Update server.js

server.js

@@ -1,5 +1,7 @@
 // ==========================================
-// PIXELDRIVE v4.7 - SERVER.JS (ESM) - ADMIN API + EMBED.HTML
+// PIXELDRIVE v4.8 - SERVER.JS (ESM)
+// + password change, account delete, activity log, stats,
+//   share TTL, view/download counters
 // ==========================================
 import express from 'express';
 import session from 'express-session';
@@ -37,6 +39,7 @@ const IS_PROD = process.env.NODE_ENV === 'production';
 const USER_QUOTA = parseInt(process.env.USER_QUOTA_GB || '50', 10) * 1024 * 1024 * 1024;
 const DAILY_TRANSFER = parseInt(process.env.DAILY_TRANSFER_GB || '100', 10) * 1024 * 1024 * 1024;
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const TTL_ALLOWED = [1, 24, 168, 720]; // ✅ 1h / 24h / 7j / 30j
 
 function log(level, msg) {
     const n = new Date();
@@ -86,19 +89,24 @@ async function pngToBuffer(pngBuffer, expectedLen) {
     return rgb.subarray(0, expectedLen);
 }
 
+// ==========================================
+// SCHÉMA (+ activity, + compteurs views/downloads)
+// ==========================================
 db.exec(`
 CREATE TABLE IF NOT EXISTS users (id INTEGER PRIMARY KEY AUTOINCREMENT, username TEXT UNIQUE NOT NULL, password_hash BLOB NOT NULL, salt BLOB NOT NULL, is_admin INTEGER DEFAULT 0, tos_accepted INTEGER DEFAULT 0, avatar BLOB, created_at INTEGER DEFAULT (strftime('%s','now')));
 CREATE TABLE IF NOT EXISTS folders (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER REFERENCES folders(id) ON DELETE CASCADE, owner_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE, name TEXT NOT NULL, created_at INTEGER DEFAULT (strftime('%s','now')), UNIQUE(parent_id, owner_id, name));
 CREATE TABLE IF NOT EXISTS files (id TEXT PRIMARY KEY, folder_id INTEGER REFERENCES folders(id) ON DELETE SET NULL, owner_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE, name TEXT NOT NULL, mime TEXT NOT NULL, size INTEGER NOT NULL, chunk_count INTEGER DEFAULT 1, status TEXT DEFAULT 'pending', progress REAL DEFAULT 0, error_msg TEXT, encryption_key_hash TEXT NOT NULL, master_key_enc BLOB, created_at INTEGER DEFAULT (strftime('%s','now')), updated_at INTEGER DEFAULT (strftime('%s','now')));
 CREATE TABLE IF NOT EXISTS file_chunks (id INTEGER PRIMARY KEY AUTOINCREMENT, file_id TEXT NOT NULL REFERENCES files(id) ON DELETE CASCADE, chunk_index INTEGER NOT NULL, imgbb_url TEXT, imgbb_delete_url TEXT, imgbb_id TEXT, size INTEGER NOT NULL, encrypted_len INTEGER NOT NULL, UNIQUE(file_id, chunk_index));
-CREATE TABLE IF NOT EXISTS share_links (token TEXT PRIMARY KEY, file_id TEXT NOT NULL REFERENCES files(id) ON DELETE CASCADE, owner_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE, type TEXT NOT NULL, created_at INTEGER DEFAULT (strftime('%s','now')), expires_at INTEGER);
+CREATE TABLE IF NOT EXISTS share_links (token TEXT PRIMARY KEY, file_id TEXT NOT NULL REFERENCES files(id) ON DELETE CASCADE, owner_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE, type TEXT NOT NULL, created_at INTEGER DEFAULT (strftime('%s','now')), expires_at INTEGER, views INTEGER DEFAULT 0, downloads INTEGER DEFAULT 0);
 CREATE TABLE IF NOT EXISTS user_shares (id INTEGER PRIMARY KEY AUTOINCREMENT, file_id TEXT REFERENCES files(id) ON DELETE CASCADE, folder_id INTEGER REFERENCES folders(id) ON DELETE CASCADE, owner_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE, shared_with INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE, created_at INTEGER DEFAULT (strftime('%s','now')));
 CREATE TABLE IF NOT EXISTS transfer_daily (id INTEGER PRIMARY KEY AUTOINCREMENT, user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE, day TEXT NOT NULL, up_bytes INTEGER DEFAULT 0, down_bytes INTEGER DEFAULT 0, UNIQUE(user_id, day));
+CREATE TABLE IF NOT EXISTS activity (id INTEGER PRIMARY KEY AUTOINCREMENT, user_id INTEGER, action TEXT NOT NULL, detail TEXT, created_at INTEGER DEFAULT (strftime('%s','now')));
 CREATE INDEX IF NOT EXISTS idx_files_owner ON files(owner_id);
 CREATE INDEX IF NOT EXISTS idx_chunks_file ON file_chunks(file_id);
 CREATE INDEX IF NOT EXISTS idx_share_owner ON share_links(owner_id);
 CREATE INDEX IF NOT EXISTS idx_ushares_with ON user_shares(shared_with);
 CREATE INDEX IF NOT EXISTS idx_transfer_day ON transfer_daily(user_id, day);
+CREATE INDEX IF NOT EXISTS idx_activity_user ON activity(user_id, created_at);
 `);
 
