improve authentication docs and added quota feature details

content/en/docs/access-control/access-control-overview.md

@@ -18,6 +18,8 @@ FileBrowser combines three separate ideas. Together they decide whether someone
 
 Access rules refine **which paths** under a source are reachable once the user already has that source and sufficient **per-source permissions** for the action.
 
+**Storage quotas (v2.1.0+)** are a separate control: they limit how much data can be stored in a folder, user scope, or share link without changing who can see a path. See {{< doclink path="features/quotas/" text="Storage quotas (v2.1.0+)" />}}.
+
 {{% alert context="info" %}}
 **Access rules are not file permissions.** Allow/deny rules control path visibility. They do **not** replace **create**, **modify**, or **delete** on the user's scope — those are configured in **User management** (per user) and **Access management** (defaults and enforce). See {{< doclink path="features/user-permissions/" text="User permissions" />}}.
 {{% /alert %}}
@@ -84,6 +86,7 @@ Access rules are configured in the admin UI or via the API: per user or group, p
 
 ## Next steps
 
+- {{< doclink path="features/quotas/" text="Storage quotas (v2.1.0+)" />}}
 - {{< doclink path="access-control/rules/" text="Access rules" />}}
 - {{< doclink path="access-control/troubleshooting/" text="Troubleshooting" />}}
 - {{< doclink path="configuration/users/" text="User management" />}}

content/en/docs/advanced/source-configuration/conditional-rules.md

@@ -61,6 +61,8 @@ sources:
           viewable: true          # allow viewing in the ui
 ```
 
+On sources where indexing is disabled, **folder and scope quotas (v2.1.0+)** can only use **tracked usage** measurement. See {{< doclink path="features/quotas/" text="Storage quotas (v2.1.0+)" />}}.
+
 ## Rule Properties
 
 These properties can be added to any rule to control behavior:
@@ -332,3 +334,4 @@ sources:
 
 - {{< doclink path="advanced/source-configuration/sources/" text="Source Configuration" />}}
 - {{< doclink path="features/indexing/" text="Understanding Indexing" />}}
+- {{< doclink path="features/quotas/" text="Storage quotas (v2.1.0+)" />}} — measurement styles when indexing is on vs off

content/en/docs/advanced/source-configuration/sources.md

@@ -117,7 +117,7 @@ server:
 
 Sources are indexed by default, which enables:
 - **Search functionality** - Fast full-text and filename search
-- **Folder size calculations** - Accurate directory size reporting
+- **Folder size calculations** - Accurate directory size reporting (also used for **indexed-size storage quotas (v2.1.0+)**; use tracked usage when indexing is disabled — see {{< doclink path="features/quotas/" text="Storage quotas (v2.1.0+)" />}})
 - **Folder previews** - Thumbnail previews for image directories
 - **Health monitoring** - Source statistics and health information
 

content/en/docs/configuration/Authentication/_index.md

@@ -6,19 +6,3 @@ date: "2025-10-08T14:59:30Z"
 lastmod: "2026-08-12T15:00:00Z"
 order: 4
 ---
-
-Choose one or more login methods under `auth.methods`. Password, OIDC, LDAP, JWT, proxy, passkey, and no-auth are documented in the pages below.
-
-## Auto-created users and sources (v2.0.1+)
-
-OIDC, LDAP, JWT, and proxy authentication **create users on first successful login**. Those users receive sources the same way as password users:
-
-- Every source with {{< doclink path="configuration/sources#defaultenabled" text="defaultEnabled: true" />}} is added to the user’s scopes when the user is **created**.
-- On **every server startup**, FileBrowser merges any missing `defaultEnabled` sources into **all** existing users’ scopes (so adding a new default-enabled source in config takes effect after restart without editing each user).
-- Sources with `defaultEnabled: false` are never auto-added; an admin must assign them.
-
-Path-level isolation inside a source still uses {{< doclink path="access-control/rules" text="access rules" />}} and {{< doclink path="configuration/sources#denybydefault" text="denyByDefault" />}}.
-
-## Groups (OIDC, LDAP, JWT)
-
-OIDC, LDAP, and JWT share `groupsClaim`, `adminGroup`, and `userGroups`. On successful login, IdP groups are synced into the access-control GroupMap (write-through to the database) so group allow/deny rules apply. See each method’s page for claim/attribute details.

content/en/docs/configuration/Authentication/jwt.md

@@ -3,11 +3,23 @@ title: "JWT Authentication"
 description: "External JWT token authentication for SSO and proxy integration"
 icon: "security"
 date: "2026-02-27T21:50:04Z"
-lastmod: "2026-04-20T18:55:31Z"
+lastmod: "2026-08-24T17:00:00Z"
 ---
 
 Accept externally-signed JWT tokens for secure authentication, enabling single sign-on, proxy authentication, and iframe embedding scenarios.
 
+{{% alert context="warning" %}}
+**Configure source access for new users**
+
+Authentication alone does not grant file access. When a user is created (password signup, admin/CLI create, or first login via OIDC / LDAP / JWT / proxy), they only receive sources where `config.defaultEnabled: true`.
+
+- Default is **`false`** — without this, new users may log in but see **no files**
+- **One source** in config: FileBrowser auto-enables `defaultEnabled` for that source
+- **Multiple sources**: set `defaultEnabled: true` on each source new users should access
+
+See {{< doclink path="configuration/sources#defaultenabled" text="Sources: defaultEnabled" />}} for full details and examples.
+{{% /alert %}}
+
 ## Basic Configuration
 
