Update server.js

server.js

@@ -1,5 +1,5 @@
 // ==========================================
-// PIXELDRIVE v4.5 - SERVER.JS (ESM) - QUOTA TRANSIT JOURNALIER
+// PIXELDRIVE v4.6 - SERVER.JS (ESM) - RENAME/MOVE + QUOTAS
 // ==========================================
 import express from 'express';
 import session from 'express-session';
@@ -34,13 +34,10 @@ const IV_LEN = 12;
 const TAG_LEN = 16;
 const OVERHEAD = IV_LEN + TAG_LEN;
 const IS_PROD = process.env.NODE_ENV === 'production';
-const USER_QUOTA = parseInt(process.env.USER_QUOTA_GB || '50', 10) * 1024 * 1024 * 1024;      // ✅ Stockage (50 GB défaut)
-const DAILY_TRANSFER = parseInt(process.env.DAILY_TRANSFER_GB || '100', 10) * 1024 * 1024 * 1024; // ✅ Transit/jour (100 GB défaut)
+const USER_QUOTA = parseInt(process.env.USER_QUOTA_GB || '50', 10) * 1024 * 1024 * 1024;
+const DAILY_TRANSFER = parseInt(process.env.DAILY_TRANSFER_GB || '100', 10) * 1024 * 1024 * 1024;
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 
-// ==========================================
-// LOGS
-// ==========================================
 function log(level, msg) {
     const n = new Date();
     const ts = [n.getHours(), n.getMinutes(), n.getSeconds()].map(x => String(x).padStart(2, '0')).join(':');
@@ -50,15 +47,11 @@ function log(level, msg) {
     else console.log(line);
 }
 
-// --- ENV ---
 const IMGBB_API_KEY = process.env.IMGBB_API_KEY;
 const SESSION_SECRET = process.env.SESSION_SECRET;
 const ADMIN_USER = process.env.ADMIN_USER || 'admin';
 
-if (!IMGBB_API_KEY || !SESSION_SECRET) {
-    log('FATAL ERROR', 'Variables manquantes: IMGBB_API_KEY, SESSION_SECRET');
-    process.exit(1);
-}
+if (!IMGBB_API_KEY || !SESSION_SECRET) { log('FATAL ERROR', 'Variables manquantes: IMGBB_API_KEY, SESSION_SECRET'); process.exit(1); }
 
 const MASTER_SECRET = process.env.MASTER_SECRET || SESSION_SECRET;
 if (process.env.MASTER_SECRET) log('INFO', 'MASTER_SECRET personnalisé actif');
@@ -66,17 +59,14 @@ else log('WARN', 'MASTER_SECRET non défini → clé maître dérivée de SESSIO
 
 const db = new Database(DB_PATH);
 db.pragma('journal_mode = WAL');
-db.pragma('busy_timeout = 5000');
+db.pragma('busy_timeout = 5000);'.slice(0,0) || db.pragma('busy_timeout = 5000');
 
-// --- CRYPTO ---
 const scryptAsync = promisify(scrypt);
 async function deriveKey(password, salt) { return scryptAsync(password, salt, KEY_LEN); }
 function encryptChunk(dataBuffer, key) { const iv = randomBytes(IV_LEN); const cipher = createCipheriv('aes-256-gcm', key, iv); const encrypted = Buffer.concat([cipher.update(dataBuffer), cipher.final()]); const tag = cipher.getAuthTag(); return Buffer.concat([iv, encrypted, tag]); }
 function decryptChunk(encBuffer, key) { if (encBuffer.length < OVERHEAD) throw new Error('Buffer trop court'); const iv = encBuffer.subarray(0, IV_LEN); const tag = encBuffer.subarray(encBuffer.length - TAG_LEN); const data = encBuffer.subarray(IV_LEN, encBuffer.length - TAG_LEN); const decipher = createDecipheriv('aes-256-gcm', key, iv); decipher.setAuthTag(tag); return Buffer.concat([decipher.update(data), decipher.final()]); }
-
 function esc(s) { return String(s).replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;').replace(/'/g,'&#39;'); }
 
-// --- PNG STEGO ---
 function bufferToPng(buffer) {
     const byteLen = buffer.length;
     const pixelsNeeded = Math.ceil(byteLen / 3);
@@ -96,9 +86,6 @@ async function pngToBuffer(pngBuffer, expectedLen) {
     return rgb.subarray(0, expectedLen);
 }
 
-// ==========================================
-// SCHÉMA (+ table transfer_daily)
-// ==========================================
 db.exec(`
 CREATE TABLE IF NOT EXISTS users (id INTEGER PRIMARY KEY AUTOINCREMENT, username TEXT UNIQUE NOT NULL, password_hash BLOB NOT NULL, salt BLOB NOT NULL, is_admin INTEGER DEFAULT 0, tos_accepted INTEGER DEFAULT 0, avatar BLOB, created_at INTEGER DEFAULT (strftime('%s','now')));
 CREATE TABLE IF NOT EXISTS folders (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER REFERENCES folders(id) ON DELETE CASCADE, owner_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE, name TEXT NOT NULL, created_at INTEGER DEFAULT (strftime('%s','now')), UNIQUE(parent_id, owner_id, name));
@@ -114,15 +101,11 @@ CREATE INDEX IF NOT EXISTS idx_ushares_with ON user_shares(shared_with);
 CREATE INDEX IF NOT EXISTS idx_transfer_day ON transfer_daily(user_id, day);
 `);
 
