Update server.js

server.js

@@ -1,5 +1,5 @@
 // ==========================================
-// PIXELDRIVE v3.2 - SERVER.JS (ESM) - COMPLET
+// PIXELDRIVE v3.3 - SERVER.JS (ESM)
 // ==========================================
 import express from 'express';
 import session from 'express-session';
@@ -32,7 +32,6 @@ const IV_LEN = 12;
 const TAG_LEN = 16;
 const OVERHEAD = IV_LEN + TAG_LEN;
 
-// --- ENV ---
 const IMGBB_API_KEY = process.env.IMGBB_API_KEY;
 const SESSION_SECRET = process.env.SESSION_SECRET;
 const ADMIN_USER = process.env.ADMIN_USER || 'admin';
@@ -42,130 +41,50 @@ if (!IMGBB_API_KEY || !SESSION_SECRET) {
     process.exit(1);
 }
 
-// --- DATABASE INSTANCE ---
 const db = new Database(DB_PATH);
 db.pragma('journal_mode = WAL');
 db.pragma('busy_timeout = 5000');
 
-// --- CRYPTO UTILS ---
+// --- CRYPTO ---
 const scryptAsync = promisify(scrypt);
 async function deriveKey(password, salt) { return scryptAsync(password, salt, KEY_LEN); }
-function encryptChunk(dataBuffer, key) { 
-    const iv = randomBytes(IV_LEN); 
-    const cipher = createCipheriv('aes-256-gcm', key, iv); 
-    const encrypted = Buffer.concat([cipher.update(dataBuffer), cipher.final()]); 
-    const tag = cipher.getAuthTag(); 
-    return Buffer.concat([iv, encrypted, tag]); 
+function encryptChunk(dataBuffer, key) { const iv = randomBytes(IV_LEN); const cipher = createCipheriv('aes-256-gcm', key, iv); const encrypted = Buffer.concat([cipher.update(dataBuffer), cipher.final()]); const tag = cipher.getAuthTag(); return Buffer.concat([iv, encrypted, tag]); }
+function decryptChunk(encBuffer, key) { if (encBuffer.length < OVERHEAD) throw new Error('Buffer trop court'); const iv = encBuffer.subarray(0, IV_LEN); const tag = encBuffer.subarray(encBuffer.length - TAG_LEN); const data = encBuffer.subarray(IV_LEN, encBuffer.length - TAG_LEN); const decipher = createDecipheriv('aes-256-gcm', key, iv); decipher.setAuthTag(tag); return Buffer.concat([decipher.update(data), decipher.final()]); }
+
+// --- PNG STEGO (OPTIMISÉ) ---
+function bufferToPng(buffer) {
+    const byteLen = buffer.length;
+    const pixelsNeeded = Math.ceil(byteLen / 3);
+    const width = Math.ceil(Math.sqrt(pixelsNeeded));
+    const height = Math.ceil(pixelsNeeded / width);
+    const rgbBuffer = Buffer.alloc(width * height * 3);
+    buffer.copy(rgbBuffer);
+    return sharp(rgbBuffer, { raw: { width, height, channels: 3 } }).png({ compressionLevel: 9, palette: false }).withMetadata(false).toBuffer();
 }
-function decryptChunk(encBuffer, key) { 
-    if (encBuffer.length < OVERHEAD) throw new Error('Buffer trop court'); 
-    const iv = encBuffer.subarray(0, IV_LEN); 
-    const tag = encBuffer.subarray(encBuffer.length - TAG_LEN); 
-    const data = encBuffer.subarray(IV_LEN, encBuffer.length - TAG_LEN); 
-    const decipher = createDecipheriv('aes-256-gcm', key, iv); 
-    decipher.setAuthTag(tag); 
-    return Buffer.concat([decipher.update(data), decipher.final()]); 
-}
-
-// --- PNG STEGANOGRAPHY (OPTIMISÉ) ---
-function bufferToPng(buffer) { 
-    const byteLen = buffer.length; 
-    const pixelsNeeded = Math.ceil(byteLen / 3); 
-    const width = Math.ceil(Math.sqrt(pixelsNeeded)); 
-    const height = Math.ceil(pixelsNeeded / width); 
-    const rgbBuffer = Buffer.alloc(width * height * 3); 
-    buffer.copy(rgbBuffer); 
-    return sharp(rgbBuffer, { raw: { width, height, channels: 3 } })
-        .png({ compressionLevel: 9, palette: false })
-        .withMetadata(false)
-        .toBuffer(); 
-}
-
-async function pngToBuffer(pngBuffer, expectedLen) { 
-    const { data, info } = await sharp(pngBuffer)
-        .raw()
-        .toBuffer({ resolveWithObject: true });
-    
+async function pngToBuffer(pngBuffer, expectedLen) {
+    const { data, info } = await sharp(pngBuffer).raw().toBuffer({ resolveWithObject: true });
     const channels = info.channels;
-    const totalPixels = info.width * info.height;
-    const rgb = Buffer.alloc(totalPixels * 3);
-    
-    if (channels === 3) {
-        data.copy(rgb, 0, 0, Math.min(data.length, rgb.length));
-    } else if (channels === 4) {
-        for (let i = 0, j = 0; i < data.length && j < rgb.length; i += 4, j += 3) {
-            rgb[j] = data[i];
-            rgb[j+1] = data[i+1];
-            rgb[j+2] = data[i+2];
-        }
-    } else if (channels === 1) {
-        for (let i = 0, j = 0; i < data.length && j < rgb.length; i++, j += 3) {
-            rgb[j] = rgb[j+1] = rgb[j+2] = data[i];
-        }
-    }
-    
-    return rgb.subarray(0, expectedLen); 
+    const rgb = Buffer.alloc(info.width * info.height * 3);
+    if (channels === 3) { data.copy(rgb, 0, 0, Math.min(data.length, rgb.length)); }
+    else if (channels === 4) { for (let i = 0, j = 0; i < data.length && j < rgb.length; i += 4, j += 3) { rgb[j] = data[i]; rgb[j+1] = data[i+1]; rgb[j+2] = data[i+2]; } }
+    else if (channels === 1) { for (let i = 0, j = 0; i < data.length && j < rgb.length; i++, j += 3) { rgb[j] = rgb[j+1] = rgb[j+2] = data[i]; } }
+    return rgb.subarray(0, expectedLen);
 }
 