 ```yaml
@@ -210,7 +222,7 @@ A string claim works (for example `"tenant": "acme"` with `groupsClaim: tenant`)
 
 ### Sources for JWT users
 
-JWT users are auto-created on first successful token auth. They receive every {{< doclink path="configuration/sources#defaultenabled" text="defaultEnabled" />}} source on create; from **v2.0.1+**, missing default-enabled sources are also merged for existing users on every server startup. See {{< doclink path="configuration/authentication/" text="Authentication overview" />}}.
+JWT users are auto-created on first successful token auth. Source access follows the callout at the top of this page.
 
 ## Advanced Configuration
 

content/en/docs/configuration/Authentication/ldap.md

@@ -3,11 +3,23 @@ title: "LDAP Authentication"
 description: "Integrate with LDAP directories for centralized user authentication"
 icon: "security"
 date: "2026-02-27T21:50:04Z"
-lastmod: "2026-04-20T18:55:31Z"
+lastmod: "2026-08-24T17:00:00Z"
 ---
 
 Authenticate users against LDAP directories like Active Directory, OpenLDAP, Authentik, and other LDAP-compliant systems.
 
+{{% alert context="warning" %}}
+**Configure source access for new users**
+
+Authentication alone does not grant file access. When a user is created (password signup, admin/CLI create, or first login via OIDC / LDAP / JWT / proxy), they only receive sources where `config.defaultEnabled: true`.
+
+- Default is **`false`** — without this, new users may log in but see **no files**
+- **One source** in config: FileBrowser auto-enables `defaultEnabled` for that source
+- **Multiple sources**: set `defaultEnabled: true` on each source new users should access
+
+See {{< doclink path="configuration/sources#defaultenabled" text="Sources: defaultEnabled" />}} for full details and examples.
+{{% /alert %}}
+
 ## Basic Configuration
 
 ```yaml
@@ -204,9 +216,7 @@ Users not in these groups will be denied access even with valid LDAP credentials
 
 ### Access-control groups and sources
 
-On successful LDAP login, groups from `groupsClaim` (default `memberOf`) are synced into FileBrowser’s access-control GroupMap (write-through to the database) so {{< doclink path="access-control/rules" text="group allow/deny rules" />}} apply with {{< doclink path="configuration/sources#denybydefault" text="denyByDefault" />}}.
-
-LDAP users are auto-created on first login and receive every {{< doclink path="configuration/sources#defaultenabled" text="defaultEnabled" />}} source. From **v2.0.1+**, missing default-enabled sources are also merged for existing users on every server startup. See {{< doclink path="configuration/authentication/" text="Authentication overview" />}}.
+On successful LDAP login, groups from `groupsClaim` (default `memberOf`) are synced into FileBrowser’s access-control GroupMap (write-through to the database) so {{< doclink path="access-control/rules" text="group allow/deny rules" />}} apply with {{< doclink path="configuration/sources#denybydefault" text="denyByDefault" />}}. LDAP users are auto-created on first login; source access follows the callout at the top of this page.
 
 ### Custom Groups Attribute
 

content/en/docs/configuration/Authentication/oidc.md

@@ -3,11 +3,23 @@ title: "OIDC Authentication"
 description: "OpenID Connect integration"
 icon: "fingerprint"
 date: "2025-10-08T14:59:30Z"
-lastmod: "2026-08-05T15:34:23Z"
+lastmod: "2026-08-24T17:00:00Z"
 ---
 
 Integrate with OpenID Connect providers for single sign-on.
 
+{{% alert context="warning" %}}
+**Configure source access for new users**
+
+Authentication alone does not grant file access. When a user is created (password signup, admin/CLI create, or first login via OIDC / LDAP / JWT / proxy), they only receive sources where `config.defaultEnabled: true`.
