//PIXELDRIVE - Single File Backend + Frontend (Node 22+)
// ============================================================
import express from 'express';
import session from 'express-session';
import multer from 'multer';
import Database from 'better-sqlite3';
import { PNG } from 'pngjs';
import { ZstdCompressor, ZstdDecompressor } from '@bokuweb/zstd-wasm';
import Bottleneck from 'bottleneck';
import { randomBytes, createHash, scrypt, timingSafeEqual } from 'crypto';
import { WebSocketServer } from 'ws'; // Pour progression temps réel (optionnel)
import { fileURLToPath } from 'url';
import { dirname, resolve } from 'path';
import { v4 as uuidv4 } from 'uuid';

// --- CONFIG ---
const __dirname = dirname(fileURLToPath(import.meta.url));
const DATA_DIR = process.env.DATA_DIR || '/data';
const DB_PATH = `${DATA_DIR}/pixeldrive.db`;
const IMGBB_API_KEY = process.env.IMGBB_API_KEY;
const PORT = 7860;
const CHUNK_TARGET_SIZE = 31 * 1024 * 1024; // 31 Mo (marge sous 32Mo IMGBB)
const PNG_PIXEL_FORMAT = 'rgba'; // 4 octets/pixel (alignement 32bits + place ECC future)
const BYTES_PER_PIXEL = 4;
const UPLOAD_QUEUE_LIMIT = 20; // 20 req/min

if (!IMGBB_API_KEY) { console.error("❌ IMGBB_API_KEY manquant !"); process.exit(1); }

// --- INIT DB ---
const db = new Database(DB_PATH);
db.pragma('journal_mode = WAL');
db.exec(`
  CREATE TABLE IF NOT EXISTS users (
    id INTEGER PRIMARY KEY, username TEXT UNIQUE, password_hash TEXT, salt TEXT, is_admin INTEGER DEFAULT 0
  );
  CREATE TABLE IF NOT EXISTS files (
    id TEXT PRIMARY KEY, owner_id INTEGER, parent_id TEXT, name TEXT, mime TEXT,
    size INTEGER, chunk_count INTEGER, created_at INTEGER,
    FOREIGN KEY(owner_id) REFERENCES users(id), FOREIGN KEY(parent_id) REFERENCES files(id)
  );
  CREATE TABLE IF NOT EXISTS chunks (
    id INTEGER PRIMARY KEY, file_id TEXT, idx INTEGER, imgbb_url TEXT, imgbb_delete_url TEXT,
    sha256 TEXT, byte_size INTEGER, pixel_w INTEGER, pixel_h INTEGER,
    FOREIGN KEY(file_id) REFERENCES files(id) ON DELETE CASCADE
  );
  CREATE INDEX IF NOT EXISTS idx_files_parent ON files(parent_id);
  CREATE INDEX IF NOT EXISTS idx_chunks_file ON chunks(file_id);
`);

// Créer admin par défaut
const adminUser = process.env.ADMIN_USER || 'admin';
const adminPass = process.env.ADMIN_PASS || 'changeme';
const adminExists = db.prepare('SELECT 1 FROM users WHERE username = ?').get(adminUser);
if (!adminExists) {
  const salt = randomBytes(16);
  const hash = await new Promise((res, rej) => scrypt(adminPass, salt, 32, (e, k) => e ? rej(e) : res(k)));
  db.prepare('INSERT INTO users (username, password_hash, salt, is_admin) VALUES (?, ?, ?, 1)')
    .run(adminUser, hash, salt);
  console.log(`✅ Admin créé: ${adminUser} / ${adminPass}`);
}

// --- CRYPTO HELPERS (Web Crypto API - AES-256-GCM) ---
const deriveKey = (password, salt) => 
  crypto.subtle.importKey('raw', await new Promise((r, j) => scrypt(password, salt, 32, (e, k) => e ? j(e) : r(k))), 'PBKDF2', false, ['deriveBits'])
    .then(k => crypto.subtle.deriveBits({ name: 'PBKDF2', salt, iterations: 210000, hash: 'SHA-256' }, k, 256))
    .then(bits => crypto.subtle.importKey('raw', bits, { name: 'AES-GCM' }, false, ['encrypt', 'decrypt']));

