Update server.js

server.js

@@ -1,14 +1,17 @@
-//PIXELDRIVE - Single File Backend + Frontend (Node 22+)
 // ============================================================
+// PIXELDRIVE - Single File Backend + Frontend (Node 22+)
+// Architecture: Server-Side Only Processing
+// Dependencies: better-sqlite3, express, express-session, multer, pngjs, bottleneck, uuid
+// ============================================================
+
 import express from 'express';
 import session from 'express-session';
 import multer from 'multer';
 import Database from 'better-sqlite3';
 import { PNG } from 'pngjs';
-import { ZstdCompressor, ZstdDecompressor } from '@bokuweb/zstd-wasm';
 import Bottleneck from 'bottleneck';
-import { randomBytes, createHash, scrypt, timingSafeEqual } from 'crypto';
-import { WebSocketServer } from 'ws'; // Pour progression temps réel (optionnel)
+import { randomBytes, createHash, scrypt, timingSafeEqual, createCipheriv, createDecipheriv } from 'crypto';
+import { promisify } from 'util';
 import { fileURLToPath } from 'url';
 import { dirname, resolve } from 'path';
 import { v4 as uuidv4 } from 'uuid';
@@ -18,24 +21,26 @@ const __dirname = dirname(fileURLToPath(import.meta.url));
 const DATA_DIR = process.env.DATA_DIR || '/data';
 const DB_PATH = `${DATA_DIR}/pixeldrive.db`;
 const IMGBB_API_KEY = process.env.IMGBB_API_KEY;
-const PORT = 7860;
-const CHUNK_TARGET_SIZE = 31 * 1024 * 1024; // 31 Mo (marge sous 32Mo IMGBB)
-const PNG_PIXEL_FORMAT = 'rgba'; // 4 octets/pixel (alignement 32bits + place ECC future)
-const BYTES_PER_PIXEL = 4;
-const UPLOAD_QUEUE_LIMIT = 20; // 20 req/min
+const PORT = parseInt(process.env.PORT) || 7860;
+const CHUNK_TARGET_SIZE = 31 * 1024 * 1024; // 31 Mo (Marge sous limite 32Mo IMGBB)
+const PNG_BYTES_PER_PIXEL = 4; // RGBA (Alignement 32-bit optimal)
+const SESSION_SECRET = process.env.SESSION_SECRET || randomBytes(32).toString('hex');
+const ADMIN_USER = process.env.ADMIN_USER || 'admin';
+const ADMIN_PASS = process.env.ADMIN_PASS || 'changeme';
 
-if (!IMGBB_API_KEY) { console.error("❌ IMGBB_API_KEY manquant !"); process.exit(1); }
+if (!IMGBB_API_KEY) { console.error("❌ ERREUR FATALE: Variable d'environnement IMGBB_API_KEY manquante !"); process.exit(1); }
 
-// --- INIT DB ---
+// --- INIT DATABASE (SQLite WAL Mode) ---
 const db = new Database(DB_PATH);
 db.pragma('journal_mode = WAL');
+db.pragma('synchronous = NORMAL');
 db.exec(`
   CREATE TABLE IF NOT EXISTS users (
-    id INTEGER PRIMARY KEY, username TEXT UNIQUE, password_hash TEXT, salt TEXT, is_admin INTEGER DEFAULT 0
+    id INTEGER PRIMARY KEY, username TEXT UNIQUE, password_hash BLOB, salt BLOB, is_admin INTEGER DEFAULT 0, created_at INTEGER DEFAULT (strftime('%s','now'))
   );
   CREATE TABLE IF NOT EXISTS files (
     id TEXT PRIMARY KEY, owner_id INTEGER, parent_id TEXT, name TEXT, mime TEXT,
-    size INTEGER, chunk_count INTEGER, created_at INTEGER,
+    size INTEGER, chunk_count INTEGER DEFAULT 0, created_at INTEGER DEFAULT (strftime('%s','now')),
     FOREIGN KEY(owner_id) REFERENCES users(id), FOREIGN KEY(parent_id) REFERENCES files(id)
   );
   CREATE TABLE IF NOT EXISTS chunks (
@@ -47,62 +52,31 @@ db.exec(`
   CREATE INDEX IF NOT EXISTS idx_chunks_file ON chunks(file_id);
 `);
 
-// Créer admin par défaut
-const adminUser = process.env.ADMIN_USER || 'admin';
-const adminPass = process.env.ADMIN_PASS || 'changeme';
-const adminExists = db.prepare('SELECT 1 FROM users WHERE username = ?').get(adminUser);
+// --- CREATE DEFAULT ADMIN ---
+const adminExists = db.prepare('SELECT 1 FROM users WHERE username = ?').get(ADMIN_USER);
 if (!adminExists) {
   const salt = randomBytes(16);
-  const hash = await new Promise((res, rej) => scrypt(adminPass, salt, 32, (e, k) => e ? rej(e) : res(k)));
-  db.prepare('INSERT INTO users (username, password_hash, salt, is_admin) VALUES (?, ?, ?, 1)')
-    .run(adminUser, hash, salt);
-  console.log(`✅ Admin créé: ${adminUser} / ${adminPass}`);
+  const hash = await scryptAsync(ADMIN_PASS, salt, 32);
+  db.prepare('INSERT INTO users (username, password_hash, salt, is_admin) VALUES (?, ?, ?, 1)').run(ADMIN_USER, hash, salt);
+  console.log(`✅ Admin créé: ${ADMIN_USER} / ${ADMIN_PASS}`);
 }
 
-// --- CRYPTO HELPERS (Web Crypto API - AES-256-GCM) ---
-const deriveKey = (password, salt) => 
-  crypto.subtle.importKey('raw', await new Promise((r, j) => scrypt(password, salt, 32, (e, k) => e ? j(e) : r(k))), 'PBKDF2', false, ['deriveBits'])
-    .then(k => crypto.subtle.deriveBits({ name: 'PBKDF2', salt, iterations: 210000, hash: 'SHA-256' }, k, 256))
-    .then(bits => crypto.subtle.importKey('raw', bits, { name: 'AES-GCM' }, false, ['encrypt', 'decrypt']));
-
-// Simplifié pour code unique : Utilisation directe scrypt -> AES-GCM (Node crypto module est plus simple ici pour streaming)
-import { createCipheriv, createDecipheriv } from 'crypto';
-const encryptStream = (key, iv) => createCipheriv('aes-256-gcm', key, iv);
-const decryptStream = (key, iv, authTag) => createDecipheriv('aes-256-gcm', key, iv).setAuthTag(authTag);
-
-// --- ZSTD INIT (WARMUP) ---
-const zstd = await ZstdCompressor.create();
-const zstdDec = await ZstdDecompressor.create();
-
-// --- IMGBB UPLOAD QUEUE (Rate Limit 20/min) ---
-const uploadLimiter = new Bottleneck({ minTime: 3000, maxConcurrent: 1 }); // 1 req / 3s = 20/min
+// --- CRYPTO HELPERS ---
+const scryptAsync = promisify(scrypt);
 
