feat(accounts): add per-bucket public domain for public access

Restore public-domain configuration to the redesigned account editor so R2
(and S3-family) buckets can be served over a public URL instead of temporary
signed links. The redesigned AccountEditModal had dropped the editor and
hard-saved public_domain: null, wiping any configured domain on every save.

- AccountEditModal: per-bucket scheme + host editor with a live public-URL
  preview and Public/Private status; loads existing values and persists real
  values for every provider (R2 -> public_domain, S3 -> public_domain_host)
- accountStore.toStorageConfig: pass publicDomain for MinIO/RustFS (was dropped)
- minio/rustfs providers: prefer publicDomain in buildBucketBaseUrl (match R2/AWS)
- FilePreviewModal: build public URLs via buildPublicUrl so object keys are
  encoded (fixes broken links for keys with spaces/unicode)
- Inspector: wire the Copy URL button to the public link with a signed-URL
  fallback, and reflect real public/private visibility
- Import/export already round-trips both field shapes (verified)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: dickwu

src/app/components/AccountEditModal.tsx

@@ -17,7 +17,7 @@ import {
 } from '@ant-design/icons';
 import { openUrl } from '@tauri-apps/plugin-opener';
 import dynamic from 'next/dynamic';
-import { generateSignedUrl, uploadContent, StorageConfig } from '@/app/lib/r2cache';
+import { buildPublicUrl, generateSignedUrl, uploadContent, StorageConfig } from '@/app/lib/r2cache';
 import { TEXT_EXTENSIONS } from '@/app/components/preview/TextViewer';
 import { useVideoThumbnail } from '@/app/hooks/useVideoThumbnail';
 import { usePreviewStore } from '@/app/stores/previewStore';
@@ -178,9 +178,9 @@ export default function FilePreviewModal({ config, onFileUpdated }: FilePreviewM
     }
 
     if (config?.publicDomain) {
-      const domain = config.publicDomain.replace(/\/$/, '');
-      const scheme = config.publicDomainScheme || 'https';
-      setSignedUrl(`${scheme}://${domain}/${file.key}`);
+      // Reuse the provider's URL builder so the object key is encoded
+      // consistently (spaces, unicode, reserved characters).
+      setSignedUrl(buildPublicUrl(config, file.key));
       return;
     }
 

src/app/components/FilePreviewModal.tsx

@@ -11,14 +11,17 @@ import {
   FileZipOutlined,
   FileOutlined,
 } from '@ant-design/icons';
+import { App } from 'antd';
 import { FileItem } from '@/app/hooks/useR2Files';
+import { buildPublicUrl, generateSignedUrl, type StorageConfig } from '@/app/lib/r2cache';
 import { formatBytes } from '@/app/utils/formatBytes';
 import dayjs from 'dayjs';
 
 interface InspectorProps {
   item: FileItem;
   bucket: string;
   path: string;
+  storageConfig?: StorageConfig | null;
   onClose: () => void;
   onDownload?: (item: FileItem) => void;
 }
@@ -123,12 +126,44 @@ function KV({ label, value }: { label: string; value: React.ReactNode }) {
   );
 }
 
-export default function Inspector({ item, bucket, path, onClose, onDownload }: InspectorProps) {
+export default function Inspector({
+  item,
+  bucket,
+  path,
+  storageConfig,
+  onClose,
+  onDownload,
+}: InspectorProps) {
+  const { message } = App.useApp();
   const type = itemType(item);
 
   const sizeLabel = item.isFolder ? '—' : formatBytes(item.size || 0);
   const modLabel = item.lastModified ? dayjs(item.lastModified).format('YYYY-MM-DD HH:mm') : '—';
 