// Simplifié pour code unique : Utilisation directe scrypt -> AES-GCM (Node crypto module est plus simple ici pour streaming)
import { createCipheriv, createDecipheriv } from 'crypto';
const encryptStream = (key, iv) => createCipheriv('aes-256-gcm', key, iv);
const decryptStream = (key, iv, authTag) => createDecipheriv('aes-256-gcm', key, iv).setAuthTag(authTag);

// --- ZSTD INIT (WARMUP) ---
const zstd = await ZstdCompressor.create();
const zstdDec = await ZstdDecompressor.create();

// --- IMGBB UPLOAD QUEUE (Rate Limit 20/min) ---
const uploadLimiter = new Bottleneck({ minTime: 3000, maxConcurrent: 1 }); // 1 req / 3s = 20/min

async function imgbbUpload(imageBuffer) {
  return uploadLimiter.schedule(async () => {
    const form = new FormData();
    form.append('image', new Blob([imageBuffer], { type: 'image/png' }));
    form.append('expiration', '0'); // Ne pas auto-supprimer
    const res = await fetch(`https://api.imgbb.com/1/upload?key=${IMGBB_API_KEY}`, { method: 'POST', body: form });
    const json = await res.json();
    if (!json.success) throw new Error(`IMGBB: ${json.error?.message || 'Unknown'}`);
    return { url: json.data.url, delete_url: json.data.delete_url, width: json.data.width, height: json.data.height };
  });
}

async function imgbbDelete(deleteUrl) {
  return uploadLimiter.schedule(async () => {
    await fetch(deleteUrl, { method: 'GET' }); // IMGBB delete via GET sur delete_url
  });
}

// --- PNG ENGINE ---
function dataToPngBuffer(dataBuffer) {
  const pixelCount = Math.ceil(dataBuffer.length / BYTES_PER_PIXEL);
  const w = Math.ceil(Math.sqrt(pixelCount));
  const h = Math.ceil(pixelCount / w);
  const png = new PNG({ width: w, height: h, colorType: 6, filterType: 4 }); // RGBA, Paeth filter
  png.data.set(dataBuffer); // Remplit R,G,B,A,R,G,B,A...
  // Padding auto à 0 par PNG.js
  return new Promise((res, rej) => {
    const chunks = [];
    png.on('data', c => chunks.push(c));
    png.on('end', () => res(Buffer.concat(chunks)));
    png.on('error', rej);
    png.pack();
  });
}

function pngBufferToData(pngBuffer, expectedLength) {
  return new Promise((res, rej) => {
    const png = new PNG();
    png.on('parsed', () => {
      const buf = png.data.subarray(0, expectedLength);
      res(buf);
    });
    png.on('error', rej);
    png.parse(pngBuffer);
  });
}

// --- EXPRESS APP ---
const app = express();
app.use(express.json({ limit: '50mb' }));
app.use(express.urlencoded({ extended: true, limit: '50mb' }));
app.use(session({
  secret: process.env.SESSION_SECRET || randomBytes(32).toString('hex'),
  resave: false, saveUninitialized: false,
  cookie: { httpOnly: true, secure: false, maxAge: 7 * 86400000, sameSite: 'lax' }
}));
const upload = multer({ dest: `${DATA_DIR}/tmp_uploads`, limits: { fileSize: 2 * 1024 * 1024 * 1024 } }); // 2Go max upload

// Auth Middleware
const requireAuth = (req, res, next) => req.session.userId ? next() : res.status(401).json({ error: 'Non connecté' });
const requireAdmin = (req, res, next) => req.session.isAdmin ? next() : res.status(403).json({ error: 'Admin requis' });

// --- API ROUTES ---

// Auth
app.post('/api/auth/register', async (req, res) => {
  const { username, password } = req.body;
  if (!username || !password) return res.status(400).json({ error: 'Champs manquants' });
  const salt = randomBytes(16);
  const hash = await new Promise((r, j) => scrypt(password, salt, 32, (e, k) => e ? j(e) : r(k)));
  try {
    db.prepare('INSERT INTO users (username, password_hash, salt) VALUES (?, ?, ?)').run(username, hash, salt);
    res.json({ ok: true });
  } catch (e) { res.status(409).json({ error: 'Utilisateur existe' }); }
});