-// ==========================================
-// MIGRATIONS
-// ==========================================
 function runMigrations() {
     log('INFO', 'Vérification migrations BDD...');
     const usersCols = db.prepare("PRAGMA table_info(users)").all().map(c => c.name);
     if (!usersCols.includes('tos_accepted')) db.exec(`ALTER TABLE users ADD COLUMN tos_accepted INTEGER DEFAULT 0;`);
     if (!usersCols.includes('avatar')) db.exec(`ALTER TABLE users ADD COLUMN avatar BLOB;`);
-
     const filesCols = db.prepare("PRAGMA table_info(files)").all().map(c => c.name);
     const filesDefs = [
         { name: 'folder_id', def: 'INTEGER REFERENCES folders(id) ON DELETE SET NULL' },
@@ -143,13 +126,11 @@ function runMigrations() {
         }
     }
     if (updatedAdded) db.exec(`UPDATE files SET updated_at = strftime('%s','now') WHERE updated_at = 0;`);
-
     const tables = db.prepare("SELECT name FROM sqlite_master WHERE type='table'").all().map(t => t.name);
     if (!tables.includes('folders')) db.exec(`CREATE TABLE folders (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER REFERENCES folders(id) ON DELETE CASCADE, owner_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE, name TEXT NOT NULL, created_at INTEGER DEFAULT (strftime('%s','now')), UNIQUE(parent_id, owner_id, name));`);
     if (!tables.includes('share_links')) db.exec(`CREATE TABLE share_links (token TEXT PRIMARY KEY, file_id TEXT NOT NULL REFERENCES files(id) ON DELETE CASCADE, owner_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE, type TEXT NOT NULL, created_at INTEGER DEFAULT (strftime('%s','now')), expires_at INTEGER);`);
     if (!tables.includes('user_shares')) db.exec(`CREATE TABLE user_shares (id INTEGER PRIMARY KEY AUTOINCREMENT, file_id TEXT REFERENCES files(id) ON DELETE CASCADE, folder_id INTEGER REFERENCES folders(id) ON DELETE CASCADE, owner_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE, shared_with INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE, created_at INTEGER DEFAULT (strftime('%s','now'))); CREATE INDEX idx_ushares_with ON user_shares(shared_with);`);
     if (!tables.includes('transfer_daily')) db.exec(`CREATE TABLE transfer_daily (id INTEGER PRIMARY KEY AUTOINCREMENT, user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE, day TEXT NOT NULL, up_bytes INTEGER DEFAULT 0, down_bytes INTEGER DEFAULT 0, UNIQUE(user_id, day)); CREATE INDEX idx_transfer_day ON transfer_daily(user_id, day);`);
-
     const sessionsCols = tables.includes('sessions') ? db.prepare("PRAGMA table_info(sessions)").all().map(c => c.name) : [];
     if (tables.includes('sessions') && (!sessionsCols.includes('data') || !sessionsCols.includes('expires_at'))) {
         log('WARN', 'Table sessions invalide → reconstruction');
@@ -167,9 +148,7 @@ DROP TRIGGER IF EXISTS update_file_ts;
 CREATE TRIGGER update_file_ts AFTER UPDATE ON files BEGIN UPDATE files SET updated_at = strftime('%s','now') WHERE id = NEW.id; END;
 `);
 
-// ==========================================
-// ✅ QUOTA DE TRANSIT JOURNALIER
-// ==========================================
+// --- QUOTA TRANSIT ---
 function todayKey() { return new Date().toISOString().slice(0, 10); }
 function getTransfer(userId) {
     const r = db.prepare('SELECT up_bytes, down_bytes FROM transfer_daily WHERE user_id=? AND day=?').get(userId, todayKey());
@@ -184,20 +163,15 @@ function addTransfer(userId, bytes, dir) {
             .run(userId, todayKey(), dir === 'up' ? bytes : 0, dir === 'down' ? bytes : 0);
     } catch (e) { log('WARN', `addTransfer: ${e.message}`); }
 }
-function transferBlocked(userId) {
-    return getTransfer(userId).total >= DAILY_TRANSFER;
-}
+function transferBlocked(userId) { return getTransfer(userId).total >= DAILY_TRANSFER; }
 
-// ==========================================
-// NETTOYAGE AUTO + BACKUPS
-// ==========================================
+// --- NETTOYAGE + BACKUPS ---
 function cleanTemp() {
     try {
         const now = Date.now();
         for (const f of readdirSync(TEMP_DIR)) {
             const p = join(TEMP_DIR, f);
-            const st = statSync(p);
-            if (now - st.mtimeMs > 24 * 3600 * 1000) { rmSync(p, { force: true }); log('INFO', `Temp nettoyé: ${f}`); }
+            if (now - statSync(p).mtimeMs > 24 * 3600 * 1000) { rmSync(p, { force: true }); log('INFO', `Temp nettoyé: ${f}`); }
         }
     } catch (e) { log('WARN', `Temp cleanup: ${e.message}`); }
 }
@@ -237,9 +211,7 @@ setInterval(() => { cleanTemp(); cleanErrorFiles(); cleanOldTransfers(); }, 3600
 setInterval(backupDb, 6 * 3600000);
 setTimeout(backupDb, 60000);
 
