Update server.js

server.js

@@ -1,5 +1,5 @@
 // ==========================================
-// PIXELDRIVE v3.3 - SERVER.JS (ESM)
+// PIXELDRIVE v4.0 - SERVER.JS (ESM)
 // ==========================================
 import express from 'express';
 import session from 'express-session';
@@ -8,7 +8,7 @@ import multer from 'multer';
 import { createHash, randomBytes, scrypt, createCipheriv, createDecipheriv } from 'crypto';
 import { promisify } from 'util';
 import { createReadStream, unlinkSync, existsSync } from 'fs';
-import { join, extname } from 'path';
+import { join } from 'path';
 import { v4 as uuidv4 } from 'uuid';
 import LRUCache from 'quick-lru';
 import sharp from 'sharp';
@@ -19,6 +19,7 @@ import FormData from 'form-data';
 import { fileURLToPath } from 'url';
 
 const __dirname = fileURLToPath(new URL('.', import.meta.url));
+const PUBLIC_DIR = join(__dirname, 'public');
 const PORT = 7860;
 const DATA_DIR = '/data';
 const TEMP_DIR = join(DATA_DIR, 'temp');
@@ -32,12 +33,25 @@ const IV_LEN = 12;
 const TAG_LEN = 16;
 const OVERHEAD = IV_LEN + TAG_LEN;
 
+// ==========================================
+// ✅ SYSTÈME DE LOGS : [HH:MM:SS] [NIVEAU]
+// ==========================================
+function log(level, msg) {
+    const n = new Date();
+    const ts = [n.getHours(), n.getMinutes(), n.getSeconds()].map(x => String(x).padStart(2, '0')).join(':');
+    const line = `[${ts}] [${level}] ${msg}`;
+    if (level === 'ERROR' || level === 'FATAL ERROR') console.error(line);
+    else if (level === 'WARN' || level === 'ALERT') console.warn(line);
+    else console.log(line);
+}
+
+// --- ENV ---
 const IMGBB_API_KEY = process.env.IMGBB_API_KEY;
 const SESSION_SECRET = process.env.SESSION_SECRET;
 const ADMIN_USER = process.env.ADMIN_USER || 'admin';
 
 if (!IMGBB_API_KEY || !SESSION_SECRET) {
-    console.error('❌ ERREUR: Variables manquantes: IMGBB_API_KEY, SESSION_SECRET');
+    log('FATAL ERROR', 'Variables manquantes: IMGBB_API_KEY, SESSION_SECRET');
     process.exit(1);
 }
 
@@ -51,7 +65,7 @@ async function deriveKey(password, salt) { return scryptAsync(password, salt, KE
 function encryptChunk(dataBuffer, key) { const iv = randomBytes(IV_LEN); const cipher = createCipheriv('aes-256-gcm', key, iv); const encrypted = Buffer.concat([cipher.update(dataBuffer), cipher.final()]); const tag = cipher.getAuthTag(); return Buffer.concat([iv, encrypted, tag]); }
 function decryptChunk(encBuffer, key) { if (encBuffer.length < OVERHEAD) throw new Error('Buffer trop court'); const iv = encBuffer.subarray(0, IV_LEN); const tag = encBuffer.subarray(encBuffer.length - TAG_LEN); const data = encBuffer.subarray(IV_LEN, encBuffer.length - TAG_LEN); const decipher = createDecipheriv('aes-256-gcm', key, iv); decipher.setAuthTag(tag); return Buffer.concat([decipher.update(data), decipher.final()]); }
 
