Hi guys
Lately I did much work. First of all, security audit fixes.

I bound internal ports to localhost; moved JWT secret to a real random value in .env; hardened rate limiting (to avoid spoofing); set file uploading limit to 40MB and switched uploads/downloads to streaming so files aren’t loaded whole into RAM.

Sharing rework (the main piece). Before, each user had one master DEK that encrypted all their files, and sharing sent that master DEK to the server in cleartext, so the server could decrypt shared files, and sharing one file handed over the key to every file. Now the master DEK only wraps other keys. Each file has its own random DEK (encrypting its content and name), stored wrapped by the master DEK.
Each user has an RSA keypair: the public key is stored in cleartext, the private key is wrapped by the master DEK (so password reset and recovery keep working without extra code). To share, the sender fetches the recipient’s public key and RSA-encrypts only that file’s DEK; the recipient decrypts it with their private key. The server never sees a key in cleartext, and the recipient gets access to only that one file. Public links work the same way, carrying the DEK for each file in the URL fragment (never sent to the server), with a revoke action.

To clean the code I also made an interfaces refactor. Moved all TypeScript interfaces into core/interfaces/, one per file (I), updated imports, removed the old model files.

I’m quite done, I still have to review some graphical aspects and improve some things in the code, but I think I’ll be done this week.