-// ==========================================
-// RATE LIMITER
-// ==========================================
+// --- RATE LIMITER ---
 function rateLimit({ windowMs = 60000, max = 100, message = 'Trop de requêtes, réessayez plus tard' } = {}) {
     const hits = new Map();
     setInterval(() => { const now = Date.now(); for (const [k, v] of hits) if (now - v.start > windowMs) hits.delete(k); }, Math.max(windowMs, 60000));
@@ -260,24 +232,18 @@ const uploadLimit   = rateLimit({ windowMs: 60*60000, max: 30, message: 'Quota u
 const shareLimit    = rateLimit({ windowMs: 60*60000, max: 50, message: 'Trop de partages' });
 const avatarLimit   = rateLimit({ windowMs: 60*60000, max: 10, message: 'Trop de changements d\'avatar' });
 
-// ==========================================
-// CSRF
-// ==========================================
+// --- CSRF ---
 function csrfGuard(req, res, next) {
     if (['GET', 'HEAD', 'OPTIONS'].includes(req.method)) return next();
     const origin = req.headers.origin;
     if (origin) {
         let oHost;
         try { oHost = new URL(origin).host; } catch (e) { return res.status(403).json({ error: 'Origin invalide' }); }
-        if (oHost !== req.get('host')) {
-            log('WARN', `CSRF bloqué: origin=${origin} host=${req.get('host')}`);
-            return res.status(403).json({ error: 'Requête cross-origin refusée' });
-        }
+        if (oHost !== req.get('host')) { log('WARN', `CSRF bloqué: origin=${origin}`); return res.status(403).json({ error: 'Requête cross-origin refusée' }); }
     }
     next();
 }
 
-// --- SESSION STORE ---
 class SQLiteStore extends session.Store {
     get(sid, cb) { try { const r = db.prepare('SELECT data, expires_at FROM sessions WHERE sid=?').get(sid); if(!r) return cb(null, null); if(r.expires_at < Date.now()){ db.prepare('DELETE FROM sessions WHERE sid=?').run(sid); return cb(null, null); } cb(null, JSON.parse(r.data)); } catch(e){ cb(e); } }
     set(sid, sess, cb) { try { const exp = sess.cookie?.expires ? new Date(sess.cookie.expires).getTime() : Date.now() + 30*24*60*60*1000; db.prepare('INSERT OR REPLACE INTO sessions(sid,data,expires_at) VALUES(?,?,?)').run(sid, JSON.stringify(sess), exp); cb(null); } catch(e){ cb(e); } }
@@ -288,7 +254,6 @@ class SQLiteStore extends session.Store {
 }
 const sessionStore = new SQLiteStore();
 
-// --- ADMIN ---
 const adminRow = db.prepare('SELECT * FROM users WHERE username=?').get(ADMIN_USER);
 if (!adminRow) {
     const salt = randomBytes(16);
@@ -297,10 +262,8 @@ if (!adminRow) {
     log('INFO', `Compte admin créé: ${ADMIN_USER}`);
 }
 
-// --- EXPRESS ---
 const app = express();
 app.set('trust proxy', 1);
-
 app.use((req, res, next) => {
     res.set({
         'X-Content-Type-Options': 'nosniff',
@@ -310,28 +273,18 @@ app.use((req, res, next) => {
         'Cross-Origin-Opener-Policy': 'same-origin',
         'Content-Security-Policy': "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; media-src 'self'; connect-src 'self'; frame-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'",
     });
-    if (req.secure || req.get('x-forwarded-proto') === 'https') {
-        res.set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
-    }
+    if (req.secure || req.get('x-forwarded-proto') === 'https') res.set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
     next();
 });
-
 app.use(express.json({ limit: '50mb' }));
 app.use(express.urlencoded({ extended: true, limit: '50mb' }));
-app.use(session({
-    secret: SESSION_SECRET,
-    store: sessionStore,
-    resave: false,
-    saveUninitialized: false,
-    cookie: { secure: IS_PROD, httpOnly: true, maxAge: 30*24*60*60*1000, sameSite: 'lax' }
-}));
+app.use(session({ secret: SESSION_SECRET, store: sessionStore, resave: false, saveUninitialized: false, cookie: { secure: IS_PROD, httpOnly: true, maxAge: 30*24*60*60*1000, sameSite: 'lax' } }));
 app.use('/api', csrfGuard);
 app.use('/api', globalLimit);
 
 const requireAuth = (req, res, next) => { if(!req.session.userId) return res.status(401).json({error:'Non authentifié'}); next(); };
 const requireTos = (req, res, next) => { if(!req.session.tosAccepted) return res.status(403).json({error:'CGU non acceptées', needTos:true}); next(); };
 
-// --- CACHE ---
 class ByteLRUCache extends LRUCache { constructor(){ super({maxSize:CACHE_MAX_BYTES, sizeCalculation:v=>v.size}); } }
 const fileCache = new ByteLRUCache();
 setInterval(()=>{ const m = process.memoryUsage(); if(m.rss > 13*1024*1024*1024){ log('ALERT', `RAM ${(m.rss/1e9).toFixed(1)}GB → vidage du cache`); fileCache.clear(); if(global.gc) global.gc(); } }, 30000);
@@ -343,27 +296,22 @@ setInterval(() => {
     if (s.changes || l.changes) log('INFO', `Cleanup: ${s.changes} session(s), ${l.changes} lien(s) expiré(s)`);
 }, 3600000);
 