app.post('/api/auth/login', async (req, res) => {
  const { username, password } = req.body;
  const user = db.prepare('SELECT * FROM users WHERE username = ?').get(username);
  if (!user) return res.status(401).json({ error: 'Identifiants invalides' });
  const hash = await new Promise((r, j) => scrypt(password, user.salt, 32, (e, k) => e ? j(e) : r(k)));
  if (!timingSafeEqual(hash, user.password_hash)) return res.status(401).json({ error: 'Identifiants invalides' });
  req.session.userId = user.id; req.session.isAdmin = !!user.is_admin; req.session.username = user.username;
  res.json({ ok: true, user: { username: user.username, isAdmin: !!user.is_admin } });
});

app.post('/api/auth/logout', (req, res) => req.session.destroy(() => res.json({ ok: true })));
app.get('/api/auth/me', (req, res) => req.session.userId ? res.json({ user: { username: req.session.username, isAdmin: req.session.isAdmin }}) : res.status(401).json({ error: 'Non connecté' }));

// Drive: List
app.get('/api/fs/list', requireAuth, (req, res) => {
  const parentId = req.query.parent_id || null;
  const items = db.prepare('SELECT id, name, mime, size, chunk_count, created_at, parent_id FROM files WHERE owner_id = ? AND (parent_id IS ? OR parent_id = ?) ORDER BY name')
    .all(req.session.userId, parentId, parentId);
  res.json({ items });
});

// Drive: Mkdir
app.post('/api/fs/mkdir', requireAuth, (req, res) => {
  const { name, parent_id } = req.body;
  if (!name) return res.status(400).json({ error: 'Nom requis' });
  const id = uuidv4();
  db.prepare('INSERT INTO files (id, owner_id, parent_id, name, mime, size, chunk_count) VALUES (?, ?, ?, ?, ?, 0, 0)')
    .run(id, req.session.userId, parent_id || null, name, 'application/vnd.pixeldrive.folder');
  res.json({ ok: true, id });
});

// Drive: Upload (Streaming Pipeline)
app.post('/api/fs/upload', requireAuth, upload.single('file'), async (req, res) => {
  if (!req.file) return res.status(400).json({ error: 'Fichier manquant' });
  const parentId = req.body.parent_id || null;
  const originalName = req.file.originalname;
  const mime = req.file.mimetype || 'application/octet-stream';
  const tmpPath = req.file.path;
  const fileId = uuidv4();

  try {
    // 1. Créer entrée DB (statut pending)
    db.prepare('INSERT INTO files (id, owner_id, parent_id, name, mime, size, chunk_count) VALUES (?, ?, ?, ?, ?, ?, 0)')
      .run(fileId, req.session.userId, parentId, originalName, mime, req.file.size);

    // 2. Pipeline: Read -> Zstd -> Encrypt -> Chunk -> PNG -> IMGBB
    const fs = await import('fs');
    const readStream = fs.createReadStream(tmpPath, { highWaterMark: 1024 * 1024 }); // 1Mo buffer

    // Key derivation per file (File Key) + User Master Key logic simplifié ici: 1 clé par user stockée en session ? Non, trop risqué.
    // STRATEGIE SIMPLE & ROBUSTE: Clé dérivée du mot de passe user + salt fichier.
    // Mais on a pas le MDP en session. ON VA FAIRE: Clé aléatoire par fichier, stockée chiffrée avec clé maître user ?
    // TROP COMPLEXE POUR 1 FICHIER.
    // COMPROMIS MOBILE: **Clé unique dérivée du UserID + Secret Serveur (SESSION_SECRET) + FileID**.
    // Permet de déchiffrer si on a accès au serveur + DB. Pas "Zero Knowledge" mais fonctionnel.
    const masterSecret = process.env.SESSION_SECRET;
    const fileKeyRaw = createHash('sha256').update(`${masterSecret}:${req.session.userId}:${fileId}`).digest(); // 32 bytes
    const iv = randomBytes(12); // GCM 96-bit

    const compressor = new zstd.simple.ZstdCompressor(3); // Level 3 rapide
    let chunkIdx = 0;
    let totalOriginalSize = 0;
    let pendingChunks = [];

    // Buffer d'accumulation pour chunking
    let buffer = Buffer.alloc(0);

    for await (const chunk of readStream) {
      buffer = Buffer.concat([buffer, chunk]);
      totalOriginalSize += chunk.length;

      while (buffer.length >= CHUNK_TARGET_SIZE) {
        const chunkData = buffer.subarray(0, CHUNK_TARGET_SIZE);
        buffer = buffer.subarray(CHUNK_TARGET_SIZE);
        await processAndUploadChunk(chunkData, chunkIdx++);
      }
    }
    // Dernier chunk
    if (buffer.length > 0) await processAndUploadChunk(buffer, chunkIdx);

