), func() error {
+		calls++
+		return sentinel
+	})
+	if !errors.Is(err, sentinel) {
+		t.Errorf("want wrapped sentinel, got %v", err)
+	}
+	if calls != 1 {
+		t.Errorf("want 1 call (no retry on non-conn-refused), got %d", calls)
+	}
+}
+
+func TestRetryWithBackoff_SuccessAfterTransientRefusals(t *testing.T) {
+	cfg := fastRetryConfig()
+	cfg.MaxRetries = 5 // allow up to 6 attempts
+	calls := 0
+	err := RetryWithBackoff(context.Background(), cfg, func() error {
+		calls++
+		if calls < 3 {
+			return syscall.ECONNREFUSED
+		}
+		return nil
+	})
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if calls != 3 {
+		t.Errorf("want 3 calls (2 failures + 1 success), got %d", calls)
+	}
+}
+
+func TestRetryWithBackoff_MaxRetriesExceededReturnsWrappedError(t *testing.T) {
+	cfg := fastRetryConfig()
+	cfg.MaxRetries = 2 // 3 total attempts (attempt 0, 1, 2)
+	calls := 0
+	err := RetryWithBackoff(context.Background(), cfg, func() error {
+		calls++
+		return syscall.ECONNREFUSED
+	})
+	if err == nil {
+		t.Fatal("expected error after exhausting retries, got nil")
+	}
+	if !errors.Is(err, syscall.ECONNREFUSED) {
+		t.Errorf("expected wrapped ECONNREFUSED, got %v", err)
+	}
+	// The loop runs attempt = 0..MaxRetries inclusive.
+	if calls != cfg.MaxRetries+1 {
+		t.Errorf("want %d calls, got %d", cfg.MaxRetries+1, calls)
+	}
+	// Error message includes the retry count for operator diagnostics.
+	if !containsAll(err.Error(), "max retries", "2") {
+		t.Errorf("error message missing retry count: %q", err.Error())
+	}
+}
+
+func TestRetryWithBackoff_ZeroMaxRetriesReturnsImmediately(t *testing.T) {
+	cfg := RetryConfig{
+		MaxRetries:     0,
+		InitialBackoff: 1 * time.Second, // large on purpose; must not sleep
+		MaxBackoff:     5 * time.Second,
+		BackoffFactor:  2.0,
+	}
+	calls := 0
+	start := time.Now()
+	err := RetryWithBackoff(context.Background(), cfg, func() error {
+		calls++
+		return syscall.ECONNREFUSED
+	})
+	elapsed := time.Since(start)
+
+	if err == nil {
+		t.Fatal("expected error, got nil")
+	}
+	if !errors.Is(err, syscall.ECONNREFUSED) {
+		t.Errorf("expected wrapped ECONNREFUSED, got %v", err)
+	}
+	if calls != 1 {
+		t.Errorf("want 1 call (no retry budget), got %d", calls)
+	}
+	// The only sleep would be after the attempt, but attempt == MaxRetries is
+	// short-circuited before the sleep select. So total runtime must be well
+	// under InitialBackoff.
+	if elapsed >= 500*time.Millisecond {
+		t.Errorf("no-retry path should not have slept; elapsed %v", elapsed)
+	}
+}
+
+func TestRetryWithBackoff_ContextCancelledDuringBackoff(t *testing.T) {
+	// Use a slow backoff so cancellation is guaranteed to land during the sleep.
+	cfg := RetryConfig{
+		MaxRetries:     5,
+		InitialBackoff: 50 * time.Millisecond,
+		MaxBackoff:     1 * time.Second,
+		BackoffFactor:  2.0,
+	}
+	ctx, cancel := context.WithCancel(context.Background())
+	// Cancel shortly after the first failed attempt starts its backoff.
+	go func() {
+		time.Sleep(10 * time.Millisecond)
+		cancel()
+	}()
+	calls := 0
+	err := RetryWithBackoff(ctx, cfg, func() error {
+		calls++
+		return syscall.ECONNREFUSED
+	})
+	if err == nil {
+		t.Fatal("expected error from cancelled context, got nil")
+	}
+	if !errors.Is(err, context.Canceled) {
+		t.Errorf("expected wrapped context.Canceled, got %v", err)
+	}
+	if calls < 1 {
+		t.Errorf("expected at least 1 call before cancellation, got %d", calls)
+	}
+}
+
+func TestRetryWithBackoff_WaitsBetweenAttempts(t *testing.T) {
+	// Lower-bound timing check — with InitialBackoff=20ms and BackoffFactor=2,
+	// three failed attempts sleep ~20ms + ~40ms = ~60ms before giving up.
+	// Assert >= 50ms to absorb scheduler jitter.
+	cfg := RetryConfig{
+		MaxRetries:     2,
+		InitialBackoff: 20 * time.Millisecond,
+		MaxBackoff:     100 * time.Millisecond,
+		BackoffFactor:  2.0,
+	}
+	start := time.Now()
+	_ = RetryWithBackoff(context.Background(), cfg, func() error {
+		return syscall.ECONNREFUSED
+	})
+	elapsed := time.Since(start)
+	if elapsed < 50*time.Millisecond {
+		t.Errorf("expected at least ~60ms of backoff delay, got %v", elapsed)
+	}
+}
+
+// containsAll reports whether s contains every substring in subs.
+func containsAll(s string, subs ...string) bool {
+	for _, sub := range subs {
+		if !strings.Contains(s, sub) {
+			return false
+		}
+	}
+	return true
+}