 // ==========================================
-// SCHÉMA DE BASE
+// SCHÉMA
 // ==========================================
 db.exec(`
-CREATE TABLE IF NOT EXISTS users (
-    id INTEGER PRIMARY KEY AUTOINCREMENT,
-    username TEXT UNIQUE NOT NULL,
-    password_hash BLOB NOT NULL,
-    salt BLOB NOT NULL,
-    is_admin INTEGER DEFAULT 0,
-    tos_accepted INTEGER DEFAULT 0,
-    created_at INTEGER DEFAULT (strftime('%s','now'))
-);
-CREATE TABLE IF NOT EXISTS folders (
-    id INTEGER PRIMARY KEY AUTOINCREMENT,
-    parent_id INTEGER REFERENCES folders(id) ON DELETE CASCADE,
-    owner_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
-    name TEXT NOT NULL,
-    created_at INTEGER DEFAULT (strftime('%s','now')),
-    UNIQUE(parent_id, owner_id, name)
-);
-CREATE TABLE IF NOT EXISTS files (
-    id TEXT PRIMARY KEY,
-    folder_id INTEGER REFERENCES folders(id) ON DELETE SET NULL,
-    owner_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
-    name TEXT NOT NULL,
-    mime TEXT NOT NULL,
-    size INTEGER NOT NULL,
-    chunk_count INTEGER DEFAULT 1,
-    status TEXT DEFAULT 'pending',
-    progress REAL DEFAULT 0,
-    error_msg TEXT,
-    encryption_key_hash TEXT NOT NULL,
-    master_key_enc BLOB,
-    created_at INTEGER DEFAULT (strftime('%s','now')),
-    updated_at INTEGER DEFAULT (strftime('%s','now'))
-);
-CREATE TABLE IF NOT EXISTS file_chunks (
-    id INTEGER PRIMARY KEY AUTOINCREMENT,
-    file_id TEXT NOT NULL REFERENCES files(id) ON DELETE CASCADE,
-    chunk_index INTEGER NOT NULL,
-    imgbb_url TEXT,
-    imgbb_delete_url TEXT,
-    imgbb_id TEXT,
-    size INTEGER NOT NULL,
-    encrypted_len INTEGER NOT NULL,
-    UNIQUE(file_id, chunk_index)
-);
-CREATE TABLE IF NOT EXISTS share_links (
-    token TEXT PRIMARY KEY,
-    file_id TEXT NOT NULL REFERENCES files(id) ON DELETE CASCADE,
-    owner_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
-    type TEXT NOT NULL,
-    created_at INTEGER DEFAULT (strftime('%s','now')),
-    expires_at INTEGER
-);
+CREATE TABLE IF NOT EXISTS users (id INTEGER PRIMARY KEY AUTOINCREMENT, username TEXT UNIQUE NOT NULL, password_hash BLOB NOT NULL, salt BLOB NOT NULL, is_admin INTEGER DEFAULT 0, tos_accepted INTEGER DEFAULT 0, created_at INTEGER DEFAULT (strftime('%s','now')));
+CREATE TABLE IF NOT EXISTS folders (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER REFERENCES folders(id) ON DELETE CASCADE, owner_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE, name TEXT NOT NULL, created_at INTEGER DEFAULT (strftime('%s','now')), UNIQUE(parent_id, owner_id, name));
+CREATE TABLE IF NOT EXISTS files (id TEXT PRIMARY KEY, folder_id INTEGER REFERENCES folders(id) ON DELETE SET NULL, owner_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE, name TEXT NOT NULL, mime TEXT NOT NULL, size INTEGER NOT NULL, chunk_count INTEGER DEFAULT 1, status TEXT DEFAULT 'pending', progress REAL DEFAULT 0, error_msg TEXT, encryption_key_hash TEXT NOT NULL, master_key_enc BLOB, created_at INTEGER DEFAULT (strftime('%s','now')), updated_at INTEGER DEFAULT (strftime('%s','now')));
+CREATE TABLE IF NOT EXISTS file_chunks (id INTEGER PRIMARY KEY AUTOINCREMENT, file_id TEXT NOT NULL REFERENCES files(id) ON DELETE CASCADE, chunk_index INTEGER NOT NULL, imgbb_url TEXT, imgbb_delete_url TEXT, imgbb_id TEXT, size INTEGER NOT NULL, encrypted_len INTEGER NOT NULL, UNIQUE(file_id, chunk_index));
+CREATE TABLE IF NOT EXISTS share_links (token TEXT PRIMARY KEY, file_id TEXT NOT NULL REFERENCES files(id) ON DELETE CASCADE, owner_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE, type TEXT NOT NULL, created_at INTEGER DEFAULT (strftime('%s','now')), expires_at INTEGER);
+CREATE TABLE IF NOT EXISTS user_shares (id INTEGER PRIMARY KEY AUTOINCREMENT, file_id TEXT REFERENCES files(id) ON DELETE CASCADE, folder_id INTEGER REFERENCES folders(id) ON DELETE CASCADE, owner_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE, shared_with INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE, created_at INTEGER DEFAULT (strftime('%s','now')));
 CREATE INDEX IF NOT EXISTS idx_files_owner ON files(owner_id);
 CREATE INDEX IF NOT EXISTS idx_chunks_file ON file_chunks(file_id);
 CREATE INDEX IF NOT EXISTS idx_share_owner ON share_links(owner_id);
+CREATE INDEX IF NOT EXISTS idx_ushares_with ON user_shares(shared_with);
 `);
 
 // ==========================================
@@ -173,12 +92,8 @@ CREATE INDEX IF NOT EXISTS idx_share_owner ON share_links(owner_id);
 // ==========================================
 function runMigrations() {
     console.log('🔍 Vérification migrations BDD...');
-
     const usersCols = db.prepare("PRAGMA table_info(users)").all().map(c => c.name);
-    if (!usersCols.includes('tos_accepted')) {
-        console.log('🔧 Migration: ALTER TABLE users ADD COLUMN tos_accepted');
-        db.exec(`ALTER TABLE users ADD COLUMN tos_accepted INTEGER DEFAULT 0;`);
-    }
+    if (!usersCols.includes('tos_accepted')) db.exec(`ALTER TABLE users ADD COLUMN tos_accepted INTEGER DEFAULT 0;`);
 
     const filesCols = db.prepare("PRAGMA table_info(files)").all().map(c => c.name);
     const filesDefs = [
@@ -191,41 +106,26 @@ function runMigrations() {
         { name: 'chunk_count', def: 'INTEGER DEFAULT 1' },
         { name: 'updated_at', def: 'INTEGER DEFAULT 0' },
     ];
-
     let updatedAdded = false;
     for (const col of filesDefs) {
         if (!filesCols.includes(col.name)) {
-            console.log(`🔧 Migration: ALTER TABLE files ADD COLUMN ${col.name} ${col.def}`);
             db.exec(`ALTER TABLE files ADD COLUMN ${col.name} ${col.def};`);
             if (col.name === 'updated_at') updatedAdded = true;
         }
     }
-
-    if (updatedAdded) {
-        console.log('🔧 Migration: Initialisation updated_at sur les lignes existantes');
-        db.exec(`UPDATE files SET updated_at = strftime('%s','now') WHERE updated_at = 0;`);
-    }
+    if (updatedAdded) db.exec(`UPDATE files SET updated_at = strftime('%s','now') WHERE updated_at = 0;`);
 
