From 3420464d7254dd6c641238efdf84a16204b39785 Mon Sep 17 00:00:00 2001
From: Kosztyk <36381705+Kosztyk@users.noreply.github.com>
Date: Thu, 4 Dec 2025 16:08:48 +0200
Subject: [PATCH] Add files via upload

---
 src/pages/antivirus.tsx | 76 ++++++++++++++++++++++++++++++++++-------
 1 file changed, 64 insertions(+), 12 deletions(-)

diff --git a/src/pages/antivirus.tsx b/src/pages/antivirus.tsx
index 8a29eee..3330d59 100644
--- a/src/pages/antivirus.tsx
+++ b/src/pages/antivirus.tsx
@@ -8,38 +8,90 @@ import {
   setAntivirusEnabled,
 } from "../helpers/avToggle";
 
+/**
+ * Antivirus toggle API
+ *
+ * GET  /api/antivirus  (auth required)
+ *   -> { available: boolean, enabled: boolean }
+ *
+ * POST /api/antivirus  (auth required)
+ *   body: { enabled: boolean }
+ *   -> { available: boolean, enabled: boolean }
+ *
+ * - `available` reflects CLAMAV_URL (via isAntivirusAvailable()).
+ * - `enabled` is the global effective flag used by upload.tsx.
+ */
 export const antivirus = new Elysia()
   .use(userService)
-  // Get current AV status
-  .get("/api/antivirus", () => {
-    const available = isAntivirusAvailable();
-    const enabled = isAntivirusEnabled();
-    return { available, enabled };
-  })
-  // Update AV status
+
+  // Read current antivirus state
+  .get(
+    "/api/antivirus",
+    () => {
+      const available = isAntivirusAvailable();
+      const enabled = isAntivirusEnabled();
+
+      console.log(
+        "[Antivirus API][GET] available:",
+        available,
+        "enabled:",
+        enabled,
+      );
+
+      return { available, enabled };
+    },
+    {
+      // 🔒 Only logged-in users should see global AV state
+      auth: true,
+    },
+  )
+
+  // Update antivirus state (enable/disable)
   .post(
     "/api/antivirus",
     ({ body }) => {
-      const { enabled } = body;
+      const requested = Boolean(body.enabled);
+      const available = isAntivirusAvailable();
 
-      if (!isAntivirusAvailable()) {
-        // CLAMAV_URL missing: force disabled and report unavailable
+      console.log(
+        "[Antivirus API][POST] requested enabled=",
+        requested,
+        "available=",
+        available,
+      );
+
+      // If AV is not available (CLAMAV_URL missing), force disabled
+      if (!available) {
+        console.warn(
+          "[Antivirus API][POST] CLAMAV_URL not configured. Refusing to enable antivirus.",
+        );
         return {
           available: false,
           enabled: false,
         };
       }
 
-      setAntivirusEnabled(Boolean(enabled));
+      // Persist the new state
+      setAntivirusEnabled(requested);
+
+      const effectiveEnabled = isAntivirusEnabled();
+
+      console.log(
+        "[Antivirus API][POST] effective enabled=",
+        effectiveEnabled,
+      );
 
       return {
         available: true,
-        enabled: isAntivirusEnabled(),
+        enabled: effectiveEnabled,
       };
     },
     {
       body: t.Object({
         enabled: t.Boolean(),
       }),
+      // 🔒 Only logged-in users can change global AV setting
+      auth: true,
     },
   );
+