    // Maj DB Final
    db.prepare('UPDATE files SET size = ?, chunk_count = ? WHERE id = ?').run(totalOriginalSize, chunkIdx, fileId);
    res.json({ ok: true, fileId, chunks: chunkIdx });

  } catch (e) {
    console.error("Upload Error:", e);
    // Cleanup IMGBB si erreur partielle ? Trop complexe ici. Log only.
    res.status(500).json({ error: e.message });
  } finally {
    fs.unlink(tmpPath).catch(()=>{});
  }

  // --- Fonction interne Upload Chunk ---
  async function processAndUploadChunk(rawChunk, idx) {
    // 1. Compress
    const compressed = compressor.compress(new Uint8Array(rawChunk));
    // 2. Encrypt
    const cipher = createCipheriv('aes-256-gcm', fileKeyRaw, iv);
    const encrypted = Buffer.concat([cipher.update(compressed), cipher.final()]);
    const authTag = cipher.getAuthTag();
    const payload = Buffer.concat([iv, authTag, encrypted]); // IV(12) + TAG(16) + DATA

    // 3. PNG Encode
    const pngBuf = await dataToPngBuffer(payload);
    // 4. IMGBB Upload
    const { url, delete_url, width, height } = await imgbbUpload(pngBuf);
    // 5. Hash pour vérif
    const sha = createHash('sha256').update(payload).digest('hex');
    // 6. Save Chunk Meta
    db.prepare('INSERT INTO chunks (file_id, idx, imgbb_url, imgbb_delete_url, sha256, byte_size, pixel_w, pixel_h) VALUES (?, ?, ?, ?, ?, ?, ?, ?)')
      .run(fileId, idx, url, delete_url, sha, payload.length, width, height);
  }
});

// Drive: Download (Reconstruct)
app.get('/api/fs/download/:fileId', requireAuth, async (req, res) => {
  const file = db.prepare('SELECT * FROM files WHERE id = ? AND owner_id = ?').get(req.params.fileId, req.session.userId);
  if (!file) return res.status(404).json({ error: 'Introuvable' });
  if (file.mime === 'application/vnd.pixeldrive.folder') return res.status(400).json({ error: 'Est un dossier' });

  const chunks = db.prepare('SELECT * FROM chunks WHERE file_id = ? ORDER BY idx').all(file.id);
  if (chunks.length === 0) return res.status(404).json({ error: 'Aucun chunk' });

  // Key derivation (Même logique qu'upload)
  const masterSecret = process.env.SESSION_SECRET;
  const fileKeyRaw = createHash('sha256').update(`${masterSecret}:${req.session.userId}:${file.id}`).digest();

  res.setHeader('Content-Disposition', `attachment; filename="${encodeURIComponent(file.name)}"`);
  res.setHeader('Content-Type', file.mime);
  res.setHeader('Content-Length', file.size); // Taille originale

  const decompressor = new zstd.simple.ZstdDecompressor();

  for (const ch of chunks) {
    try {
      // 1. Fetch Image
      const imgRes = await fetch(ch.imgbb_url);
      if (!imgRes.ok) throw new Error(`DL IMGBB failed: ${imgRes.status}`);
      const pngBuf = Buffer.from(await imgRes.arrayBuffer());

      // 2. Decode PNG
      const payload = await pngBufferToData(pngBuf, ch.byte_size);
      
      // 3. Verify Hash
      const sha = createHash('sha256').update(payload).digest('hex');
      if (sha !== ch.sha256) throw new Error(`Hash mismatch chunk ${ch.idx}`);

      // 4. Decrypt
      const iv = payload.subarray(0, 12);
      const authTag = payload.subarray(12, 28);
      const encrypted = payload.subarray(28);
      const decipher = createDecipheriv('aes-256-gcm', fileKeyRaw, iv);
      decipher.setAuthTag(authTag);
      const compressed = Buffer.concat([decipher.update(encrypted), decipher.final()]);

      // 5. Decompress & Stream
      const original = decompressor.decompress(new Uint8Array(compressed));
      res.write(Buffer.from(original));

    } catch (e) {
      console.error(`Chunk ${ch.idx} error:`, e);
      return res.destroy(new Error(`Corruption chunk ${ch.idx}`));
    }
  }
  res.end();
});