-// --- NSFW ---
 let nsfwModel = null;
 async function loadNsfwModel(){ try{ await tf.setBackend('wasm'); tf.wasm.setWasmPaths('/app/tfjs_wasm/','tfjs-backend-wasm.wasm'); await tf.ready(); nsfwModel = await nsfwjs.load('/app/tfjs_wasm/',{type:'mobilenet_v2',size:224}); log('INFO', 'NSFW WASM chargé'); }catch(e){ log('WARN', `NSFW load fail: ${e.message}`); } }
 loadNsfwModel();
 async function checkNsfw(buf){ if(!nsfwModel) return {safe:true}; try{ const t=tf.node.decodeImage(buf,3).resizeNearestNeighbor([224,224]).expandDims(0); const p=await nsfwModel.classify(t); t.dispose(); const porn=p.find(x=>x.className==='Porn'||x.className==='Sexual Activity')?.probability||0; const hentai=p.find(x=>x.className==='Hentai')?.probability||0; if(porn>0.85||hentai>0.9) return {safe:false}; return {safe:true}; }catch(e){ return {safe:true}; } }
 
-// --- QUEUE ---
 class UploadQueue{ constructor(c){ this.c=c; this.r=0; this.q=[]; } add(t){ return new Promise((res,rej)=>{ this.q.push({t,res,rej}); this.proc(); }); } async proc(){ if(this.r>=this.c||!this.q.length) return; this.r++; const {t,res,rej}=this.q.shift(); try{ res(await t()); }catch(e){ rej(e); }finally{ this.r--; this.proc(); } } }
 const uploadQueue = new UploadQueue(MAX_CONCURRENT_UPLOADS);
 
-// --- IMGBB ---
 async function imgbbUpload(buf){ const f=new FormData(); f.append('image',buf.toString('base64')); const {data}=await axios.post(`https://api.imgbb.com/1/upload?key=${IMGBB_API_KEY}`,f,{headers:f.getHeaders(),timeout:120000,maxContentLength:Infinity,maxBodyLength:Infinity}); if(!data.success) throw new Error(data.error?.message||'ImgBB fail'); return {url:data.data.url,deleteUrl:data.data.delete_url,id:data.data.id}; }
 async function imgbbDelete(u){ try{await axios.get(u,{timeout:10000});}catch(_){} }
 
-// --- KEYS ---
 const SERVER_MASTER_KEY = createHash('sha256').update(MASTER_SECRET + '|PixelDriveMaster').digest();
 function encryptMasterKey(k){ const iv=randomBytes(12); const c=createCipheriv('aes-256-gcm',SERVER_MASTER_KEY,iv); return Buffer.concat([iv,c.update(k),c.final(),c.getAuthTag()]); }
 function decryptMasterKey(b){ const iv=b.subarray(0,12), tag=b.subarray(-16), d=b.subarray(12,-16); const dc=createDecipheriv('aes-256-gcm',SERVER_MASTER_KEY,iv); dc.setAuthTag(tag); return Buffer.concat([dc.update(d),dc.final()]); }
 async function getMasterKey(fid){ const r=db.prepare('SELECT master_key_enc FROM files WHERE id=?').get(fid); if(!r?.master_key_enc) throw new Error('Clé manquante'); return decryptMasterKey(r.master_key_enc); }
 
-// --- CONTRÔLE D'ACCÈS ---
 function canAccessFolder(userId, folderId){
     let cur = db.prepare('SELECT * FROM folders WHERE id=?').get(folderId);
     let depth = 0;
@@ -384,7 +332,6 @@ function canAccessFile(userId, fileId){
     return null;
 }
 
-// --- THUMB ---
 async function genThumb(fid,mime,key){
     if(!mime.startsWith('image/')&&!mime.startsWith('video/')) return;
     try{
@@ -400,7 +347,6 @@ async function genThumb(fid,mime,key){
     }catch(e){ log('WARN', `Thumb ${fid}: ${e.message}`); }
 }
 
-// --- STREAM (✅ compte le transit download) ---
 async function streamFile(res,file,key,range,counterUserId){
     const chunks = db.prepare('SELECT chunk_index,imgbb_url,size FROM file_chunks WHERE file_id=? ORDER BY chunk_index').all(file.id);
     const total = file.size;
@@ -410,7 +356,7 @@ async function streamFile(res,file,key,range,counterUserId){
     const sentBytes = e - s + 1;
     res.set({'Content-Type':file.mime,'Content-Length':sentBytes,'Accept-Ranges':'bytes','Content-Disposition':`inline; filename="${encodeURIComponent(file.name)}"`});
     if(range){ res.status(206); res.set('Content-Range', `bytes ${s}-${e}/${total}`); }
-    log('INFO', `Stream ${file.name} (${(sentBytes/1048576).toFixed(2)} MB, ${chunks.length} chunk(s))`);
+    log('INFO', `Stream ${file.name} (${(sentBytes/1048576).toFixed(2)} MB)`);
     let cur = 0;
     for(const c of chunks){
         const cs = cur, ce = cur + c.size - 1;
@@ -423,10 +369,9 @@ async function streamFile(res,file,key,range,counterUserId){
                     const t0 = Date.now();
                     const {data} = await axios.get(c.imgbb_url,{responseType:'arraybuffer',timeout:120000});
                     const t1 = Date.now();
-                    log('INFO', `  Chunk ${c.chunk_index}: ${(data.byteLength/1048576).toFixed(2)} MB en ${t1-t0}ms`);
                     const enc = await pngToBuffer(Buffer.from(data), c.size + OVERHEAD);
                     dec = decryptChunk(enc, key);
-                    log('INFO', `  Chunk ${c.chunk_index}: décodé+déchiffré en ${Date.now()-t1}ms`);
+                    log('INFO', `  Chunk ${c.chunk_index}: ${(data.byteLength/1048576).toFixed(2)} MB en ${Date.now()-t0}ms`);
                     fileCache.set(ck, {data: dec, size: dec.length});
                 }
                 const sl = dec.subarray(off, off + len);
@@ -437,10 +382,9 @@ async function streamFile(res,file,key,range,counterUserId){
         if(cs > e) break;
     }
     res.end();
-    if (counterUserId) addTransfer(counterUserId, sentBytes, 'down'); // ✅ transit ↓
+    if (counterUserId) addTransfer(counterUserId, sentBytes, 'down');
 }
 