-async function imgbbUpload(imageBuffer) {
-  return uploadLimiter.schedule(async () => {
-    const form = new FormData();
-    form.append('image', new Blob([imageBuffer], { type: 'image/png' }));
-    form.append('expiration', '0'); // Ne pas auto-supprimer
-    const res = await fetch(`https://api.imgbb.com/1/upload?key=${IMGBB_API_KEY}`, { method: 'POST', body: form });
-    const json = await res.json();
-    if (!json.success) throw new Error(`IMGBB: ${json.error?.message || 'Unknown'}`);
-    return { url: json.data.url, delete_url: json.data.delete_url, width: json.data.width, height: json.data.height };
-  });
+// Dérivation clé fichier : SHA256(SESSION_SECRET + UserID + FileID) -> 32 bytes
+// NOTE: Pas "Zero Knowledge" (serveur connaît la clé), mais simple, robuste, sans libsodium.
+function getFileKey(userId, fileId) {
+  return createHash('sha256').update(`${SESSION_SECRET}:${userId}:${fileId}`).digest();
 }
 
-async function imgbbDelete(deleteUrl) {
-  return uploadLimiter.schedule(async () => {
-    await fetch(deleteUrl, { method: 'GET' }); // IMGBB delete via GET sur delete_url
-  });
-}
-
-// --- PNG ENGINE ---
+// --- PNG ENGINE (Pure JS) ---
 function dataToPngBuffer(dataBuffer) {
-  const pixelCount = Math.ceil(dataBuffer.length / BYTES_PER_PIXEL);
+  const pixelCount = Math.ceil(dataBuffer.length / PNG_BYTES_PER_PIXEL);
   const w = Math.ceil(Math.sqrt(pixelCount));
   const h = Math.ceil(pixelCount / w);
-  const png = new PNG({ width: w, height: h, colorType: 6, filterType: 4 }); // RGBA, Paeth filter
-  png.data.set(dataBuffer); // Remplit R,G,B,A,R,G,B,A...
-  // Padding auto à 0 par PNG.js
+  const png = new PNG({ width: w, height: h, colorType: 6, filterType: 4 }); // RGBA, Paeth Filter
+  png.data.set(dataBuffer); // Remplissage direct (padding auto à 0)
   return new Promise((res, rej) => {
     const chunks = [];
     png.on('data', c => chunks.push(c));
@@ -115,49 +89,69 @@ function dataToPngBuffer(dataBuffer) {
 function pngBufferToData(pngBuffer, expectedLength) {
   return new Promise((res, rej) => {
     const png = new PNG();
-    png.on('parsed', () => {
-      const buf = png.data.subarray(0, expectedLength);
-      res(buf);
-    });
+    png.on('parsed', () => res(png.data.subarray(0, expectedLength)));
     png.on('error', rej);
     png.parse(pngBuffer);
   });
 }
 
+// --- IMGBB QUEUE (Rate Limit: 20 req/min = 1 req / 3s) ---
+const imgbbLimiter = new Bottleneck({ minTime: 3000, maxConcurrent: 1 });
+
+async function imgbbUpload(imageBuffer) {
+  return imgbbLimiter.schedule(async () => {
+    const form = new FormData();
+    form.append('image', new Blob([imageBuffer], { type: 'image/png' }));
+    form.append('expiration', '0'); // Pas d'auto-suppression
+    const res = await fetch(`https://api.imgbb.com/1/upload?key=${IMGBB_API_KEY}`, { method: 'POST', body: form });
+    const json = await res.json();
+    if (!json.success) throw new Error(`IMGBB Upload Failed: ${json.error?.message || res.statusText}`);
+    return { url: json.data.url, delete_url: json.data.delete_url, width: json.data.width, height: json.data.height };
+  });
+}
+
+async function imgbbDelete(deleteUrl) {
+  if (!deleteUrl) return;
+  return imgbbLimiter.schedule(async () => {
+    try { await fetch(deleteUrl, { method: 'GET' }); } catch (e) { console.warn('IMGBB Delete failed:', e.message); }
+  });
+}
+
 // --- EXPRESS APP ---
 const app = express();
 app.use(express.json({ limit: '50mb' }));
 app.use(express.urlencoded({ extended: true, limit: '50mb' }));
 app.use(session({
-  secret: process.env.SESSION_SECRET || randomBytes(32).toString('hex'),
-  resave: false, saveUninitialized: false,
+  secret: SESSION_SECRET, resave: false, saveUninitialized: false,
   cookie: { httpOnly: true, secure: false, maxAge: 7 * 86400000, sameSite: 'lax' }
 }));
-const upload = multer({ dest: `${DATA_DIR}/tmp_uploads`, limits: { fileSize: 2 * 1024 * 1024 * 1024 } }); // 2Go max upload
 
-// Auth Middleware
+// Multer: Stockage temporaire sur disque (évite RAM overflow gros fichiers)
+const upload = multer({ dest: `${DATA_DIR}/tmp_uploads`, limits: { fileSize: 4 * 1024 * 1024 * 1024 } }); // 4Go max
+
+// --- MIDDLEWARES ---
 const requireAuth = (req, res, next) => req.session.userId ? next() : res.status(401).json({ error: 'Non connecté' });
 const requireAdmin = (req, res, next) => req.session.isAdmin ? next() : res.status(403).json({ error: 'Admin requis' });
 