// Drive: Preview / Embed (Streaming direct pour Video/Image)
app.get('/api/fs/preview/:fileId', requireAuth, async (req, res) => {
  const file = db.prepare('SELECT * FROM files WHERE id = ? AND owner_id = ?').get(req.params.fileId, req.session.userId);
  if (!file) return res.status(404).send('Not found');
  
  // Seuls types embeddables
  const embeddable = ['image/', 'video/', 'audio/', 'application/pdf'];
  if (!embeddable.some(t => file.mime.startsWith(t))) return res.status(400).send('Non prévisualisable');

  // Si image unique (1 chunk) -> Redirection directe IMGBB (Cache navigateur)
  if (file.chunk_count === 1 && file.mime.startsWith('image/')) {
    const ch = db.prepare('SELECT imgbb_url FROM chunks WHERE file_id = ?').get(file.id);
    if (ch) return res.redirect(ch.imgbb_url);
  }

  // Sinon Streaming reconstruit (Range requests pour vidéo)
  // NOTE: Implémentation complète Range Request complexe ici.
  // On fait simple: stream complet (OK pour images, lent pour grosses vidéos seek).
  // Pour VRAI streaming vidéo, il faut un worker qui reconstruit les chunks demandés.
  // ICI ON FAIT LE MINIMUM: Stream complet.
  req.url = `/api/fs/download/${file.id}`; // Hack interne
  app._router.handle(req, res); // Réutilise download logic
});

// Drive: Delete (Cascade IMGBB + DB)
app.delete('/api/fs/:fileId', requireAuth, async (req, res) => {
  const file = db.prepare('SELECT * FROM files WHERE id = ? AND owner_id = ?').get(req.params.fileId, req.session.userId);
  if (!file) return res.status(404).json({ error: 'Introuvable' });

  const chunks = db.prepare('SELECT imgbb_delete_url FROM chunks WHERE file_id = ?').all(file.id);
  
  // Supprimer IMGBB (Background, ne pas bloquer)
  chunks.forEach(ch => {
    if (ch.imgbb_delete_url) imgbbDelete(ch.imgbb_delete_url).catch(console.error);
  });

  // Supprimer DB (CASCADE supprime chunks)
  db.prepare('DELETE FROM files WHERE id = ?').run(file.id);
  res.json({ ok: true, deletedChunks: chunks.length });
});

// Admin: Stats
app.get('/api/admin/stats', requireAuth, requireAdmin, (req, res) => {
  const users = db.prepare('SELECT COUNT(*) as c FROM users').get().c;
  const files = db.prepare('SELECT COUNT(*) as c, SUM(size) as s FROM files WHERE mime != ?').get('application/vnd.pixeldrive.folder');
  const chunks = db.prepare('SELECT COUNT(*) as c FROM chunks').get().c;
  res.json({ users, files: files.c, totalSize: files.s || 0, chunks: chunks.c });
});