-// --- SSE ---
 const sseClients = new Map();
 function broadcast(fid,d){ const cs = sseClients.get(fid); if(cs){ const p = `data: ${JSON.stringify(d)}\n\n`; for(const r of cs) r.write(p); } }
 
@@ -453,8 +397,7 @@ app.post('/api/register', registerLimit, async(req,res)=>{
     if(typeof u !== 'string' || !/^[a-zA-Z0-9_.\-]{3,20}$/.test(u)) return res.status(400).json({error:'Nom d\'utilisateur invalide (3-20 caractères alphanumériques)'});
     if(typeof p !== 'string' || p.length < 6) return res.status(400).json({error:'Mot de passe trop court (6 caractères min)'});
     if(db.prepare('SELECT 1 FROM users WHERE username=?').get(u)) return res.status(409).json({error:'Existe'});
-    const s = randomBytes(16);
-    const h = await deriveKey(p, s);
+    const s = randomBytes(16); const h = await deriveKey(p, s);
     db.prepare('INSERT INTO users(username,password_hash,salt,tos_accepted) VALUES(?,?,?,1)').run(u,h,s);
     log('INFO', `Nouvel utilisateur: ${u}`);
     res.json({ok:true});
@@ -466,35 +409,23 @@ app.post('/api/login', loginLimit, async(req,res)=>{
     if(!usr) return res.status(401).json({error:'Invalide'});
     const h = await deriveKey(p, usr.salt);
     if(!h.equals(usr.password_hash)) return res.status(401).json({error:'Invalide'});
-    try {
-        await new Promise((ok, bad) => req.session.regenerate(e => e ? bad(e) : ok()));
-    } catch(e) {
-        log('ERROR', `Session regenerate échouée: ${e.message}`);
-        return res.status(500).json({error:'Erreur session'});
-    }
-    req.session.userId = usr.id;
-    req.session.isAdmin = !!usr.is_admin;
-    req.session.tosAccepted = !!usr.tos_accepted;
-    req.session.username = usr.username;
+    try { await new Promise((ok, bad) => req.session.regenerate(e => e ? bad(e) : ok())); }
+    catch(e) { log('ERROR', `Session regenerate échouée: ${e.message}`); return res.status(500).json({error:'Erreur session'}); }
+    req.session.userId = usr.id; req.session.isAdmin = !!usr.is_admin; req.session.tosAccepted = !!usr.tos_accepted; req.session.username = usr.username;
     log('INFO', `Connexion: ${u}`);
     res.json({ok:true,user:{id:usr.id,username:usr.username,isAdmin:!!usr.is_admin,tosAccepted:!!usr.tos_accepted}});
 });
 app.post('/api/logout',(req,res)=>req.session.destroy(()=>res.json({ok:true})));
 
-// ✅ /api/me AVEC QUOTAS (stockage + transit)
 app.get('/api/me',(req,res)=>{
     if(!req.session.userId) return res.status(401).json({error:'Non connecté'});
     const used = db.prepare("SELECT COALESCE(SUM(size),0) as t FROM files WHERE owner_id=? AND status!='error'").get(req.session.userId).t;
     const tr = getTransfer(req.session.userId);
-    res.json({
-        id:req.session.userId, username:req.session.username, isAdmin:req.session.isAdmin, tosAccepted:req.session.tosAccepted,
-        quotaUsed:used, quotaMax:USER_QUOTA,
-        transferUp:tr.up, transferDown:tr.down, transferUsed:tr.total, transferMax:DAILY_TRANSFER
-    });
+    res.json({ id:req.session.userId, username:req.session.username, isAdmin:req.session.isAdmin, tosAccepted:req.session.tosAccepted,
+        quotaUsed:used, quotaMax:USER_QUOTA, transferUp:tr.up, transferDown:tr.down, transferUsed:tr.total, transferMax:DAILY_TRANSFER });
 });
 app.post('/api/tos/accept',requireAuth,(req,res)=>{db.prepare('UPDATE users SET tos_accepted=1 WHERE id=?').run(req.session.userId);req.session.tosAccepted=true;res.json({ok:true});});
 
-// AVATARS
 app.post('/api/avatar', requireAuth, avatarLimit, async(req,res)=>{
     const { data } = req.body;
     if (!data || !data.startsWith('data:image/')) return res.status(400).json({error:'Image invalide'});
@@ -515,7 +446,6 @@ app.get('/api/users/:id/avatar',(req,res)=>{
     res.send(u.avatar);
 });
 