 // --- API ROUTES ---
 
-// Auth
+// AUTH
 app.post('/api/auth/register', async (req, res) => {
   const { username, password } = req.body;
   if (!username || !password) return res.status(400).json({ error: 'Champs manquants' });
-  const salt = randomBytes(16);
-  const hash = await new Promise((r, j) => scrypt(password, salt, 32, (e, k) => e ? j(e) : r(k)));
   try {
+    const salt = randomBytes(16);
+    const hash = await scryptAsync(password, salt, 32);
     db.prepare('INSERT INTO users (username, password_hash, salt) VALUES (?, ?, ?)').run(username, hash, salt);
     res.json({ ok: true });
-  } catch (e) { res.status(409).json({ error: 'Utilisateur existe' }); }
+  } catch (e) { res.status(409).json({ error: 'Utilisateur existe déjà' }); }
 });
 
 app.post('/api/auth/login', async (req, res) => {
   const { username, password } = req.body;
   const user = db.prepare('SELECT * FROM users WHERE username = ?').get(username);
   if (!user) return res.status(401).json({ error: 'Identifiants invalides' });
-  const hash = await new Promise((r, j) => scrypt(password, user.salt, 32, (e, k) => e ? j(e) : r(k)));
+  const hash = await scryptAsync(password, user.salt, 32);
   if (!timingSafeEqual(hash, user.password_hash)) return res.status(401).json({ error: 'Identifiants invalides' });
   req.session.userId = user.id; req.session.isAdmin = !!user.is_admin; req.session.username = user.username;
   res.json({ ok: true, user: { username: user.username, isAdmin: !!user.is_admin } });
@@ -166,63 +160,51 @@ app.post('/api/auth/login', async (req, res) => {
 app.post('/api/auth/logout', (req, res) => req.session.destroy(() => res.json({ ok: true })));
 app.get('/api/auth/me', (req, res) => req.session.userId ? res.json({ user: { username: req.session.username, isAdmin: req.session.isAdmin }}) : res.status(401).json({ error: 'Non connecté' }));
 
-// Drive: List
+// DRIVE: LIST
 app.get('/api/fs/list', requireAuth, (req, res) => {
   const parentId = req.query.parent_id || null;
-  const items = db.prepare('SELECT id, name, mime, size, chunk_count, created_at, parent_id FROM files WHERE owner_id = ? AND (parent_id IS ? OR parent_id = ?) ORDER BY name')
-    .all(req.session.userId, parentId, parentId);
+  const items = db.prepare('SELECT id, name, mime, size, chunk_count, created_at FROM files WHERE owner_id = ? AND (parent_id IS ? OR parent_id = ?) ORDER BY (mime = ?) DESC, name')
+    .all(req.session.userId, parentId, parentId, 'application/vnd.pixeldrive.folder');
   res.json({ items });
 });
 
-// Drive: Mkdir
+// DRIVE: MKDIR
 app.post('/api/fs/mkdir', requireAuth, (req, res) => {
   const { name, parent_id } = req.body;
-  if (!name) return res.status(400).json({ error: 'Nom requis' });
+  if (!name || name.includes('/')) return res.status(400).json({ error: 'Nom invalide' });
   const id = uuidv4();
-  db.prepare('INSERT INTO files (id, owner_id, parent_id, name, mime, size, chunk_count) VALUES (?, ?, ?, ?, ?, 0, 0)')
+  db.prepare('INSERT INTO files (id, owner_id, parent_id, name, mime) VALUES (?, ?, ?, ?, ?)')
     .run(id, req.session.userId, parent_id || null, name, 'application/vnd.pixeldrive.folder');
   res.json({ ok: true, id });
 });
 
-// Drive: Upload (Streaming Pipeline)
+// DRIVE: UPLOAD (Streaming Pipeline: Read -> Chunk -> Encrypt -> PNG -> IMGBB)
 app.post('/api/fs/upload', requireAuth, upload.single('file'), async (req, res) => {
   if (!req.file) return res.status(400).json({ error: 'Fichier manquant' });
+  
   const parentId = req.body.parent_id || null;
   const originalName = req.file.originalname;
   const mime = req.file.mimetype || 'application/octet-stream';
   const tmpPath = req.file.path;
   const fileId = uuidv4();
+  const fileKey = getFileKey(req.session.userId, fileId);
+  const iv = randomBytes(12); // IV unique par FICHIER (réutilisé pour tous chunks de ce fichier)
 
   try {
-    // 1. Créer entrée DB (statut pending)
-    db.prepare('INSERT INTO files (id, owner_id, parent_id, name, mime, size, chunk_count) VALUES (?, ?, ?, ?, ?, ?, 0)')
-      .run(fileId, req.session.userId, parentId, originalName, mime, req.file.size);
+    // 1. DB Entry
+    db.prepare('INSERT INTO files (id, owner_id, parent_id, name, mime, size, chunk_count) VALUES (?, ?, ?, ?, ?, 0, 0)')
+      .run(fileId, req.session.userId, parentId, originalName, mime);
 
-    // 2. Pipeline: Read -> Zstd -> Encrypt -> Chunk -> PNG -> IMGBB
+    // 2. Pipeline
     const fs = await import('fs');
-    const readStream = fs.createReadStream(tmpPath, { highWaterMark: 1024 * 1024 }); // 1Mo buffer
-
-    // Key derivation per file (File Key) + User Master Key logic simplifié ici: 1 clé par user stockée en session ? Non, trop risqué.
-    // STRATEGIE SIMPLE & ROBUSTE: Clé dérivée du mot de passe user + salt fichier.
-    // Mais on a pas le MDP en session. ON VA FAIRE: Clé aléatoire par fichier, stockée chiffrée avec clé maître user ?
-    // TROP COMPLEXE POUR 1 FICHIER.
-    // COMPROMIS MOBILE: **Clé unique dérivée du UserID + Secret Serveur (SESSION_SECRET) + FileID**.
-    // Permet de déchiffrer si on a accès au serveur + DB. Pas "Zero Knowledge" mais fonctionnel.
-    const masterSecret = process.env.SESSION_SECRET;
-    const fileKeyRaw = createHash('sha256').update(`${masterSecret}:${req.session.userId}:${fileId}`).digest(); // 32 bytes
-    const iv = randomBytes(12); // GCM 96-bit
-
-    const compressor = new zstd.simple.ZstdCompressor(3); // Level 3 rapide
-    let chunkIdx = 0;
-    let totalOriginalSize = 0;
-    let pendingChunks = [];
-
-    // Buffer d'accumulation pour chunking
+    const readStream = fs.createReadStream(tmpPath, { highWaterMark: 1024 * 1024 }); // 1Mo chunks lecture
     let buffer = Buffer.alloc(0);
+    let totalSize = 0;
+    let chunkIdx = 0;
 
     for await (const chunk of readStream) {
       buffer = Buffer.concat([buffer, chunk]);
-      totalOriginalSize += chunk.length;
+      totalSize += chunk.length;
 
       while (buffer.length >= CHUNK_TARGET_SIZE) {
         const chunkData = buffer.subarray(0, CHUNK_TARGET_SIZE);
@@ -230,138 +212,157 @@ app.post('/api/fs/upload', requireAuth, upload.single('file'), async (req, res)
         await processAndUploadChunk(chunkData, chunkIdx++);
       }
     }
-    // Dernier chunk
     if (buffer.length > 0) await processAndUploadChunk(buffer, chunkIdx);
 
