add file sharing nav bar

Overlord-Server/src/db.ts

@@ -244,6 +244,174 @@ db.run(
   `CREATE INDEX IF NOT EXISTS idx_auto_deploy_runs_ts ON auto_deploy_runs(ts DESC);`,
 );
 
+db.run(`
+  CREATE TABLE IF NOT EXISTS shared_files (
+    id TEXT PRIMARY KEY,
+    filename TEXT NOT NULL,
+    stored_path TEXT NOT NULL,
+    size INTEGER NOT NULL,
+    mime_type TEXT NOT NULL,
+    uploaded_by INTEGER NOT NULL,
+    uploaded_by_username TEXT NOT NULL,
+    password_hash TEXT,
+    max_downloads INTEGER,
+    download_count INTEGER NOT NULL DEFAULT 0,
+    expires_at INTEGER,
+    created_at INTEGER NOT NULL,
+    description TEXT
+  );
+`);
+db.run(
+  `CREATE INDEX IF NOT EXISTS idx_shared_files_created_at ON shared_files(created_at DESC);`,
+);
+db.run(
+  `CREATE INDEX IF NOT EXISTS idx_shared_files_uploaded_by ON shared_files(uploaded_by);`,
+);
+
+export type SharedFileRecord = {
+  id: string;
+  filename: string;
+  storedPath: string;
+  size: number;
+  mimeType: string;
+  uploadedBy: number;
+  uploadedByUsername: string;
+  passwordHash: string | null;
+  maxDownloads: number | null;
+  downloadCount: number;
+  expiresAt: number | null;
+  createdAt: number;
+  description: string | null;
+};
+
+export function insertSharedFile(file: SharedFileRecord): void {
+  db.run(
+    `INSERT INTO shared_files (id, filename, stored_path, size, mime_type, uploaded_by, uploaded_by_username, password_hash, max_downloads, download_count, expires_at, created_at, description)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+    file.id,
+    file.filename,
+    file.storedPath,
+    file.size,
+    file.mimeType,
+    file.uploadedBy,
+    file.uploadedByUsername,
+    file.passwordHash,
+    file.maxDownloads,
+    file.downloadCount,
+    file.expiresAt,
+    file.createdAt,
+    file.description,
+  );
+}
+
+export function getSharedFile(id: string): SharedFileRecord | null {
+  const row = db.query<any>(`SELECT * FROM shared_files WHERE id=?`).get(id);
+  if (!row) return null;
+  return {
+    id: row.id,
+    filename: row.filename,
+    storedPath: row.stored_path,
+    size: row.size,
+    mimeType: row.mime_type,
+    uploadedBy: row.uploaded_by,
+    uploadedByUsername: row.uploaded_by_username,
+    passwordHash: row.password_hash,
+    maxDownloads: row.max_downloads,
+    downloadCount: row.download_count,
+    expiresAt: row.expires_at,
+    createdAt: row.created_at,
+    description: row.description,
+  };
+}
+
+export function listSharedFiles(): SharedFileRecord[] {
+  return db
+    .query<any>(`SELECT * FROM shared_files ORDER BY created_at DESC`)
+    .all()
+    .map((row: any) => ({
+      id: row.id,
+      filename: row.filename,
+      storedPath: row.stored_path,
+      size: row.size,
+      mimeType: row.mime_type,
+      uploadedBy: row.uploaded_by,
+      uploadedByUsername: row.uploaded_by_username,
+      passwordHash: row.password_hash,
+      maxDownloads: row.max_downloads,
+      downloadCount: row.download_count,
+      expiresAt: row.expires_at,
+      createdAt: row.created_at,
+      description: row.description,
+    }));
+}
+
+export function deleteSharedFile(id: string): boolean {
+  const result = db.run(`DELETE FROM shared_files WHERE id=?`, id);
+  return (result as any)?.changes ? (result as any).changes > 0 : false;
+}
+
+export function updateSharedFile(
+  id: string,
+  updates: {
+    passwordHash?: string | null;
+    maxDownloads?: number | null;
+    expiresAt?: number | null;
+    description?: string | null;
+  },
+): boolean {
+  const setClauses: string[] = [];
+  const values: any[] = [];
+
+  if (updates.passwordHash !== undefined) {
+    setClauses.push("password_hash=?");
+    values.push(updates.passwordHash);
+  }
+  if (updates.maxDownloads !== undefined) {
+    setClauses.push("max_downloads=?");
+    values.push(updates.maxDownloads);
+  }
+  if (updates.expiresAt !== undefined) {
+    setClauses.push("expires_at=?");
+    values.push(updates.expiresAt);
+  }
+  if (updates.description !== undefined) {
+    setClauses.push("description=?");
+    values.push(updates.description);
+  }
+
+  if (setClauses.length === 0) return false;
+
+  values.push(id);
+  const result = db.run(
+    `UPDATE shared_files SET ${setClauses.join(", ")} WHERE id=?`,
+    ...values,
+  );
+  return (result as any)?.changes ? (result as any).changes > 0 : false;
+}
+
+export function incrementSharedFileDownloadCount(id: string): boolean {
+  const result = db.run(
+    `UPDATE shared_files SET download_count = download_count + 1 WHERE id=?`,
+    id,
+  );
+  return (result as any)?.changes ? (result as any).changes > 0 : false;
+}
+
+export function deleteExpiredSharedFiles(): string[] {
+  const now = Date.now();
+  const expired = db
+    .query<any>(`SELECT id, stored_path FROM shared_files WHERE expires_at IS NOT NULL AND expires_at < ?`)
+    .all(now);
+  const ids = expired.map((r: any) => r.id);
+  const paths = expired.map((r: any) => r.stored_path);
+  if (ids.length > 0) {
+    for (const id of ids) {
+      db.run(`DELETE FROM shared_files WHERE id=?`, id);
+    }
+  }
+  return paths;
+}
+
 export function upsertClientRow(
   partial: Partial<ClientInfo> & {
     id: string;