+
+- Default is **`false`** — without this, new users may log in but see **no files**
+- **One source** in config: FileBrowser auto-enables `defaultEnabled` for that source
+- **Multiple sources**: set `defaultEnabled: true` on each source new users should access
+
+See {{< doclink path="configuration/sources#defaultenabled" text="Sources: defaultEnabled" />}} for full details and examples.
+{{% /alert %}}
+
 {{% alert context="info" %}}
 **OIDC callback URL:** FileBrowser does **not** use `http.externalUrl` for OIDC. Register your provider callback from the URL you actually use to log in (for example `https://files.example.com/files/api/auth/oidc/callback`). See [Callback URL](#callback-url) below.
 {{% /alert %}}
@@ -28,10 +40,6 @@ auth:
 
 If you need group claims, add them to `scopes` (for example `groups`) per your provider.
 
-{{% alert context="info" %}}
-**Sources:** OIDC users are auto-created on first login and receive every {{< doclink path="configuration/sources#defaultenabled" text="defaultEnabled" />}} source (also merged for existing users on startup in v2.0.1+). For path-level group isolation, use {{< doclink path="configuration/sources#denybydefault" text="denyByDefault" />}} with {{< doclink path="access-control/rules" text="access rules" />}} — groups from `groupsClaim` sync into the GroupMap on each successful OIDC login.
-{{% /alert %}}
-
 ## Configuration Options
 
 | Option | Description |
@@ -165,7 +173,7 @@ auth:
 
 ## Group-Based Access Control
 
-On successful OIDC login, groups from `groupsClaim` are synced into FileBrowser’s access-control GroupMap (write-through to the database) so {{< doclink path="access-control/rules" text="group allow/deny rules" />}} apply.
+On successful OIDC login, groups from `groupsClaim` are synced into FileBrowser’s access-control GroupMap (write-through to the database) so {{< doclink path="access-control/rules" text="group allow/deny rules" />}} apply. For path-level group isolation, use {{< doclink path="configuration/sources#denybydefault" text="denyByDefault" />}} on the source.
 
 ### Admin Group
 

content/en/docs/configuration/Authentication/password.md

@@ -3,11 +3,23 @@ title: "Password Authentication"
 description: "Configure password authentication"
 icon: "key"
 date: "2025-10-08T14:59:30Z"
-lastmod: "2026-04-20T18:55:31Z"
+lastmod: "2026-08-24T17:00:00Z"
 ---
 
 Password authentication uses the typical `username` and `password` to login a user. Password authentication also supports **Signup**, **recaptcha**, and **Two-Factor Authentication** features.
 
+{{% alert context="warning" %}}
+**Configure source access for new users**
+
+Authentication alone does not grant file access. When a user is created (password signup, admin/CLI create, or first login via OIDC / LDAP / JWT / proxy), they only receive sources where `config.defaultEnabled: true`.
+
+- Default is **`false`** — without this, new users may log in but see **no files**
+- **One source** in config: FileBrowser auto-enables `defaultEnabled` for that source
+- **Multiple sources**: set `defaultEnabled: true` on each source new users should access
+
+See {{< doclink path="configuration/sources#defaultenabled" text="Sources: defaultEnabled" />}} for full details and examples.
+{{% /alert %}}
+
 ## Basic Configuration
 
 ```yaml

content/en/docs/configuration/Authentication/proxy.md

@@ -3,12 +3,24 @@ title: "Proxy Authentication"
 description: "Header-based authentication"
 icon: "security"
 date: "2025-10-08T14:59:30Z"
-lastmod: "2026-08-05T15:34:23Z"
+lastmod: "2026-08-24T17:00:00Z"
 order: 2
 ---
 
 Authenticate based on HTTP headers -- strictly designed to be used behind a reverse proxy.
 