frontend/src/components/buckets/ObjectsTable.tsx

@@ -1,4 +1,4 @@
-import {useEffect, useState} from 'react';
+import {useEffect, useMemo, useState} from 'react';
 import {useNavigate} from 'react-router-dom';
 import {Badge} from '@/components/ui/badge';
 import {Button} from '@/components/ui/button';
@@ -64,7 +64,6 @@ export function ObjectsTable({
   const navigate = useNavigate();
   const [sortColumn, setSortColumn] = useState<SortColumn>('name');
   const [sortDirection, setSortDirection] = useState<SortDirection>('asc');
-  const [filteredObjects, setFilteredObjects] = useState<S3Object[]>([]);
   // Store tokens for each page: [undefined (page 1), token1 (page 2), token2 (page 3), ...]
   const [pageTokens, setPageTokens] = useState<(string | undefined)[]>([undefined]);
   const [currentPageIndex, setCurrentPageIndex] = useState(0);
@@ -86,14 +85,13 @@ export function ObjectsTable({
     }
   }, [initialized, initialPageToken, initialItemsPerPage, itemsPerPage, nextContinuationToken, onPageChange, onItemsPerPageChange]);
 
-  const sortObjects = (objList: S3Object[]): S3Object[] => {
-    const sorted = [...objList].sort((a, b) => {
-      // Always put folders before files
+  const filteredObjects = useMemo(() => {
+    const query = searchQuery.toLowerCase();
+    const filtered = objects.filter((obj) => obj.key.toLowerCase().includes(query));
+    return [...filtered].sort((a, b) => {
       const aIsFolder = a.isFolder ? 1 : 0;
       const bIsFolder = b.isFolder ? 1 : 0;
-      if (aIsFolder !== bIsFolder) {
-        return bIsFolder - aIsFolder;
-      }
+      if (aIsFolder !== bIsFolder) return bIsFolder - aIsFolder;
 
       let compareValue = 0;
       switch (sortColumn) {
@@ -116,20 +114,7 @@ export function ObjectsTable({
 
       return sortDirection === 'asc' ? compareValue : -compareValue;
     });
-
-    return sorted;
-  };
-
-  // Effect 1: Apply client-side filtering and sorting (NO pagination reset)
-  useEffect(() => {
-    const filtered = objects.filter((obj) =>
-      obj.key.toLowerCase().includes(searchQuery.toLowerCase())
-    );
-    const sorted = sortObjects(filtered);
-    setFilteredObjects(sorted);
-
-    // Do NOT reset pagination - search/sort are client-side operations
-  }, [searchQuery, objects, sortColumn, sortDirection]);
+  }, [objects, searchQuery, sortColumn, sortDirection, currentPath]);
 