     const tables = db.prepare("SELECT name FROM sqlite_master WHERE type='table'").all().map(t => t.name);
-    
-    if (!tables.includes('folders')) { 
-        console.log('🔧 Migration: CREATE TABLE folders'); 
-        db.exec(`CREATE TABLE folders (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER REFERENCES folders(id) ON DELETE CASCADE, owner_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE, name TEXT NOT NULL, created_at INTEGER DEFAULT (strftime('%s','now')), UNIQUE(parent_id, owner_id, name));`); 
-    }
-    if (!tables.includes('share_links')) { 
-        console.log('🔧 Migration: CREATE TABLE share_links'); 
-        db.exec(`CREATE TABLE share_links (token TEXT PRIMARY KEY, file_id TEXT NOT NULL REFERENCES files(id) ON DELETE CASCADE, owner_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE, type TEXT NOT NULL, created_at INTEGER DEFAULT (strftime('%s','now')), expires_at INTEGER);`); 
-    }
+    if (!tables.includes('folders')) db.exec(`CREATE TABLE folders (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER REFERENCES folders(id) ON DELETE CASCADE, owner_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE, name TEXT NOT NULL, created_at INTEGER DEFAULT (strftime('%s','now')), UNIQUE(parent_id, owner_id, name));`);
+    if (!tables.includes('share_links')) db.exec(`CREATE TABLE share_links (token TEXT PRIMARY KEY, file_id TEXT NOT NULL REFERENCES files(id) ON DELETE CASCADE, owner_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE, type TEXT NOT NULL, created_at INTEGER DEFAULT (strftime('%s','now')), expires_at INTEGER);`);
+    if (!tables.includes('user_shares')) db.exec(`CREATE TABLE user_shares (id INTEGER PRIMARY KEY AUTOINCREMENT, file_id TEXT REFERENCES files(id) ON DELETE CASCADE, folder_id INTEGER REFERENCES folders(id) ON DELETE CASCADE, owner_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE, shared_with INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE, created_at INTEGER DEFAULT (strftime('%s','now'))); CREATE INDEX idx_ushares_with ON user_shares(shared_with);`);
 
     const sessionsCols = tables.includes('sessions') ? db.prepare("PRAGMA table_info(sessions)").all().map(c => c.name) : [];
     if (tables.includes('sessions') && (!sessionsCols.includes('data') || !sessionsCols.includes('expires_at'))) {
-        console.log('🔧 Migration: Reconstruction table sessions (colonnes manquantes)');
         db.exec(`DROP TABLE sessions; CREATE TABLE sessions (sid TEXT PRIMARY KEY, data TEXT NOT NULL, expires_at INTEGER NOT NULL); CREATE INDEX idx_sessions_expires ON sessions(expires_at);`);
     } else if (!tables.includes('sessions')) {
-        console.log('🔧 Migration: CREATE TABLE sessions'); 
-        db.exec(`CREATE TABLE sessions (sid TEXT PRIMARY KEY, data TEXT NOT NULL, expires_at INTEGER NOT NULL); CREATE INDEX idx_sessions_expires ON sessions(expires_at);`); 
+        db.exec(`CREATE TABLE sessions (sid TEXT PRIMARY KEY, data TEXT NOT NULL, expires_at INTEGER NOT NULL); CREATE INDEX idx_sessions_expires ON sessions(expires_at);`);
     }
-    
     console.log('✅ Migrations terminées.');
 }
 runMigrations();
@@ -233,32 +133,13 @@ runMigrations();
 db.exec(`
 CREATE INDEX IF NOT EXISTS idx_files_folder ON files(folder_id);
 DROP TRIGGER IF EXISTS update_file_ts;
-CREATE TRIGGER update_file_ts AFTER UPDATE ON files
-BEGIN
-    UPDATE files SET updated_at = strftime('%s','now') WHERE id = NEW.id;
-END;
+CREATE TRIGGER update_file_ts AFTER UPDATE ON files BEGIN UPDATE files SET updated_at = strftime('%s','now') WHERE id = NEW.id; END;
 `);
 
 // --- SESSION STORE ---
 class SQLiteStore extends session.Store {
-    get(sid, cb) { 
-        try { 
-            const r = db.prepare('SELECT data, expires_at FROM sessions WHERE sid=?').get(sid); 
-            if(!r) return cb(null, null); 
-            if(r.expires_at < Date.now()){ 
-                db.prepare('DELETE FROM sessions WHERE sid=?').run(sid); 
-                return cb(null, null); 
-            } 
-            cb(null, JSON.parse(r.data)); 
-        } catch(e){ cb(e); } 
-    }
-    set(sid, sess, cb) { 
-        try { 
-            const exp = sess.cookie?.expires ? new Date(sess.cookie.expires).getTime() : Date.now() + 30*24*60*60*1000; 
-            db.prepare('INSERT OR REPLACE INTO sessions(sid,data,expires_at) VALUES(?,?,?)').run(sid, JSON.stringify(sess), exp); 
-            cb(null); 
-        } catch(e){ cb(e); } 
-    }
+    get(sid, cb) { try { const r = db.prepare('SELECT data, expires_at FROM sessions WHERE sid=?').get(sid); if(!r) return cb(null, null); if(r.expires_at < Date.now()){ db.prepare('DELETE FROM sessions WHERE sid=?').run(sid); return cb(null, null); } cb(null, JSON.parse(r.data)); } catch(e){ cb(e); } }
+    set(sid, sess, cb) { try { const exp = sess.cookie?.expires ? new Date(sess.cookie.expires).getTime() : Date.now() + 30*24*60*60*1000; db.prepare('INSERT OR REPLACE INTO sessions(sid,data,expires_at) VALUES(?,?,?)').run(sid, JSON.stringify(sess), exp); cb(null); } catch(e){ cb(e); } }
     destroy(sid, cb) { try { db.prepare('DELETE FROM sessions WHERE sid=?').run(sid); cb(null); } catch(e){ cb(e); } }
     clear(cb) { try { db.prepare('DELETE FROM sessions').run(); cb(null); } catch(e){ cb(e); } }
     length(cb) { try { const r = db.prepare('SELECT COUNT(*) as c FROM sessions').get(); cb(null, r.c); } catch(e){ cb(e); } }
@@ -266,13 +147,13 @@ class SQLiteStore extends session.Store {
 }
 const sessionStore = new SQLiteStore();
 
-// --- ADMIN INIT ---
+// --- ADMIN ---
 const adminRow = db.prepare('SELECT * FROM users WHERE username=?').get(ADMIN_USER);
-if (!adminRow) { 
-    const salt = randomBytes(16); 
-    const hash = await deriveKey(process.env.ADMIN_PASS || 'ChangeMeNow!', salt); 
-    db.prepare('INSERT INTO users(username,password_hash,salt,is_admin,tos_accepted) VALUES(?,?,?,1,1)').run(ADMIN_USER, hash, salt); 
-    console.log(`👑 Admin: ${ADMIN_USER} / Pass: ${process.env.ADMIN_PASS || 'ChangeMeNow!'}`); 
+if (!adminRow) {
+    const salt = randomBytes(16);
+    const hash = await deriveKey(process.env.ADMIN_PASS || 'ChangeMeNow!', salt);
+    db.prepare('INSERT INTO users(username,password_hash,salt,is_admin,tos_accepted) VALUES(?,?,?,1,1)').run(ADMIN_USER, hash, salt);
+    console.log(`👑 Admin: ${ADMIN_USER} / Pass: ${process.env.ADMIN_PASS || 'ChangeMeNow!'}`);
 }
 