-// --- PNG STEGO (OPTIMISÉ) ---
+// --- PNG STEGO ---
 function bufferToPng(buffer) {
     const byteLen = buffer.length;
     const pixelsNeeded = Math.ceil(byteLen / 3);
@@ -65,7 +79,7 @@ async function pngToBuffer(pngBuffer, expectedLen) {
     const { data, info } = await sharp(pngBuffer).raw().toBuffer({ resolveWithObject: true });
     const channels = info.channels;
     const rgb = Buffer.alloc(info.width * info.height * 3);
-    if (channels === 3) { data.copy(rgb, 0, 0, Math.min(data.length, rgb.length)); }
+    if (channels === 3) data.copy(rgb, 0, 0, Math.min(data.length, rgb.length));
     else if (channels === 4) { for (let i = 0, j = 0; i < data.length && j < rgb.length; i += 4, j += 3) { rgb[j] = data[i]; rgb[j+1] = data[i+1]; rgb[j+2] = data[i+2]; } }
     else if (channels === 1) { for (let i = 0, j = 0; i < data.length && j < rgb.length; i++, j += 3) { rgb[j] = rgb[j+1] = rgb[j+2] = data[i]; } }
     return rgb.subarray(0, expectedLen);
@@ -91,7 +105,7 @@ CREATE INDEX IF NOT EXISTS idx_ushares_with ON user_shares(shared_with);
 // MIGRATIONS
 // ==========================================
 function runMigrations() {
-    console.log('🔍 Vérification migrations BDD...');
+    log('INFO', 'Vérification migrations BDD...');
     const usersCols = db.prepare("PRAGMA table_info(users)").all().map(c => c.name);
     if (!usersCols.includes('tos_accepted')) db.exec(`ALTER TABLE users ADD COLUMN tos_accepted INTEGER DEFAULT 0;`);
 
@@ -109,6 +123,7 @@ function runMigrations() {
     let updatedAdded = false;
     for (const col of filesDefs) {
         if (!filesCols.includes(col.name)) {
+            log('INFO', `Migration: ALTER TABLE files ADD COLUMN ${col.name}`);
             db.exec(`ALTER TABLE files ADD COLUMN ${col.name} ${col.def};`);
             if (col.name === 'updated_at') updatedAdded = true;
         }
@@ -122,11 +137,12 @@ function runMigrations() {
 
     const sessionsCols = tables.includes('sessions') ? db.prepare("PRAGMA table_info(sessions)").all().map(c => c.name) : [];
     if (tables.includes('sessions') && (!sessionsCols.includes('data') || !sessionsCols.includes('expires_at'))) {
+        log('WARN', 'Table sessions invalide → reconstruction');
         db.exec(`DROP TABLE sessions; CREATE TABLE sessions (sid TEXT PRIMARY KEY, data TEXT NOT NULL, expires_at INTEGER NOT NULL); CREATE INDEX idx_sessions_expires ON sessions(expires_at);`);
     } else if (!tables.includes('sessions')) {
         db.exec(`CREATE TABLE sessions (sid TEXT PRIMARY KEY, data TEXT NOT NULL, expires_at INTEGER NOT NULL); CREATE INDEX idx_sessions_expires ON sessions(expires_at);`);
     }
-    console.log('✅ Migrations terminées.');
+    log('INFO', 'Migrations terminées.');
 }
 runMigrations();
 
@@ -142,7 +158,7 @@ class SQLiteStore extends session.Store {
     set(sid, sess, cb) { try { const exp = sess.cookie?.expires ? new Date(sess.cookie.expires).getTime() : Date.now() + 30*24*60*60*1000; db.prepare('INSERT OR REPLACE INTO sessions(sid,data,expires_at) VALUES(?,?,?)').run(sid, JSON.stringify(sess), exp); cb(null); } catch(e){ cb(e); } }
     destroy(sid, cb) { try { db.prepare('DELETE FROM sessions WHERE sid=?').run(sid); cb(null); } catch(e){ cb(e); } }
     clear(cb) { try { db.prepare('DELETE FROM sessions').run(); cb(null); } catch(e){ cb(e); } }
-    length(cb) { try { const r = db.prepare('SELECT COUNT(*) as c FROM sessions').get(); cb(null, r.c); } catch(e){ cb(e); } }
+    length(cb) { try { cb(null, db.prepare('SELECT COUNT(*) as c FROM sessions').get().c); } catch(e){ cb(e); } }
     touch(sid, sess, cb) { this.set(sid, sess, cb); }
 }
 const sessionStore = new SQLiteStore();
@@ -153,7 +169,7 @@ if (!adminRow) {
     const salt = randomBytes(16);
     const hash = await deriveKey(process.env.ADMIN_PASS || 'ChangeMeNow!', salt);
     db.prepare('INSERT INTO users(username,password_hash,salt,is_admin,tos_accepted) VALUES(?,?,?,1,1)').run(ADMIN_USER, hash, salt);
-    console.log(`👑 Admin: ${ADMIN_USER} / Pass: ${process.env.ADMIN_PASS || 'ChangeMeNow!'}`);
+    log('INFO', `Compte admin créé: ${ADMIN_USER}`);
 }
 
