$ curl -s http://127.0.0.1:8334/api/config | python3 -m json.tool | grep -E '"(version|license|name)"'
    "license": "agpl",
    "name": "Filestash",
    "version": "244e8b74ebdf60cdbd650a24c1f22569d839a814",

$ curl -s http://127.0.0.1:8334/api/config | python3 -m json.tool | head -20
{
    "result": {
        "auth": [],
        "connections": [
            {"label": "SFTP 服务器", "type": "sftp"},
            {"label": "WebDAV 服务器", "type": "webdav"}
        ],
        "default_sort": "type",
        "default_view": "grid",
        "display_hidden": false,
        "editor": "emacs",
        "enable_chromecast": true,
        "enable_search": true,
        "enable_share": true,
        "enable_tags": true,
        "license": "agpl",
        "logout": "",
        ...(mime 注册表，约 308 个扩展名映射)...
        "name": "Filestash",
        "open_mode": "single_click",
        "origin": "",
        "refresh_after_upload": false,
        "share_default_access": "editor",
        "share_redirect": "",
        "thumbnailer": ["image/jpeg", "image/png", "image/gif"],
        "upload_button": false,
        "upload_chunk_size": 0,
        "upload_pool_size": 0,
        "version": "244e8b74ebdf60cdbd650a24c1f22569d839a814"
    },
    "status": "ok"
}

$ curl -s -D- http://127.0.0.1:8334/admin/api/config
HTTP/1.1 403 Forbidden
Content-Type: text/plain
...

2026/10/22 04:50:14 HTTP 403 GET 0.0ms /admin/api/config

$ curl -s -c /tmp/admin.cookie -H 'X-Requested-With: XmlHttpRequest' \
    -H 'Content-Type: application/json' \
    -d '{"password": "q1w2e3r4"}' \
    http://127.0.0.1:8334/admin/api/session
{"status": "ok", "result": true}

2026/10/22 04:44:34 HTTP 200 POST 1538.7ms /admin/api/session

"display_hidden": {
    "label": "display_hidden",
    "type": "boolean",
    "description": "Should files starting with a dot be visible by default?",
    "readonly": false,
    "default": false,
    "value": null,
    "required": false
}

"log": {
    "enable": {
        "label": "enable", "type": "enable",
        "target": ["log_level"],        // 管辖 id 为 log_level 的参数
        "default": true, "value": null, ...
    },
    "level": {
        "id": "log_level",              // 被 log.enable 的 target 引用
        "label": "level", "type": "select",
        "options": ["DEBUG", "INFO", "WARNING", "ERROR"],
        "default": "INFO", "value": null, ...
    },
    ...
}

"auth": {
    "admin": {
        "label": "admin", "type": "bcrypt",
        "description": "Password of the admin section.",
        "default": "", "value": "$2b$10$hJXK4pqyc9DGDizo6Rp7/Ojc8Tqds5KDSCgGqL/zUDsBE9cUxdCpK", ...
    }
}

"constant": {
    "user":    {"type": "boolean", "readonly": true, "value": "filestash"},
    "license": {"type": "text",    "readonly": true, "value": "agpl"}
}

import json, urllib.request, urllib.error, http.cookiejar

cj = http.cookiejar.CookieJar()
op = urllib.request.build_opener(urllib.request.HTTPCookieProcessor(cj))
H = {"Content-Type": "application/json", "X-Requested-With": "XmlHttpRequest", "User-Agent": "Mozilla/5.0"}
BASE = "http://127.0.0.1:8334"

def call(method, url, payload=None, extra=None):
    data = json.dumps(payload).encode() if payload is not None else None
    hh = dict(H); hh.update(extra or {})
    try:
        r = op.open(urllib.request.Request(url, data=data, headers=hh, method=method))
        return r.status, json.loads(r.read().decode())
    except urllib.error.HTTPError as e:
        return e.code, e.read().decode().strip()[:200]