-    // Maj DB Final
-    db.prepare('UPDATE files SET size = ?, chunk_count = ? WHERE id = ?').run(totalOriginalSize, chunkIdx, fileId);
-    res.json({ ok: true, fileId, chunks: chunkIdx });
+    // 3. Finalize DB
+    db.prepare('UPDATE files SET size = ?, chunk_count = ? WHERE id = ?').run(totalSize, chunkIdx, fileId);
+    res.json({ ok: true, fileId, chunks: chunkIdx, size: totalSize });
 
   } catch (e) {
-    console.error("Upload Error:", e);
-    // Cleanup IMGBB si erreur partielle ? Trop complexe ici. Log only.
+    console.error(`[UPLOAD ERROR] ${fileId}:`, e);
     res.status(500).json({ error: e.message });
   } finally {
-    fs.unlink(tmpPath).catch(()=>{});
+    // Cleanup temp file
+    fs.unlink(tmpPath).catch(() => {});
   }
 
-  // --- Fonction interne Upload Chunk ---
+  // --- Internal Chunk Processor ---
   async function processAndUploadChunk(rawChunk, idx) {
-    // 1. Compress
-    const compressed = compressor.compress(new Uint8Array(rawChunk));
-    // 2. Encrypt
-    const cipher = createCipheriv('aes-256-gcm', fileKeyRaw, iv);
-    const encrypted = Buffer.concat([cipher.update(compressed), cipher.final()]);
+    // 1. Encrypt (AES-256-GCM)
+    const cipher = createCipheriv('aes-256-gcm', fileKey, iv);
+    const encrypted = Buffer.concat([cipher.update(rawChunk), cipher.final()]);
     const authTag = cipher.getAuthTag();
-    const payload = Buffer.concat([iv, authTag, encrypted]); // IV(12) + TAG(16) + DATA
+    
+    // Payload Format: IV(12) | TAG(16) | ENCRYPTED_DATA
+    const payload = Buffer.concat([iv, authTag, encrypted]);
 
-    // 3. PNG Encode
+    // 2. Encode PNG
     const pngBuf = await dataToPngBuffer(payload);
-    // 4. IMGBB Upload
+
+    // 3. Upload IMGBB (Rate Limited)
     const { url, delete_url, width, height } = await imgbbUpload(pngBuf);
-    // 5. Hash pour vérif
+
+    // 4. Integrity Hash
     const sha = createHash('sha256').update(payload).digest('hex');
-    // 6. Save Chunk Meta
+
+    // 5. Save Chunk Meta
     db.prepare('INSERT INTO chunks (file_id, idx, imgbb_url, imgbb_delete_url, sha256, byte_size, pixel_w, pixel_h) VALUES (?, ?, ?, ?, ?, ?, ?, ?)')
       .run(fileId, idx, url, delete_url, sha, payload.length, width, height);
   }
 });
 
-// Drive: Download (Reconstruct)
+// DRIVE: DOWNLOAD (Reconstruct Stream: IMGBB -> PNG -> Decrypt -> Client)
 app.get('/api/fs/download/:fileId', requireAuth, async (req, res) => {
   const file = db.prepare('SELECT * FROM files WHERE id = ? AND owner_id = ?').get(req.params.fileId, req.session.userId);
   if (!file) return res.status(404).json({ error: 'Introuvable' });
   if (file.mime === 'application/vnd.pixeldrive.folder') return res.status(400).json({ error: 'Est un dossier' });
 
   const chunks = db.prepare('SELECT * FROM chunks WHERE file_id = ? ORDER BY idx').all(file.id);
-  if (chunks.length === 0) return res.status(404).json({ error: 'Aucun chunk' });
+  if (!chunks.length) return res.status(404).json({ error: 'Aucun chunk (corrompu?)' });
 
-  // Key derivation (Même logique qu'upload)
-  const masterSecret = process.env.SESSION_SECRET;
-  const fileKeyRaw = createHash('sha256').update(`${masterSecret}:${req.session.userId}:${file.id}`).digest();
+  const fileKey = getFileKey(req.session.userId, file.id);
 
   res.setHeader('Content-Disposition', `attachment; filename="${encodeURIComponent(file.name)}"`);
   res.setHeader('Content-Type', file.mime);
-  res.setHeader('Content-Length', file.size); // Taille originale
-
-  const decompressor = new zstd.simple.ZstdDecompressor();
+  res.setHeader('Content-Length', file.size);
 
   for (const ch of chunks) {
     try {
-      // 1. Fetch Image
+      // 1. Fetch PNG from IMGBB
       const imgRes = await fetch(ch.imgbb_url);
-      if (!imgRes.ok) throw new Error(`DL IMGBB failed: ${imgRes.status}`);
+      if (!imgRes.ok) throw new Error(`IMGBB DL Failed: ${imgRes.status}`);
       const pngBuf = Buffer.from(await imgRes.arrayBuffer());
 
       // 2. Decode PNG
       const payload = await pngBufferToData(pngBuf, ch.byte_size);
-      
-      // 3. Verify Hash
+
+      // 3. Verify Integrity
       const sha = createHash('sha256').update(payload).digest('hex');
-      if (sha !== ch.sha256) throw new Error(`Hash mismatch chunk ${ch.idx}`);
+      if (sha !== ch.sha256) throw new Error(`Hash Mismatch Chunk ${ch.idx}`);
 
       // 4. Decrypt
       const iv = payload.subarray(0, 12);
       const authTag = payload.subarray(12, 28);
       const encrypted = payload.subarray(28);
-      const decipher = createDecipheriv('aes-256-gcm', fileKeyRaw, iv);
+      
+      const decipher = createDecipheriv('aes-256-gcm', fileKey, iv);
       decipher.setAuthTag(authTag);
-      const compressed = Buffer.concat([decipher.update(encrypted), decipher.final()]);
+      const decrypted = Buffer.concat([decipher.update(encrypted), decipher.final()]);
 