 function runMigrations() {
@@ -126,11 +134,16 @@ function runMigrations() {
         }
     }
     if (updatedAdded) db.exec(`UPDATE files SET updated_at = strftime('%s','now') WHERE updated_at = 0;`);
+    // ✅ Compteurs de vues/téléchargements sur share_links
+    const slCols = db.prepare("PRAGMA table_info(share_links)").all().map(c => c.name);
+    if (!slCols.includes('views')) db.exec(`ALTER TABLE share_links ADD COLUMN views INTEGER DEFAULT 0;`);
+    if (!slCols.includes('downloads')) db.exec(`ALTER TABLE share_links ADD COLUMN downloads INTEGER DEFAULT 0;`);
     const tables = db.prepare("SELECT name FROM sqlite_master WHERE type='table'").all().map(t => t.name);
     if (!tables.includes('folders')) db.exec(`CREATE TABLE folders (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER REFERENCES folders(id) ON DELETE CASCADE, owner_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE, name TEXT NOT NULL, created_at INTEGER DEFAULT (strftime('%s','now')), UNIQUE(parent_id, owner_id, name));`);
-    if (!tables.includes('share_links')) db.exec(`CREATE TABLE share_links (token TEXT PRIMARY KEY, file_id TEXT NOT NULL REFERENCES files(id) ON DELETE CASCADE, owner_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE, type TEXT NOT NULL, created_at INTEGER DEFAULT (strftime('%s','now')), expires_at INTEGER);`);
+    if (!tables.includes('share_links')) db.exec(`CREATE TABLE share_links (token TEXT PRIMARY KEY, file_id TEXT NOT NULL REFERENCES files(id) ON DELETE CASCADE, owner_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE, type TEXT NOT NULL, created_at INTEGER DEFAULT (strftime('%s','now')), expires_at INTEGER, views INTEGER DEFAULT 0, downloads INTEGER DEFAULT 0);`);
     if (!tables.includes('user_shares')) db.exec(`CREATE TABLE user_shares (id INTEGER PRIMARY KEY AUTOINCREMENT, file_id TEXT REFERENCES files(id) ON DELETE CASCADE, folder_id INTEGER REFERENCES folders(id) ON DELETE CASCADE, owner_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE, shared_with INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE, created_at INTEGER DEFAULT (strftime('%s','now'))); CREATE INDEX idx_ushares_with ON user_shares(shared_with);`);
     if (!tables.includes('transfer_daily')) db.exec(`CREATE TABLE transfer_daily (id INTEGER PRIMARY KEY AUTOINCREMENT, user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE, day TEXT NOT NULL, up_bytes INTEGER DEFAULT 0, down_bytes INTEGER DEFAULT 0, UNIQUE(user_id, day)); CREATE INDEX idx_transfer_day ON transfer_daily(user_id, day);`);
+    if (!tables.includes('activity')) db.exec(`CREATE TABLE activity (id INTEGER PRIMARY KEY AUTOINCREMENT, user_id INTEGER, action TEXT NOT NULL, detail TEXT, created_at INTEGER DEFAULT (strftime('%s','now'))); CREATE INDEX idx_activity_user ON activity(user_id, created_at);`);
     const sessionsCols = tables.includes('sessions') ? db.prepare("PRAGMA table_info(sessions)").all().map(c => c.name) : [];
     if (tables.includes('sessions') && (!sessionsCols.includes('data') || !sessionsCols.includes('expires_at'))) {
         log('WARN', 'Table sessions invalide → reconstruction');
@@ -165,6 +178,11 @@ function addTransfer(userId, bytes, dir) {
 }
 function transferBlocked(userId) { return getTransfer(userId).total >= DAILY_TRANSFER; }
 