def flatten(o):
    """取每个叶子节点的 value；number 类型转 int"""
    out = {}
    for k, v in o.items():
        if isinstance(v, dict) and all(kk in v for kk in ("label", "type", "default", "value")):
            val = v["value"]
            if v["type"] == "number":
                try: val = int(val)
                except Exception: val = 0
            out[k] = val
        elif isinstance(v, dict): out[k] = flatten(v)
        else: out[k] = v
    return out

def admin_post(changes):
    """changes 形如 {"general.display_hidden": True}；按点分路径嵌套写入"""
    st, adm = call("GET", BASE+"/admin/api/config")
    b = flatten(adm["result"])
    b["connections"] = [{"type": "sftp", "label": "SFTP 服务器"},
                        {"type": "webdav", "label": "WebDAV 服务器"}]   # 关键！见 8.2
    for dotted, v in changes.items():
        parts = dotted.split("."); node = b
        for p in parts[:-1]: node = node[p]
        node[parts[-1]] = v
    return call("POST", BASE+"/admin/api/config", b)

## 修改提交成功（但 body 里没有 connections）
2026/10/22 04:52:42 HTTP 200 POST 0.7ms /admin/api/config

## 立即查看前台配置：connections 变成了空数组
$ curl -s http://127.0.0.1:8334/api/config | python3 -m json.tool | grep -A1 connections
        "connections": [],

## 已登录的 SFTP 会话随即失效，文件列表接口返回 403
2026/10/22 04:52:42 SYST DEBUG middleware::session::start action=extractBackend error="Not Allowed"
2026/10/22 04:52:42 HTTP 403 GET 0.0ms /api/files/ls?path=/srv/share/

>>> admin_post({"log.level": "DEBUG"})
(200, {'status': 'ok'})
>>> admin_post({"log.level": None})
(200, {'status': 'ok'})

2026/10/22 04:59:46 HTTP 200 GET 0.7ms /admin/api/config
2026/10/22 04:59:46 HTTP 200 POST 1.1ms /admin/api/config trace=58sl838M4OgNd7sJMraOqAriiVPvu2wa
2026/10/22 04:59:46 HTTP 200 GET 0.1ms /healthz
2026/10/22 04:59:46 HTTP 200 GET 0.1ms /api/config trace=krSKhWAgKa3XvhCjPRvB1dAmLsfxGKk1
2026/10/22 04:59:46 HTTP 200 GET 0.3ms /admin/api/config trace=Zwq6V8BHjZIltBO1Y32AczsvB2eyWkrN
2026/10/22 04:59:46 HTTP 200 POST 0.7ms /admin/api/config
2026/10/22 04:59:46 HTTP 200 GET 0.1ms /healthz
2026/10/22 04:59:46 HTTP 200 GET 0.1ms /api/config

2026/10/22 04:52:42 SYST DEBUG middleware::session::start action=extractBackend error="Not Allowed"

## 1. 创建共享（viewer 角色：只读）
$ curl -s -X PUT -H 'X-Requested-With: XmlHttpRequest' -H 'Content-Type: application/json' \
    -H "Authorization: Bearer <SFTP会话令牌>" \
    -d '{"path": "/srv/share/docs/", "can_read": true, "can_write": false, "can_upload": false}' \
    "http://127.0.0.1:8334/api/share/c1tst001"
{"status": "ok"}

## 2. 列出该路径的共享
$ curl -s -H "Authorization: Bearer <SFTP会话令牌>" \
    "http://127.0.0.1:8334/api/share?path=/srv/share/docs/"
{"status": "ok", "results": [{"id": "c1tst001", "path": "/", "can_read": true, "can_write": false, "can_upload": false}]}

## 3. 共享链接页面可访问（HTTP 200）
$ curl -s -o /dev/null -w "%{http_code}\n" http://127.0.0.1:8334/s/c1tst001
200

>>> admin_post({"features.share.enable": False})
(200, {'status': 'ok'})
$ grep -A4 '"share"' /opt/filestash/data/state/config/config.json
"share": {"enable": false, "default_access": null, "redirect": null}
$ curl -s http://127.0.0.1:8334/api/config | python3 -m json.tool | grep enable_share
        "enable_share": false,

