Update server.js

server.js

@@ -1,7 +1,7 @@
 // ==========================================
-// PIXELDRIVE v4.8 - SERVER.JS (ESM)
-// + password change, account delete, activity log, stats,
-//   share TTL, view/download counters
+// PIXELDRIVE v4.9 - SERVER.JS (ESM)
+// + notifications, aperçu docs, éditeur texte, stats avancées,
+//   propriétés (SHA-256), animations (front)
 // ==========================================
 import express from 'express';
 import session from 'express-session';
@@ -39,7 +39,8 @@ const IS_PROD = process.env.NODE_ENV === 'production';
 const USER_QUOTA = parseInt(process.env.USER_QUOTA_GB || '50', 10) * 1024 * 1024 * 1024;
 const DAILY_TRANSFER = parseInt(process.env.DAILY_TRANSFER_GB || '100', 10) * 1024 * 1024 * 1024;
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-const TTL_ALLOWED = [1, 24, 168, 720]; // ✅ 1h / 24h / 7j / 30j
+const TTL_ALLOWED = [1, 24, 168, 720];
+const EDITABLE_RE = /\.(txt|md|markdown|json|js|mjs|css|html|htm|xml|yml|yaml|py|sh|c|cpp|h|java|ts|tsx|jsx|sql|log|ini|conf|csv)$/i;
 
 function log(level, msg) {
     const n = new Date();
@@ -90,7 +91,7 @@ async function pngToBuffer(pngBuffer, expectedLen) {
 }
 
 // ==========================================
-// SCHÉMA (+ activity, + compteurs views/downloads)
+// SCHÉMA (+ notifications)
 // ==========================================
 db.exec(`
 CREATE TABLE IF NOT EXISTS users (id INTEGER PRIMARY KEY AUTOINCREMENT, username TEXT UNIQUE NOT NULL, password_hash BLOB NOT NULL, salt BLOB NOT NULL, is_admin INTEGER DEFAULT 0, tos_accepted INTEGER DEFAULT 0, avatar BLOB, created_at INTEGER DEFAULT (strftime('%s','now')));
@@ -101,12 +102,14 @@ CREATE TABLE IF NOT EXISTS share_links (token TEXT PRIMARY KEY, file_id TEXT NOT
 CREATE TABLE IF NOT EXISTS user_shares (id INTEGER PRIMARY KEY AUTOINCREMENT, file_id TEXT REFERENCES files(id) ON DELETE CASCADE, folder_id INTEGER REFERENCES folders(id) ON DELETE CASCADE, owner_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE, shared_with INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE, created_at INTEGER DEFAULT (strftime('%s','now')));
 CREATE TABLE IF NOT EXISTS transfer_daily (id INTEGER PRIMARY KEY AUTOINCREMENT, user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE, day TEXT NOT NULL, up_bytes INTEGER DEFAULT 0, down_bytes INTEGER DEFAULT 0, UNIQUE(user_id, day));
 CREATE TABLE IF NOT EXISTS activity (id INTEGER PRIMARY KEY AUTOINCREMENT, user_id INTEGER, action TEXT NOT NULL, detail TEXT, created_at INTEGER DEFAULT (strftime('%s','now')));
+CREATE TABLE IF NOT EXISTS notifications (id INTEGER PRIMARY KEY AUTOINCREMENT, user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE, type TEXT NOT NULL, detail TEXT, read INTEGER DEFAULT 0, created_at INTEGER DEFAULT (strftime('%s','now')));
 CREATE INDEX IF NOT EXISTS idx_files_owner ON files(owner_id);
 CREATE INDEX IF NOT EXISTS idx_chunks_file ON file_chunks(file_id);
 CREATE INDEX IF NOT EXISTS idx_share_owner ON share_links(owner_id);
 CREATE INDEX IF NOT EXISTS idx_ushares_with ON user_shares(shared_with);
 CREATE INDEX IF NOT EXISTS idx_transfer_day ON transfer_daily(user_id, day);
 CREATE INDEX IF NOT EXISTS idx_activity_user ON activity(user_id, created_at);
+CREATE INDEX IF NOT EXISTS idx_notif_user ON notifications(user_id, read, created_at);
 `);
 