Overlord-Server/src/main-server.ts

@@ -3,7 +3,8 @@ import { decodeMessage, encodeMessage, type WireMessage, type PluginManifest } f
 import { logger } from "./logger";
 import { fileURLToPath } from "url";
 import path from "path";
-import { upsertClientRow, setOnlineState, listClients, markAllClientsOffline, getBuild, getBuildByTag, getAllBuilds, deleteExpiredBuilds, deleteBuild, getNotificationScreenshot, clearNotificationScreenshots, deleteClientRow, getClientIp, banIp, isIpBanned, clientExists } from "./db";
+import fs from "fs/promises";
+import { upsertClientRow, setOnlineState, listClients, markAllClientsOffline, getBuild, getBuildByTag, getAllBuilds, deleteExpiredBuilds, deleteBuild, getNotificationScreenshot, clearNotificationScreenshots, deleteClientRow, getClientIp, banIp, isIpBanned, clientExists, deleteExpiredSharedFiles } from "./db";
 import { handleFrame, handleHello, handlePing, handlePong } from "./wsHandlers";
 import { getMessageByteLength, getMaxPayloadLimit, isAllowedClientMessageType } from "./wsValidation";
 import { ClientInfo, ClientRole } from "./types";
@@ -29,6 +30,7 @@ import { handleMiscRoutes } from "./server/routes/misc-routes";
 import { handleNotificationsConfigRoutes } from "./server/routes/notifications-config-routes";
 import { handlePageRoutes } from "./server/routes/page-routes";
 import { handlePluginRoutes } from "./server/routes/plugin-routes";
+import { handleFileShareRoutes } from "./server/routes/file-share-routes";
 import { handleUsersRoutes } from "./server/routes/users-routes";
 import { handleWebSocketClose, handleWebSocketMessage, handleWebSocketOpen } from "./server/routes/websocket-lifecycle-routes";
 import { handleWsUpgradeRoutes } from "./server/routes/ws-upgrade-routes";
@@ -146,6 +148,7 @@ const PLUGIN_STATE_PATH = path.join(PLUGIN_ROOT, ".plugin-state.json");
 const DATA_DIR = ensureDataDir();
 const DEPLOY_ROOT = path.join(DATA_DIR, "deploy");
 const WINRE_ROOT = path.join(DATA_DIR, "winre");
+const FILE_SHARE_ROOT = path.join(DATA_DIR, "file-share");
 
 const TLS_CERT_PATH = config.tls.certPath;
 const TLS_KEY_PATH = config.tls.keyPath;
@@ -395,6 +398,9 @@ async function startServer() {
       securePluginHeaders,
       mimeType,
     },
+    fileShare: {
+      FILE_SHARE_ROOT,
+    },
     misc: {
       CORS_HEADERS,
       SERVER_VERSION,
@@ -562,6 +568,7 @@ async function startServer() {
       handleWinRERoutes,
       handleFileDownloadRoutes,
       handlePluginRoutes,
+      handleFileShareRoutes,
       handleMiscRoutes,
       handleAssetsRoutes,
       handlePageRoutes,
@@ -587,6 +594,12 @@ async function startServer() {
   deleteExpiredBuilds();
   logger.info(`[db] Cleaned up expired builds`);
 