## 禁用状态下创建新共享：仍然成功
$ curl -s -X PUT ... -d '{"path": "/srv/share/docs/", "can_read": true, ...}' \
    "http://127.0.0.1:8334/api/share/c1dis001"
{"status": "ok"}

## 禁用状态下访问已有共享链接：仍然 200
$ curl -s -o /dev/null -w "%{http_code}\n" http://127.0.0.1:8334/s/c1tst001
200

$ curl -s -X DELETE -H "Authorization: Bearer <SFTP会话令牌>" http://127.0.0.1:8334/api/share/c1dis001
{"status": "ok"}
>>> admin_post({"features.share.enable": True})
(200, {'status': 'ok'})
$ curl -s http://127.0.0.1:8334/api/config | python3 -m json.tool | grep enable_share
        "enable_share": true,

>>> admin_post({"general.display_hidden": True})
(200, {'status': 'ok'})
$ grep -n 'display_hidden' /opt/filestash/data/state/config/config.json
10:        "display_hidden": true,
$ curl -s http://127.0.0.1:8334/api/config | python3 -m json.tool | grep display_hidden
        "display_hidden": true,

$ curl -s -H "Authorization: Bearer <SFTP会话令牌>" \
    "http://127.0.0.1:8334/api/files/ls?path=/srv/share/" | python3 -m json.tool
{
    "status": "ok",
    "results": [
        {"name": "sample.bin", ...},
        {"name": ".c1hidden.txt", ...},
        {"name": "docs", ...},
        {"name": "b1-verify", ...}
    ]
}

>>> admin_post({"general.filepage_default_view": "list"})
(200, {'status': 'ok'})
$ curl -s http://127.0.0.1:8334/api/config | python3 -m json.tool | grep default_view
        "default_view": "list",

>>> admin_post({"general.display_hidden": None, "general.filepage_default_view": None,
...             "log.level": None, "features.share.enable": True})
(200, {'status': 'ok'})
$ curl -s http://127.0.0.1:8334/api/config | python3 -m json.tool | grep -E '"(display_hidden|default_view|enable_share)"'
        "default_view": "grid",
        "display_hidden": false,
        "enable_share": true,

$ cat /opt/filestash/data/state/config/config.json
{
    "general": {
        "name": null,
        "port": 0,
        "host": null,
        "secret_key": "iUIfIl67pLEWX98S",
        "force_ssl": null,
        "editor": null,
        "logout": null,
        "display_hidden": null,
        "refresh_after_upload": null,
        "open_mode": null,
        "upload_button": null,
        "upload_pool_size": 0,
        "upload_chunk_size": 0,
        "buffer_size": null,
        "filepage_default_view": null,
        "filepage_default_sort": null,
        "cookie_timeout": 0,
        "extended_session": null,
        "custom_css": null,
        "license": null
    },
    "features": {
        "api": {"enable": null},
        "share": {"enable": null, "default_access": null, "redirect": null},
        ...(protection/collaborative/workflow/office/mcp/site/search/video/server，同构，均为 null/0)...
    },
    "log": {"enable": null, "level": null, "telemetry": null},
    "email": {"server": null, "port": 0, "username": null, "password": null, "from": null},
    "auth": {"admin": "$2b$10$hJXK4pqyc9DGDizo6Rp7/Ojc8Tqds5KDSCgGqL/zUDsBE9cUxdCpK"},
    "middleware": {"identity_provider": {"type": null, "params": null},
                   "attribute_mapping": {"related_backend": null, "params": null}},
    "constant": {"user": "filestash", "license": "agpl"},
    "connections": [
        {"type": "sftp", "label": "SFTP 服务器"},
        {"type": "webdav", "label": "WebDAV 服务器"}
    ]
}