 function runMigrations() {
@@ -134,7 +137,6 @@ function runMigrations() {
         }
     }
     if (updatedAdded) db.exec(`UPDATE files SET updated_at = strftime('%s','now') WHERE updated_at = 0;`);
-    // ✅ Compteurs de vues/téléchargements sur share_links
     const slCols = db.prepare("PRAGMA table_info(share_links)").all().map(c => c.name);
     if (!slCols.includes('views')) db.exec(`ALTER TABLE share_links ADD COLUMN views INTEGER DEFAULT 0;`);
     if (!slCols.includes('downloads')) db.exec(`ALTER TABLE share_links ADD COLUMN downloads INTEGER DEFAULT 0;`);
@@ -144,6 +146,7 @@ function runMigrations() {
     if (!tables.includes('user_shares')) db.exec(`CREATE TABLE user_shares (id INTEGER PRIMARY KEY AUTOINCREMENT, file_id TEXT REFERENCES files(id) ON DELETE CASCADE, folder_id INTEGER REFERENCES folders(id) ON DELETE CASCADE, owner_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE, shared_with INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE, created_at INTEGER DEFAULT (strftime('%s','now'))); CREATE INDEX idx_ushares_with ON user_shares(shared_with);`);
     if (!tables.includes('transfer_daily')) db.exec(`CREATE TABLE transfer_daily (id INTEGER PRIMARY KEY AUTOINCREMENT, user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE, day TEXT NOT NULL, up_bytes INTEGER DEFAULT 0, down_bytes INTEGER DEFAULT 0, UNIQUE(user_id, day)); CREATE INDEX idx_transfer_day ON transfer_daily(user_id, day);`);
     if (!tables.includes('activity')) db.exec(`CREATE TABLE activity (id INTEGER PRIMARY KEY AUTOINCREMENT, user_id INTEGER, action TEXT NOT NULL, detail TEXT, created_at INTEGER DEFAULT (strftime('%s','now'))); CREATE INDEX idx_activity_user ON activity(user_id, created_at);`);
+    if (!tables.includes('notifications')) db.exec(`CREATE TABLE notifications (id INTEGER PRIMARY KEY AUTOINCREMENT, user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE, type TEXT NOT NULL, detail TEXT, read INTEGER DEFAULT 0, created_at INTEGER DEFAULT (strftime('%s','now'))); CREATE INDEX idx_notif_user ON notifications(user_id, read, created_at);`);
     const sessionsCols = tables.includes('sessions') ? db.prepare("PRAGMA table_info(sessions)").all().map(c => c.name) : [];
     if (tables.includes('sessions') && (!sessionsCols.includes('data') || !sessionsCols.includes('expires_at'))) {
         log('WARN', 'Table sessions invalide → reconstruction');
@@ -178,12 +181,16 @@ function addTransfer(userId, bytes, dir) {
 }
 function transferBlocked(userId) { return getTransfer(userId).total >= DAILY_TRANSFER; }
 
-// ✅ JOURNAL D'ACTIVITÉ
 function logActivity(userId, action, detail) {
     try { db.prepare('INSERT INTO activity(user_id, action, detail) VALUES(?,?,?)').run(userId, action, String(detail || '').slice(0, 200)); } catch (e) {}
 }
 