+  const expiredPaths = deleteExpiredSharedFiles();
+  for (const p of expiredPaths) {
+    try { const dir = path.dirname(p); await fs.rm(dir, { recursive: true, force: true }); } catch {}
+  }
+  if (expiredPaths.length) logger.info(`[db] Cleaned up ${expiredPaths.length} expired shared files`);
+
   startMaintenanceLoops({
     getClients: clientManager.getAllClients,
     setOnlineState,

Overlord-Server/src/server/http-dispatch.ts

@@ -27,6 +27,7 @@ type HttpDispatchDeps<
   TWinRE,
   TFileDownload,
   TPlugin,
+  TFileShare,
   TMisc,
   TAssets,
   TPage,
@@ -47,6 +48,7 @@ type HttpDispatchDeps<
   handleWinRERoutes: RouteHandlerWithServerDeps<TServer, TWinRE>;
   handleFileDownloadRoutes: RouteHandlerWithServerDeps<TServer, TFileDownload>;
   handlePluginRoutes: RouteHandlerWithDeps<TPlugin>;
+  handleFileShareRoutes: RouteHandlerWithDeps<TFileShare>;
   handleMiscRoutes: RouteHandlerWithDeps<TMisc>;
   handleAssetsRoutes: RouteHandlerWithDeps<TAssets>;
   handlePageRoutes: RouteHandlerWithDeps<TPage>;
@@ -60,6 +62,7 @@ type HttpDispatchDeps<
     winre: TWinRE;
     fileDownload: TFileDownload;
     plugin: TPlugin;
+    fileShare: TFileShare;
     misc: TMisc;
     assets: TAssets;
     page: TPage;
@@ -77,6 +80,7 @@ export function createHttpFetchHandler<
   TWinRE,
   TFileDownload,
   TPlugin,
+  TFileShare,
   TMisc,
   TAssets,
   TPage,
@@ -92,6 +96,7 @@ export function createHttpFetchHandler<
     TWinRE,
     TFileDownload,
     TPlugin,
+    TFileShare,
     TMisc,
     TAssets,
     TPage,
@@ -144,6 +149,9 @@ export function createHttpFetchHandler<
       const pluginResponse = await deps.handlePluginRoutes(req, url, deps.routeDeps.plugin);
       if (pluginResponse) return pluginResponse;
 
+      const fileShareResponse = await deps.handleFileShareRoutes(req, url, deps.routeDeps.fileShare);
+      if (fileShareResponse) return fileShareResponse;
+
       const miscResponse = await deps.handleMiscRoutes(req, url, deps.routeDeps.misc);
       if (miscResponse) return miscResponse;
 

