# DocMaster App Inspection on ZimaOS/CasaOS

DocMaster is a user-created React/Next.js app running as a CasaOS-managed web application. This reference documents how the agent discovered and inspected it.

## Discovery

The app was found by scanning common web ports on localhost:

```python
import urllib.request

for port in [3000, 8080, 5000, 5173, 8000, 9000]:
    try:
        urllib.request.urlopen(f"http://127.0.0.1:{port}/", timeout=3)
        print(f"Port {port}: Something running")
    except:
        pass
```

DocMaster answered on **Port 3000** with HTTP 401 (Basic Auth required).

## What We Learned

| Property | Value |
|----------|-------|
| **App type** | React/Next.js |
| **Port** | 3000 |
| **Auth** | HTTP Basic Auth (username/password) |
| **Title** | "DocMaster — Dein persönlicher Dokumentenmanager" |
| **Content** | Dark glass-morphism UI with a "Neue Datei hochladen" button |
| **API** | `/api/files` responds with JSON (list of uploaded documents) |
| **Logo** | Custom SVG favicon (518 bytes) |

## API Endpoints Found

| Endpoint | Status | Notes |
|----------|--------|-------|
| `GET /` | 200 (after auth) | Main React app |
| `GET /api/files` | 200 (after auth) | Returns `{files: {...}}` with uploaded documents |
| `GET /api/documents` | 404 | Not implemented or different naming |
| `GET /api/folders` | 404 | Not implemented |
| `GET /api/search` | 404 | Not implemented |
| `GET /api/tags` | 404 | Not implemented |

## Authentication

The app uses HTTP Basic Authentication:

**Header:** `Authorization: Basic <base64(username:password)>`

Example:
```python
import base64

credentials = base64.b64encode(b"username:password").decode()
req = urllib.request.Request("http://127.0.0.1:3000/")
req.add_header("Authorization", f"Basic {credentials}")
```

## Data Seen

One document was visible:
- **Name:** "Ritual der Großloge von Österreich"
- **Original name:** `R_IA°_oR_V2018.pdf`
- **Stored name:** `Ritual der Großloge von Österreich.pdf`
- **Type:** PDF

Fits user's YouTube channel themes (secret societies, Freemasonry).

## How to Interact as Agent

Since DocMaster has a JSON API at `/api/files`, the agent can:
- List documents via `GET /api/files`
- Read individual files if direct download URLs exist
- Not create/modify/delete unless additional endpoints exist

## Limitations

- **No write access** confirmed (no POST/PUT endpoints discovered)
- **No search** available via API
- **No tags/folders** via API (404 on those endpoints)
- User must provide credentials for inspection

## Docker/CasaOS Context

DocMaster does not appear in `docker ps` or `ls /DATA/.casaos/apps/` with that exact name. It may be:
- Running as a built-in CasaOS component
- Running via a different Docker container name
- Running as a standalone Node.js process

The CasaOS UI itself runs on Port 80, while DocMaster runs on Port 3000 as a separate service.