+// ✅ JOURNAL D'ACTIVITÉ
+function logActivity(userId, action, detail) {
+    try { db.prepare('INSERT INTO activity(user_id, action, detail) VALUES(?,?,?)').run(userId, action, String(detail || '').slice(0, 200)); } catch (e) {}
+}
+
 // --- NETTOYAGE + BACKUPS ---
 function cleanTemp() {
     try {
@@ -186,28 +204,23 @@ function backupDb() {
         log('INFO', `Backup BDD: ${name}`);
     } catch (e) { log('ERROR', `Backup échoué: ${e.message}`); }
 }
-function cleanErrorFiles() {
+function cleanHourly() {
     try {
-        const cutoff = Math.floor(Date.now() / 1000) - 7 * 86400;
+        const now = Date.now();
+        const s = db.prepare('DELETE FROM sessions WHERE expires_at < ?').run(now);
+        const l = db.prepare('DELETE FROM share_links WHERE expires_at IS NOT NULL AND expires_at < ?').run(now);
+        const a = db.prepare('DELETE FROM activity WHERE created_at < ?').run(Math.floor(now / 1000) - 30 * 86400);
+        db.prepare('DELETE FROM activity WHERE id NOT IN (SELECT id FROM activity ORDER BY id DESC LIMIT 2000)').run();
+        const cutoff = Math.floor(now / 1000) - 7 * 86400;
         const olds = db.prepare("SELECT id FROM files WHERE status='error' AND updated_at < ?").all(cutoff);
-        for (const f of olds) {
-            db.prepare('DELETE FROM files WHERE id=?').run(f.id);
-            try { unlinkSync(join(THUMB_DIR, `${f.id}.jpg`)); } catch (_) {}
-        }
-        if (olds.length) log('INFO', `Cleanup: ${olds.length} fichier(s) en erreur supprimé(s)`);
-    } catch (e) { log('WARN', `Error-files cleanup: ${e.message}`); }
-}
-function cleanOldTransfers() {
-    try {
-        const old = new Date(Date.now() - 3 * 86400000).toISOString().slice(0, 10);
-        const r = db.prepare('DELETE FROM transfer_daily WHERE day < ?').run(old);
-        if (r.changes) log('INFO', `Cleanup: ${r.changes} ligne(s) transfer_daily`);
-    } catch (e) { log('WARN', `Transfer cleanup: ${e.message}`); }
+        for (const f of olds) { db.prepare('DELETE FROM files WHERE id=?').run(f.id); try { unlinkSync(join(THUMB_DIR, `${f.id}.jpg`)); } catch (_) {} }
+        if (s.changes || l.changes || a.changes || olds.length) log('INFO', `Cleanup: ${s.changes} session(s), ${l.changes} lien(s), ${a.changes} activité(s), ${olds.length} fichier(s) erreur`);
+    } catch (e) { log('WARN', `Cleanup: ${e.message}`); }
 }
 mkdirSync(TEMP_DIR, { recursive: true });
 mkdirSync(THUMB_DIR, { recursive: true });
 cleanTemp();
-setInterval(() => { cleanTemp(); cleanErrorFiles(); cleanOldTransfers(); }, 3600000);
+setInterval(cleanHourly, 3600000);
 setInterval(backupDb, 6 * 3600000);
 setTimeout(backupDb, 60000);
 