-// Folders
 app.get('/api/folders',requireAuth,(req,res)=>{
     const p = req.query.parent_id ? parseInt(req.query.parent_id) : null;
     if (p !== null) {
@@ -527,7 +457,36 @@ app.get('/api/folders',requireAuth,(req,res)=>{
 app.post('/api/folders',requireAuth,requireTos,(req,res)=>{const{n,p}=req.body;if(!n||typeof n!=='string'||n.length>100)return res.status(400).json({error:'Nom requis'});try{const i=db.prepare('INSERT INTO folders(name,parent_id,owner_id) VALUES(?,?,?)').run(n,p||null,req.session.userId);res.json({id:i.lastInsertRowid,name:n,parent_id:p});}catch(e){res.status(409).json({error:'Existe'});}});
 app.delete('/api/folders/:id',requireAuth,(req,res)=>{db.prepare('DELETE FROM folders WHERE id=? AND owner_id=?').run(req.params.id,req.session.userId);res.json({ok:true});});
 
-// Files
+// ✅ RENAMER DOSSIER
+app.post('/api/folders/:id/rename',requireAuth,(req,res)=>{
+    const { name } = req.body;
+    if(!name || typeof name !== 'string' || !name.trim() || name.length > 100) return res.status(400).json({error:'Nom invalide'});
+    const fo = db.prepare('SELECT id FROM folders WHERE id=? AND owner_id=?').get(req.params.id, req.session.userId);
+    if(!fo) return res.status(404).json({error:'Introuvable'});
+    try { db.prepare('UPDATE folders SET name=? WHERE id=?').run(name.trim(), req.params.id); res.json({ok:true}); }
+    catch(e){ res.status(409).json({error:'Un dossier porte déjà ce nom'}); }
+});
+
+// ✅ DÉPLACER DOSSIER (anti-cycle)
+app.post('/api/folders/:id/move',requireAuth,(req,res)=>{
+    const { parent_id } = req.body;
+    const fo = db.prepare('SELECT * FROM folders WHERE id=? AND owner_id=?').get(req.params.id, req.session.userId);
+    if(!fo) return res.status(404).json({error:'Introuvable'});
+    if (parent_id) {
+        const target = db.prepare('SELECT * FROM folders WHERE id=?').get(parent_id);
+        if (!target || target.owner_id !== req.session.userId) return res.status(403).json({error:'Dossier cible invalide'});
+        let cur = target, depth = 0;
+        while (cur && depth < 50) {
+            if (cur.id === fo.id) return res.status(400).json({error:'Impossible de déplacer un dossier dans lui-même'});
+            cur = cur.parent_id ? db.prepare('SELECT * FROM folders WHERE id=?').get(cur.parent_id) : null;
+            depth++;
+        }
+    }
+    db.prepare('UPDATE folders SET parent_id=? WHERE id=?').run(parent_id || null, req.params.id);
+    log('INFO', `Dossier ${req.params.id} déplacé → ${parent_id || 'racine'}`);
+    res.json({ok:true});
+});
+
 app.get('/api/files',requireAuth,(req,res)=>{
     const f = req.query.folder_id ? parseInt(req.query.folder_id) : null;
     if (f !== null) {
@@ -537,7 +496,32 @@ app.get('/api/files',requireAuth,(req,res)=>{
     res.json(db.prepare('SELECT * FROM files WHERE owner_id=? AND folder_id IS NULL ORDER BY name COLLATE NOCASE').all(req.session.userId));
 });
 
-// Partage utilisateurs
+// ✅ RENAMER FICHIER
+app.post('/api/files/:id/rename',requireAuth,(req,res)=>{
+    if(!UUID_RE.test(req.params.id)) return res.status(400).json({error:'ID invalide'});
+    const { name } = req.body;
+    if(!name || typeof name !== 'string' || !name.trim() || name.length > 200) return res.status(400).json({error:'Nom invalide'});
+    const f = db.prepare('SELECT id FROM files WHERE id=? AND owner_id=?').get(req.params.id, req.session.userId);
+    if(!f) return res.status(404).json({error:'Introuvable'});
+    db.prepare('UPDATE files SET name=? WHERE id=?').run(name.trim(), req.params.id);
+    res.json({ok:true});
+});
+
+// ✅ DÉPLACER FICHIER
+app.post('/api/files/:id/move',requireAuth,(req,res)=>{
+    if(!UUID_RE.test(req.params.id)) return res.status(400).json({error:'ID invalide'});
+    const { folder_id } = req.body;
+    const f = db.prepare('SELECT id FROM files WHERE id=? AND owner_id=?').get(req.params.id, req.session.userId);
+    if(!f) return res.status(404).json({error:'Introuvable'});
+    if (folder_id) {
+        const target = db.prepare('SELECT owner_id FROM folders WHERE id=?').get(folder_id);
+        if (!target || target.owner_id !== req.session.userId) return res.status(403).json({error:'Dossier cible invalide'});
+    }
+    db.prepare('UPDATE files SET folder_id=? WHERE id=?').run(folder_id || null, req.params.id);
+    log('INFO', `Fichier ${req.params.id} déplacé → ${folder_id || 'racine'}`);
+    res.json({ok:true});
+});
+
 app.post('/api/share-user',requireAuth,requireTos,shareLimit,(req,res)=>{
     const { type, id, username } = req.body;
     if (!type || !id || !username) return res.status(400).json({error:'Champs manquants'});
@@ -572,18 +556,14 @@ app.delete('/api/my-shares/:id',requireAuth,(req,res)=>{
     res.json({ok:true});
 });
 