   // Effect 2: Reset pagination ONLY on path navigation
   useEffect(() => {
@@ -192,6 +177,7 @@ export function ObjectsTable({
   return (
     <>
       <div className="overflow-x-auto">
+        <TooltipProvider>
         <Table>
           <TableHeader>
           <TableRow>
@@ -304,55 +290,53 @@ export function ObjectsTable({
                 {obj.lastModified ? (() => {
                   const d = new Date(obj.lastModified);
                   return (
-                    <TooltipProvider>
-                      <Tooltip>
-                        <TooltipTrigger asChild>
-                          <div className="decoration-dashed decoration-1 underline underline-offset-6 cursor-pointer text-muted-foreground hover:text-foreground transition-colors">
-                            {d.toLocaleDateString('en-GB', {
-                              day: '2-digit',
-                              month: 'short',
-                              year: 'numeric',
-                            })} {d.toLocaleTimeString('en-GB', {
-                              hour: '2-digit',
-                              minute: '2-digit',
-                              second: '2-digit',
-                              hour12: false,
-                            })} CET
+                    <Tooltip>
+                      <TooltipTrigger asChild>
+                        <div className="decoration-dashed decoration-1 underline underline-offset-6 cursor-pointer text-muted-foreground hover:text-foreground transition-colors">
+                          {d.toLocaleDateString('en-GB', {
+                            day: '2-digit',
+                            month: 'short',
+                            year: 'numeric',
+                          })} {d.toLocaleTimeString('en-GB', {
+                            hour: '2-digit',
+                            minute: '2-digit',
+                            second: '2-digit',
+                            hour12: false,
+                          })} CET
+                        </div>
+                      </TooltipTrigger>
+                      <TooltipContent>
+                        <div className="space-y-1 min-w-max">
+                          <div className="flex gap-3 items-center">
+                            <span className="text-sm text-gray-400 w-20 text-right">UTC</span>
+                            <span className="text-sm text-white">
+                              {d.toLocaleString('en-GB', {
+                                day: '2-digit',
+                                month: 'short',
+                                year: 'numeric',
+                                hour: '2-digit',
+                                minute: '2-digit',
+                                second: '2-digit',
+                                hour12: false,
+                                timeZone: 'UTC',
+                              })} UTC
+                            </span>
                           </div>
-                        </TooltipTrigger>
-                        <TooltipContent>
-                          <div className="space-y-1 min-w-max">
-                            <div className="flex gap-3 items-center">
-                              <span className="text-sm text-gray-400 w-20 text-right">UTC</span>
-                              <span className="text-sm text-white">
-                                {d.toLocaleString('en-GB', {
-                                  day: '2-digit',
-                                  month: 'short',
-                                  year: 'numeric',
-                                  hour: '2-digit',
-                                  minute: '2-digit',
-                                  second: '2-digit',
-                                  hour12: false,
-                                  timeZone: 'UTC',
-                                })} UTC
-                              </span>
-                            </div>
-                            <div className="flex gap-3 items-center">
-                              <span className="text-sm text-gray-400 w-20 text-right">Relative</span>
-                              <span className="text-sm text-white">
-                                {formatRelativeTime(d)}
-                              </span>
-                            </div>
-                            <div className="flex gap-3 items-center">
-                              <span className="text-sm text-gray-400 w-20 text-right">Timestamp</span>
-                              <span className="text-sm text-white font-mono">
-                                {d.toISOString()}
-                              </span>
-                            </div>
+                          <div className="flex gap-3 items-center">
+                            <span className="text-sm text-gray-400 w-20 text-right">Relative</span>
+                            <span className="text-sm text-white">
+                              {formatRelativeTime(d)}
+                            </span>
                           </div>
-                        </TooltipContent>
-                      </Tooltip>
-                    </TooltipProvider>
+                          <div className="flex gap-3 items-center">
+                            <span className="text-sm text-gray-400 w-20 text-right">Timestamp</span>
+                            <span className="text-sm text-white font-mono">
+                              {d.toISOString()}
+                            </span>
+                          </div>
+                        </div>
+                      </TooltipContent>
+                    </Tooltip>
                   );
                 })() : null}
               </TableCell>
@@ -390,6 +374,7 @@ export function ObjectsTable({
         )}
       </TableBody>
     </Table>
+        </TooltipProvider>
       </div>
 