+  const isPublic = !!storageConfig?.publicDomain;
+  // Only treat as a public link when a public domain is configured. Without one,
+  // buildPublicUrl would return the S3 API endpoint (e.g. *.r2.cloudflarestorage.com),
+  // which requires signing — so we fall back to a temporary signed URL instead.
+  const publicUrl =
+    !item.isFolder && isPublic && storageConfig ? buildPublicUrl(storageConfig, item.key) : null;
+
+  async function handleCopyUrl() {
+    if (item.isFolder || !storageConfig) return;
+    try {
+      const url = publicUrl ?? (await generateSignedUrl(storageConfig, item.key));
+      if (!url) {
+        message.warning('No public domain or credentials available for this bucket');
+        return;
+      }
+      await navigator.clipboard.writeText(url);
+      message.success(
+        publicUrl ? 'Public URL copied to clipboard' : 'Signed URL copied to clipboard'
+      );
+    } catch {
+      message.error('Failed to copy URL');
+    }
+  }
+
   return (
     <div className="inspector">
       <div className="inspector-header">
@@ -162,9 +197,15 @@ export default function Inspector({ item, bucket, path, onClose, onDownload }: I
               <DownloadOutlined style={{ fontSize: 12 }} /> Download
             </button>
           )}
-          <button className="btn btn-sm">
-            <LinkOutlined style={{ fontSize: 12 }} /> Copy URL
-          </button>
+          {!item.isFolder && (
+            <button
+              className="btn btn-sm"
+              onClick={handleCopyUrl}
+              title={isPublic ? 'Copy public URL' : 'Copy temporary signed URL'}
+            >
+              <LinkOutlined style={{ fontSize: 12 }} /> {isPublic ? 'Copy link' : 'Copy URL'}
+            </button>
+          )}
           <button className="btn btn-sm" style={{ padding: '0 8px' }}>
             <MoreOutlined style={{ fontSize: 12 }} />
           </button>
@@ -180,7 +221,16 @@ export default function Inspector({ item, bucket, path, onClose, onDownload }: I
             <KV label="ETag" value="—" />
             <KV label="Storage class" value="STANDARD" />
             <KV label="Encryption" value="AES-256" />
-            <KV label="Visibility" value="private" />
+            <KV
+              label="Visibility"
+              value={
+                isPublic ? (
+                  <span style={{ color: 'var(--accent)', fontWeight: 600 }}>public</span>
+                ) : (
+                  'private'
+                )
+              }
+            />
           </>
         )}
       </div>

src/app/components/Inspector.tsx

@@ -3819,6 +3819,152 @@ html.dark .download-task-list > div::-webkit-scrollbar-thumb:hover {
   color: var(--text-muted);
 }
 