+{{% alert context="warning" %}}
+**Configure source access for new users**
+
+Authentication alone does not grant file access. When a user is created (password signup, admin/CLI create, or first login via OIDC / LDAP / JWT / proxy), they only receive sources where `config.defaultEnabled: true`.
+
+- Default is **`false`** — without this, new users may log in but see **no files**
+- **One source** in config: FileBrowser auto-enables `defaultEnabled` for that source
+- **Multiple sources**: set `defaultEnabled: true` on each source new users should access
+
+See {{< doclink path="configuration/sources#defaultenabled" text="Sources: defaultEnabled" />}} for full details and examples.
+{{% /alert %}}
+
 ## Configuration
 
 {{% alert context="warning" %}}
@@ -21,24 +33,28 @@ auth:
     proxy:
       enabled: true
       header: "X-Forwarded-User"  # or "Remote-User"
-      # Optional (same shared fields as OIDC / LDAP / JWT):
-      # adminGroup: ""
-      # userGroups: []
-      # groupsClaim: "groups"
+      # Optional role/group headers (v2.1.0+):
+      # groupsClaim: "x-cosmos-role"  # HTTP header name for group/role value
+      # userGroups: ["2", "1"]        # allow-list; omit to allow all
+      # adminGroup: "2"               # group value that grants admin
       # userIdentifier: ""
       # disableVerifyTLS: false   # testing only
       # logoutRedirectUrl: ""
 ```
 
+{{% alert context="info" %}}
+**v2.1.0+:** `groupsClaim`, `adminGroup`, and `userGroups` enable role-based access for proxy auth. For proxy auth, `groupsClaim` is the **HTTP header name** (for example `x-cosmos-role`), not a JSON claim field. Versions before v2.1.0 ignore these options; admin is only granted when the proxy username matches `auth.adminUsername`.
+{{% /alert %}}
+
 ## Options
 
 | Option | Description |
 |--------|-------------|
 | `enabled` | Enable proxy authentication |
 | `header` | **Required.** Header whose value is trusted as the username (must sit behind a trusted proxy) |
-| `adminGroup` | Group name that grants admin (if your proxy/IdP also sends group claims — integration-dependent) |
-| `userGroups` | If set, only users in these groups may log in |
-| `groupsClaim` | JSON field name for groups when reading group data (default: `groups`) |
+| `adminGroup` | **v2.1.0+.** Group/role header value that grants admin privileges |
+| `userGroups` | **v2.1.0+.** If set, only users whose group/role header value is in this list may log in |
+| `groupsClaim` | **v2.1.0+.** HTTP header name for the user's group/role (required when `userGroups` or `adminGroup` is set) |
 | `userIdentifier` | Field to use as username when not using the raw header value in composite setups |
 | `disableVerifyTLS` | Disable TLS verification for any outbound calls (testing only) |
 | `logoutRedirectUrl` | Optional URL to redirect after logout |
@@ -49,14 +65,44 @@ auth:
 
 ## Sources for proxy users
 
-Proxy users are auto-created on first successful header auth and receive every {{< doclink path="configuration/sources#defaultenabled" text="defaultEnabled" />}} source on create. From **v2.0.1+**, missing default-enabled sources are also merged for existing users on every server startup. Proxy auth does not sync IdP groups into the GroupMap (unlike OIDC / LDAP / JWT). See {{< doclink path="configuration/authentication/" text="Authentication overview" />}}.
+Proxy users are auto-created on first successful header auth. Source access follows the callout at the top of this page. From **v2.1.0+**, proxy auth syncs group/role header values into the access-control GroupMap (write-through to the database), same as OIDC / LDAP / JWT.
 
 ## Example Use Cases
 
 - Corporate SSO via proxy
 - Kubernetes ingress authentication
 - Nginx auth_request module
 - Traefik ForwardAuth
+- Cosmos Cloud auth proxy with role headers
+
+<div class="pattern-card">
+
+## Cosmos Cloud Example (v2.1.0+)
+
+Cosmos Cloud sends a username header and a numeric role header (`0` = guest, `1` = user, `2` = admin):