Overlord-Server/src/server/routes/file-share-routes.ts

@@ -0,0 +1,353 @@
+import fs from "fs/promises";
+import path from "path";
+import { v4 as uuidv4 } from "uuid";
+import { authenticateRequest } from "../../auth";
+import { AuditAction, logAudit } from "../../auditLog";
+import { logger } from "../../logger";
+import {
+  getSharedFile,
+  listSharedFiles,
+  insertSharedFile,
+  deleteSharedFile,
+  updateSharedFile,
+  incrementSharedFileDownloadCount,
+} from "../../db";
+import { getUserById, canUploadFiles } from "../../users";
+
+type FileShareRouteDeps = {
+  FILE_SHARE_ROOT: string;
+};
+
+function guessMimeType(filename: string): string {
+  const ext = path.extname(filename).toLowerCase();
+  const map: Record<string, string> = {
+    ".txt": "text/plain",
+    ".html": "text/html",
+    ".css": "text/css",
+    ".js": "application/javascript",
+    ".json": "application/json",
+    ".png": "image/png",
+    ".jpg": "image/jpeg",
+    ".jpeg": "image/jpeg",
+    ".gif": "image/gif",
+    ".webp": "image/webp",
+    ".svg": "image/svg+xml",
+    ".pdf": "application/pdf",
+    ".zip": "application/zip",
+    ".gz": "application/gzip",
+    ".tar": "application/x-tar",
+    ".7z": "application/x-7z-compressed",
+    ".rar": "application/vnd.rar",
+    ".exe": "application/vnd.microsoft.portable-executable",
+    ".dll": "application/vnd.microsoft.portable-executable",
+    ".iso": "application/x-iso9660-image",
+    ".mp4": "video/mp4",
+    ".mp3": "audio/mpeg",
+    ".wav": "audio/wav",
+    ".doc": "application/msword",
+    ".docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+    ".xls": "application/vnd.ms-excel",
+    ".xlsx": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+    ".csv": "text/csv",
+    ".xml": "application/xml",
+  };
+  return map[ext] || "application/octet-stream";
+}
+
+export async function handleFileShareRoutes(
+  req: Request,
+  url: URL,
+  deps: FileShareRouteDeps,
+): Promise<Response | null> {
+
+  const infoMatch = url.pathname.match(/^\/api\/file-share\/([^/]+)\/info$/);
+  if (req.method === "GET" && infoMatch) {
+    const fileId = infoMatch[1];
+    const file = getSharedFile(fileId);
+    if (!file) {
+      return Response.json({ error: "File not found" }, { status: 404 });
+    }
+
+    if (file.expiresAt && file.expiresAt < Date.now()) {
+      return Response.json({ error: "File has expired" }, { status: 410 });
+    }
+
+    if (file.maxDownloads !== null && file.downloadCount >= file.maxDownloads) {
+      return Response.json({ error: "Download limit reached" }, { status: 410 });
+    }
+
+    return Response.json({
+      id: file.id,
+      filename: file.filename,
+      size: file.size,
+      mimeType: file.mimeType,
+      hasPassword: !!file.passwordHash,
+      maxDownloads: file.maxDownloads,
+      downloadCount: file.downloadCount,
+      expiresAt: file.expiresAt,
+      createdAt: file.createdAt,
+      uploadedByUsername: file.uploadedByUsername,
+      description: file.description,
+    });
+  }
+
+  const downloadMatch = url.pathname.match(/^\/api\/file-share\/([^/]+)\/download$/);
+  if (req.method === "GET" && downloadMatch) {
+    const fileId = downloadMatch[1];
+    const file = getSharedFile(fileId);
+    if (!file) {
+      return Response.json({ error: "File not found" }, { status: 404 });
+    }
+
+    if (file.expiresAt && file.expiresAt < Date.now()) {
+      return Response.json({ error: "File has expired" }, { status: 410 });
+    }
+
+    if (file.maxDownloads !== null && file.downloadCount >= file.maxDownloads) {
+      return Response.json({ error: "Download limit reached" }, { status: 410 });
+    }
+
+    if (file.passwordHash) {
+      const providedPassword = req.headers.get("X-Download-Password") || url.searchParams.get("password") || "";
+      if (!providedPassword) {
+        return Response.json({ error: "Password required" }, { status: 401 });
+      }
+      const valid = await Bun.password.verify(providedPassword, file.passwordHash);
+      if (!valid) {
+        return Response.json({ error: "Invalid password" }, { status: 403 });
+      }
+    }
+
+    const diskFile = Bun.file(file.storedPath);
+    if (!(await diskFile.exists())) {
+      return Response.json({ error: "File not found on disk" }, { status: 404 });
+    }
+
+    incrementSharedFileDownloadCount(file.id);
+
+    const sanitizedFilename = file.filename.replace(/[^\w.\-() ]/g, "_");
+
+    return new Response(diskFile, {
+      headers: {
+        "Content-Type": file.mimeType || "application/octet-stream",
+        "Content-Disposition": `attachment; filename="${sanitizedFilename}"`,
+        "Content-Length": String(file.size),
+      },
+    });
+  }
+
+  if (!url.pathname.startsWith("/api/file-share")) {
+    return null;
+  }
+
+  let user;
+  try {
+    user = await authenticateRequest(req);
+  } catch {
+    return null;
+  }
+  if (!user) return null;
+
+  if (user.role === "viewer") {
+    return Response.json({ error: "Forbidden" }, { status: 403 });
+  }
+
+  if (req.method === "GET" && url.pathname === "/api/file-share") {
+    const files = listSharedFiles();
+    const userCanUpload = canUploadFiles(user.userId, user.role);
+    return Response.json({
+      files: files.map((f) => ({
+        id: f.id,
+        filename: f.filename,
+        size: f.size,
+        mimeType: f.mimeType,
+        uploadedBy: f.uploadedBy,
+        uploadedByUsername: f.uploadedByUsername,
+        hasPassword: !!f.passwordHash,
+        maxDownloads: f.maxDownloads,
+        downloadCount: f.downloadCount,