-// --- NETTOYAGE + BACKUPS ---
+// ✅ NOTIFICATIONS
+function notify(userId, type, detail) {
+    try { db.prepare('INSERT INTO notifications(user_id, type, detail) VALUES(?,?,?)').run(userId, type, String(detail || '').slice(0, 200)); } catch (e) {}
+}
+
+// --- NETTOYAGE + BACKUPS + NOTIF EXPIRATION ---
 function cleanTemp() {
     try {
         const now = Date.now();
@@ -211,6 +218,17 @@ function cleanHourly() {
         const l = db.prepare('DELETE FROM share_links WHERE expires_at IS NOT NULL AND expires_at < ?').run(now);
         const a = db.prepare('DELETE FROM activity WHERE created_at < ?').run(Math.floor(now / 1000) - 30 * 86400);
         db.prepare('DELETE FROM activity WHERE id NOT IN (SELECT id FROM activity ORDER BY id DESC LIMIT 2000)').run();
+        db.prepare('DELETE FROM notifications WHERE created_at < ?').run(Math.floor(now / 1000) - 30 * 86400);
+        // ✅ Notifie les liens qui expirent sous 24h
+        const soon = now + 24 * 3600000;
+        const expiring = db.prepare('SELECT token, file_id, owner_id FROM share_links WHERE type=? AND expires_at > ? AND expires_at < ?').all('embed', now, soon);
+        for (const lk of expiring) {
+            const dup = db.prepare('SELECT 1 FROM notifications WHERE user_id=? AND type=? AND detail=?').get(lk.owner_id, 'expiring', lk.token);
+            if (!dup) {
+                const f = db.prepare('SELECT name FROM files WHERE id=?').get(lk.file_id);
+                notify(lk.owner_id, 'expiring', (f?.name || '?') + ' (' + lk.token.slice(0, 8) + '…)');
+            }
+        }
         const cutoff = Math.floor(now / 1000) - 7 * 86400;
         const olds = db.prepare("SELECT id FROM files WHERE status='error' AND updated_at < ?").all(cutoff);
         for (const f of olds) { db.prepare('DELETE FROM files WHERE id=?').run(f.id); try { unlinkSync(join(THUMB_DIR, `${f.id}.jpg`)); } catch (_) {} }
@@ -338,6 +356,29 @@ function canAccessFile(userId, fileId){
     if (f.folder_id && canAccessFolder(userId, f.folder_id)) return f;
     return null;
 }
+function isEditable(f) {
+    return (f.mime && (f.mime.startsWith('text/') || ['application/json','application/javascript','application/xml'].includes(f.mime))) || EDITABLE_RE.test(f.name || '');
+}
+function isMarkdown(f) { return /\.(md|markdown)$/i.test(f.name || ''); }
+
+// ✅ Déchiffre tout le fichier en mémoire (aperçu texte / édition)
+async function decryptWholeFile(f) {
+    const k = await getMasterKey(f.id);
+    const chunks = db.prepare('SELECT chunk_index,imgbb_url,size FROM file_chunks WHERE file_id=? ORDER BY chunk_index').all(f.id);
+    const bufs = [];
+    for (const c of chunks) {
+        const ck = `chunk:${f.id}:${c.chunk_index}`;
+        let dec = fileCache.get(ck)?.data;
+        if (!dec) {
+            const {data} = await axios.get(c.imgbb_url,{responseType:'arraybuffer',timeout:60000});
+            const enc = await pngToBuffer(Buffer.from(data), c.size + OVERHEAD);
+            dec = decryptChunk(enc, k);
+            fileCache.set(ck,{data:dec,size:dec.length});
+        }
+        bufs.push(dec);
+    }
+    return Buffer.concat(bufs, f.size);
+}
 
 async function genThumb(fid,mime,key){
     if(!mime.startsWith('image/')&&!mime.startsWith('video/')) return;
@@ -442,7 +483,15 @@ app.get('/api/me',(req,res)=>{
 });
 app.post('/api/tos/accept',requireAuth,(req,res)=>{db.prepare('UPDATE users SET tos_accepted=1 WHERE id=?').run(req.session.userId);req.session.tosAccepted=true;res.json({ok:true});});
 