 // --- EXPRESS ---
@@ -280,210 +161,118 @@ const app = express();
 app.set('trust proxy', 1);
 app.use(express.json({ limit: '50mb' }));
 app.use(express.urlencoded({ extended: true, limit: '50mb' }));
-app.use(session({ 
-    secret: SESSION_SECRET, 
-    store: sessionStore, 
-    resave: false, 
-    saveUninitialized: false, 
-    cookie: { secure: false, httpOnly: true, maxAge: 30*24*60*60*1000, sameSite: 'lax' } 
-}));
+app.use(session({ secret: SESSION_SECRET, store: sessionStore, resave: false, saveUninitialized: false, cookie: { secure: false, httpOnly: true, maxAge: 30*24*60*60*1000, sameSite: 'lax' } }));
 
 const requireAuth = (req, res, next) => { if(!req.session.userId) return res.status(401).json({error:'Non authentifié'}); next(); };
 const requireTos = (req, res, next) => { if(!req.session.tosAccepted) return res.status(403).json({error:'CGU non acceptées', needTos:true}); next(); };
 
-// --- CACHE LRU ---
-class ByteLRUCache extends LRUCache { 
-    constructor(){ super({maxSize:CACHE_MAX_BYTES, sizeCalculation:v=>v.size}); } 
-    async getOrLoad(key, loader){ 
-        if(this.has(key)) return this.get(key).data; 
-        const data = await loader(); 
-        this.set(key, {data, size: data.length, time: Date.now()}); 
-        return data; 
-    } 
-}
+// --- CACHE ---
+class ByteLRUCache extends LRUCache { constructor(){ super({maxSize:CACHE_MAX_BYTES, sizeCalculation:v=>v.size}); } }
 const fileCache = new ByteLRUCache();
-setInterval(()=>{ 
-    const m = process.memoryUsage(); 
-    if(m.rss > 13*1024*1024*1024){ 
-        console.warn(`⚠️ RAM ${(m.rss/1e9).toFixed(1)}GB, vidage cache`); 
-        fileCache.clear(); 
-        if(global.gc) global.gc(); 
-    } 
-}, 30000);
-
-// --- NSFW WASM ---
+setInterval(()=>{ const m = process.memoryUsage(); if(m.rss > 13*1024*1024*1024){ fileCache.clear(); if(global.gc) global.gc(); } }, 30000);
+
+// --- NSFW ---
 let nsfwModel = null;
-async function loadNsfwModel(){ 
-    try{ 
-        await tf.setBackend('wasm'); 
-        tf.wasm.setWasmPaths('/app/tfjs_wasm/','tfjs-backend-wasm.wasm'); 
-        await tf.ready(); 
-        nsfwModel = await nsfwjs.load('/app/tfjs_wasm/',{type:'mobilenet_v2',size:224}); 
-        console.log('🛡️ NSFW WASM chargé'); 
-    }catch(e){ console.error('❌ NSFW load fail:',e.message); } 
-}
+async function loadNsfwModel(){ try{ await tf.setBackend('wasm'); tf.wasm.setWasmPaths('/app/tfjs_wasm/','tfjs-backend-wasm.wasm'); await tf.ready(); nsfwModel = await nsfwjs.load('/app/tfjs_wasm/',{type:'mobilenet_v2',size:224}); console.log('🛡️ NSFW WASM chargé'); }catch(e){ console.error('❌ NSFW load fail:',e.message); } }
 loadNsfwModel();
+async function checkNsfw(buf){ if(!nsfwModel) return {safe:true}; try{ const t=tf.node.decodeImage(buf,3).resizeNearestNeighbor([224,224]).expandDims(0); const p=await nsfwModel.classify(t); t.dispose(); const porn=p.find(x=>x.className==='Porn'||x.className==='Sexual Activity')?.probability||0; const hentai=p.find(x=>x.className==='Hentai')?.probability||0; if(porn>0.85||hentai>0.9) return {safe:false}; return {safe:true}; }catch(e){ return {safe:true}; } }
 
-async function checkNsfw(buf){ 
-    if(!nsfwModel) return {safe:true}; 
-    try{ 
-        const t = tf.node.decodeImage(buf,3).resizeNearestNeighbor([224,224]).expandDims(0); 
-        const p = await nsfwModel.classify(t); 
-        t.dispose(); 
-        const porn = p.find(x=>x.className==='Porn'||x.className==='Sexual Activity')?.probability||0; 
-        const hentai = p.find(x=>x.className==='Hentai')?.probability||0; 
-        if(porn>0.85||hentai>0.9) return {safe:false,reason:`NSFW (P:${porn.toFixed(2)} H:${hentai.toFixed(2)})`}; 
-        return {safe:true}; 
-    }catch(e){ return {safe:true}; } 
-}
-
-// --- UPLOAD QUEUE ---
-class UploadQueue{ 
-    constructor(c){ this.c=c; this.r=0; this.q=[]; } 
-    add(t){ return new Promise((res,rej)=>{ this.q.push({t,res,rej}); this.proc(); }); } 
-    async proc(){ 
-        if(this.r>=this.c||!this.q.length) return; 
-        this.r++; 
-        const {t,res,rej} = this.q.shift(); 
-        try{ res(await t()); }catch(e){ rej(e); }finally{ this.r--; this.proc(); } 
-    } 
-}
+// --- QUEUE ---
+class UploadQueue{ constructor(c){ this.c=c; this.r=0; this.q=[]; } add(t){ return new Promise((res,rej)=>{ this.q.push({t,res,rej}); this.proc(); }); } async proc(){ if(this.r>=this.c||!this.q.length) return; this.r++; const {t,res,rej}=this.q.shift(); try{ res(await t()); }catch(e){ rej(e); }finally{ this.r--; this.proc(); } } }
 const uploadQueue = new UploadQueue(MAX_CONCURRENT_UPLOADS);
 