-// Liens publics
 app.get('/api/share-links',requireAuth,(req,res)=>{ res.json(db.prepare(`SELECT sl.*, f.name as file_name, f.mime, f.size FROM share_links sl LEFT JOIN files f ON sl.file_id = f.id WHERE sl.owner_id = ? ORDER BY sl.created_at DESC`).all(req.session.userId)); });
 app.delete('/api/share-links/:token',requireAuth,(req,res)=>{ const r = db.prepare('DELETE FROM share_links WHERE token=? AND owner_id=?').run(req.params.token, req.session.userId); if (!r.changes) return res.status(404).json({error:'Introuvable'}); res.json({ok:true}); });
 
-// ✅ UPLOAD : quota stockage + quota transit + NSFW
 const upload = multer({dest:TEMP_DIR,limits:{fileSize:5*1024*1024*1024}});
 app.post('/api/files/upload',requireAuth,requireTos,uploadLimit,upload.single('file'),async(req,res)=>{
     if(!req.file)return res.status(400).json({error:'Fichier manquant'});
     const uid = req.session.userId;
     const fsize = req.file.size;
-
-    // ✅ Quota transit journalier (upload)
     const tr = getTransfer(uid);
     const remaining = DAILY_TRANSFER - tr.total;
     if (remaining <= 0) {
@@ -595,14 +575,11 @@ app.post('/api/files/upload',requireAuth,requireTos,uploadLimit,upload.single('f
         try { unlinkSync(req.file.path); } catch (_) {}
         return res.status(413).json({error:`Quota journalier insuffisant (reste ${(remaining/1073741824).toFixed(1)} GB)`});
     }
-
-    // Quota stockage
     const used = db.prepare("SELECT COALESCE(SUM(size),0) as t FROM files WHERE owner_id=? AND status!='error'").get(uid).t;
     if (used + fsize > USER_QUOTA) {
         try { unlinkSync(req.file.path); } catch (_) {}
         return res.status(413).json({error:`Quota de stockage dépassé (${(USER_QUOTA/1073741824).toFixed(0)} GB max)`});
     }
-
     const fid=uuidv4(),fpath=req.file.path,cc=Math.ceil(fsize/CHUNK_SIZE),mk=randomBytes(KEY_LEN),kh=createHash('sha256').update(mk).digest('hex'),mke=encryptMasterKey(mk),fidParam=req.body.folder_id?parseInt(req.body.folder_id):null;
     db.prepare(`INSERT INTO files(id,folder_id,owner_id,name,mime,size,chunk_count,status,encryption_key_hash,master_key_enc) VALUES(?,?,?,?,?,?,?,'pending',?,?)`).run(fid,fidParam,uid,req.file.originalname,req.file.mimetype,fsize,cc,kh,mke);
     const stmt=db.prepare('INSERT INTO file_chunks(file_id,chunk_index,size,encrypted_len) VALUES(?,?,?,?)');
@@ -625,10 +602,7 @@ async function processUpload(fid,path,mk,cc,mime,fsize,username,uid){
             const raw=await readChunk(path,off,ci.size);
             if (i === 0 && mime.startsWith('image/')) {
                 const scan = await checkNsfw(raw);
-                if (!scan.safe) {
-                    log('ALERT', `NSFW bloqué: ${fid} par ${username}`);
-                    throw new Error('Contenu bloqué par le filtre de modération');
-                }
+                if (!scan.safe) { log('ALERT', `NSFW bloqué: ${fid} par ${username}`); throw new Error('Contenu bloqué par le filtre de modération'); }
             }
             const enc=encryptChunk(raw,mk);
             if(enc.length>ci.encrypted_len)throw new Error(`Overflow chunk ${i}`);
@@ -646,10 +620,9 @@ async function processUpload(fid,path,mk,cc,mime,fsize,username,uid){
         await genThumb(fid,mime,mk);
         db.prepare("UPDATE files SET status='ready',progress=100 WHERE id=?").run(fid);
         broadcast(fid,{type:'progress',progress:100,status:'ready',type:'done'});
-        addTransfer(uid, fsize, 'up'); // ✅ transit ↑
+        addTransfer(uid, fsize, 'up');
         const secs = (Date.now()-t0)/1000;
-        const speed = (fsize/1048576)/secs;
-        log('INFO', `Upload terminé: ${fid} en ${secs.toFixed(1)}s (${speed.toFixed(2)} MB/s)`);
+        log('INFO', `Upload terminé: ${fid} en ${secs.toFixed(1)}s (${(fsize/1048576/secs).toFixed(2)} MB/s)`);
     }catch(e){
         log('ERROR', `Upload échoué ${fid}: ${e.message}`);
         db.prepare("UPDATE files SET status='error',error_msg=? WHERE id=?").run(e.message,fid);
@@ -661,13 +634,9 @@ async function processUpload(fid,path,mk,cc,mime,fsize,username,uid){
 }
 function readChunk(p,o,l){return new Promise((res,rej)=>{const s=createReadStream(p,{start:o,end:o+l-1}),c=[];s.on('data',d=>c.push(d)).on('end',()=>res(Buffer.concat(c,l))).on('error',rej);});}
 