+/* ── Bucket + public-access editor (AccountEditModal) ──────────── */
+.bkt-section-head {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 8px;
+  margin-bottom: 6px;
+}
+.bkt-section-count {
+  font-size: 11px;
+  font-weight: 600;
+  color: var(--text-subtle);
+  font-variant-numeric: tabular-nums;
+  white-space: nowrap;
+}
+.bkt-list {
+  display: flex;
+  flex-direction: column;
+  gap: 8px;
+}
+.bkt-card {
+  position: relative;
+  border: 1px solid var(--border);
+  border-radius: 9px;
+  background: var(--bg-panel);
+  overflow: hidden;
+  transition:
+    border-color 140ms ease,
+    box-shadow 140ms ease;
+}
+.bkt-card:focus-within {
+  border-color: var(--accent);
+  box-shadow: 0 0 0 3px var(--accent-soft);
+}
+.bkt-card.is-public {
+  border-color: var(--border-strong);
+}
+.bkt-card.is-public::before {
+  content: '';
+  position: absolute;
+  left: 0;
+  top: 0;
+  bottom: 0;
+  width: 2px;
+  background: var(--accent);
+}
+.bkt-head {
+  display: flex;
+  align-items: center;
+  gap: 9px;
+  padding: 9px 11px 7px;
+}
+.bkt-ico {
+  font-size: 13px;
+  color: var(--text-muted);
+  flex-shrink: 0;
+}
+.bkt-name {
+  flex: 1;
+  min-width: 0;
+  font-family: var(--font-mono);
+  font-size: 12px;
+  color: var(--text);
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+.bkt-pill {
+  font-size: 10px;
+  font-weight: 700;
+  letter-spacing: 0.05em;
+  text-transform: uppercase;
+  padding: 2px 7px;
+  border-radius: 999px;
+  flex-shrink: 0;
+}
+.bkt-pill.public {
+  color: var(--accent);
+  background: var(--accent-soft);
+}
+.bkt-pill.private {
+  color: var(--text-subtle);
+  background: var(--bg-sunken);
+}
+.bkt-domain {
+  display: flex;
+  align-items: center;
+  gap: 7px;
+  padding: 0 11px 9px;
+}
+.bkt-domain-ico {
+  font-size: 12px;
+  color: var(--text-subtle);
+  flex-shrink: 0;
+}
+.bkt-scheme {
+  width: auto;
+  min-width: 88px;
+  flex-shrink: 0;
+  height: 30px;
+  padding: 0 8px;
+  font-family: var(--font-mono);
+  font-size: 11.5px;
+}
+.bkt-host {
+  flex: 1;
+  min-width: 0;
+  height: 30px;
+  font-size: 11.5px;
+}
+.bkt-preview {
+  display: flex;
+  align-items: center;
+  gap: 7px;
+  padding: 7px 11px;
+  border-top: 1px solid var(--border);
+  background: var(--bg-sunken);
+  font-family: var(--font-mono);
+  font-size: 11px;
+  line-height: 1.3;
+  min-width: 0;
+}
+.bkt-preview-arrow {
+  color: var(--accent);
+  flex-shrink: 0;
+}
+.bkt-preview-url {
+  color: var(--text-muted);
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+  min-width: 0;
+}
+.bkt-preview-obj {
+  color: var(--text-subtle);
+}
+.bkt-preview-hint {
+  color: var(--text-subtle);
+  font-family: var(--font-sans);
+  font-size: 11px;
+}
+.bkt-load-btn {
+  align-self: flex-start;
+  margin-top: 2px;
+}
+
 /* Account list items inside SettingsAccountPanel */
 .acct-list-item {
   display: flex;

src/app/globals.css

@@ -1175,6 +1175,7 @@ export default function Home() {
                   item={focusedItem}
                   bucket={currentConfig?.bucket ?? ''}
                   path={currentPath}
+                  storageConfig={config}
                   onClose={() => setShowInspector(false)}
                   onDownload={handleDownload}
                 />

src/app/page.tsx

@@ -143,6 +143,10 @@ export const minioProvider: StorageProviderAdapter<MinioStorageConfig> = {
   },
 
   buildBucketBaseUrl: (config) => {
+    if (config.publicDomain) {
+      const scheme = config.publicDomainScheme || 'https';
+      return `${scheme}://${config.publicDomain.replace(/\/+$/, '')}`;
+    }
     if (!config.bucket || !config.endpointHost) return null;
     const scheme = config.endpointScheme || 'https';
     const host = config.endpointHost;

src/app/providers/minio/index.ts

@@ -143,6 +143,10 @@ export const rustfsProvider: StorageProviderAdapter<RustfsStorageConfig> = {
   },
 
   buildBucketBaseUrl: (config) => {
+    if (config.publicDomain) {
+      const scheme = config.publicDomainScheme || 'https';
+      return `${scheme}://${config.publicDomain.replace(/\/+$/, '')}`;
+    }
     if (!config.bucket || !config.endpointHost) return null;
     const scheme = config.endpointScheme || 'https';
     const host = config.endpointHost;

src/app/providers/rustfs/index.ts

@@ -759,6 +759,8 @@ export const useAccountStore = create<AccountStore>((set, get) => ({
         endpointHost: currentConfig.endpoint_host,
         forcePathStyle: currentConfig.force_path_style ?? false,
         bucket: currentConfig.bucket,
+        publicDomain: currentConfig.public_domain || undefined,
+        publicDomainScheme: currentConfig.public_domain_scheme || undefined,
       };
     }
 
@@ -775,6 +777,8 @@ export const useAccountStore = create<AccountStore>((set, get) => ({
         endpointHost: currentConfig.endpoint_host,
         forcePathStyle: true,
         bucket: currentConfig.bucket,
+        publicDomain: currentConfig.public_domain || undefined,
+        publicDomainScheme: currentConfig.public_domain_scheme || undefined,
       };
     }