// --- FRONTEND SPA (Servi sur /) ---
const HTML = `<!DOCTYPE html>
<html lang="fr"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>PixelDrive</title>
<style>
:root { --bg:#0d1117; --fg:#c9d1d9; --accent:#58a6ff; --card:#161b22; --border:#30363d; --danger:#f85149; --success:#3fb950; }
* { box-sizing:border-box; font-family: system-ui, sans-serif; margin:0; padding:0; }
body { background:var(--bg); color:var(--fg); min-height:100vh; display:flex; flex-direction:column; }
header { background:var(--card); border-bottom:1px solid var(--border); padding:1rem 1.5rem; display:flex; justify-content:space-between; align-items:center; position:sticky; top:0; z-index:10; }
h1 { font-size:1.25rem; font-weight:600; color:var(--accent); }
header div { display:flex; gap:0.5rem; align-items:center; }
button, input, select { background:var(--bg); color:var(--fg); border:1px solid var(--border); padding:0.5rem 1rem; border-radius:6px; cursor:pointer; font-size:0.9rem; }
button.primary { background:var(--accent); color:#fff; border-color:var(--accent); }
button.danger { background:var(--danger); color:#fff; border-color:var(--danger); }
button:disabled { opacity:0.5; cursor:not-allowed; }
input[type=file] { padding:0.3rem; }
main { flex:1; padding:1.5rem; max-width:900px; width:100%; margin:0 auto; }
.card { background:var(--card); border:1px solid var(--border); border-radius:8px; padding:1.5rem; margin-bottom:1rem; }
.grid { display:grid; grid-template-columns:repeat(auto-fill, minmax(180px, 1fr)); gap:1rem; }
.item { background:var(--bg); border:1px solid var(--border); border-radius:6px; padding:1rem; display:flex; flex-direction:column; gap:0.5rem; position:relative; }
.item.folder { border-color:var(--accent); }
.item-name { font-weight:500; white-space:nowrap; overflow:hidden; text-overflow:ellipsis; }
.item-meta { font-size:0.75rem; color:#8b949e; }
.item-actions { display:flex; gap:0.25rem; margin-top:auto; padding-top:0.5rem; border-top:1px solid var(--border); }
.modal { position:fixed; inset:0; background:#0008; display:flex; align-items:center; justify-content:center; z-index:100; }
.modal.hidden { display:none; }
.modal-content { background:var(--card); border:1px solid var(--border); border-radius:8px; padding:1.5rem; width:100%; max-width:400px; display:flex; flex-direction:column; gap:1rem; }
.toast { position:fixed; bottom:1rem; right:1rem; padding:1rem 1.5rem; background:var(--card); border:1px solid var(--border); border-radius:6px; z-index:200; animation:slide 0.3s; }
.toast.success { border-left:4px solid var(--success); }
.toast.error { border-left:4px solid var(--danger); }
@keyframes slide { from { transform:translateX(100%); opacity:0; } to { transform:translateX(0); opacity:1; } }
.progress-bar { height:4px; background:var(--border); border-radius:2px; overflow:hidden; margin:0.5rem 0; }
.progress-bar > div { height:100%; background:var(--accent); width:0%; transition:width 0.1s; }
</style>
</head><body>
<header>
  <h1>💾 PixelDrive</h1>
  <div>
    <span id="userInfo" style="margin-right:1rem; font-size:0.9rem;"></span>
    <button id="btnLogout" class="danger" style="display:none;">Déconnexion</button>
    <button id="btnLogin" class="primary">Connexion</button>
  </div>
</header>
<main id="app">
  <!-- Vue Auth -->
  <div id="viewAuth" class="card" style="max-width:400px; margin:2rem auto;">
    <h2 style="margin-bottom:1rem;">Connexion / Inscription</h2>
    <input id="authUser" placeholder="Nom d'utilisateur" style="width:100%; margin-bottom:0.5rem;">
    <input id="authPass" type="password" placeholder="Mot de passe" style="width:100%; margin-bottom:0.5rem;">
    <button id="btnDoLogin" class="primary" style="width:100%;">Se connecter</button>
    <button id="btnDoRegister" style="width:100%; margin-top:0.5rem;">Créer compte</button>
  </div>

  <!-- Vue Drive (Cachée au debut) -->
  <div id="viewDrive" class="hidden">
    <div class="card" style="display:flex; gap:0.5rem; flex-wrap:wrap; margin-bottom:1rem;">
      <input type="file" id="fileInput" multiple>
      <button id="btnUpload" class="primary">Uploader</button>
      <input type="text" id="mkdirName" placeholder="Nom dossier" style="flex:1; min-width:150px;">
      <button id="btnMkdir">Créer dossier</button>
      <span style="flex:1;"></span>
      <span id="pathDisplay" style="align-self:center; color:#8b949e; font-size:0.9rem;">🏠 Racine</span>
    </div>
    <div id="progressContainer" class="card hidden">
      <div>Upload: <span id="progressText">0%</span></div>
      <div class="progress-bar"><div id="progressBar"></div></div>
    </div>
    <div id="grid" class="grid"></div>
  </div>
</main>

<!-- Modals -->
<div id="modalConfirm" class="modal hidden"><div class="modal-content"><h3>Confirmer</h3><p id="modalText"></p><div style="display:flex; justify-content:flex-end; gap:0.5rem;"><button id="modalCancel">Annuler</button><button id="modalOk" class="danger">Supprimer</button></div></div></div>
<div id="modalPreview" class="modal hidden"><div class="modal-content" style="max-width:90vw; max-height:90vh; padding:0;"><button style="align-self:flex-end; background:none; border:none; color:var(--fg); font-size:1.5rem; padding:0.5rem;">✕</button><div id="previewContent" style="max-height:80vh; overflow:auto;"></div></div></div>

<div id="toastContainer"></div>

<script>
const API = '';
let currentParentId = null;
const pathStack = [{id: null, name: 'Racine'}];