-// ✅ DOWNLOAD : quota transit du demandeur
 app.get('/api/files/:id/download',requireAuth,async(req,res)=>{
     if(!UUID_RE.test(req.params.id)) return res.status(400).json({error:'ID invalide'});
-    if (transferBlocked(req.session.userId)) {
-        log('ALERT', `Quota transit atteint (download bloqué): ${req.session.username}`);
-        return res.status(429).json({error:'Quota de transfert journalier atteint, réessayez demain'});
-    }
+    if (transferBlocked(req.session.userId)) { log('ALERT', `Quota transit atteint (download bloqué): ${req.session.username}`); return res.status(429).json({error:'Quota de transfert journalier atteint, réessayez demain'}); }
     const f = canAccessFile(req.session.userId, req.params.id);
     if(!f)return res.status(404).json({error:'Introuvable'});
     if(f.status!=='ready')return res.status(409).json({error:'Pas prêt',status:f.status});
@@ -684,7 +653,6 @@ app.post('/api/files/:id/share',requireAuth,shareLimit,async(req,res)=>{
     res.json({preview:`/s/${pt}`,download:`/d/${dt2}`,expires});
 });
 
-// PAGE PUBLIQUE
 app.get('/s/:token',async(req,res)=>{
     const l=db.prepare('SELECT * FROM share_links WHERE token=? AND type=? AND (expires_at IS NULL OR expires_at>?)').get(req.params.token,'embed',Date.now());
     if(!l)return res.status(404).send(html('Lien invalide/expiré'));
@@ -703,19 +671,15 @@ app.get('/s/:token',async(req,res)=>{
     { title: name, desc: `${sizeMb} MB · PixelDrive — partage sécurisé`, image: ogImage }));
 });
 
-// ✅ DOWNLOAD PUBLIC : quota transit du PROPRIÉTAIRE
 app.get('/d/:token',async(req,res)=>{
     const l=db.prepare('SELECT * FROM share_links WHERE token=? AND type=? AND (expires_at IS NULL OR expires_at>?)').get(req.params.token,'download',Date.now());
     if(!l)return res.status(404).json({error:'Invalide'});
     const f=db.prepare('SELECT * FROM files WHERE id=?').get(l.file_id);
     if(!f||f.status!=='ready')return res.status(404).json({error:'Indisponible'});
-    if (transferBlocked(f.owner_id)) {
-        log('ALERT', `Quota transit propriétaire atteint (lien public bloqué): fichier ${f.id}`);
-        return res.status(429).json({error:'Quota journalier du propriétaire atteint'});
-    }
+    if (transferBlocked(f.owner_id)) { log('ALERT', `Quota transit propriétaire atteint: ${f.id}`); return res.status(429).json({error:'Quota journalier du propriétaire atteint'}); }
     log('INFO', `Téléchargement public /d/${req.params.token} (${f.name})`);
-    const mk=decryptMasterKey(db.prepare('SELECT master_key_enc FROM files WHERE id=?').get(f.id).master_key_enc);
-    await streamFile(res,f,k mk,req.headers.range,f.owner_id);
+    const mk = decryptMasterKey(db.prepare('SELECT master_key_enc FROM files WHERE id=?').get(f.id).master_key_enc);
+    await streamFile(res,f,mk,req.headers.range,f.owner_id);
 });
 
 app.delete('/api/files/:id',requireAuth,async(req,res)=>{
@@ -755,7 +719,6 @@ app.get('/api/files/:id/progress',requireAuth,(req,res)=>{
 app.get('/api/admin/users',requireAuth,(req,res)=>{if(!req.session.isAdmin)return res.status(403).json({error:'Admin only'});res.json(db.prepare('SELECT id,username,is_admin,tos_accepted,created_at FROM users').all());});
 app.get('/health',(_,res)=>res.json({ok:true,cache:fileCache.size,mem:process.memoryUsage()}));
 
-// STATIQUE
 app.use(express.static(PUBLIC_DIR, { dotfiles: 'deny', index: false }));
 app.get('/manifest.json', (req,res) => res.sendFile(join(__dirname, 'manifest.json')));
 app.get('*', (req, res) => {
@@ -763,14 +726,13 @@ app.get('*', (req, res) => {
     res.sendFile(join(PUBLIC_DIR, 'index.html'));
 });
 
-// ERROR HANDLER
 app.use((err, req, res, next) => {
     if (err.type === 'entity.parse.failed' || err instanceof SyntaxError) return res.status(400).json({ error: 'Bad Request' });
     log('ERROR', `Server: ${err.message}`);
     res.status(500).json({ error: 'Internal Server Error' });
 });
 
-const server = app.listen(PORT, '0.0.0.0', () => log('INFO', `PixelDrive v4.5 démarré | stockage ${(USER_QUOTA/1073741824).toFixed(0)} GB/user | transit ${(DAILY_TRANSFER/1073741824).toFixed(0)} GB/jour/user`));
+const server = app.listen(PORT, '0.0.0.0', () => log('INFO', `PixelDrive v4.6 démarré | stockage ${(USER_QUOTA/1073741824).toFixed(0)} GB | transit ${(DAILY_TRANSFER/1073741824).toFixed(0)} GB/j`));
 process.on('SIGTERM', () => { log('WARN', 'SIGTERM reçu, arrêt...'); server.close(() => process.exit(0)); });
 
 function html(b, og) {