 // --- EXPRESS ---
@@ -169,11 +185,11 @@ const requireTos = (req, res, next) => { if(!req.session.tosAccepted) return res
 // --- CACHE ---
 class ByteLRUCache extends LRUCache { constructor(){ super({maxSize:CACHE_MAX_BYTES, sizeCalculation:v=>v.size}); } }
 const fileCache = new ByteLRUCache();
-setInterval(()=>{ const m = process.memoryUsage(); if(m.rss > 13*1024*1024*1024){ fileCache.clear(); if(global.gc) global.gc(); } }, 30000);
+setInterval(()=>{ const m = process.memoryUsage(); if(m.rss > 13*1024*1024*1024){ log('ALERT', `RAM ${(m.rss/1e9).toFixed(1)}GB → vidage du cache`); fileCache.clear(); if(global.gc) global.gc(); } }, 30000);
 
 // --- NSFW ---
 let nsfwModel = null;
-async function loadNsfwModel(){ try{ await tf.setBackend('wasm'); tf.wasm.setWasmPaths('/app/tfjs_wasm/','tfjs-backend-wasm.wasm'); await tf.ready(); nsfwModel = await nsfwjs.load('/app/tfjs_wasm/',{type:'mobilenet_v2',size:224}); console.log('🛡️ NSFW WASM chargé'); }catch(e){ console.error('❌ NSFW load fail:',e.message); } }
+async function loadNsfwModel(){ try{ await tf.setBackend('wasm'); tf.wasm.setWasmPaths('/app/tfjs_wasm/','tfjs-backend-wasm.wasm'); await tf.ready(); nsfwModel = await nsfwjs.load('/app/tfjs_wasm/',{type:'mobilenet_v2',size:224}); log('INFO', 'NSFW WASM chargé'); }catch(e){ log('WARN', `NSFW load fail: ${e.message}`); } }
 loadNsfwModel();
 async function checkNsfw(buf){ if(!nsfwModel) return {safe:true}; try{ const t=tf.node.decodeImage(buf,3).resizeNearestNeighbor([224,224]).expandDims(0); const p=await nsfwModel.classify(t); t.dispose(); const porn=p.find(x=>x.className==='Porn'||x.className==='Sexual Activity')?.probability||0; const hentai=p.find(x=>x.className==='Hentai')?.probability||0; if(porn>0.85||hentai>0.9) return {safe:false}; return {safe:true}; }catch(e){ return {safe:true}; } }
 
@@ -191,9 +207,7 @@ function encryptMasterKey(k){ const iv=randomBytes(12); const c=createCipheriv('
 function decryptMasterKey(b){ const iv=b.subarray(0,12), tag=b.subarray(-16), d=b.subarray(12,-16); const dc=createDecipheriv('aes-256-gcm',SERVER_MASTER_KEY,iv); dc.setAuthTag(tag); return Buffer.concat([dc.update(d),dc.final()]); }
 async function getMasterKey(fid){ const r=db.prepare('SELECT master_key_enc FROM files WHERE id=?').get(fid); if(!r?.master_key_enc) throw new Error('Clé manquante'); return decryptMasterKey(r.master_key_enc); }
 
-// ==========================================
-// ✅ CONTRÔLE D'ACCÈS (partage entre utilisateurs)
-// ==========================================
+// --- CONTRÔLE D'ACCÈS ---
 function canAccessFolder(userId, folderId){
     let cur = db.prepare('SELECT * FROM folders WHERE id=?').get(folderId);
     let depth = 0;
@@ -227,7 +241,7 @@ async function genThumb(fid,mime,key){
         if(mime.startsWith('image/')) buf = await sharp(dec).rotate().resize(256,256,{fit:'inside'}).jpeg({quality:80}).toBuffer();
         else buf = await sharp({create:{width:256,height:144,channels:3,background:'#1e1e2f'}}).jpeg().toBuffer();
         await sharp(buf).toFile(join(THUMB_DIR,`${fid}.jpg`));
-    }catch(e){ console.warn(`Thumb ${fid}:`,e.message); }
+    }catch(e){ log('WARN', `Thumb ${fid}: ${e.message}`); }
 }
 