@@ -290,13 +303,6 @@ class ByteLRUCache extends LRUCache { constructor(){ super({maxSize:CACHE_MAX_BY
 const fileCache = new ByteLRUCache();
 setInterval(()=>{ const m = process.memoryUsage(); if(m.rss > 13*1024*1024*1024){ log('ALERT', `RAM ${(m.rss/1e9).toFixed(1)}GB → vidage du cache`); fileCache.clear(); if(global.gc) global.gc(); } }, 30000);
 
-setInterval(() => {
-    const now = Date.now();
-    const s = db.prepare('DELETE FROM sessions WHERE expires_at < ?').run(now);
-    const l = db.prepare('DELETE FROM share_links WHERE expires_at IS NOT NULL AND expires_at < ?').run(now);
-    if (s.changes || l.changes) log('INFO', `Cleanup: ${s.changes} session(s), ${l.changes} lien(s) expiré(s)`);
-}, 3600000);
-
 let nsfwModel = null;
 async function loadNsfwModel(){ try{ await tf.setBackend('wasm'); tf.wasm.setWasmPaths('/app/tfjs_wasm/','tfjs-backend-wasm.wasm'); await tf.ready(); nsfwModel = await nsfwjs.load('/app/tfjs_wasm/',{type:'mobilenet_v2',size:224}); log('INFO', 'NSFW WASM chargé'); }catch(e){ log('WARN', `NSFW load fail: ${e.message}`); } }
 loadNsfwModel();
@@ -382,13 +388,12 @@ async function streamFile(res,file,key,range,counterUserId){
         if(cs > e) break;
     }
     res.end();
-    if (counterUserId) addTransfer(counterUserId, sentBytes, 'down'); // ✅ transit ↓ compté
+    if (counterUserId) addTransfer(counterUserId, sentBytes, 'down');
 }
 
 const sseClients = new Map();
 function broadcast(fid,d){ const cs = sseClients.get(fid); if(cs){ const p = `data: ${JSON.stringify(d)}\n\n`; for(const r of cs) r.write(p); } }
 
-// ✅ TEMPLATE EMBED (public/embed.html)
 let EMBED_TPL = null;
 function embedTpl() {
     if (EMBED_TPL === null) {
@@ -423,6 +428,7 @@ app.post('/api/login', loginLimit, async(req,res)=>{
     catch(e) { log('ERROR', `Session regenerate échouée: ${e.message}`); return res.status(500).json({error:'Erreur session'}); }
     req.session.userId = usr.id; req.session.isAdmin = !!usr.is_admin; req.session.tosAccepted = !!usr.tos_accepted; req.session.username = usr.username;
     log('INFO', `Connexion: ${u}`);
+    logActivity(usr.id, 'login', 'Connexion');
     res.json({ok:true,user:{id:usr.id,username:usr.username,isAdmin:!!usr.is_admin,tosAccepted:!!usr.tos_accepted}});
 });
 app.post('/api/logout',(req,res)=>req.session.destroy(()=>res.json({ok:true})));
@@ -436,7 +442,48 @@ app.get('/api/me',(req,res)=>{
 });
 app.post('/api/tos/accept',requireAuth,(req,res)=>{db.prepare('UPDATE users SET tos_accepted=1 WHERE id=?').run(req.session.userId);req.session.tosAccepted=true;res.json({ok:true});});
 