-      // 5. Decompress & Stream
-      const original = decompressor.decompress(new Uint8Array(compressed));
-      res.write(Buffer.from(original));
+      // 5. Stream to Client
+      res.write(decrypted);
 
     } catch (e) {
-      console.error(`Chunk ${ch.idx} error:`, e);
+      console.error(`[DOWNLOAD ERROR] File ${file.id} Chunk ${ch.idx}:`, e);
       return res.destroy(new Error(`Corruption chunk ${ch.idx}`));
     }
   }
   res.end();
 });
 
-// Drive: Preview / Embed (Streaming direct pour Video/Image)
+// DRIVE: PREVIEW / EMBED (Streaming pour Image/Video/Audio/PDF)
 app.get('/api/fs/preview/:fileId', requireAuth, async (req, res) => {
   const file = db.prepare('SELECT * FROM files WHERE id = ? AND owner_id = ?').get(req.params.fileId, req.session.userId);
   if (!file) return res.status(404).send('Not found');
-  
-  // Seuls types embeddables
+
   const embeddable = ['image/', 'video/', 'audio/', 'application/pdf'];
   if (!embeddable.some(t => file.mime.startsWith(t))) return res.status(400).send('Non prévisualisable');
 
-  // Si image unique (1 chunk) -> Redirection directe IMGBB (Cache navigateur)
+  // Optimisation: Si image unique (1 chunk) -> Redirection directe IMGBB (Cache navigateur + Pas de CPU serveur)
   if (file.chunk_count === 1 && file.mime.startsWith('image/')) {
     const ch = db.prepare('SELECT imgbb_url FROM chunks WHERE file_id = ?').get(file.id);
-    if (ch) return res.redirect(ch.imgbb_url);
+    if (ch) return res.redirect(302, ch.imgbb_url);
   }
 
-  // Sinon Streaming reconstruit (Range requests pour vidéo)
-  // NOTE: Implémentation complète Range Request complexe ici.
-  // On fait simple: stream complet (OK pour images, lent pour grosses vidéos seek).
-  // Pour VRAI streaming vidéo, il faut un worker qui reconstruit les chunks demandés.
-  // ICI ON FAIT LE MINIMUM: Stream complet.
-  req.url = `/api/fs/download/${file.id}`; // Hack interne
-  app._router.handle(req, res); // Réutilise download logic
+  // Sinon: Stream reconstruit (Supporte Range Request basique via pipe manuel si besoin, ici simple stream)
+  // Note: Pour vrai streaming vidéo (seek), il faut un Range Parser complexe. 
+  // Ici on stream complet. Suffisant pour images/PDF/petites vidéos.
+  req.params.fileId = file.id; // Réutilise la logique download mais sans attachment header
+  res.setHeader('Content-Disposition', `inline; filename="${encodeURIComponent(file.name)}"`);
+  res.setHeader('Content-Type', file.mime);
+  res.setHeader('Accept-Ranges', 'bytes'); // Indique support potentiel
+  res.setHeader('Content-Length', file.size);
+  
+  // Appel interne de la logique download (on duplique le code pour enlever Content-Disposition attachment)
+  const chunks = db.prepare('SELECT * FROM chunks WHERE file_id = ? ORDER BY idx').all(file.id);
+  const fileKey = getFileKey(req.session.userId, file.id);
+  
+  for (const ch of chunks) {
+    try {
+      const imgRes = await fetch(ch.imgbb_url);
+      if (!imgRes.ok) throw new Error(`IMGBB DL Failed: ${imgRes.status}`);
+      const pngBuf = Buffer.from(await imgRes.arrayBuffer());
+      const payload = await pngBufferToData(pngBuf, ch.byte_size);
+      const sha = createHash('sha256').update(payload).digest('hex');
+      if (sha !== ch.sha256) throw new Error(`Hash Mismatch Chunk ${ch.idx}`);
+      const iv = payload.subarray(0, 12);
+      const authTag = payload.subarray(12, 28);
+      const encrypted = payload.subarray(28);
+      const decipher = createDecipheriv('aes-256-gcm', fileKey, iv);
+      decipher.setAuthTag(authTag);
+      const decrypted = Buffer.concat([decipher.update(encrypted), decipher.final()]);
+      res.write(decrypted);
+    } catch (e) { console.error(e); return res.destroy(e); }
+  }
+  res.end();
 });
 
-// Drive: Delete (Cascade IMGBB + DB)
+// DRIVE: DELETE (Cascade DB + IMGBB)
 app.delete('/api/fs/:fileId', requireAuth, async (req, res) => {
   const file = db.prepare('SELECT * FROM files WHERE id = ? AND owner_id = ?').get(req.params.fileId, req.session.userId);
   if (!file) return res.status(404).json({ error: 'Introuvable' });
 
   const chunks = db.prepare('SELECT imgbb_delete_url FROM chunks WHERE file_id = ?').all(file.id);
   
-  // Supprimer IMGBB (Background, ne pas bloquer)
-  chunks.forEach(ch => {
-    if (ch.imgbb_delete_url) imgbbDelete(ch.imgbb_delete_url).catch(console.error);
-  });
+  // Suppression IMGBB Async (Fire & Forget avec queue)
+  chunks.forEach(ch => { if (ch.imgbb_delete_url) imgbbDelete(ch.imgbb_delete_url); });
 
-  // Supprimer DB (CASCADE supprime chunks)
+  // Suppression DB (CASCADE supprime chunks table)
   db.prepare('DELETE FROM files WHERE id = ?').run(file.id);
   res.json({ ok: true, deletedChunks: chunks.length });
 });
 
-// Admin: Stats
+// ADMIN: STATS
 app.get('/api/admin/stats', requireAuth, requireAdmin, (req, res) => {
   const users = db.prepare('SELECT COUNT(*) as c FROM users').get().c;
   const files = db.prepare('SELECT COUNT(*) as c, SUM(size) as s FROM files WHERE mime != ?').get('application/vnd.pixeldrive.folder');
@@ -369,7 +370,7 @@ app.get('/api/admin/stats', requireAuth, requireAdmin, (req, res) => {
   res.json({ users, files: files.c, totalSize: files.s || 0, chunks: chunks.c });
 });
 