-// ✅ CHANGER SON MOT DE PASSE
+// ✅ NOTIFICATIONS
+app.get('/api/notifications', requireAuth, (req,res) => {
+    res.json(db.prepare('SELECT id, type, detail, read, created_at FROM notifications WHERE user_id=? ORDER BY created_at DESC LIMIT 50').all(req.session.userId));
+});
+app.post('/api/notifications/read', requireAuth, (req,res) => {
+    db.prepare('UPDATE notifications SET read=1 WHERE user_id=?').run(req.session.userId);
+    res.json({ok:true});
+});
+
 app.post('/api/password', requireAuth, async(req,res)=>{
     const { current, next } = req.body;
     if (typeof current !== 'string' || typeof next !== 'string') return res.status(400).json({error:'Champs manquants'});
@@ -458,7 +507,6 @@ app.post('/api/password', requireAuth, async(req,res)=>{
     res.json({ok:true});
 });
 
-// ✅ SUPPRIMER SON COMPTE (self-service)
 app.delete('/api/account', requireAuth, async(req,res)=>{
     const { password } = req.body;
     const usr = db.prepare('SELECT * FROM users WHERE id=?').get(req.session.userId);
@@ -472,13 +520,25 @@ app.delete('/api/account', requireAuth, async(req,res)=>{
     req.session.destroy(() => res.json({ok:true}));
 });
 
-// ✅ STATS PERSO (donut par type)
 app.get('/api/stats', requireAuth, (req,res) => {
     res.json(db.prepare(`SELECT CASE WHEN mime LIKE 'image/%' THEN 'image' WHEN mime LIKE 'video/%' THEN 'video' WHEN mime LIKE 'audio/%' THEN 'audio' ELSE 'autre' END as cat, COUNT(*) c, COALESCE(SUM(size),0) s
         FROM files WHERE owner_id=? AND status!='error' GROUP BY cat`).all(req.session.userId));
 });
 
-// ✅ ACTIVITÉ PERSO
+// ✅ STATS AVANCÉES (7 jours + top fichiers)
+app.get('/api/stats/advanced', requireAuth, (req,res) => {
+    const days = [];
+    for (let i = 6; i >= 0; i--) {
+        const d = new Date(Date.now() - i*86400000).toISOString().slice(0,10);
+        const r = db.prepare('SELECT COALESCE(SUM(up_bytes),0) u, COALESCE(SUM(down_bytes),0) d FROM transfer_daily WHERE user_id=? AND day=?').get(req.session.userId, d);
+        const acts = db.prepare("SELECT COUNT(*) c FROM activity WHERE user_id=? AND strftime('%Y-%m-%d', created_at, 'unixepoch')=?").get(req.session.userId, d).c;
+        days.push({ day: d.slice(5), up: r.u, down: r.d, acts });
+    }
+    const top = db.prepare(`SELECT f.name, (SELECT COALESCE(SUM(downloads),0) FROM share_links sl WHERE sl.file_id=f.id) dl
+        FROM files f WHERE f.owner_id=? AND f.status='ready' ORDER BY dl DESC LIMIT 5`).all(req.session.userId);
+    res.json({ days, top });
+});
+
 app.get('/api/activity', requireAuth, (req,res) => {
     res.json(db.prepare('SELECT action, detail, created_at FROM activity WHERE user_id=? ORDER BY created_at DESC LIMIT 100').all(req.session.userId));
 });
@@ -620,10 +680,11 @@ app.post('/api/share-user',requireAuth,requireTos,shareLimit,(req,res)=>{
     if (!target) return res.status(404).json({error:'Utilisateur introuvable'});
     if (target.id === req.session.userId) return res.status(400).json({error:'Impossible de partager avec vous-même'});
     const col = type === 'file' ? 'file_id' : 'folder_id';
-    const own = db.prepare(`SELECT id FROM ${type === 'file' ? 'files' : 'folders'} WHERE id=? AND owner_id=?`).get(id, req.session.userId);
+    const own = db.prepare(`SELECT id, name FROM ${type === 'file' ? 'files' : 'folders'} WHERE id=? AND owner_id=?`).get(id, req.session.userId);
     if (!own) return res.status(404).json({error:'Introuvable'});
     if (db.prepare(`SELECT 1 FROM user_shares WHERE ${col}=? AND shared_with=?`).get(id, target.id)) return res.status(409).json({error:'Déjà partagé'});
     db.prepare(`INSERT INTO user_shares(${col},owner_id,shared_with) VALUES(?,?,?)`).run(id, req.session.userId, target.id);
+    notify(target.id, 'share', `${req.session.username} → ${own.name}`);
     log('INFO', `Partage ${type} ${id} → ${username.trim()}`);
     logActivity(req.session.userId,'share_user',`${type} → ${username.trim()}`);
     res.json({ok:true});
@@ -738,7 +799,70 @@ app.get('/api/files/:id/download',requireAuth,async(req,res)=>{
     await streamFile(res,f,k,req.headers.range,req.session.userId);
 });
 