 // --- STREAM ---
@@ -239,7 +253,7 @@ async function streamFile(res,file,key,range){
     if(s >= total || e >= total) return res.status(416).send('Range Not Satisfiable');
     res.set({'Content-Type':file.mime,'Content-Length':e-s+1,'Accept-Ranges':'bytes','Content-Disposition':`inline; filename="${encodeURIComponent(file.name)}"`});
     if(range){ res.status(206); res.set('Content-Range', `bytes ${s}-${e}/${total}`); }
-    console.log(`📥 Stream ${file.name} (${((e-s+1)/1024/1024).toFixed(2)} MB, ${chunks.length} chunk(s))`);
+    log('INFO', `Stream ${file.name} (${((e-s+1)/1048576).toFixed(2)} MB, ${chunks.length} chunk(s))`);
     let cur = 0;
     for(const c of chunks){
         const cs = cur, ce = cur + c.size - 1;
@@ -252,17 +266,15 @@ async function streamFile(res,file,key,range){
                     const t0 = Date.now();
                     const {data} = await axios.get(c.imgbb_url,{responseType:'arraybuffer',timeout:120000});
                     const t1 = Date.now();
-                    console.log(`  ⬇️  Chunk ${c.chunk_index}: ${(data.byteLength/1024/1024).toFixed(2)} MB en ${t1-t0}ms`);
+                    log('INFO', `  Chunk ${c.chunk_index}: ${(data.byteLength/1048576).toFixed(2)} MB téléchargé en ${t1-t0}ms`);
                     const enc = await pngToBuffer(Buffer.from(data), c.size + OVERHEAD);
-                    const t2 = Date.now();
-                    console.log(`  🖼️  PNG→Buffer: ${t2-t1}ms`);
                     dec = decryptChunk(enc, key);
-                    console.log(`  🔓 Decrypt: ${Date.now()-t2}ms`);
+                    log('INFO', `  Chunk ${c.chunk_index}: décodé+déchiffré en ${Date.now()-t1}ms`);
                     fileCache.set(ck, {data: dec, size: dec.length});
                 }
                 const sl = dec.subarray(off, off + len);
                 if(!res.write(sl)) await new Promise(r => res.once('drain', r));
-            }catch(err){ console.error(`❌ Stream chunk ${c.chunk_index}:`, err.message); return res.destroy(err); }
+            }catch(err){ log('ERROR', `Stream chunk ${c.chunk_index}: ${err.message}`); return res.destroy(err); }
         }
         cur += c.size;
         if(cs > e) break;
@@ -277,14 +289,13 @@ function broadcast(fid,d){ const cs = sseClients.get(fid); if(cs){ const p = `da
 // ==========================================
 // ROUTES
 // ==========================================
-app.post('/api/register',async(req,res)=>{const{u,p,t}=req.body;if(!u||!p||!t)return res.status(400).json({error:'Champs manquants'});if(db.prepare('SELECT 1 FROM users WHERE username=?').get(u))return res.status(409).json({error:'Existe'});const s=randomBytes(16);const h=await deriveKey(p,s);db.prepare('INSERT INTO users(username,password_hash,salt,tos_accepted) VALUES(?,?,?,1)').run(u,h,s);res.json({ok:true});});
-app.post('/api/login',async(req,res)=>{const{u,p}=req.body;const usr=db.prepare('SELECT * FROM users WHERE username=?').get(u);if(!usr)return res.status(401).json({error:'Invalide'});const h=await deriveKey(p,usr.salt);if(!h.equals(usr.password_hash))return res.status(401).json({error:'Invalide'});req.session.userId=usr.id;req.session.isAdmin=!!usr.is_admin;req.session.tosAccepted=!!usr.tos_accepted;req.session.username=usr.username;res.json({ok:true,user:{id:usr.id,username:usr.username,isAdmin:!!usr.is_admin,tosAccepted:!!usr.tos_accepted}});});
+app.post('/api/register',async(req,res)=>{const{u,p,t}=req.body;if(!u||!p||!t)return res.status(400).json({error:'Champs manquants'});if(db.prepare('SELECT 1 FROM users WHERE username=?').get(u))return res.status(409).json({error:'Existe'});const s=randomBytes(16);const h=await deriveKey(p,s);db.prepare('INSERT INTO users(username,password_hash,salt,tos_accepted) VALUES(?,?,?,1)').run(u,h,s);log('INFO',`Nouvel utilisateur: ${u}`);res.json({ok:true});});
+app.post('/api/login',async(req,res)=>{const{u,p}=req.body;const usr=db.prepare('SELECT * FROM users WHERE username=?').get(u);if(!usr)return res.status(401).json({error:'Invalide'});const h=await deriveKey(p,usr.salt);if(!h.equals(usr.password_hash))return res.status(401).json({error:'Invalide'});req.session.userId=usr.id;req.session.isAdmin=!!usr.is_admin;req.session.tosAccepted=!!usr.tos_accepted;req.session.username=usr.username;log('INFO',`Connexion: ${u}`);res.json({ok:true,user:{id:usr.id,username:usr.username,isAdmin:!!usr.is_admin,tosAccepted:!!usr.tos_accepted}});});
 app.post('/api/logout',(req,res)=>req.session.destroy(()=>res.json({ok:true})));
 app.get('/api/me',(req,res)=>req.session.userId?res.json({id:req.session.userId,username:req.session.username,isAdmin:req.session.isAdmin,tosAccepted:req.session.tosAccepted}):res.status(401).json({error:'Non connecté'}));
-app.get('/api/tos',(_,res)=>res.send(`PIXELDRIVE CGU\n1. RESPONSABILITÉ TOTALE\n2. AUCUNE GARANTIE (Projet test)\n3. INTERDITS: Illégal, NSFW, Abus\n4. CHIFFRÉ AES-256-GCM + Filtre NSFW Local\n5. ACCEPTATION = Responsabilité légale`));
 app.post('/api/tos/accept',requireAuth,(req,res)=>{db.prepare('UPDATE users SET tos_accepted=1 WHERE id=?').run(req.session.userId);req.session.tosAccepted=true;res.json({ok:true});});
 