-// --- FRONTEND SPA (Servi sur /) ---
+// --- FRONTEND SPA (Served at /) ---
 const HTML = `<!DOCTYPE html>
 <html lang="fr"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0">
 <title>PixelDrive</title>
@@ -390,7 +391,7 @@ main { flex:1; padding:1.5rem; max-width:900px; width:100%; margin:0 auto; }
 .grid { display:grid; grid-template-columns:repeat(auto-fill, minmax(180px, 1fr)); gap:1rem; }
 .item { background:var(--bg); border:1px solid var(--border); border-radius:6px; padding:1rem; display:flex; flex-direction:column; gap:0.5rem; position:relative; }
 .item.folder { border-color:var(--accent); }
-.item-name { font-weight:500; white-space:nowrap; overflow:hidden; text-overflow:ellipsis; }
+.item-name { font-weight:500; white-space:nowrap; overflow:hidden; text-overflow:ellipsis; cursor:pointer; }
 .item-meta { font-size:0.75rem; color:#8b949e; }
 .item-actions { display:flex; gap:0.25rem; margin-top:auto; padding-top:0.5rem; border-top:1px solid var(--border); }
 .modal { position:fixed; inset:0; background:#0008; display:flex; align-items:center; justify-content:center; z-index:100; }
@@ -402,18 +403,18 @@ main { flex:1; padding:1.5rem; max-width:900px; width:100%; margin:0 auto; }
 @keyframes slide { from { transform:translateX(100%); opacity:0; } to { transform:translateX(0); opacity:1; } }
 .progress-bar { height:4px; background:var(--border); border-radius:2px; overflow:hidden; margin:0.5rem 0; }
 .progress-bar > div { height:100%; background:var(--accent); width:0%; transition:width 0.1s; }
+.hidden { display:none !important; }
 </style>
 </head><body>
 <header>
   <h1>💾 PixelDrive</h1>
   <div>
     <span id="userInfo" style="margin-right:1rem; font-size:0.9rem;"></span>
-    <button id="btnLogout" class="danger" style="display:none;">Déconnexion</button>
+    <button id="btnLogout" class="danger hidden">Déconnexion</button>
     <button id="btnLogin" class="primary">Connexion</button>
   </div>
 </header>
 <main id="app">
-  <!-- Vue Auth -->
   <div id="viewAuth" class="card" style="max-width:400px; margin:2rem auto;">
     <h2 style="margin-bottom:1rem;">Connexion / Inscription</h2>
     <input id="authUser" placeholder="Nom d'utilisateur" style="width:100%; margin-bottom:0.5rem;">
@@ -421,67 +422,65 @@ main { flex:1; padding:1.5rem; max-width:900px; width:100%; margin:0 auto; }
     <button id="btnDoLogin" class="primary" style="width:100%;">Se connecter</button>
     <button id="btnDoRegister" style="width:100%; margin-top:0.5rem;">Créer compte</button>
   </div>
-
-  <!-- Vue Drive (Cachée au debut) -->
   <div id="viewDrive" class="hidden">
-    <div class="card" style="display:flex; gap:0.5rem; flex-wrap:wrap; margin-bottom:1rem;">
-      <input type="file" id="fileInput" multiple>
+    <div class="card" style="display:flex; gap:0.5rem; flex-wrap:wrap; margin-bottom:1rem; align-items:center;">
+      <input type="file" id="fileInput" multiple style="flex:1; min-width:200px;">
       <button id="btnUpload" class="primary">Uploader</button>
       <input type="text" id="mkdirName" placeholder="Nom dossier" style="flex:1; min-width:150px;">
       <button id="btnMkdir">Créer dossier</button>
-      <span style="flex:1;"></span>
-      <span id="pathDisplay" style="align-self:center; color:#8b949e; font-size:0.9rem;">🏠 Racine</span>
+      <button id="btnUpFolder" title="Dossier parent" style="padding:0.5rem 1rem;">⬆</button>
+      <span id="pathDisplay" style="flex:1; text-align:right; color:#8b949e; font-size:0.9rem; white-space:nowrap; overflow:hidden; text-overflow:ellipsis;">🏠 Racine</span>
     </div>
     <div id="progressContainer" class="card hidden">
-      <div>Upload: <span id="progressText">0%</span></div>
+      <div style="display:flex; justify-content:space-between; margin-bottom:0.25rem;"><span>Upload: <span id="progressText">0%</span></span><span id="currentFile" style="font-size:0.8rem; color:#8b949e;"></span></div>
       <div class="progress-bar"><div id="progressBar"></div></div>
     </div>
     <div id="grid" class="grid"></div>
   </div>
 </main>
-
-<!-- Modals -->
-<div id="modalConfirm" class="modal hidden"><div class="modal-content"><h3>Confirmer</h3><p id="modalText"></p><div style="display:flex; justify-content:flex-end; gap:0.5rem;"><button id="modalCancel">Annuler</button><button id="modalOk" class="danger">Supprimer</button></div></div></div>
-<div id="modalPreview" class="modal hidden"><div class="modal-content" style="max-width:90vw; max-height:90vh; padding:0;"><button style="align-self:flex-end; background:none; border:none; color:var(--fg); font-size:1.5rem; padding:0.5rem;">✕</button><div id="previewContent" style="max-height:80vh; overflow:auto;"></div></div></div>
-
+<div id="modalConfirm" class="modal hidden"><div class="modal-content"><h3>Confirmer suppression</h3><p id="modalText"></p><div style="display:flex; justify-content:flex-end; gap:0.5rem;"><button id="modalCancel">Annuler</button><button id="modalOk" class="danger">Supprimer</button></div></div></div>
+<div id="modalPreview" class="modal hidden"><div class="modal-content" style="max-width:90vw; max-height:90vh; padding:0; overflow:hidden;"><button style="align-self:flex-end; background:none; border:none; color:var(--fg); font-size:1.5rem; padding:0.5rem 1rem; cursor:pointer;">✕</button><div id="previewContent" style="max-height:80vh; overflow:auto; background:var(--bg);"></div></div></div>
 <div id="toastContainer"></div>
 