+
+```yaml
+auth:
+  methods:
+    password:
+      enabled: false
+    proxy:
+      enabled: true
+      header: "X-Cosmos-User"
+      groupsClaim: "x-cosmos-role"
+      userGroups:
+        - "2"
+        - "1"
+      adminGroup: "2"
+```
+
+Expected behavior:
+
+- Role `0` (guest): login denied, user not created
+- Role `1` (user): regular user access
+- Role `2` (admin): regular access plus admin privileges
+
+</div>
 
 <div class="pattern-card">
 
@@ -143,4 +189,3 @@ auth:
 
 - {{< doclink path="configuration/authentication/oidc/" text="OIDC authentication" />}}
 - {{< doclink path="configuration/users/" text="Configure users" />}}
-

content/en/docs/configuration/server.md

@@ -195,6 +195,19 @@ server:
 
 During upgrade from v1.x, set `migrateFrom` to your renamed BoltDB file. Remove it after migration — see {{< doclink path="getting-started/v2/migration/" text="v2 migration guide" />}}.
 
+**Storage quotas (v2.1.0+)** (folder, per-user scope, and share caps) use additional SQLite tables added in v2.1.0. They are created automatically on upgrade; legacy Bolt imports do not carry over quota limits. See {{< doclink path="features/quotas/" text="Storage quotas (v2.1.0+)" />}}.
+
+Optional quota counter flush tuning (v2.1.0+):
+
+```yaml
+server:
+  database:
+    path: "data/filebrowser.sqlite"
+    quotas:
+      flushIntervalSeconds: 10   # batch write interval for tracked usage counters (default 10)
+      flushMaxBuffers: 500       # flush when this many dirty counters are queued (default 500)
+```
+
 </div>
 
 <div class="pattern-card">

content/en/docs/configuration/sources.md

@@ -3,18 +3,24 @@ title: "Sources"
 description: "Configure file system sources"
 icon: "folder_open"
 date: "2025-10-08T14:59:30Z"
-lastmod: "2026-07-24T01:02:28Z"
+lastmod: "2026-08-24T17:00:00Z"
 order: 3
 ---
 
 Sources are the core concept in FileBrowser - each source represents a file system location users can access.
 
+Indexing on each source provides folder sizes used by the UI and by **indexed-size storage quotas (v2.1.0+)**. Sources with indexing disabled only support **tracked usage** quotas (v2.1.0+). See {{< doclink path="features/quotas/" text="Storage quotas (v2.1.0+)" />}} and {{< doclink path="features/indexing/" text="Indexing" />}}.
+
 {{% alert context="info" %}}
 **v2.0.0 source config**
 
 Deprecated source options (`indexingIntervalMinutes`, `conditionals` wrapper, old rule field names) were removed in v2.0.0. See {{< doclink path="advanced/source-configuration/sources/" text="Advanced source configuration" />}} for current rule syntax.
 {{% /alert %}}
 
+{{% alert context="warning" %}}
+**Setting up authentication?** New users only receive sources with `defaultEnabled: true`. When enabling password signup, OIDC, LDAP, JWT, or proxy auth, configure `defaultEnabled` on your sources at the same time. See [defaultEnabled](#defaultenabled) below.
+{{% /alert %}}
+
 {{% alert context="warning" %}}
 A source should not be a root directory or include "/var" directory on linux.
 {{% /alert %}}
@@ -112,6 +118,24 @@ When `true`, this source is granted to **all** users:
 
 Default: `false`. Use `false` for sources that should only be assigned manually.
 
+```yaml
+server:
+  sources:
+    - path: "/data/shared"
+      name: "Shared"
+      config:
+        defaultEnabled: true
+    - path: "/data/restricted"
+      name: "Restricted"
+      # defaultEnabled: false — assign via admin UI
+
+auth:
+  methods:
+    oidc:
+      enabled: true
+      # clientId, clientSecret, issuerUrl, ...
+```
+
 ```yaml
 server:
   sources:
@@ -246,6 +270,7 @@ server:
 
 ## Next Steps
 
+- {{< doclink path="features/quotas/" text="Storage quotas (v2.1.0+)" />}}
 - {{< doclink path="advanced/source-configuration/sources/" text="Advanced Source Configuration" />}}
 - {{< doclink path="configuration/authentication/" text="Configure authentication" />}}
 - {{< doclink path="configuration/users/" text="Manage users" />}}