     {/* Pagination Controls */}

frontend/src/hooks/useBucketObjects.ts

@@ -1,4 +1,4 @@
-import { useState, useEffect, useCallback } from 'react';
+import { useState, useEffect, useCallback, useRef } from 'react';
 import { objectsApi } from '@/lib/api';
 import type { S3Object, UploadTask } from '@/types';
 import { toast } from 'sonner';
@@ -13,8 +13,9 @@ export function useBucketObjects(bucketName: string | null, currentPath: string
   const [nextContinuationToken, setNextContinuationToken] = useState<string | undefined>(undefined);
   const [itemsPerPage, setItemsPerPage] = useState(25);
   const [currentContinuationToken, setCurrentContinuationToken] = useState<string | undefined>(undefined);
-  const [previousPath, setPreviousPath] = useState<string>(currentPath);
+  const previousPathRef = useRef<string>(currentPath);
   const [uploadTasks, setUploadTasks] = useState<UploadTask[]>([]);
+  const clearTasksTimerRef = useRef<ReturnType<typeof setTimeout> | null>(null);
 
   const fetchObjects = useCallback(async (continuationToken?: string, isRefresh = false, isNav = false) => {
     if (!bucketName) return;
@@ -46,24 +47,26 @@ export function useBucketObjects(bucketName: string | null, currentPath: string
   useEffect(() => {
     if (!bucketName) return;
 
-    // Detect if this is a path change (navigation) or initial load
-    const isPathChange = previousPath !== currentPath && objects.length > 0;
-    setPreviousPath(currentPath);
+    const isPathChange = previousPathRef.current !== currentPath && objects.length > 0;
+    previousPathRef.current = currentPath;
 
-    // Use navigation mode if it's a path change, otherwise use normal loading
     fetchObjects(undefined, false, isPathChange);
     // eslint-disable-next-line react-hooks/exhaustive-deps
   }, [bucketName, currentPath, itemsPerPage]);
 
+  useEffect(() => {
+    return () => {
+      if (clearTasksTimerRef.current) clearTimeout(clearTasksTimerRef.current);
+    };
+  }, []);
+
   const uploadFiles = useCallback(async (files: File[]) => {
     if (!bucketName) return false;
 
-    // Check if files are from a folder upload
-    const hasRelativePaths = files.some((file: any) => file.webkitRelativePath);
+    const hasRelativePaths = files.some((file) => !!file.webkitRelativePath);
 
-    // Get unique folders from the files
     const folders = new Set<string>();
-    files.forEach((file: any) => {
+    files.forEach((file) => {
       if (file.webkitRelativePath) {
         const parts = file.webkitRelativePath.split('/');
         if (parts.length > 1) {
@@ -72,9 +75,8 @@ export function useBucketObjects(bucketName: string | null, currentPath: string
       }
     });
 
-    // Initialize upload tasks
     const tasks: UploadTask[] = files.map((file, index) => {
-      const relativePath = (file as any).webkitRelativePath || file.name;
+      const relativePath = file.webkitRelativePath || file.name;
       const key = currentPath ? `${currentPath}${relativePath}` : relativePath;
       return {
         id: `${Date.now()}-${index}`,
@@ -88,53 +90,36 @@ export function useBucketObjects(bucketName: string | null, currentPath: string
 
     setUploadTasks(tasks);
 