-// ✅ ADMIN API
+// ✅ CHANGER SON MOT DE PASSE
+app.post('/api/password', requireAuth, async(req,res)=>{
+    const { current, next } = req.body;
+    if (typeof current !== 'string' || typeof next !== 'string') return res.status(400).json({error:'Champs manquants'});
+    if (next.length < 6) return res.status(400).json({error:'Nouveau mot de passe trop court (6 min)'});
+    const usr = db.prepare('SELECT * FROM users WHERE id=?').get(req.session.userId);
+    const hCur = await deriveKey(current, usr.salt);
+    if (!hCur.equals(usr.password_hash)) return res.status(403).json({error:'Mot de passe actuel invalide'});
+    const salt = randomBytes(16);
+    const hNew = await deriveKey(next, salt);
+    db.prepare('UPDATE users SET password_hash=?, salt=? WHERE id=?').run(hNew, salt, usr.id);
+    log('INFO', `Mot de passe changé: ${usr.username}`);
+    logActivity(usr.id, 'password', 'Mot de passe modifié');
+    res.json({ok:true});
+});
+
+// ✅ SUPPRIMER SON COMPTE (self-service)
+app.delete('/api/account', requireAuth, async(req,res)=>{
+    const { password } = req.body;
+    const usr = db.prepare('SELECT * FROM users WHERE id=?').get(req.session.userId);
+    const h = await deriveKey(String(password || ''), usr.salt);
+    if (!h.equals(usr.password_hash)) return res.status(403).json({error:'Mot de passe invalide'});
+    const urls = db.prepare('SELECT fc.imgbb_delete_url FROM file_chunks fc JOIN files f ON f.id=fc.file_id WHERE f.owner_id=? AND fc.imgbb_delete_url IS NOT NULL').all(usr.id).map(r => r.imgbb_delete_url);
+    logActivity(usr.id, 'account_delete', 'Compte supprimé');
+    db.prepare('DELETE FROM users WHERE id=?').run(usr.id);
+    log('ALERT', `Compte #${usr.id} (${usr.username}) auto-supprimé (${urls.length} chunks en nettoyage)`);
+    (async () => { for (const u of urls) await imgbbDelete(u); })();
+    req.session.destroy(() => res.json({ok:true}));
+});
+
+// ✅ STATS PERSO (donut par type)
+app.get('/api/stats', requireAuth, (req,res) => {
+    res.json(db.prepare(`SELECT CASE WHEN mime LIKE 'image/%' THEN 'image' WHEN mime LIKE 'video/%' THEN 'video' WHEN mime LIKE 'audio/%' THEN 'audio' ELSE 'autre' END as cat, COUNT(*) c, COALESCE(SUM(size),0) s
+        FROM files WHERE owner_id=? AND status!='error' GROUP BY cat`).all(req.session.userId));
+});
+
+// ✅ ACTIVITÉ PERSO
+app.get('/api/activity', requireAuth, (req,res) => {
+    res.json(db.prepare('SELECT action, detail, created_at FROM activity WHERE user_id=? ORDER BY created_at DESC LIMIT 100').all(req.session.userId));
+});
+
+// ✅ ADMIN
 app.get('/api/admin/stats', requireAuth, requireAdmin, (req,res) => {
     const users = db.prepare('SELECT COUNT(*) c FROM users').get().c;