// Utils
const $ = (sel) => document.querySelector(sel);
const $$ = (sel) => document.querySelectorAll(sel);
const show = (el) => el.classList.remove('hidden');
const hide = (el) => el.classList.add('hidden');
const toast = (msg, type='') => { const t=document.createElement('div'); t.className='toast '+type; t.textContent=msg; $('#toastContainer').append(t); setTimeout(()=>t.remove(), 3000); };
const req = async (url, opts={}) => { const r = await fetch(API+url, {credentials:'include', headers:{'Content-Type':'application/json', ...(opts.headers||{})}, ...opts}); if(!r.ok){ const e=await r.json().catch(()=>({error:r.statusText})); throw new Error(e.error||r.status); } return r.json(); };
const reqForm = async (url, formData) => { const r = await fetch(API+url, {method:'POST', credentials:'include', body:formData}); if(!r.ok) throw new Error((await r.json()).error||r.status); return r.json(); };

// Auth UI
$('#btnLogin').onclick = () => { hide($('#viewDrive')); show($('#viewAuth')); };
$('#btnLogout').onclick = async () => { await req('/api/auth/logout', {method:'POST'}); location.reload(); };
$('#btnDoLogin').onclick = async () => { try{ await req('/api/auth/login', {method:'POST', body:JSON.stringify({username:$('#authUser').value, password:$('#authPass').value})}); toast('Connecté','success'); initDrive(); }catch(e){ toast(e.message,'error'); }};
$('#btnDoRegister').onclick = async () => { try{ await req('/api/auth/register', {method:'POST', body:JSON.stringify({username:$('#authUser').value, password:$('#authPass').value})}); toast('Compte créé, connectez-vous','success'); }catch(e){ toast(e.message,'error'); }};

// Drive Init
async function initDrive() {
  const me = await req('/api/auth/me');
  $('#userInfo').textContent = me.user.username + (me.user.isAdmin ? ' 👑' : '');
  hide($('#viewAuth')); hide($('#btnLogin')); show($('#btnLogout')); show($('#viewDrive'));
  loadFolder(null);
}

// Folder Navigation
function updatePath() { $('#pathDisplay').textContent = '🏠 ' + pathStack.map(p=>p.name).join(' / '); }
async function loadFolder(parentId) {
  currentParentId = parentId;
  updatePath();
  const {items} = await req('/api/fs/list?parent_id=' + (parentId || ''));
  renderGrid(items);
}
function renderGrid(items) {
  const grid = $('#grid'); grid.innerHTML = '';
  items.forEach(item => {
    const div = document.createElement('div');
    div.className = 'item' + (item.mime === 'application/vnd.pixeldrive.folder' ? ' folder' : '');
    div.innerHTML = \`
      <div class="item-name" title="\${item.name}">\${item.mime === 'application/vnd.pixeldrive.folder' ? '📁' : '📄'} \${item.name}</div>
      <div class="item-meta">\${item.mime !== 'application/vnd.pixeldrive.folder' ? formatBytes(item.size) + ' • ' + item.chunk_count + ' chunks' : ''}\${new Date(item.created_at).toLocaleString()}</div>
      <div class="item-actions">
        \${item.mime !== 'application/vnd.pixeldrive.folder' ? \`<button class="btn-preview" title="Voir/Embed">👁</button>\` : ''}
        \${item.mime !== 'application/vnd.pixeldrive.folder' ? \`<button class="btn-download" title="Télécharger">⬇</button>\` : ''}
        <button class="btn-delete danger" title="Supprimer">🗑</button>
      </div>
    \`;
    // Events
    if(item.mime === 'application/vnd.pixeldrive.folder') {
      div.querySelector('.item-name').onclick = () => { pathStack.push(item); loadFolder(item.id); };
    } else {
      div.querySelector('.btn-download').onclick = () => window.open('/api/fs/download/' + item.id, '_blank');
      div.querySelector('.btn-preview').onclick = () => openPreview(item.id, item.mime, item.name);
    }
    div.querySelector('.btn-delete').onclick = () => confirmDelete(item.id, item.name, item.mime === 'application/vnd.pixeldrive.folder');
    grid.appendChild(div);
  });
  // Breadcrumb click
  $('#pathDisplay').onclick = (e) => { if(e.target.tagName==='SPAN'){} }; // Pas simple sans router, on met bouton "Retour"
}