 <script>
-const API = '';
-let currentParentId = null;
-const pathStack = [{id: null, name: 'Racine'}];
-
-// Utils
-const $ = (sel) => document.querySelector(sel);
-const $$ = (sel) => document.querySelectorAll(sel);
+const $ = (s) => document.querySelector(s);
+const $$ = (s) => document.querySelectorAll(s);
 const show = (el) => el.classList.remove('hidden');
 const hide = (el) => el.classList.add('hidden');
 const toast = (msg, type='') => { const t=document.createElement('div'); t.className='toast '+type; t.textContent=msg; $('#toastContainer').append(t); setTimeout(()=>t.remove(), 3000); };
-const req = async (url, opts={}) => { const r = await fetch(API+url, {credentials:'include', headers:{'Content-Type':'application/json', ...(opts.headers||{})}, ...opts}); if(!r.ok){ const e=await r.json().catch(()=>({error:r.statusText})); throw new Error(e.error||r.status); } return r.json(); };
-const reqForm = async (url, formData) => { const r = await fetch(API+url, {method:'POST', credentials:'include', body:formData}); if(!r.ok) throw new Error((await r.json()).error||r.status); return r.json(); };
+const fmtBytes = (b) => { if(!b) return '0o'; const k=1024, u=['o','Ko','Mo','Go','To']; const i=Math.floor(Math.log(b)/Math.log(k)); return (b/Math.pow(k,i)).toFixed(1)+' '+u[i]; };
+
+let currentParentId = null;
+const pathStack = [{id: null, name: 'Racine'}];
+
+// API Helper
+const api = (url, opts={}) => fetch(url, {credentials:'include', headers:{'Content-Type':'application/json', ...(opts.headers||{})}, ...opts}).then(r => { if(!r.ok) return r.json().then(e=>Promise.reject(e.error||r.statusText)); return r.json(); });
 
 // Auth UI
 $('#btnLogin').onclick = () => { hide($('#viewDrive')); show($('#viewAuth')); };
-$('#btnLogout').onclick = async () => { await req('/api/auth/logout', {method:'POST'}); location.reload(); };
-$('#btnDoLogin').onclick = async () => { try{ await req('/api/auth/login', {method:'POST', body:JSON.stringify({username:$('#authUser').value, password:$('#authPass').value})}); toast('Connecté','success'); initDrive(); }catch(e){ toast(e.message,'error'); }};
-$('#btnDoRegister').onclick = async () => { try{ await req('/api/auth/register', {method:'POST', body:JSON.stringify({username:$('#authUser').value, password:$('#authPass').value})}); toast('Compte créé, connectez-vous','success'); }catch(e){ toast(e.message,'error'); }};
+$('#btnLogout').onclick = async () => { await api('/api/auth/logout', {method:'POST'}); location.reload(); };
+$('#btnDoLogin').onclick = async () => { try{ await api('/api/auth/login', {method:'POST', body:JSON.stringify({username:$('#authUser').value, password:$('#authPass').value})}); toast('Connecté','success'); initDrive(); }catch(e){ toast(e,'error'); }};
+$('#btnDoRegister').onclick = async () => { try{ await api('/api/auth/register', {method:'POST', body:JSON.stringify({username:$('#authUser').value, password:$('#authPass').value})}); toast('Compte créé','success'); }catch(e){ toast(e,'error'); }};
 
 // Drive Init
 async function initDrive() {
-  const me = await req('/api/auth/me');
+  const me = await api('/api/auth/me');
   $('#userInfo').textContent = me.user.username + (me.user.isAdmin ? ' 👑' : '');
   hide($('#viewAuth')); hide($('#btnLogin')); show($('#btnLogout')); show($('#viewDrive'));
   loadFolder(null);
 }
 
-// Folder Navigation
+// Navigation
 function updatePath() { $('#pathDisplay').textContent = '🏠 ' + pathStack.map(p=>p.name).join(' / '); }
+$('#btnUpFolder').onclick = () => { if(pathStack.length > 1) { pathStack.pop(); loadFolder(pathStack[pathStack.length-1].id); } };
+
 async function loadFolder(parentId) {
   currentParentId = parentId;
   updatePath();
-  const {items} = await req('/api/fs/list?parent_id=' + (parentId || ''));
+  const {items} = await api('/api/fs/list?parent_id=' + (parentId || ''));
   renderGrid(items);
 }
+
 function renderGrid(items) {
   const grid = $('#grid'); grid.innerHTML = '';
   items.forEach(item => {
@@ -489,14 +488,13 @@ function renderGrid(items) {
     div.className = 'item' + (item.mime === 'application/vnd.pixeldrive.folder' ? ' folder' : '');
     div.innerHTML = \`
       <div class="item-name" title="\${item.name}">\${item.mime === 'application/vnd.pixeldrive.folder' ? '📁' : '📄'} \${item.name}</div>
-      <div class="item-meta">\${item.mime !== 'application/vnd.pixeldrive.folder' ? formatBytes(item.size) + ' • ' + item.chunk_count + ' chunks' : ''}\${new Date(item.created_at).toLocaleString()}</div>
+      <div class="item-meta">\${item.mime !== 'application/vnd.pixeldrive.folder' ? fmtBytes(item.size) + ' • ' + item.chunk_count + ' chunks • ' : ''}\${new Date(item.created_at*1000).toLocaleString()}</div>
       <div class="item-actions">
         \${item.mime !== 'application/vnd.pixeldrive.folder' ? \`<button class="btn-preview" title="Voir/Embed">👁</button>\` : ''}
         \${item.mime !== 'application/vnd.pixeldrive.folder' ? \`<button class="btn-download" title="Télécharger">⬇</button>\` : ''}
         <button class="btn-delete danger" title="Supprimer">🗑</button>
       </div>
     \`;
-    // Events
     if(item.mime === 'application/vnd.pixeldrive.folder') {
       div.querySelector('.item-name').onclick = () => { pathStack.push(item); loadFolder(item.id); };
     } else {
@@ -506,65 +504,63 @@ function renderGrid(items) {
     div.querySelector('.btn-delete').onclick = () => confirmDelete(item.id, item.name, item.mime === 'application/vnd.pixeldrive.folder');
     grid.appendChild(div);
   });
-  // Breadcrumb click
-  $('#pathDisplay').onclick = (e) => { if(e.target.tagName==='SPAN'){} }; // Pas simple sans router, on met bouton "Retour"
 }
 