 // --- IMGBB ---
-async function imgbbUpload(buf){ 
-    const f = new FormData(); 
-    f.append('image',buf.toString('base64')); 
-    const {data} = await axios.post(
-        `https://api.imgbb.com/1/upload?key=${IMGBB_API_KEY}`,
-        f,
-        {
-            headers: f.getHeaders(),
-            timeout: 120000,
-            maxContentLength: Infinity,
-            maxBodyLength: Infinity
-        }
-    ); 
-    if(!data.success) throw new Error(data.error?.message||'ImgBB fail'); 
-    return {url:data.data.url,deleteUrl:data.data.delete_url,id:data.data.id}; 
-}
+async function imgbbUpload(buf){ const f=new FormData(); f.append('image',buf.toString('base64')); const {data}=await axios.post(`https://api.imgbb.com/1/upload?key=${IMGBB_API_KEY}`,f,{headers:f.getHeaders(),timeout:120000,maxContentLength:Infinity,maxBodyLength:Infinity}); if(!data.success) throw new Error(data.error?.message||'ImgBB fail'); return {url:data.data.url,deleteUrl:data.data.delete_url,id:data.data.id}; }
 async function imgbbDelete(u){ try{await axios.get(u,{timeout:10000});}catch(_){} }
 
-// --- KEY MGMT ---
+// --- KEYS ---
 const SERVER_MASTER_KEY = createHash('sha256').update(SESSION_SECRET+'|PixelDriveMaster').digest();
-function encryptMasterKey(k){ 
-    const iv = randomBytes(12); 
-    const c = createCipheriv('aes-256-gcm',SERVER_MASTER_KEY,iv); 
-    return Buffer.concat([iv,c.update(k),c.final(),c.getAuthTag()]); 
-}
-function decryptMasterKey(b){ 
-    const iv = b.subarray(0,12), tag = b.subarray(-16), d = b.subarray(12,-16); 
-    const dc = createDecipheriv('aes-256-gcm',SERVER_MASTER_KEY,iv); 
-    dc.setAuthTag(tag); 
-    return Buffer.concat([dc.update(d),dc.final()]); 
+function encryptMasterKey(k){ const iv=randomBytes(12); const c=createCipheriv('aes-256-gcm',SERVER_MASTER_KEY,iv); return Buffer.concat([iv,c.update(k),c.final(),c.getAuthTag()]); }
+function decryptMasterKey(b){ const iv=b.subarray(0,12), tag=b.subarray(-16), d=b.subarray(12,-16); const dc=createDecipheriv('aes-256-gcm',SERVER_MASTER_KEY,iv); dc.setAuthTag(tag); return Buffer.concat([dc.update(d),dc.final()]); }
+async function getMasterKey(fid){ const r=db.prepare('SELECT master_key_enc FROM files WHERE id=?').get(fid); if(!r?.master_key_enc) throw new Error('Clé manquante'); return decryptMasterKey(r.master_key_enc); }
+
+// ==========================================
+// ✅ CONTRÔLE D'ACCÈS (partage entre utilisateurs)
+// ==========================================
+function canAccessFolder(userId, folderId){
+    let cur = db.prepare('SELECT * FROM folders WHERE id=?').get(folderId);
+    let depth = 0;
+    while (cur && depth < 50) {
+        if (cur.owner_id === userId) return true;
+        if (db.prepare('SELECT 1 FROM user_shares WHERE folder_id=? AND shared_with=?').get(cur.id, userId)) return true;
+        cur = cur.parent_id ? db.prepare('SELECT * FROM folders WHERE id=?').get(cur.parent_id) : null;
+        depth++;
+    }
+    return false;
 }
-async function getMasterKey(uid,fid){ 
-    const r = db.prepare('SELECT master_key_enc FROM files WHERE id=? AND owner_id=?').get(fid,uid); 
-    if(!r?.master_key_enc) throw new Error('Clé manquante'); 
-    return decryptMasterKey(r.master_key_enc); 
+function canAccessFile(userId, fileId){
+    const f = db.prepare('SELECT * FROM files WHERE id=?').get(fileId);
+    if (!f) return null;
+    if (f.owner_id === userId) return f;
+    if (db.prepare('SELECT 1 FROM user_shares WHERE file_id=? AND shared_with=?').get(fileId, userId)) return f;
+    if (f.folder_id && canAccessFolder(userId, f.folder_id)) return f;
+    return null;
 }
 
 // --- THUMB ---
-async function genThumb(fid,mime,key){ 
-    if(!mime.startsWith('image/')&&!mime.startsWith('video/')) return; 
-    try{ 
-        const c = db.prepare('SELECT imgbb_url, size FROM file_chunks WHERE file_id=? AND chunk_index=0').get(fid); 
-        if(!c) return; 
-        const {data} = await axios.get(c.imgbb_url,{responseType:'arraybuffer',timeout:30000}); 
-        const enc = await pngToBuffer(Buffer.from(data), c.size + OVERHEAD); 
-        const dec = decryptChunk(enc,key); 
-        let buf; 
-        if(mime.startsWith('image/')) buf = await sharp(dec).rotate().resize(256,256,{fit:'inside'}).jpeg({quality:80}).toBuffer(); 
-        else buf = await sharp({create:{width:256,height:144,channels:3,background:'#1e1e2f'}}).jpeg().toBuffer(); 
-        await sharp(buf).toFile(join(THUMB_DIR,`${fid}.jpg`)); 
-    }catch(e){ console.warn(`Thumb ${fid}:`,e.message); } 
+async function genThumb(fid,mime,key){
+    if(!mime.startsWith('image/')&&!mime.startsWith('video/')) return;
+    try{
+        const c = db.prepare('SELECT imgbb_url, size FROM file_chunks WHERE file_id=? AND chunk_index=0').get(fid);
+        if(!c) return;
+        const {data} = await axios.get(c.imgbb_url,{responseType:'arraybuffer',timeout:30000});
+        const enc = await pngToBuffer(Buffer.from(data), c.size + OVERHEAD);
+        const dec = decryptChunk(enc,key);
+        let buf;
+        if(mime.startsWith('image/')) buf = await sharp(dec).rotate().resize(256,256,{fit:'inside'}).jpeg({quality:80}).toBuffer();
+        else buf = await sharp({create:{width:256,height:144,channels:3,background:'#1e1e2f'}}).jpeg().toBuffer();
+        await sharp(buf).toFile(join(THUMB_DIR,`${fid}.jpg`));
+    }catch(e){ console.warn(`Thumb ${fid}:`,e.message); }
 }
 