-    // Upload files with progress tracking and error handling
     let successCount = 0;
     let errorCount = 0;
 
-    // Upload files one by one
-    const concurrency = 1;
-    const uploadPromises: Promise<void>[] = [];
+    for (const task of tasks) {
+      try {
+        setUploadTasks(prev => prev.map(t =>
+          t.id === task.id ? { ...t, status: 'uploading' as const } : t
+        ));
 
-    for (let i = 0; i < tasks.length; i += concurrency) {
-      const batch = tasks.slice(i, Math.min(i + concurrency, tasks.length));
+        await objectsApi.upload(bucketName, task.key, task.file, (progress) => {
+          setUploadTasks(prev => prev.map(t => {
+            if (t.id !== task.id || t.progress === progress) return t;
+            return { ...t, progress };
+          }));
+        });
 
-      const batchPromises = batch.map(async (task) => {
-        try {
-          // Update task status to uploading
-          setUploadTasks(prev => prev.map(t =>
-            t.id === task.id ? { ...t, status: 'uploading' as const } : t
-          ));
-
-          await objectsApi.upload(bucketName, task.key, task.file, (progress) => {
-            setUploadTasks(prev => prev.map(t =>
-              t.id === task.id ? { ...t, progress } : t
-            ));
-          });
-
-          // Update task status to completed
-          setUploadTasks(prev => prev.map(t =>
-            t.id === task.id ? { ...t, status: 'completed' as const, progress: 100 } : t
-          ));
-          successCount++;
-        } catch (error) {
-          // Update task status to error but continue with other uploads
-          const errorMessage = error instanceof Error ? error.message : 'Upload failed';
-          setUploadTasks(prev => prev.map(t =>
-            t.id === task.id ? { ...t, status: 'error' as const, error: errorMessage } : t
-          ));
-          errorCount++;
-          console.error(`Failed to upload ${task.key}:`, error);
-        }
-      });
-
-      uploadPromises.push(...batchPromises);
-      await Promise.all(batchPromises);
+        setUploadTasks(prev => prev.map(t =>
+          t.id === task.id ? { ...t, status: 'completed' as const, progress: 100 } : t
+        ));
+        successCount++;
+      } catch (error) {
+        const errorMessage = error instanceof Error ? error.message : 'Upload failed';
+        setUploadTasks(prev => prev.map(t =>
+          t.id === task.id ? { ...t, status: 'error' as const, error: errorMessage } : t
+        ));
+        errorCount++;
+        console.error(`Failed to upload ${task.key}:`, error);
+      }
     }
 
-    await Promise.all(uploadPromises);
-
-    // Show summary toast
     if (errorCount === 0) {
       if (hasRelativePaths && folders.size > 0) {
         const folderNames = Array.from(folders).join(', ');
@@ -148,9 +133,10 @@ export function useBucketObjects(bucketName: string | null, currentPath: string
       toast.error(`Failed to upload ${errorCount} file${errorCount > 1 ? 's' : ''}`);
     }
 
-    // Clear upload tasks after a delay
-    setTimeout(() => {
+    if (clearTasksTimerRef.current) clearTimeout(clearTasksTimerRef.current);
+    clearTasksTimerRef.current = setTimeout(() => {
       setUploadTasks([]);
+      clearTasksTimerRef.current = null;
     }, 3000);
 
     await fetchObjects(currentContinuationToken, true);
@@ -161,7 +147,6 @@ export function useBucketObjects(bucketName: string | null, currentPath: string
     if (!bucketName) return false;
 
     try {
-      // Optimistically remove the object from the UI
       setObjects(prev => prev.filter(obj => obj.key !== key));
 