-// Upload
-$('#btnMkdir').onclick = async () => { const n=$('#mkdirName').value.trim(); if(!n) return; try{ await req('/api/fs/mkdir', {method:'POST', body:JSON.stringify({name:n, parent_id:currentParentId})}); toast('Dossier créé','success'); $('#mkdirName').value=''; loadFolder(currentParentId); }catch(e){ toast(e.message,'error'); }};
+// Mkdir
+$('#btnMkdir').onclick = async () => { const n=$('#mkdirName').value.trim(); if(!n) return; try{ await api('/api/fs/mkdir', {method:'POST', body:JSON.stringify({name:n, parent_id:currentParentId})}); toast('Dossier créé','success'); $('#mkdirName').value=''; loadFolder(currentParentId); }catch(e){ toast(e,'error'); }};
+
+// Upload (XHR for progress)
 $('#btnUpload').onclick = () => $('#fileInput').click();
 $('#fileInput').onchange = async (e) => {
-  const files = e.target.files; if(!files.length) return;
+  const files = Array.from(e.target.files); if(!files.length) return;
   hide($('#btnUpload')); show($('#progressContainer'));
   for(const file of files) {
+    $('#currentFile').textContent = file.name;
     const form = new FormData(); form.append('file', file); form.append('parent_id', currentParentId || '');
     try {
-      // XHR pour progression
       await new Promise((resolve, reject) => {
         const xhr = new XMLHttpRequest();
         xhr.open('POST', '/api/fs/upload', true);
         xhr.withCredentials = true;
         xhr.upload.onprogress = (ev) => { if(ev.lengthComputable) { const p=Math.round(ev.loaded/ev.total*100); $('#progressBar').style.width=p+'%'; $('#progressText').textContent=p+'%'; }};
         xhr.onload = () => { if(xhr.status>=200&&xhr.status<300) resolve(JSON.parse(xhr.response)); else reject(new Error(xhr.responseText)); };
-        xhr.onerror = () => reject(new Error('Network'));
+        xhr.onerror = () => reject(new Error('Network Error'));
         xhr.send(form);
       });
-      toast(\`\${file.name} uploadé\`, 'success');
+      toast(\`\${file.name} uploadé (\${files.length} total)\`, 'success');
     } catch(err) { toast(\`Erreur \${file.name}: \${err.message}\`, 'error'); }
   }
   $('#fileInput').value=''; show($('#btnUpload')); hide($('#progressContainer')); loadFolder(currentParentId);
 };
 
 // Delete
-let deleteTarget = null;
-function confirmDelete(id, name, isFolder) { deleteTarget = {id, isFolder}; $('#modalText').textContent = \`Supprimer \${isFolder?'le dossier':'le fichier'} "\${name}" ? \${isFolder?'(Récursif - TODO)':''}\`; show($('#modalConfirm')); }
+let delTarget = null;
+function confirmDelete(id, name, isFolder) { delTarget = {id, isFolder}; $('#modalText').textContent = \`Supprimer \${isFolder?'le dossier':'le fichier'} "\${name}" ?\`; show($('#modalConfirm')); }
 $('#modalCancel').onclick = () => hide($('#modalConfirm'));
-$('#modalOk').onclick = async () => { if(!deleteTarget) return; try{ await req('/api/fs/'+deleteTarget.id, {method:'DELETE'}); toast('Supprimé','success'); loadFolder(currentParentId); }catch(e){ toast(e.message,'error'); } hide($('#modalConfirm')); deleteTarget=null; };
+$('#modalOk').onclick = async () => { if(!delTarget) return; try{ await api('/api/fs/'+delTarget.id, {method:'DELETE'}); toast('Supprimé','success'); loadFolder(currentParentId); }catch(e){ toast(e,'error'); } hide($('#modalConfirm')); delTarget=null; };
 
 // Preview Modal
 function openPreview(id, mime, name) {
   const c = $('#previewContent'); c.innerHTML = '';
-  if(mime.startsWith('image/')) c.innerHTML = \`<img src="/api/fs/preview/\${id}" style="max-width:100%; max-height:80vh;" alt="\${name}">\`;
-  else if(mime.startsWith('video/') || mime.startsWith('audio/')) c.innerHTML = \`<video controls style="max-width:100%; max-height:80vh;"><source src="/api/fs/preview/\${id}" type="\${mime}"></video>\`;
+  if(mime.startsWith('image/')) c.innerHTML = \`<img src="/api/fs/preview/\${id}" style="max-width:100%; max-height:80vh; display:block; margin:auto;" alt="\${name}">\`;
+  else if(mime.startsWith('video/')) c.innerHTML = \`<video controls style="max-width:100%; max-height:80vh; display:block; margin:auto;"><source src="/api/fs/preview/\${id}" type="\${mime}"></video>\`;
+  else if(mime.startsWith('audio/')) c.innerHTML = \`<audio controls style="width:100%;"><source src="/api/fs/preview/\${id}" type="\${mime}"></audio>\`;
   else if(mime === 'application/pdf') c.innerHTML = \`<iframe src="/api/fs/preview/\${id}" style="width:100%; height:80vh; border:none;"></iframe>\`;
   else c.innerHTML = \`<p style="padding:2rem; text-align:center;">Aperçu non dispo pour \${mime}</p>\`;
   show($('#modalPreview'));
 }
 $('#modalPreview').onclick = (e) => { if(e.target === $('#modalPreview') || e.target.tagName==='BUTTON') hide($('#modalPreview')); };
 
-// Helpers
-function formatBytes(b) { if(b<1024) return b+'o'; const k=1024, sizes=['o','Ko','Mo','Go','To']; const i=Math.floor(Math.log(b)/Math.log(k)); return (b/Math.pow(k,i)).toFixed(1)+' '+sizes[i]; }
-
 // Start
 initDrive().catch(()=>{ show($('#viewAuth')); hide($('#viewDrive')); });
 </script>
 </body></html>`;
 
 app.get('/', (req, res) => res.type('html').send(HTML));
-app.use(express.static('public', { maxAge: '1h' })); // Au cas où tu ajoutes des assets
 
-// --- START ---
+// --- START SERVER ---
 const server = app.listen(PORT, '0.0.0.0', () => console.log(`🚀 PixelDrive running on http://0.0.0.0:${PORT}`));
 
-// Graceful shutdown
-process.on('SIGTERM', () => { console.log('SIGTERM received'); server.close(() => { db.close(); process.exit(0); }); });
+// Graceful Shutdown
+process.on('SIGTERM', () => { console.log('SIGTERM received, closing...'); server.close(() => { db.close(); process.exit(0); }); });
+process.on('SIGINT', () => { console.log('SIGINT received, closing...'); server.close(() => { db.close(); process.exit(0); }); });