+        expiresAt: f.expiresAt,
+        createdAt: f.createdAt,
+        description: f.description,
+      })),
+      canUpload: userCanUpload,
+    });
+  }
+
+  if (req.method === "POST" && url.pathname === "/api/file-share/upload") {
+    if (!canUploadFiles(user.userId, user.role)) {
+      return Response.json({ error: "You do not have upload permission" }, { status: 403 });
+    }
+
+    let form: FormData;
+    try {
+      form = await req.formData();
+    } catch {
+      return Response.json({ error: "Invalid form data" }, { status: 400 });
+    }
+
+    const file = form.get("file");
+    if (!(file instanceof File)) {
+      return Response.json({ error: "Missing file" }, { status: 400 });
+    }
+
+    const filename = path.basename(file.name || "upload.bin");
+    const id = uuidv4();
+
+    await fs.mkdir(deps.FILE_SHARE_ROOT, { recursive: true });
+    const folder = path.join(deps.FILE_SHARE_ROOT, id);
+    await fs.mkdir(folder, { recursive: true });
+    const targetPath = path.join(folder, filename);
+
+    const bytes = new Uint8Array(await file.arrayBuffer());
+    await fs.writeFile(targetPath, bytes);
+
+    const password = form.get("password")?.toString() || "";
+    let passwordHash: string | null = null;
+    if (password) {
+      passwordHash = await Bun.password.hash(password, {
+        algorithm: "bcrypt",
+        cost: 10,
+      });
+    }
+
+    const maxDownloadsStr = form.get("maxDownloads")?.toString();
+    let maxDownloads: number | null = null;
+    if (maxDownloadsStr && maxDownloadsStr !== "" && maxDownloadsStr !== "0") {
+      const parsed = parseInt(maxDownloadsStr, 10);
+      if (!isNaN(parsed) && parsed > 0) {
+        maxDownloads = parsed;
+      }
+    }
+
+    const expiresAtStr = form.get("expiresAt")?.toString();
+    let expiresAt: number | null = null;
+    if (expiresAtStr && expiresAtStr !== "") {
+      const parsed = parseInt(expiresAtStr, 10);
+      if (!isNaN(parsed) && parsed > Date.now()) {
+        expiresAt = parsed;
+      }
+    }
+
+    const description = form.get("description")?.toString() || null;
+
+    const dbUser = getUserById(user.userId);
+
+    const record = {
+      id,
+      filename,
+      storedPath: targetPath,
+      size: bytes.length,
+      mimeType: guessMimeType(filename),
+      uploadedBy: user.userId,
+      uploadedByUsername: dbUser?.username || user.username || "unknown",
+      passwordHash,
+      maxDownloads,
+      downloadCount: 0,
+      expiresAt,
+      createdAt: Date.now(),
+      description,
+    };
+
+    insertSharedFile(record);
+
+    logger.info(`[file-share] ${record.uploadedByUsername} uploaded "${filename}" (${bytes.length} bytes) id=${id}`);
+
+    return Response.json({
+      ok: true,
+      id,
+      filename,
+      size: bytes.length,
+    });
+  }
+
+  const deleteMatch = url.pathname.match(/^\/api\/file-share\/([^/]+)$/);
+  if (req.method === "DELETE" && deleteMatch) {
+    const fileId = deleteMatch[1];
+    const file = getSharedFile(fileId);
+    if (!file) {
+      return Response.json({ error: "File not found" }, { status: 404 });
+    }
+
+    if (file.uploadedBy !== user.userId && user.role !== "admin") {
+      return Response.json({ error: "Forbidden" }, { status: 403 });
+    }
+
+    try {
+      const folder = path.dirname(file.storedPath);
+      await fs.rm(folder, { recursive: true, force: true });
+    } catch (err) {
+      logger.warn(`[file-share] Failed to remove file from disk: ${file.storedPath}`, err);
+    }
+
+    deleteSharedFile(fileId);
+    logger.info(`[file-share] ${user.username} deleted file "${file.filename}" id=${fileId}`);
+
+    return Response.json({ ok: true });
+  }
+
+  const patchMatch = url.pathname.match(/^\/api\/file-share\/([^/]+)$/);
+  if (req.method === "PATCH" && patchMatch) {
+    const fileId = patchMatch[1];
+    const file = getSharedFile(fileId);
+    if (!file) {
+      return Response.json({ error: "File not found" }, { status: 404 });
+    }
+
+    if (file.uploadedBy !== user.userId && user.role !== "admin") {
+      return Response.json({ error: "Forbidden" }, { status: 403 });
+    }
+
+    let body: any;
+    try {
+      body = await req.json();
+    } catch {
+      return Response.json({ error: "Invalid JSON" }, { status: 400 });
+    }
+
+    const updates: Record<string, any> = {};
+
+    if (body.password !== undefined) {
+      if (body.password === "" || body.password === null) {
+        updates.passwordHash = null;
+      } else {
+        updates.passwordHash = await Bun.password.hash(body.password, {
+          algorithm: "bcrypt",
+          cost: 10,
+        });
+      }
+    }
+
+    if (body.maxDownloads !== undefined) {
+      if (body.maxDownloads === null || body.maxDownloads === 0 || body.maxDownloads === "") {
+        updates.maxDownloads = null;
+      } else {
+        const parsed = parseInt(body.maxDownloads, 10);
+        if (!isNaN(parsed) && parsed > 0) {
+          updates.maxDownloads = parsed;
+        }
+      }
+    }
+
+    if (body.expiresAt !== undefined) {
+      if (body.expiresAt === null || body.expiresAt === "") {
+        updates.expiresAt = null;
+      } else {
+        const parsed = parseInt(body.expiresAt, 10);
+        if (!isNaN(parsed)) {
+          updates.expiresAt = parsed;
+        }
+      }
+    }
+
+    if (body.description !== undefined) {
+      updates.description = body.description || null;
+    }
+
+    updateSharedFile(fileId, updates);
+
+    return Response.json({ ok: true });
+  }
+
+  return null;
+}