       await objectsApi.delete(bucketName, key);
@@ -170,7 +155,6 @@ export function useBucketObjects(bucketName: string | null, currentPath: string
       return true;
     } catch (error) {
       console.error('Delete object error:', error);
-      // Revert the optimistic update by refetching
       await fetchObjects(currentContinuationToken, true);
       return false;
     }
@@ -180,7 +164,6 @@ export function useBucketObjects(bucketName: string | null, currentPath: string
     if (!bucketName || keys.length === 0) return false;
 
     try {
-      // Optimistically remove the objects from the UI
       setObjects(prev => prev.filter(obj => !keys.includes(obj.key)));
 
       await objectsApi.deleteMultiple(bucketName, keys, currentPath || undefined);
@@ -189,7 +172,6 @@ export function useBucketObjects(bucketName: string | null, currentPath: string
       return true;
     } catch (error) {
       console.error('Bulk delete error:', error);
-      // Revert the optimistic update by refetching
       await fetchObjects(currentContinuationToken, true);
       return false;
     }
@@ -200,7 +182,7 @@ export function useBucketObjects(bucketName: string | null, currentPath: string
 
     try {
       const dirKey = currentPath ? `${currentPath}${dirName}/` : `${dirName}/`;
-      await objectsApi.upload(bucketName, dirKey, new File([], ''));
+      await objectsApi.upload(bucketName, dirKey, new File([], '.keep'));
       toast.success(`Directory "${dirName}" created successfully`);
       await fetchObjects(currentContinuationToken, true);
       return true;

frontend/src/pages/AccessControl.tsx

@@ -1,4 +1,4 @@
-import {useEffect, useState} from 'react';
+import {useEffect, useMemo, useState} from 'react';
 import {Header} from '@/components/layout/header';
 import {Button} from '@/components/ui/button';
 import {Input} from '@/components/ui/input';
@@ -31,7 +31,6 @@ import {toast} from 'sonner';
 
 export function AccessControl() {
   const [keys, setKeys] = useState<AccessKey[]>([]);
-  const [filteredKeys, setFilteredKeys] = useState<AccessKey[]>([]);
   const [searchQuery, setSearchQuery] = useState('');
   const [isLoading, setIsLoading] = useState(true);
   const [createDialogOpen, setCreateDialogOpen] = useState(false);
@@ -83,7 +82,6 @@ export function AccessControl() {
         setIsLoading(true);
         const data = await accessApi.listKeys();
         setKeys(data);
-        setFilteredKeys(data);
       } catch (error) {
         console.error('Failed to fetch keys:', error);
       } finally {
@@ -94,14 +92,15 @@ export function AccessControl() {
     fetchKeys();
   }, []);
 
-  useEffect(() => {
-    const filtered = keys.filter(
-      (key) =>
-        key.name.toLowerCase().includes(searchQuery.toLowerCase()) ||
-        key.accessKeyId.toLowerCase().includes(searchQuery.toLowerCase())
-    );
-    setFilteredKeys(filtered);
-  }, [searchQuery, keys]);
+  const filteredKeys = useMemo(
+    () =>
+      keys.filter(
+        (key) =>
+          key.name.toLowerCase().includes(searchQuery.toLowerCase()) ||
+          key.accessKeyId.toLowerCase().includes(searchQuery.toLowerCase())
+      ),
+    [keys, searchQuery]
+  );
 
   const handleCreateKey = async () => {
     if (!newKeyName) {

helm/garage-ui/Chart.yaml

@@ -3,8 +3,8 @@ name: garage-ui
 description: A Helm chart for Garage UI - Web interface for Garage S3 object storage
 icon: https://helm.noste.dev/garage.png
 type: application
-version: 0.2.0
-appVersion: "v0.2.0"
+version: 0.2.2
+appVersion: "v0.2.2"
 keywords:
   - garage
   - s3

helm/garage-ui/README.md

@@ -2,8 +2,8 @@
 
 A Helm chart for deploying [Garage UI](https://github.com/Noooste/garage-ui), a modern web interface for managing [Garage](https://garagehq.deuxfleurs.fr/) distributed object storage systems.
 