-// ✅ Folders (avec accès partagé)
+// Folders
 app.get('/api/folders',requireAuth,(req,res)=>{
     const p = req.query.parent_id ? parseInt(req.query.parent_id) : null;
     if (p !== null) {
@@ -296,7 +307,7 @@ app.get('/api/folders',requireAuth,(req,res)=>{
 app.post('/api/folders',requireAuth,requireTos,(req,res)=>{const{n,p}=req.body;if(!n)return res.status(400).json({error:'Nom requis'});try{const i=db.prepare('INSERT INTO folders(name,parent_id,owner_id) VALUES(?,?,?)').run(n,p||null,req.session.userId);res.json({id:i.lastInsertRowid,name:n,parent_id:p});}catch(e){res.status(409).json({error:'Existe'});}});
 app.delete('/api/folders/:id',requireAuth,(req,res)=>{db.prepare('DELETE FROM folders WHERE id=? AND owner_id=?').run(req.params.id,req.session.userId);res.json({ok:true});});
 
-// ✅ Files (avec accès partagé)
+// Files
 app.get('/api/files',requireAuth,(req,res)=>{
     const f = req.query.folder_id ? parseInt(req.query.folder_id) : null;
     if (f !== null) {
@@ -306,58 +317,47 @@ app.get('/api/files',requireAuth,(req,res)=>{
     res.json(db.prepare('SELECT * FROM files WHERE owner_id=? AND folder_id IS NULL ORDER BY name COLLATE NOCASE').all(req.session.userId));
 });
 