     const files = db.prepare('SELECT COUNT(*) c, COALESCE(SUM(size),0) s FROM files').get();
@@ -454,13 +501,16 @@ app.get('/api/admin/users', requireAuth, requireAdmin, (req,res) => {
         transferToday: getTransfer(u.id).total,
     })));
 });
+app.get('/api/admin/activity', requireAuth, requireAdmin, (req,res) => {
+    res.json(db.prepare(`SELECT a.action, a.detail, a.created_at, COALESCE(u.username,'public') as username FROM activity a LEFT JOIN users u ON u.id=a.user_id ORDER BY a.created_at DESC LIMIT 100`).all());
+});
 app.delete('/api/admin/users/:id', requireAuth, requireAdmin, (req,res) => {
     const id = parseInt(req.params.id, 10);
     if (!id) return res.status(400).json({error:'ID invalide'});
     if (id === req.session.userId) return res.status(400).json({error:'Impossible de supprimer votre propre compte'});
-    const urls = db.prepare('SELECT fc.imgbb_delete_url FROM file_chunks fc JOIN files f ON f.id = fc.file_id WHERE f.owner_id=? AND fc.imgbb_delete_url IS NOT NULL').all(id).map(r => r.imgbb_delete_url);
+    const urls = db.prepare('SELECT fc.imgbb_delete_url FROM file_chunks fc JOIN files f ON f.id=fc.file_id WHERE f.owner_id=? AND fc.imgbb_delete_url IS NOT NULL').all(id).map(r => r.imgbb_delete_url);
     db.prepare('DELETE FROM users WHERE id=?').run(id);
-    log('ALERT', `Admin ${req.session.username} a supprimé le compte #${id} (${urls.length} chunks ImgBB en nettoyage)`);
+    log('ALERT', `Admin ${req.session.username} a supprimé le compte #${id}`);
     (async () => { for (const u of urls) await imgbbDelete(u); })();
     res.json({ok:true});
 });
@@ -508,7 +558,7 @@ app.post('/api/folders/:id/rename',requireAuth,(req,res)=>{
     if(!name || typeof name !== 'string' || !name.trim() || name.length > 100) return res.status(400).json({error:'Nom invalide'});
     const fo = db.prepare('SELECT id FROM folders WHERE id=? AND owner_id=?').get(req.params.id, req.session.userId);
     if(!fo) return res.status(404).json({error:'Introuvable'});
-    try { db.prepare('UPDATE folders SET name=? WHERE id=?').run(name.trim(), req.params.id); res.json({ok:true}); }
+    try { db.prepare('UPDATE folders SET name=? WHERE id=?').run(name.trim(), req.params.id); logActivity(req.session.userId,'rename',name.trim()); res.json({ok:true}); }
     catch(e){ res.status(409).json({error:'Un dossier porte déjà ce nom'}); }
 });
 app.post('/api/folders/:id/move',requireAuth,(req,res)=>{
@@ -526,6 +576,7 @@ app.post('/api/folders/:id/move',requireAuth,(req,res)=>{
         }
     }
     db.prepare('UPDATE folders SET parent_id=? WHERE id=?').run(parent_id || null, req.params.id);
+    logActivity(req.session.userId,'move',fo.name);
     res.json({ok:true});
 });
 