-// ✅ PARTAGE AVEC TTL AU CHOIX (1h / 24h / 7j / 30j)
+// ✅ APERÇU TEXTE / MARKDOWN / CODE (contenu déchiffré, 2 MB max)
+app.get('/api/files/:id/raw', requireAuth, async(req,res)=>{
+    if(!UUID_RE.test(req.params.id)) return res.status(400).json({error:'ID invalide'});
+    const f = canAccessFile(req.session.userId, req.params.id);
+    if(!f) return res.status(404).json({error:'Introuvable'});
+    if(f.status!=='ready') return res.status(409).json({error:'Pas prêt'});
+    if (f.size > 2*1024*1024) return res.status(413).json({error:'Fichier trop lourd pour l\'aperçu (2 MB max)'});
+    try {
+        const all = await decryptWholeFile(f);
+        res.set({'Content-Type': (f.mime && f.mime.startsWith('text/')) ? f.mime : 'text/plain; charset=utf-8'});
+        res.send(all);
+    } catch (e) { log('ERROR', `Raw ${f.id}: ${e.message}`); res.status(500).json({error:'Erreur de déchiffrement'}); }
+});
+
+// ✅ ÉDITEUR TEXTE (remplace le contenu, re-chiffre, re-upload)
+app.post('/api/files/:id/edit', requireAuth, requireTos, async(req,res)=>{
+    if(!UUID_RE.test(req.params.id)) return res.status(400).json({error:'ID invalide'});
+    const { content } = req.body;
+    if (typeof content !== 'string') return res.status(400).json({error:'Contenu manquant'});
+    const f = db.prepare('SELECT * FROM files WHERE id=? AND owner_id=?').get(req.params.id, req.session.userId);
+    if(!f) return res.status(404).json({error:'Introuvable'});
+    if (!isEditable(f)) return res.status(400).json({error:'Type de fichier non éditable'});
+    const buf = Buffer.from(content, 'utf8');
+    if (buf.length > CHUNK_SIZE) return res.status(413).json({error:'Contenu trop lourd (30 MB max)'});
+    try {
+        const mk = decryptMasterKey(f.master_key_enc);
+        const enc = encryptChunk(buf, mk);
+        const png = await bufferToPng(enc);
+        const {url, deleteUrl, id: imgId} = await imgbbUpload(png);
+        const olds = db.prepare('SELECT imgbb_delete_url FROM file_chunks WHERE file_id=?').all(f.id);
+        db.prepare('DELETE FROM file_chunks WHERE file_id=?').run(f.id);
+        db.prepare('INSERT INTO file_chunks(file_id,chunk_index,size,encrypted_len) VALUES(?,?,?,?)').run(f.id,0,buf.length,enc.length);
+        db.prepare('UPDATE files SET size=?, chunk_count=1, status=? WHERE id=?').run(buf.length,'ready',f.id);
+        fileCache.delete(`chunk:${f.id}:0`);
+        for (const o of olds) if (o.imgbb_delete_url) await imgbbDelete(o.imgbb_delete_url);
+        logActivity(req.session.userId,'edit',f.name);
+        log('INFO', `Fichier édité: ${f.name} (${buf.length} o)`);
+        res.json({ok:true, size: buf.length});
+    } catch (e) { log('ERROR', `Edit ${f.id}: ${e.message}`); res.status(500).json({error:'Erreur d\'enregistrement'}); }
+});
+
+// ✅ PROPRIÉTÉS (SHA-256 du chiffré + hash de clé)
+app.get('/api/files/:id/properties', requireAuth, async(req,res)=>{
+    if(!UUID_RE.test(req.params.id)) return res.status(400).json({error:'ID invalide'});
+    const f = canAccessFile(req.session.userId, req.params.id);
+    if(!f) return res.status(404).json({error:'Introuvable'});
+    const chunks = db.prepare('SELECT imgbb_url, size FROM file_chunks WHERE file_id=? ORDER BY chunk_index').all(f.id);
+    const hash = createHash('sha256');
+    for (const c of chunks) {
+        try {
+            const { data } = await axios.get(c.imgbb_url, { responseType:'arraybuffer', timeout:30000 });
+            hash.update(Buffer.from(data));
+        } catch (e) {
+            log('ERROR', `Properties hash failed for ${f.id}: ${e.message}`);
+            return res.status(500).json({error:'Erreur de calcul'});
+        }
+    }
+    res.json({
+        id: f.id, name: f.name, size: f.size, mime: f.mime, status: f.status,
+        created_at: f.created_at, updated_at: f.updated_at, chunk_count: f.chunk_count,
+        encryption_key_hash: f.encryption_key_hash, sha256: hash.digest('hex'), owner_id: f.owner_id
+    });
+});
+
 app.post('/api/files/:id/share',requireAuth,shareLimit,async(req,res)=>{
     const f=db.prepare('SELECT * FROM files WHERE id=? AND owner_id=?').get(req.params.id,req.session.userId);
     if(!f||f.status!=='ready') return res.status(404).json({error:'Fichier non disponible'});
@@ -751,7 +875,6 @@ app.post('/api/files/:id/share',requireAuth,shareLimit,async(req,res)=>{
     res.json({preview:`/s/${pt}`,download:`/d/${dt2}`,expires,ttl});
 });
 