-// ✅ PARTAGE ENTRE UTILISATEURS
+// ✅ PARTAGE UTILISATEURS (vraie gestion)
 app.post('/api/share-user',requireAuth,requireTos,(req,res)=>{
     const { type, id, username } = req.body;
     if (!type || !id || !username) return res.status(400).json({error:'Champs manquants'});
     const target = db.prepare('SELECT id FROM users WHERE username=?').get(username.trim());
     if (!target) return res.status(404).json({error:'Utilisateur introuvable'});
     if (target.id === req.session.userId) return res.status(400).json({error:'Impossible de partager avec vous-même'});
-    if (type === 'file') {
-        const f = db.prepare('SELECT id FROM files WHERE id=? AND owner_id=?').get(id, req.session.userId);
-        if (!f) return res.status(404).json({error:'Fichier introuvable'});
-        if (db.prepare('SELECT 1 FROM user_shares WHERE file_id=? AND shared_with=?').get(id, target.id)) return res.status(409).json({error:'Déjà partagé'});
-        db.prepare('INSERT INTO user_shares(file_id,owner_id,shared_with) VALUES(?,?,?)').run(id, req.session.userId, target.id);
-    } else {
-        const fo = db.prepare('SELECT id FROM folders WHERE id=? AND owner_id=?').get(id, req.session.userId);
-        if (!fo) return res.status(404).json({error:'Dossier introuvable'});
-        if (db.prepare('SELECT 1 FROM user_shares WHERE folder_id=? AND shared_with=?').get(id, target.id)) return res.status(409).json({error:'Déjà partagé'});
-        db.prepare('INSERT INTO user_shares(folder_id,owner_id,shared_with) VALUES(?,?,?)').run(id, req.session.userId, target.id);
-    }
+    const col = type === 'file' ? 'file_id' : 'folder_id';
+    const own = db.prepare(`SELECT id FROM ${type === 'file' ? 'files' : 'folders'} WHERE id=? AND owner_id=?`).get(id, req.session.userId);
+    if (!own) return res.status(404).json({error:'Introuvable'});
+    if (db.prepare(`SELECT 1 FROM user_shares WHERE ${col}=? AND shared_with=?`).get(id, target.id)) return res.status(409).json({error:'Déjà partagé'});
+    db.prepare(`INSERT INTO user_shares(${col},owner_id,shared_with) VALUES(?,?,?)`).run(id, req.session.userId, target.id);
+    log('INFO', `Partage ${type} ${id} → ${username.trim()}`);
     res.json({ok:true});
 });
 
 app.get('/api/shared-with-me',requireAuth,(req,res)=>{
-    res.json(db.prepare(`
-        SELECT us.id as share_id, us.created_at as shared_at, u.username as owner_name,
-               us.file_id, us.folder_id,
-               f.name as file_name, f.mime, f.size, f.status,
-               fo.name as folder_name
-        FROM user_shares us
-        JOIN users u ON u.id = us.owner_id
-        LEFT JOIN files f ON f.id = us.file_id
-        LEFT JOIN folders fo ON fo.id = us.folder_id
-        WHERE us.shared_with = ?
-        ORDER BY us.created_at DESC
-    `).all(req.session.userId));
+    res.json(db.prepare(`SELECT us.id as share_id, us.created_at as shared_at, u.username as owner_name, us.file_id, us.folder_id, f.name as file_name, f.mime, f.size, f.status, fo.name as folder_name
+        FROM user_shares us JOIN users u ON u.id = us.owner_id LEFT JOIN files f ON f.id = us.file_id LEFT JOIN folders fo ON fo.id = us.folder_id
+        WHERE us.shared_with = ? ORDER BY us.created_at DESC`).all(req.session.userId));
 });
+app.delete('/api/shared-with-me/:id',requireAuth,(req,res)=>{ db.prepare('DELETE FROM user_shares WHERE id=? AND shared_with=?').run(req.params.id, req.session.userId); res.json({ok:true}); });
 
-app.delete('/api/shared-with-me/:id',requireAuth,(req,res)=>{
-    db.prepare('DELETE FROM user_shares WHERE id=? AND shared_with=?').run(req.params.id, req.session.userId);
+// ✅ GESTION CÔTÉ PROPRIÉTAIRE : mes partages + révocation
+app.get('/api/my-shares',requireAuth,(req,res)=>{
+    res.json(db.prepare(`SELECT us.id, us.created_at, u.username as shared_with_name, us.file_id, us.folder_id, f.name as file_name, f.mime, f.size, fo.name as folder_name
+        FROM user_shares us JOIN users u ON u.id = us.shared_with LEFT JOIN files f ON f.id = us.file_id LEFT JOIN folders fo ON fo.id = us.folder_id
+        WHERE us.owner_id = ? ORDER BY us.created_at DESC`).all(req.session.userId));
+});
+app.delete('/api/my-shares/:id',requireAuth,(req,res)=>{
+    const r = db.prepare('DELETE FROM user_shares WHERE id=? AND owner_id=?').run(req.params.id, req.session.userId);
+    if (!r.changes) return res.status(404).json({error:'Introuvable'});
+    log('INFO', `Partage révoqué: #${req.params.id}`);
     res.json({ok:true});
 });
 