-[![Version](https://img.shields.io/badge/version-0.1.13-blue.svg)](Chart.yaml)
-[![App Version](https://img.shields.io/badge/app%20version-v0.1.2-green.svg)](Chart.yaml)
+[![Version](https://img.shields.io/badge/version-0.2.2-blue.svg)](Chart.yaml)
+[![App Version](https://img.shields.io/badge/app%20version-v0.2.2-green.svg)](Chart.yaml)
 
 ## Table of Contents
 

helm/garage-ui/templates/configmap.yaml

@@ -2,6 +2,7 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: {{ include "garage-ui.fullname" . }}-config
+  namespace: {{ .Release.Namespace }}
   labels:
     {{- include "garage-ui.labels" . | nindent 4 }}
 data:

helm/garage-ui/templates/deployment.yaml

@@ -2,6 +2,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: {{ include "garage-ui.fullname" . }}
+  namespace: {{ .Release.Namespace }}
   labels:
     {{- include "garage-ui.labels" . | nindent 4 }}
 spec:

helm/garage-ui/templates/ingress.yaml

@@ -3,6 +3,7 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: {{ include "garage-ui.fullname" . }}
+  namespace: {{ .Release.Namespace }}
   labels:
     {{- include "garage-ui.labels" . | nindent 4 }}
   {{- with .Values.ingress.annotations }}

helm/garage-ui/templates/networkpolicy.yaml

@@ -3,6 +3,7 @@ apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
   name: {{ include "garage-ui.fullname" . }}
+  namespace: {{ .Release.Namespace }}
   labels:
     {{- include "garage-ui.labels" . | nindent 4 }}
 spec:

helm/garage-ui/templates/secret.yaml

@@ -3,6 +3,7 @@ apiVersion: v1
 kind: Secret
 metadata:
   name: {{ include "garage-ui.fullname" . }}-admin-token
+  namespace: {{ .Release.Namespace }}
   labels:
     {{- include "garage-ui.labels" . | nindent 4 }}
 type: Opaque
@@ -15,6 +16,7 @@ apiVersion: v1
 kind: Secret
 metadata:
   name: {{ include "garage-ui.fullname" . }}-admin-password
+  namespace: {{ .Release.Namespace }}
   labels:
     {{- include "garage-ui.labels" . | nindent 4 }}
 type: Opaque
@@ -31,6 +33,7 @@ apiVersion: v1
 kind: Secret
 metadata:
   name: {{ include "garage-ui.fullname" . }}-oidc-client-secret
+  namespace: {{ .Release.Namespace }}
   labels:
     {{- include "garage-ui.labels" . | nindent 4 }}
 type: Opaque
@@ -43,6 +46,7 @@ apiVersion: v1
 kind: Secret
 metadata:
   name: {{ include "garage-ui.fullname" . }}-jwt-key
+  namespace: {{ .Release.Namespace }}
   labels:
     {{- include "garage-ui.labels" . | nindent 4 }}
   annotations:
@@ -61,6 +65,7 @@ apiVersion: v1
 kind: Secret
 metadata:
   name: {{ $secretName }}
+  namespace: {{ .Release.Namespace }}
   labels:
     {{- include "garage-ui.labels" . | nindent 4 }}
   annotations:

helm/garage-ui/templates/service.yaml

@@ -2,6 +2,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: {{ include "garage-ui.fullname" . }}
+  namespace: {{ .Release.Namespace }}
   labels:
     {{- include "garage-ui.labels" . | nindent 4 }}
 spec:

helm/garage-ui/templates/servicemonitor.yaml

@@ -3,6 +3,7 @@ apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
   name: {{ include "garage-ui.fullname" . }}
+  namespace: {{ .Release.Namespace }}
   labels:
     {{- include "garage-ui.labels" . | nindent 4 }}
     {{- with .Values.serviceMonitor.labels }}