-// ✅ /s/ : embed + compteur de vues + activité
 app.get('/s/:token',async(req,res)=>{
     const tpl = embedTpl();
     const serve = (status, data, og) => {
@@ -774,7 +897,6 @@ app.get('/s/:token',async(req,res)=>{
     serve(200, { name: f.name, size: f.size, mime: f.mime, dl: '/d/' + dt }, og);
 });
 
-// ✅ /d/ : compteur de téléchargements + activité
 app.get('/d/:token',async(req,res)=>{
     const l=db.prepare('SELECT * FROM share_links WHERE token=? AND type=? AND (expires_at IS NULL OR expires_at>?)').get(req.params.token,'download',Date.now());
     if(!l)return res.status(404).json({error:'Invalide'});
@@ -838,5 +960,5 @@ app.use((err, req, res, next) => {
     res.status(500).json({ error: 'Internal Server Error' });
 });
 
-const server = app.listen(PORT, '0.0.0.0', () => log('INFO', `PixelDrive v4.8 démarré | stockage ${(USER_QUOTA/1073741824).toFixed(0)} GB | transit ${(DAILY_TRANSFER/1073741824).toFixed(0)} GB/j`));
+const server = app.listen(PORT, '0.0.0.0', () => log('INFO', `PixelDrive v4.9 démarré | stockage ${(USER_QUOTA/1073741824).toFixed(0)} GB | transit ${(DAILY_TRANSFER/1073741824).toFixed(0)} GB/j`));
 process.on('SIGTERM', () => { log('WARN', 'SIGTERM reçu, arrêt...'); server.close(() => process.exit(0)); });