-// --- STREAM DOWNLOAD (OPTIMISÉ) ---
-async function streamFile(res,file,key,range){ 
-    const chunks = db.prepare('SELECT chunk_index,imgbb_url,size FROM file_chunks WHERE file_id=? ORDER BY chunk_index').all(file.id); 
-    const total = file.size; 
-    let s = 0, e = total - 1; 
-    
-    if(range){ 
-        const p = range.replace('bytes=','').split('-'); 
-        s = parseInt(p[0]); 
-        e = p[1] ? parseInt(p[1]) : total - 1; 
-    } 
-    
-    if(s >= total || e >= total) return res.status(416).send('Range Not Satisfiable'); 
-    
-    res.set({
-        'Content-Type': file.mime,
-        'Content-Length': e - s + 1,
-        'Accept-Ranges': 'bytes',
-        'Content-Disposition': `inline; filename="${encodeURIComponent(file.name)}"` 
-    }); 
-    
-    if(range){
-        res.status(206);
-        res.set('Content-Range', `bytes ${s}-${e}/${total}`);
-    } 
-    
+// --- STREAM ---
+async function streamFile(res,file,key,range){
+    const chunks = db.prepare('SELECT chunk_index,imgbb_url,size FROM file_chunks WHERE file_id=? ORDER BY chunk_index').all(file.id);
+    const total = file.size;
+    let s = 0, e = total - 1;
+    if(range){ const p = range.replace('bytes=','').split('-'); s = parseInt(p[0]); e = p[1] ? parseInt(p[1]) : total - 1; }
+    if(s >= total || e >= total) return res.status(416).send('Range Not Satisfiable');
+    res.set({'Content-Type':file.mime,'Content-Length':e-s+1,'Accept-Ranges':'bytes','Content-Disposition':`inline; filename="${encodeURIComponent(file.name)}"`});
+    if(range){ res.status(206); res.set('Content-Range', `bytes ${s}-${e}/${total}`); }
     console.log(`📥 Stream ${file.name} (${((e-s+1)/1024/1024).toFixed(2)} MB, ${chunks.length} chunk(s))`);
-    
-    let cur = 0; 
-    for(const c of chunks){ 
-        const cs = cur, ce = cur + c.size - 1; 
-        if(ce >= s && cs <= e){ 
-            const off = Math.max(0, s - cs);
-            const len = Math.min(c.size - off, e - Math.max(s, cs) + 1); 
-            try{ 
-                const ck = `chunk:${file.id}:${c.chunk_index}`; 
-                let dec = fileCache.get(ck)?.data; 
-                
-                if(!dec){ 
+    let cur = 0;
+    for(const c of chunks){
+        const cs = cur, ce = cur + c.size - 1;
+        if(ce >= s && cs <= e){
+            const off = Math.max(0, s - cs), len = Math.min(c.size - off, e - Math.max(s, cs) + 1);
+            try{
+                const ck = `chunk:${file.id}:${c.chunk_index}`;
+                let dec = fileCache.get(ck)?.data;
+                if(!dec){
                     const t0 = Date.now();
-                    const {data} = await axios.get(c.imgbb_url,{
-                        responseType:'arraybuffer',
-                        timeout:120000
-                    }); 
+                    const {data} = await axios.get(c.imgbb_url,{responseType:'arraybuffer',timeout:120000});
                     const t1 = Date.now();
                     console.log(`  ⬇️  Chunk ${c.chunk_index}: ${(data.byteLength/1024/1024).toFixed(2)} MB en ${t1-t0}ms`);
-                    
-                    const enc = await pngToBuffer(Buffer.from(data), c.size + OVERHEAD); 
+                    const enc = await pngToBuffer(Buffer.from(data), c.size + OVERHEAD);
                     const t2 = Date.now();
                     console.log(`  🖼️  PNG→Buffer: ${t2-t1}ms`);
-                    
-                    dec = decryptChunk(enc, key); 
-                    const t3 = Date.now();
-                    console.log(`  🔓 Decrypt: ${t3-t2}ms`);
-                    
-                    fileCache.set(ck, {data: dec, size: dec.length}); 
-                } 
-                
-                const sl = dec.subarray(off, off + len); 
-                if(!res.write(sl)) await new Promise(r => res.once('drain', r)); 
-            }catch(err){ 
-                console.error(`❌ Stream chunk ${c.chunk_index}:`, err.message); 
-                return res.destroy(err); 
-            } 
-        } 
-        cur += c.size; 
-        if(cs > e) break; 
-    } 
-    res.end(); 
+                    dec = decryptChunk(enc, key);
+                    console.log(`  🔓 Decrypt: ${Date.now()-t2}ms`);
+                    fileCache.set(ck, {data: dec, size: dec.length});
+                }
+                const sl = dec.subarray(off, off + len);
+                if(!res.write(sl)) await new Promise(r => res.once('drain', r));
+            }catch(err){ console.error(`❌ Stream chunk ${c.chunk_index}:`, err.message); return res.destroy(err); }
+        }
+        cur += c.size;
+        if(cs > e) break;
+    }
+    res.end();
 }
 
 // --- SSE ---
-const sseClients = new Map(); 
-function broadcast(fid,d){ 
-    const cs = sseClients.get(fid); 
-    if(cs){ 
-        const p = `data: ${JSON.stringify(d)}\n\n`; 
-        for(const r of cs) r.write(p); 
-    } 
-}
+const sseClients = new Map();
+function broadcast(fid,d){ const cs = sseClients.get(fid); if(cs){ const p = `data: ${JSON.stringify(d)}\n\n`; for(const r of cs) r.write(p); } }
 
 // ==========================================
 // ROUTES
@@ -495,31 +284,80 @@ app.get('/api/me',(req,res)=>req.session.userId?res.json({id:req.session.userId,
 app.get('/api/tos',(_,res)=>res.send(`PIXELDRIVE CGU\n1. RESPONSABILITÉ TOTALE\n2. AUCUNE GARANTIE (Projet test)\n3. INTERDITS: Illégal, NSFW, Abus\n4. CHIFFRÉ AES-256-GCM + Filtre NSFW Local\n5. ACCEPTATION = Responsabilité légale`));
 app.post('/api/tos/accept',requireAuth,(req,res)=>{db.prepare('UPDATE users SET tos_accepted=1 WHERE id=?').run(req.session.userId);req.session.tosAccepted=true;res.json({ok:true});});
 
-app.get('/api/folders',requireAuth,(req,res)=>{const p=req.query.parent_id?parseInt(req.query.parent_id):null;res.json(db.prepare('SELECT * FROM folders WHERE owner_id=? AND parent_id IS ?').all(req.session.userId,p));});
+// ✅ Folders (avec accès partagé)
+app.get('/api/folders',requireAuth,(req,res)=>{
+    const p = req.query.parent_id ? parseInt(req.query.parent_id) : null;
+    if (p !== null) {
+        if (!canAccessFolder(req.session.userId, p)) return res.status(403).json({error:'Accès refusé'});
+        return res.json(db.prepare('SELECT * FROM folders WHERE parent_id=? ORDER BY name COLLATE NOCASE').all(p));
+    }
+    res.json(db.prepare('SELECT * FROM folders WHERE owner_id=? AND parent_id IS NULL ORDER BY name COLLATE NOCASE').all(req.session.userId));
+});
 app.post('/api/folders',requireAuth,requireTos,(req,res)=>{const{n,p}=req.body;if(!n)return res.status(400).json({error:'Nom requis'});try{const i=db.prepare('INSERT INTO folders(name,parent_id,owner_id) VALUES(?,?,?)').run(n,p||null,req.session.userId);res.json({id:i.lastInsertRowid,name:n,parent_id:p});}catch(e){res.status(409).json({error:'Existe'});}});
 app.delete('/api/folders/:id',requireAuth,(req,res)=>{db.prepare('DELETE FROM folders WHERE id=? AND owner_id=?').run(req.params.id,req.session.userId);res.json({ok:true});});
 
