$ show AlistGo/alist
AList is a self-hosted file listing and sharing gateway written in Go. In production it aggregates over 100 distinct storage backends — local disk, Aliyun Drive, OneDrive, Google Drive, S3, Baidu, PikPak, Thunder, WebDAV mounts, FTP/SFTP servers, and more — behind a unified virtual file tree, then exposes that tree simultaneously through a web UI + REST API, WebDAV, an S3-compatible object storage endpoint, FTP, SFTP, and an MCP (Model Context Protocol) tool server. It is a monolithic Go application (Gin + GORM) deployed as a single binary or Docker container, with a rich feature surface: role/permission-based multi-user access with path-scoped grants, password-protected time-limited shares with burn-after-read and download tracking, pluggable search backends (Meilisearch, Bleve, database full-text, no-index), offline downloads via aria2/qBittorrent/Transmission plus cloud-native tools, archive extraction (zip/7z/rar/iso9660), device session limits, rate limiting, SSO/LDAP/WebAuthn auth, and an FRP reverse-proxy client for NAT traversal.
The LLM identified 6 files worth highlighting for reuse:
SecureJoin provides safe path resolution for archive extraction, preventing zip-slip and traversal attacks when extracting zip/7z/rar/iso9660 archives. It is isolated, stdlib-only, covered by its own test file, and directly portable to any project that extracts untrusted archives.
A complete aria2 JSON-RPC client supporting both HTTP and WebSocket transports, with notification handling, request/response serialization, and unit tests. It is a self-contained package that could be dropped into any Go project needing to drive an aria2 daemon for offline downloads.
An elegant bridge between Go's io.Reader/io.Writer interfaces and native channels, allowing streaming data between goroutines using channel semantics with copy/eof signaling. It demonstrates non-obvious concurrency craftsmanship and is fully generic — usable anywhere pipe-like data flow between goroutines is needed.
A self-contained WebDAV client library with basic and digest authentication, netrc support, range reads, directory listing, and a bundled CLI. It ships with its own tests, Makefile, and README, making it trivially extractable as a standalone Go module for any WebDAV integration.
A reusable qBittorrent WebUI API client used by the offline-download subsystem. It wraps the qBittorrent HTTP API (login, torrent addition, status polling) in a small self-contained package that could be extracted for any torrent-management integration.
A concurrent multi-range HTTP downloader with retry/backoff, global concurrency limiting, and buffered chunk pipeline. It solves the recurring problem of fast resumable downloads from arbitrary HTTP endpoints and is generic enough to extract into any Go project needing robust large-file fetching.