Overlord-Server/src/server/routes/page-routes.ts

@@ -76,6 +76,7 @@ const STATIC_PAGES: StaticPageDef[] = [
   { path: "/scripts",            file: "scripts.html",             access: "no-viewer" },
   { path: "/deploy",             file: "deploy.html",              access: "admin" },
   { path: "/socks5-manager",     file: "socks5-manager.html",      access: "no-viewer",        checkPasswordChange: true },
+  { path: "/file-share",          file: "file-share.html",          access: "no-viewer",        checkPasswordChange: true },
   { path: "/purgatory",          file: "purgatory.html",           access: "admin-or-operator", checkPasswordChange: true },
 ];
 

Overlord-Server/src/server/routes/users-routes.ts

@@ -15,6 +15,7 @@ import {
   setUserClientAccessRule,
   setUserClientAccessScope,
   setUserCanBuild,
+  setUserCanUploadFiles,
   updateUserPassword,
   updateUserRole,
 } from "../../users";
@@ -353,6 +354,34 @@ export async function handleUsersRoutes(
       return Response.json({ success: true, canBuild });
     }
 
+    if (req.method === "PUT" && url.pathname.match(/^\/api\/users\/\d+\/can-upload-files$/)) {
+      const authedUser = requirePermission(user, "users:manage");
+      const userId = parseInt(url.pathname.split("/")[3]);
+      const targetUser = getUserById(userId);
+      if (!targetUser) {
+        return Response.json({ error: "User not found" }, { status: 404 });
+      }
+
+      const body = await req.json();
+      const canUploadFiles = !!body?.canUploadFiles;
+      const result = setUserCanUploadFiles(userId, canUploadFiles);
+      if (!result.success) {
+        return Response.json({ error: result.error }, { status: 400 });
+      }
+
+      const ip = server.requestIP(req)?.address || "unknown";
+      logAudit({
+        timestamp: Date.now(),
+        username: authedUser.username,
+        ip,
+        action: AuditAction.COMMAND,
+        details: `${canUploadFiles ? "Granted" : "Revoked"} file upload permission for ${targetUser.username}`,
+        success: true,
+      });
+
+      return Response.json({ success: true, canUploadFiles });
+    }
+
     return new Response("Not found", { status: 404 });
   } catch (error) {
     if (error instanceof Response) {