 // Liens publics
-app.get('/api/share-links',requireAuth,(req,res)=>{
-    res.json(db.prepare(`SELECT sl.*, f.name as file_name, f.mime, f.size FROM share_links sl LEFT JOIN files f ON sl.file_id = f.id WHERE sl.owner_id = ? ORDER BY sl.created_at DESC`).all(req.session.userId));
-});
-app.delete('/api/share-links/:token',requireAuth,(req,res)=>{
-    const r = db.prepare('DELETE FROM share_links WHERE token=? AND owner_id=?').run(req.params.token, req.session.userId);
-    if (r.changes === 0) return res.status(404).json({error:'Lien introuvable'});
-    res.json({ok:true});
-});
+app.get('/api/share-links',requireAuth,(req,res)=>{ res.json(db.prepare(`SELECT sl.*, f.name as file_name, f.mime, f.size FROM share_links sl LEFT JOIN files f ON sl.file_id = f.id WHERE sl.owner_id = ? ORDER BY sl.created_at DESC`).all(req.session.userId)); });
+app.delete('/api/share-links/:token',requireAuth,(req,res)=>{ const r = db.prepare('DELETE FROM share_links WHERE token=? AND owner_id=?').run(req.params.token, req.session.userId); if (!r.changes) return res.status(404).json({error:'Introuvable'}); res.json({ok:true}); });
 
-// Upload
+// ✅ UPLOAD (timing + vitesse)
 const upload = multer({dest:TEMP_DIR,limits:{fileSize:5*1024*1024*1024}});
 app.post('/api/files/upload',requireAuth,requireTos,upload.single('file'),async(req,res)=>{
     if(!req.file)return res.status(400).json({error:'Fichier manquant'});
@@ -369,10 +369,12 @@ app.post('/api/files/upload',requireAuth,requireTos,upload.single('file'),async(
     for(let i=0;i<cc;i++){const sz=Math.min(CHUNK_SIZE,fsize-i*CHUNK_SIZE);cd.push([fid,i,sz,sz+OVERHEAD]);}
     tx(cd);
     res.json({fileId:fid,status:'pending',chunkCount:cc});
-    uploadQueue.add(()=>processUpload(fid,fpath,mk,cc,req.file.mimetype));
+    uploadQueue.add(()=>processUpload(fid,fpath,mk,cc,req.file.mimetype,fsize,req.session.username));
 });
 
-async function processUpload(fid,path,mk,cc,mime){
+async function processUpload(fid,path,mk,cc,mime,fsize,username){
+    const t0 = Date.now();
+    log('INFO', `Upload démarré: "${path.split('/').pop()}" par ${username} (${(fsize/1048576).toFixed(2)} MB, ${cc} chunk(s))`);
     try{
         db.prepare("UPDATE files SET status='uploading' WHERE id=?").run(fid);
         for(let i=0;i<cc;i++){
@@ -395,8 +397,12 @@ async function processUpload(fid,path,mk,cc,mime){
         await genThumb(fid,mime,mk);
         db.prepare("UPDATE files SET status='ready',progress=100 WHERE id=?").run(fid);
         broadcast(fid,{type:'progress',progress:100,status:'ready',type:'done'});
+        // ✅ TIMING + VITESSE
+        const secs = (Date.now()-t0)/1000;
+        const speed = (fsize/1048576)/secs;
+        log('INFO', `Upload terminé: ${fid} en ${secs.toFixed(1)}s (${speed.toFixed(2)} MB/s)`);
     }catch(e){
-        console.error(`Upload ${fid}`,e);
+        log('ERROR', `Upload échoué ${fid}: ${e.message}`);
         db.prepare("UPDATE files SET status='error',error_msg=? WHERE id=?").run(e.message,fid);
         broadcast(fid,{type:'error',error:e.message});
         const cs=db.prepare('SELECT imgbb_delete_url FROM file_chunks WHERE file_id=?').all(fid);
@@ -405,7 +411,7 @@ async function processUpload(fid,path,mk,cc,mime){
 }
 function readChunk(p,o,l){return new Promise((res,rej)=>{const s=createReadStream(p,{start:o,end:o+l-1}),c=[];s.on('data',d=>c.push(d)).on('end',()=>res(Buffer.concat(c,l))).on('error',rej);});}
 