// Upload
$('#btnMkdir').onclick = async () => { const n=$('#mkdirName').value.trim(); if(!n) return; try{ await req('/api/fs/mkdir', {method:'POST', body:JSON.stringify({name:n, parent_id:currentParentId})}); toast('Dossier créé','success'); $('#mkdirName').value=''; loadFolder(currentParentId); }catch(e){ toast(e.message,'error'); }};
$('#btnUpload').onclick = () => $('#fileInput').click();
$('#fileInput').onchange = async (e) => {
  const files = e.target.files; if(!files.length) return;
  hide($('#btnUpload')); show($('#progressContainer'));
  for(const file of files) {
    const form = new FormData(); form.append('file', file); form.append('parent_id', currentParentId || '');
    try {
      // XHR pour progression
      await new Promise((resolve, reject) => {
        const xhr = new XMLHttpRequest();
        xhr.open('POST', '/api/fs/upload', true);
        xhr.withCredentials = true;
        xhr.upload.onprogress = (ev) => { if(ev.lengthComputable) { const p=Math.round(ev.loaded/ev.total*100); $('#progressBar').style.width=p+'%'; $('#progressText').textContent=p+'%'; }};
        xhr.onload = () => { if(xhr.status>=200&&xhr.status<300) resolve(JSON.parse(xhr.response)); else reject(new Error(xhr.responseText)); };
        xhr.onerror = () => reject(new Error('Network'));
        xhr.send(form);
      });
      toast(\`\${file.name} uploadé\`, 'success');
    } catch(err) { toast(\`Erreur \${file.name}: \${err.message}\`, 'error'); }
  }
  $('#fileInput').value=''; show($('#btnUpload')); hide($('#progressContainer')); loadFolder(currentParentId);
};

// Delete
let deleteTarget = null;
function confirmDelete(id, name, isFolder) { deleteTarget = {id, isFolder}; $('#modalText').textContent = \`Supprimer \${isFolder?'le dossier':'le fichier'} "\${name}" ? \${isFolder?'(Récursif - TODO)':''}\`; show($('#modalConfirm')); }
$('#modalCancel').onclick = () => hide($('#modalConfirm'));
$('#modalOk').onclick = async () => { if(!deleteTarget) return; try{ await req('/api/fs/'+deleteTarget.id, {method:'DELETE'}); toast('Supprimé','success'); loadFolder(currentParentId); }catch(e){ toast(e.message,'error'); } hide($('#modalConfirm')); deleteTarget=null; };

// Preview Modal
function openPreview(id, mime, name) {
  const c = $('#previewContent'); c.innerHTML = '';
  if(mime.startsWith('image/')) c.innerHTML = \`<img src="/api/fs/preview/\${id}" style="max-width:100%; max-height:80vh;" alt="\${name}">\`;
  else if(mime.startsWith('video/') || mime.startsWith('audio/')) c.innerHTML = \`<video controls style="max-width:100%; max-height:80vh;"><source src="/api/fs/preview/\${id}" type="\${mime}"></video>\`;
  else if(mime === 'application/pdf') c.innerHTML = \`<iframe src="/api/fs/preview/\${id}" style="width:100%; height:80vh; border:none;"></iframe>\`;
  else c.innerHTML = \`<p style="padding:2rem; text-align:center;">Aperçu non dispo pour \${mime}</p>\`;
  show($('#modalPreview'));
}
$('#modalPreview').onclick = (e) => { if(e.target === $('#modalPreview') || e.target.tagName==='BUTTON') hide($('#modalPreview')); };

// Helpers
function formatBytes(b) { if(b<1024) return b+'o'; const k=1024, sizes=['o','Ko','Mo','Go','To']; const i=Math.floor(Math.log(b)/Math.log(k)); return (b/Math.pow(k,i)).toFixed(1)+' '+sizes[i]; }

// Start
initDrive().catch(()=>{ show($('#viewAuth')); hide($('#viewDrive')); });
</script>
</body></html>`;

app.get('/', (req, res) => res.type('html').send(HTML));
app.use(express.static('public', { maxAge: '1h' })); // Au cas où tu ajoutes des assets

// --- START ---
const server = app.listen(PORT, '0.0.0.0', () => console.log(`🚀 PixelDrive running on http://0.0.0.0:${PORT}`));

// Graceful shutdown
process.on('SIGTERM', () => { console.log('SIGTERM received'); server.close(() => { db.close(); process.exit(0); }); });