@@ -545,6 +596,7 @@ app.post('/api/files/:id/rename',requireAuth,(req,res)=>{
     const f = db.prepare('SELECT id FROM files WHERE id=? AND owner_id=?').get(req.params.id, req.session.userId);
     if(!f) return res.status(404).json({error:'Introuvable'});
     db.prepare('UPDATE files SET name=? WHERE id=?').run(name.trim(), req.params.id);
+    logActivity(req.session.userId,'rename',name.trim());
     res.json({ok:true});
 });
 app.post('/api/files/:id/move',requireAuth,(req,res)=>{
@@ -557,6 +609,7 @@ app.post('/api/files/:id/move',requireAuth,(req,res)=>{
         if (!target || target.owner_id !== req.session.userId) return res.status(403).json({error:'Dossier cible invalide'});
     }
     db.prepare('UPDATE files SET folder_id=? WHERE id=?').run(folder_id || null, req.params.id);
+    logActivity(req.session.userId,'move',f.name);
     res.json({ok:true});
 });
 
@@ -572,6 +625,7 @@ app.post('/api/share-user',requireAuth,requireTos,shareLimit,(req,res)=>{
     if (db.prepare(`SELECT 1 FROM user_shares WHERE ${col}=? AND shared_with=?`).get(id, target.id)) return res.status(409).json({error:'Déjà partagé'});
     db.prepare(`INSERT INTO user_shares(${col},owner_id,shared_with) VALUES(?,?,?)`).run(id, req.session.userId, target.id);
     log('INFO', `Partage ${type} ${id} → ${username.trim()}`);
+    logActivity(req.session.userId,'share_user',`${type} → ${username.trim()}`);
     res.json({ok:true});
 });
 
@@ -659,6 +713,7 @@ async function processUpload(fid,path,mk,cc,mime,fsize,username,uid){
         db.prepare("UPDATE files SET status='ready',progress=100 WHERE id=?").run(fid);
         broadcast(fid,{type:'progress',progress:100,status:'ready',type:'done'});
         addTransfer(uid, fsize, 'up');
+        logActivity(uid, 'upload', path.split('/').pop());
         const secs = (Date.now()-t0)/1000;
         log('INFO', `Upload terminé: ${fid} en ${secs.toFixed(1)}s (${(fsize/1048576/secs).toFixed(2)} MB/s)`);
     }catch(e){
@@ -678,33 +733,38 @@ app.get('/api/files/:id/download',requireAuth,async(req,res)=>{
     const f = canAccessFile(req.session.userId, req.params.id);
     if(!f)return res.status(404).json({error:'Introuvable'});
     if(f.status!=='ready')return res.status(409).json({error:'Pas prêt',status:f.status});
+    logActivity(req.session.userId,'download',f.name);
     const k = await getMasterKey(f.id);
     await streamFile(res,f,k,req.headers.range,req.session.userId);
 });
 
+// ✅ PARTAGE AVEC TTL AU CHOIX (1h / 24h / 7j / 30j)
 app.post('/api/files/:id/share',requireAuth,shareLimit,async(req,res)=>{
     const f=db.prepare('SELECT * FROM files WHERE id=? AND owner_id=?').get(req.params.id,req.session.userId);
     if(!f||f.status!=='ready') return res.status(404).json({error:'Fichier non disponible'});
-    const pt=uuidv4(), dt2=uuidv4(), expires=Date.now()+7*24*3600000;
+    const ttlReq = parseInt(req.body.ttl, 10);
+    const ttl = TTL_ALLOWED.includes(ttlReq) ? ttlReq : 168;
+    const pt=uuidv4(), dt2=uuidv4(), expires=Date.now()+ttl*3600000;
     db.prepare('INSERT INTO share_links(token,file_id,owner_id,type,expires_at) VALUES(?,?,?,?,?)').run(pt,f.id,req.session.userId,'embed',expires);
     db.prepare('INSERT INTO share_links(token,file_id,owner_id,type,expires_at) VALUES(?,?,?,?,?)').run(dt2,f.id,req.session.userId,'download',expires);
-    res.json({preview:`/s/${pt}`,download:`/d/${dt2}`,expires});
+    logActivity(req.session.userId,'share_link',`${f.name} (${ttl}h)`);
+    res.json({preview:`/s/${pt}`,download:`/d/${dt2}`,expires,ttl});
 });
 