Overlord-Server/src/users.ts

@@ -23,6 +23,7 @@ export interface User {
   must_change_password: number;
   client_scope: ClientAccessScope;
   can_build: number;
+  can_upload_files: number;
   telegram_chat_id: string | null;
 }
 
@@ -35,6 +36,7 @@ export interface UserInfo {
   created_by: string | null;
   client_scope: ClientAccessScope;
   can_build: number;
+  can_upload_files: number;
   telegram_chat_id: string | null;
 }
 
@@ -157,6 +159,23 @@ for (const col of notificationColumns) {
   }
 }
 
+try {
+  db.exec(
+    `ALTER TABLE users ADD COLUMN can_upload_files INTEGER NOT NULL DEFAULT 0`,
+  );
+  logger.info("[users] Added can_upload_files column to existing database");
+
+  try {
+    db.exec(`UPDATE users SET can_upload_files=1 WHERE role='admin'`);
+  } catch (err: any) {
+    logger.error("[users] Failed to backfill admin can_upload_files:", err);
+  }
+} catch (err: any) {
+  if (!err.message?.includes("duplicate column name")) {
+    logger.error("[users] Migration error:", err);
+  }
+}
+
 const userCount = db.prepare("SELECT COUNT(*) as count FROM users").get() as {
   count: number;
 };
@@ -172,8 +191,8 @@ if (userCount.count === 0) {
   });
 
   db.prepare(
-    "INSERT INTO users (username, password_hash, role, created_at, created_by, must_change_password, client_scope, can_build) VALUES (?, ?, ?, ?, ?, ?, ?, ?)",
-  ).run(initialUsername, defaultPassword, "admin", Date.now(), "system", 1, "all", 1);
+    "INSERT INTO users (username, password_hash, role, created_at, created_by, must_change_password, client_scope, can_build, can_upload_files) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)",
+  ).run(initialUsername, defaultPassword, "admin", Date.now(), "system", 1, "all", 1, 1);
 
   const createdUser = db
     .prepare("SELECT * FROM users WHERE username = ?")
@@ -209,7 +228,7 @@ export function getUserByUsername(username: string): User | null {
 export function listUsers(): UserInfo[] {
   const users = db
     .prepare(
-      "SELECT id, username, role, created_at, last_login, created_by, client_scope, can_build, telegram_chat_id FROM users ORDER BY created_at DESC",
+      "SELECT id, username, role, created_at, last_login, created_by, client_scope, can_build, can_upload_files, telegram_chat_id FROM users ORDER BY created_at DESC",
     )
     .all() as UserInfo[];
   return users;
@@ -425,9 +444,9 @@ export async function createUser(
 
     const result = db
       .prepare(
-        "INSERT INTO users (username, password_hash, role, created_at, created_by, client_scope, can_build) VALUES (?, ?, ?, ?, ?, ?, ?)",
+        "INSERT INTO users (username, password_hash, role, created_at, created_by, client_scope, can_build, can_upload_files) VALUES (?, ?, ?, ?, ?, ?, ?, ?)",
       )
-      .run(username, passwordHash, role, Date.now(), createdBy, role === "admin" ? "all" : "none", role === "admin" || role === "operator" ? 1 : 0);
+      .run(username, passwordHash, role, Date.now(), createdBy, role === "admin" ? "all" : "none", role === "admin" || role === "operator" ? 1 : 0, role === "admin" ? 1 : 0);
 
     invalidateNotificationDeliveryCache();
 
@@ -584,6 +603,25 @@ export function setUserCanBuild(
   }
 }
 
+export function canUploadFiles(userId: number, role: UserRole): boolean {
+  if (role === "admin") return true;
+  const user = getUserById(userId);
+  return user ? user.can_upload_files === 1 : false;
+}
+
+export function setUserCanUploadFiles(
+  userId: number,
+  canUpload: boolean,
+): { success: boolean; error?: string } {
+  try {
+    db.prepare("UPDATE users SET can_upload_files = ? WHERE id = ?").run(canUpload ? 1 : 0, userId);
+    return { success: true };
+  } catch (err: any) {
+    logger.error("[users] setUserCanUploadFiles error:", err);
+    return { success: false, error: err.message || "Failed to update upload permission" };
+  }
+}
+
 export function setUserTelegramChatId(
   userId: number,
   chatId: string | null,