-// ✅ Download (accès partagé autorisé)
+// Download / preview / public
 app.get('/api/files/:id/download',requireAuth,async(req,res)=>{
     const f = canAccessFile(req.session.userId, req.params.id);
     if(!f)return res.status(404).json({error:'Introuvable'});
@@ -423,14 +429,6 @@ app.post('/api/files/:id/share',requireAuth,async(req,res)=>{
     res.json({preview:`/s/${pt}`,download:`/d/${dt2}`,expires});
 });
 
-app.get('/api/files/:id/preview',requireAuth,async(req,res)=>{
-    const f=db.prepare('SELECT * FROM files WHERE id=? AND owner_id=?').get(req.params.id,req.session.userId);
-    if(!f||f.status!=='ready')return res.status(404).json({error:'Pas prêt'});
-    const t=uuidv4();
-    db.prepare('INSERT INTO share_links(token,file_id,owner_id,type,expires_at) VALUES(?,?,?,?,?)').run(t,f.id,req.session.userId,'embed',Date.now()+3600000);
-    res.json({url:`/s/${t}`});
-});
-
 app.get('/s/:token',async(req,res)=>{
     const l=db.prepare('SELECT * FROM share_links WHERE token=? AND type=? AND (expires_at IS NULL OR expires_at>?)').get(req.params.token,'embed',Date.now());
     if(!l)return res.status(404).send(html('Lien invalide/expiré'));
@@ -466,20 +464,22 @@ app.get('/api/files/:id/progress',requireAuth,(req,res)=>{res.set({'Content-Type
 app.get('/api/admin/users',requireAuth,(req,res)=>{if(!req.session.isAdmin)return res.status(403).json({error:'Admin only'});res.json(db.prepare('SELECT id,username,is_admin,tos_accepted,created_at FROM users').all());});
 app.get('/health',(_,res)=>res.json({ok:true,cache:fileCache.size,mem:process.memoryUsage()}));
 
-app.use(express.static(__dirname));
+// ✅ STATIQUE : dossier public/
+app.use(express.static(PUBLIC_DIR));
+app.get('/manifest.json', (req,res) => res.sendFile(join(__dirname, 'manifest.json')));
 app.get('*', (req, res) => {
     if (/\.[a-zA-Z0-9]+$/.test(req.path)) return res.status(404).send('Not Found');
-    res.sendFile(join(__dirname, 'public.html'));
+    res.sendFile(join(PUBLIC_DIR, 'index.html'));
 });
 
 // ERROR HANDLER
 app.use((err, req, res, next) => {
     if (err.type === 'entity.parse.failed' || err instanceof SyntaxError) return res.status(400).json({ error: 'Bad Request' });
-    console.error('❌ Server Error:', err.message);
+    log('ERROR', `Server: ${err.message}`);
     res.status(500).json({ error: 'Internal Server Error' });
 });
 
-const server = app.listen(PORT, '0.0.0.0', () => console.log(`🚀 PixelDrive v3.3 on http://0.0.0.0:${PORT} | Cache: 12GB LRU`));
-process.on('SIGTERM', () => { console.log('SIGTERM'); server.close(() => process.exit(0)); });
+const server = app.listen(PORT, '0.0.0.0', () => log('INFO', `PixelDrive v4.0 démarré sur http://0.0.0.0:${PORT}`));
+process.on('SIGTERM', () => { log('WARN', 'SIGTERM reçu, arrêt...'); server.close(() => process.exit(0)); });
 
 function html(b){return `<!DOCTYPE html><html><head><meta charset="utf-8"/><meta name="viewport" content="width=device-width, initial-scale=1"/><title>PixelDrive</title><style>body{margin:0;font-family:system-ui,sans-serif;background:#0d0d12;color:#eee;display:flex;align-items:center;justify-content:center;height:100vh}</style></head><body>${b}</body></html>`;}