-// ✅ /s/:token → EMBED.HTML (page lisse) + OG injectés
+// ✅ /s/ : embed + compteur de vues + activité
 app.get('/s/:token',async(req,res)=>{
     const tpl = embedTpl();
     const serve = (status, data, og) => {
         if (!tpl) return res.status(status).send('Lien invalide');
-        const out = tpl
-            .replace('__OG_META__', og || '')
-            .replace('__EMBED_DATA__', JSON.stringify(data).replace(/</g, '\\u003c'));
+        const out = tpl.replace('__OG_META__', og || '').replace('__EMBED_DATA__', JSON.stringify(data).replace(/</g, '\\u003c'));
         res.status(status).send(out);
     };
     const l = db.prepare('SELECT * FROM share_links WHERE token=? AND type=? AND (expires_at IS NULL OR expires_at>?)').get(req.params.token,'embed',Date.now());
     if (!l) return serve(404, { error: 'Lien invalide ou expiré' });
     const f = db.prepare('SELECT * FROM files WHERE id=?').get(l.file_id);
     if (!f) return serve(404, { error: 'Fichier supprimé' });
+    db.prepare('UPDATE share_links SET views = views + 1 WHERE token=?').run(req.params.token);
+    logActivity(f.owner_id, 'public_view', f.name);
     let dt;
     const existing = db.prepare('SELECT token FROM share_links WHERE file_id=? AND type=? AND owner_id=? AND (expires_at IS NULL OR expires_at>?)').get(f.id,'download',l.owner_id,Date.now());
     if (existing) dt = existing.token;
@@ -714,12 +774,15 @@ app.get('/s/:token',async(req,res)=>{
     serve(200, { name: f.name, size: f.size, mime: f.mime, dl: '/d/' + dt }, og);
 });
 
+// ✅ /d/ : compteur de téléchargements + activité
 app.get('/d/:token',async(req,res)=>{
     const l=db.prepare('SELECT * FROM share_links WHERE token=? AND type=? AND (expires_at IS NULL OR expires_at>?)').get(req.params.token,'download',Date.now());
     if(!l)return res.status(404).json({error:'Invalide'});
     const f=db.prepare('SELECT * FROM files WHERE id=?').get(l.file_id);
     if(!f||f.status!=='ready')return res.status(404).json({error:'Indisponible'});
     if (transferBlocked(f.owner_id)) { log('ALERT', `Quota transit propriétaire atteint: ${f.id}`); return res.status(429).json({error:'Quota journalier du propriétaire atteint'}); }
+    db.prepare('UPDATE share_links SET downloads = downloads + 1 WHERE token=?').run(req.params.token);
+    logActivity(f.owner_id, 'public_download', f.name);
     log('INFO', `Téléchargement public /d/${req.params.token} (${f.name})`);
     const mk = decryptMasterKey(db.prepare('SELECT master_key_enc FROM files WHERE id=?').get(f.id).master_key_enc);
     await streamFile(res,f,mk,req.headers.range,f.owner_id);
@@ -734,6 +797,7 @@ app.delete('/api/files/:id',requireAuth,async(req,res)=>{
     db.prepare('DELETE FROM files WHERE id=?').run(f.id);
     fileCache.delete(`chunk:${f.id}:0`);
     try{unlinkSync(join(THUMB_DIR,`${f.id}.jpg`));}catch(_){}
+    logActivity(req.session.userId,'delete',f.name);
     res.json({ok:true});
 });
 
@@ -774,5 +838,5 @@ app.use((err, req, res, next) => {
     res.status(500).json({ error: 'Internal Server Error' });
 });
 
-const server = app.listen(PORT, '0.0.0.0', () => log('INFO', `PixelDrive v4.7 démarré | stockage ${(USER_QUOTA/1073741824).toFixed(0)} GB | transit ${(DAILY_TRANSFER/1073741824).toFixed(0)} GB/j`));
+const server = app.listen(PORT, '0.0.0.0', () => log('INFO', `PixelDrive v4.8 démarré | stockage ${(USER_QUOTA/1073741824).toFixed(0)} GB | transit ${(DAILY_TRANSFER/1073741824).toFixed(0)} GB/j`));
 process.on('SIGTERM', () => { log('WARN', 'SIGTERM reçu, arrêt...'); server.close(() => process.exit(0)); });