-app.get('/api/files',requireAuth,(req,res)=>{const f=req.query.folder_id?parseInt(req.query.folder_id):null;res.json(db.prepare('SELECT * FROM files WHERE owner_id=? AND folder_id IS ? ORDER BY name COLLATE NOCASE').all(req.session.userId,f));});
+// ✅ Files (avec accès partagé)
+app.get('/api/files',requireAuth,(req,res)=>{
+    const f = req.query.folder_id ? parseInt(req.query.folder_id) : null;
+    if (f !== null) {
+        if (!canAccessFolder(req.session.userId, f)) return res.status(403).json({error:'Accès refusé'});
+        return res.json(db.prepare('SELECT * FROM files WHERE folder_id=? ORDER BY name COLLATE NOCASE').all(f));
+    }
+    res.json(db.prepare('SELECT * FROM files WHERE owner_id=? AND folder_id IS NULL ORDER BY name COLLATE NOCASE').all(req.session.userId));
+});
+
+// ✅ PARTAGE ENTRE UTILISATEURS
+app.post('/api/share-user',requireAuth,requireTos,(req,res)=>{
+    const { type, id, username } = req.body;
+    if (!type || !id || !username) return res.status(400).json({error:'Champs manquants'});
+    const target = db.prepare('SELECT id FROM users WHERE username=?').get(username.trim());
+    if (!target) return res.status(404).json({error:'Utilisateur introuvable'});
+    if (target.id === req.session.userId) return res.status(400).json({error:'Impossible de partager avec vous-même'});
+    if (type === 'file') {
+        const f = db.prepare('SELECT id FROM files WHERE id=? AND owner_id=?').get(id, req.session.userId);
+        if (!f) return res.status(404).json({error:'Fichier introuvable'});
+        if (db.prepare('SELECT 1 FROM user_shares WHERE file_id=? AND shared_with=?').get(id, target.id)) return res.status(409).json({error:'Déjà partagé'});
+        db.prepare('INSERT INTO user_shares(file_id,owner_id,shared_with) VALUES(?,?,?)').run(id, req.session.userId, target.id);
+    } else {
+        const fo = db.prepare('SELECT id FROM folders WHERE id=? AND owner_id=?').get(id, req.session.userId);
+        if (!fo) return res.status(404).json({error:'Dossier introuvable'});
+        if (db.prepare('SELECT 1 FROM user_shares WHERE folder_id=? AND shared_with=?').get(id, target.id)) return res.status(409).json({error:'Déjà partagé'});
+        db.prepare('INSERT INTO user_shares(folder_id,owner_id,shared_with) VALUES(?,?,?)').run(id, req.session.userId, target.id);
+    }
+    res.json({ok:true});
+});
 
-// ✅ NOUVELLE ROUTE : Liste des liens de partage de l'utilisateur
-app.get('/api/share-links',requireAuth,(req,res)=>{
-    const links = db.prepare(`
-        SELECT sl.*, f.name as file_name, f.mime, f.size 
-        FROM share_links sl
-        LEFT JOIN files f ON sl.file_id = f.id
-        WHERE sl.owner_id = ? 
-        ORDER BY sl.created_at DESC
-    `).all(req.session.userId);
-    res.json(links);
+app.get('/api/shared-with-me',requireAuth,(req,res)=>{
+    res.json(db.prepare(`
+        SELECT us.id as share_id, us.created_at as shared_at, u.username as owner_name,
+               us.file_id, us.folder_id,
+               f.name as file_name, f.mime, f.size, f.status,
+               fo.name as folder_name
+        FROM user_shares us
+        JOIN users u ON u.id = us.owner_id
+        LEFT JOIN files f ON f.id = us.file_id
+        LEFT JOIN folders fo ON fo.id = us.folder_id
+        WHERE us.shared_with = ?
+        ORDER BY us.created_at DESC
+    `).all(req.session.userId));
+});
+
+app.delete('/api/shared-with-me/:id',requireAuth,(req,res)=>{
+    db.prepare('DELETE FROM user_shares WHERE id=? AND shared_with=?').run(req.params.id, req.session.userId);
+    res.json({ok:true});
 });
 
-// ✅ NOUVELLE ROUTE : Supprimer un lien de partage
+// Liens publics
+app.get('/api/share-links',requireAuth,(req,res)=>{
+    res.json(db.prepare(`SELECT sl.*, f.name as file_name, f.mime, f.size FROM share_links sl LEFT JOIN files f ON sl.file_id = f.id WHERE sl.owner_id = ? ORDER BY sl.created_at DESC`).all(req.session.userId));
+});
 app.delete('/api/share-links/:token',requireAuth,(req,res)=>{
-    const result = db.prepare('DELETE FROM share_links WHERE token=? AND owner_id=?').run(req.params.token, req.session.userId);
-    if (result.changes === 0) return res.status(404).json({error:'Lien introuvable'});
+    const r = db.prepare('DELETE FROM share_links WHERE token=? AND owner_id=?').run(req.params.token, req.session.userId);
+    if (r.changes === 0) return res.status(404).json({error:'Lien introuvable'});
     res.json({ok:true});
 });
 
+// Upload
 const upload = multer({dest:TEMP_DIR,limits:{fileSize:5*1024*1024*1024}});
 app.post('/api/files/upload',requireAuth,requireTos,upload.single('file'),async(req,res)=>{
     if(!req.file)return res.status(400).json({error:'Fichier manquant'});
@@ -565,27 +403,29 @@ async function processUpload(fid,path,mk,cc,mime){
         for(const c of cs)if(c.imgbb_delete_url)await imgbbDelete(c.imgbb_delete_url);
     }
 }
-
 function readChunk(p,o,l){return new Promise((res,rej)=>{const s=createReadStream(p,{start:o,end:o+l-1}),c=[];s.on('data',d=>c.push(d)).on('end',()=>res(Buffer.concat(c,l))).on('error',rej);});}
 
-app.get('/api/files/:id/download',requireAuth,async(req,res)=>{const f=db.prepare('SELECT * FROM files WHERE id=? AND owner_id=?').get(req.params.id,req.session.userId);if(!f)return res.status(404).json({error:'Introuvable'});if(f.status!=='ready')return res.status(409).json({error:'Pas prêt',status:f.status});const k=await getMasterKey(req.session.userId,f.id);await streamFile(res,f,k,req.headers.range);});
+// ✅ Download (accès partagé autorisé)
+app.get('/api/files/:id/download',requireAuth,async(req,res)=>{
+    const f = canAccessFile(req.session.userId, req.params.id);
+    if(!f)return res.status(404).json({error:'Introuvable'});
+    if(f.status!=='ready')return res.status(409).json({error:'Pas prêt',status:f.status});
+    const k = await getMasterKey(f.id);
+    await streamFile(res,f,k,req.headers.range);
+});
 
-// ✅ Génère TOUS les liens de partage d'un coup
 app.post('/api/files/:id/share',requireAuth,async(req,res)=>{
     const f=db.prepare('SELECT * FROM files WHERE id=? AND owner_id=?').get(req.params.id,req.session.userId);
     if(!f||f.status!=='ready') return res.status(404).json({error:'Fichier non disponible'});
-    const previewToken=uuidv4();
-    const downloadToken=uuidv4();
-    const expires=Date.now()+7*24*3600000;
-    db.prepare('INSERT INTO share_links(token,file_id,owner_id,type,expires_at) VALUES(?,?,?,?,?)').run(previewToken,f.id,req.session.userId,'embed',expires);
-    db.prepare('INSERT INTO share_links(token,file_id,owner_id,type,expires_at) VALUES(?,?,?,?,?)').run(downloadToken,f.id,req.session.userId,'download',expires);
-    res.json({preview:`/s/${previewToken}`,download:`/d/${downloadToken}`,expires:expires});
+    const pt=uuidv4(), dt2=uuidv4(), expires=Date.now()+7*24*3600000;
+    db.prepare('INSERT INTO share_links(token,file_id,owner_id,type,expires_at) VALUES(?,?,?,?,?)').run(pt,f.id,req.session.userId,'embed',expires);
+    db.prepare('INSERT INTO share_links(token,file_id,owner_id,type,expires_at) VALUES(?,?,?,?,?)').run(dt2,f.id,req.session.userId,'download',expires);
+    res.json({preview:`/s/${pt}`,download:`/d/${dt2}`,expires});
 });
 
 app.get('/api/files/:id/preview',requireAuth,async(req,res)=>{
     const f=db.prepare('SELECT * FROM files WHERE id=? AND owner_id=?').get(req.params.id,req.session.userId);
     if(!f||f.status!=='ready')return res.status(404).json({error:'Pas prêt'});
-    if(!f.mime.startsWith('image/')&&!f.mime.startsWith('video/')&&!f.mime.startsWith('audio/')&&f.mime!=='application/pdf')return res.status(400).json({error:'Type non prévisualisable'});
     const t=uuidv4();
     db.prepare('INSERT INTO share_links(token,file_id,owner_id,type,expires_at) VALUES(?,?,?,?,?)').run(t,f.id,req.session.userId,'embed',Date.now()+3600000);
     res.json({url:`/s/${t}`});
@@ -613,32 +453,33 @@ app.get('/d/:token',async(req,res)=>{
 
 app.delete('/api/files/:id',requireAuth,async(req,res)=>{const f=db.prepare('SELECT * FROM files WHERE id=? AND owner_id=?').get(req.params.id,req.session.userId);if(!f)return res.status(404).json({error:'Introuvable'});const cs=db.prepare('SELECT imgbb_delete_url FROM file_chunks WHERE file_id=?').all(f.id);for(const c of cs)if(c.imgbb_delete_url)await imgbbDelete(c.imgbb_delete_url);db.prepare('DELETE FROM files WHERE id=?').run(f.id);fileCache.delete(`chunk:${f.id}:0`);try{unlinkSync(join(THUMB_DIR,`${f.id}.jpg`));}catch(_){}res.json({ok:true});});
 
-app.get('/api/files/:id/thumb',requireAuth,(req,res)=>{const p=join(THUMB_DIR,`${req.params.id}.jpg`);if(existsSync(p))return res.sendFile(p);res.set('Content-Type','image/svg+xml');res.send(`<svg xmlns="http://www.w3.org/2000/svg" width="256" height="144"><rect fill="#2a2a3e" width="100%" height="100%"/><text x="50%" y="50%" dominant-baseline="middle" text-anchor="middle" fill="#666" font-family="sans-serif" font-size="16">FILE</text></svg>`);});
+app.get('/api/files/:id/thumb',requireAuth,(req,res)=>{
+    if(!canAccessFile(req.session.userId, req.params.id)) return res.status(404).json({error:'Introuvable'});
+    const p=join(THUMB_DIR,`${req.params.id}.jpg`);
+    if(existsSync(p))return res.sendFile(p);
+    res.set('Content-Type','image/svg+xml');
+    res.send(`<svg xmlns="http://www.w3.org/2000/svg" width="256" height="144"><rect fill="#2a2a3e" width="100%" height="100%"/><text x="50%" y="50%" dominant-baseline="middle" text-anchor="middle" fill="#666" font-family="sans-serif" font-size="16">FILE</text></svg>`);
+});
 
 app.get('/api/files/:id/progress',requireAuth,(req,res)=>{res.set({'Content-Type':'text/event-stream','Cache-Control':'no-cache','Connection':'keep-alive'});res.flushHeaders();const id=req.params.id;if(!sseClients.has(id))sseClients.set(id,new Set());sseClients.get(id).add(res);req.on('close',()=>sseClients.get(id)?.delete(res));});
 
 app.get('/api/admin/users',requireAuth,(req,res)=>{if(!req.session.isAdmin)return res.status(403).json({error:'Admin only'});res.json(db.prepare('SELECT id,username,is_admin,tos_accepted,created_at FROM users').all());});
-
 app.get('/health',(_,res)=>res.json({ok:true,cache:fileCache.size,mem:process.memoryUsage()}));
 
 app.use(express.static(__dirname));
-app.get('*',(_,res)=>res.sendFile(join(__dirname,'public.html')));
+app.get('*', (req, res) => {
+    if (/\.[a-zA-Z0-9]+$/.test(req.path)) return res.status(404).send('Not Found');
+    res.sendFile(join(__dirname, 'public.html'));
+});
 
-// ==========================================
-// ERROR HANDLER (Anti-pollution logs)
-// ==========================================
+// ERROR HANDLER
 app.use((err, req, res, next) => {
-    if (err.type === 'entity.parse.failed' || err instanceof SyntaxError) {
-        return res.status(400).json({ error: 'Bad Request' });
-    }
+    if (err.type === 'entity.parse.failed' || err instanceof SyntaxError) return res.status(400).json({ error: 'Bad Request' });
     console.error('❌ Server Error:', err.message);
     res.status(500).json({ error: 'Internal Server Error' });
 });
 
-// ==========================================
-// START
-// ==========================================
-const server = app.listen(PORT, '0.0.0.0', () => console.log(`🚀 PixelDrive v3.2 on http://0.0.0.0:${PORT} | Cache: 12GB LRU`));
+const server = app.listen(PORT, '0.0.0.0', () => console.log(`🚀 PixelDrive v3.3 on http://0.0.0.0:${PORT} | Cache: 12GB LRU`));
 process.on('SIGTERM', () => { console.log('SIGTERM'); server.close(() => process.exit(0)); });
 
 function html(b){return `<!DOCTYPE html><html><head><meta charset="utf-8"/><meta name="viewport" content="width=device-width, initial-scale=1"/><title>PixelDrive</title><style>body{margin:0;font-family:system-ui,sans-serif;background:#0d0d12;color:#eee;display:flex;align-items:center;justify-content:center;height:100vh}</style></head><body>${b}</body></html>`;}