9drive 1.0.0

package/backend/dist/app.js

@@ -0,0 +1,113 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.app = void 0;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const cors_1 = __importDefault(require("cors"));
+const express_1 = __importDefault(require("express"));
+const env_js_1 = require("./config/env.js");
+const error_middleware_js_1 = require("./middleware/error.middleware.js");
+const auth_routes_js_1 = require("./modules/auth/auth.routes.js");
+const provider_config_routes_js_1 = require("./modules/provider-configs/provider-config.routes.js");
+const connected_account_routes_js_1 = require("./modules/connected-accounts/connected-account.routes.js");
+const storage_routes_js_1 = require("./modules/storage/storage.routes.js");
+const upload_routes_js_1 = require("./modules/uploads/upload.routes.js");
+const file_routes_js_1 = require("./modules/files/file.routes.js");
+const folder_routes_js_1 = require("./modules/folders/folder.routes.js");
+const public_routes_js_1 = require("./modules/public/public.routes.js");
+const invite_routes_js_1 = require("./modules/invites/invite.routes.js");
+const api_key_routes_js_1 = require("./modules/api-keys/api-key.routes.js");
+const public_api_routes_js_1 = require("./modules/public-api/public-api.routes.js");
+const cdn_routes_js_1 = require("./modules/cdn/cdn.routes.js");
+const audit_log_routes_js_1 = require("./modules/audit-logs/audit-log.routes.js");
+const system_routes_js_1 = require("./modules/system/system.routes.js");
+const baseDir = typeof __dirname !== 'undefined' ? __dirname : process.cwd();
+// Find frontend public build if available (for unified CLI or production hosting)
+const possiblePublicDirs = [
+    path_1.default.resolve(baseDir, '../public'),
+    path_1.default.resolve(baseDir, '../../frontend/dist'),
+    path_1.default.resolve(process.cwd(), 'dist-frontend'),
+    path_1.default.resolve(process.cwd(), 'public'),
+];
+const publicDir = possiblePublicDirs.find((dir) => fs_1.default.existsSync(path_1.default.join(dir, 'index.html')));
+exports.app = (0, express_1.default)();
+exports.app.set('trust proxy', true);
+// Dynamic CORS: Allow open access for CDN delivery and public API routes, allow frontend origins
+exports.app.use((req, res, next) => {
+    if (req.path.startsWith('/cdn') || req.path.startsWith('/api') || req.path.startsWith('/public')) {
+        return (0, cors_1.default)({ origin: '*' })(req, res, next);
+    }
+    const host = req.get('host');
+    return (0, cors_1.default)({
+        origin: (origin, callback) => {
+            if (!origin ||
+                origin === env_js_1.env.FRONTEND_URL ||
+                origin.startsWith('http://localhost:') ||
+                origin.startsWith('http://127.0.0.1:') ||
+                (host && (origin === `http://${host}` || origin === `https://${host}`))) {
+                return callback(null, true);
+            }
+            return callback(null, false);
+        },
+        credentials: true,
+    })(req, res, next);
+});
+exports.app.use(express_1.default.json({ limit: '1mb' }));
+exports.app.get('/health', (_req, res) => res.json({ status: 'ok' }));
+exports.app.use('/cdn', cdn_routes_js_1.cdnRouter);
+exports.app.use('/api', public_api_routes_js_1.publicApiRouter);
+exports.app.use('/public', public_routes_js_1.publicRouter);
+// Core module routers (both root and /api prefixes supported)
+exports.app.use('/auth', auth_routes_js_1.authRouter);
+exports.app.use('/api/auth', auth_routes_js_1.authRouter);
+exports.app.use('/api-keys', api_key_routes_js_1.apiKeyRouter);
+exports.app.use('/api/api-keys', api_key_routes_js_1.apiKeyRouter);
+exports.app.use('/provider-configs', provider_config_routes_js_1.providerConfigRouter);
+exports.app.use('/api/provider-configs', provider_config_routes_js_1.providerConfigRouter);
+exports.app.use('/connected-accounts', connected_account_routes_js_1.connectedAccountRouter);
+exports.app.use('/api/connected-accounts', connected_account_routes_js_1.connectedAccountRouter);
+exports.app.use('/storage', storage_routes_js_1.storageRouter);
+exports.app.use('/api/storage', storage_routes_js_1.storageRouter);
+exports.app.use('/uploads', upload_routes_js_1.uploadRouter);
+exports.app.use('/api/uploads', upload_routes_js_1.uploadRouter);
+exports.app.use('/files', file_routes_js_1.fileRouter);
+exports.app.use('/api/files', file_routes_js_1.fileRouter);
+exports.app.use('/folders', folder_routes_js_1.folderRouter);
+exports.app.use('/api/folders', folder_routes_js_1.folderRouter);
+exports.app.use('/invites', invite_routes_js_1.inviteRouter);
+exports.app.use('/api/invites', invite_routes_js_1.inviteRouter);
+exports.app.use('/audit-logs', audit_log_routes_js_1.auditLogRouter);
+exports.app.use('/api/audit-logs', audit_log_routes_js_1.auditLogRouter);
+exports.app.use('/system', system_routes_js_1.systemRouter);
+exports.app.use('/api/system', system_routes_js_1.systemRouter);
+// Serve frontend SPA if bundle is found
+if (publicDir) {
+    exports.app.use(express_1.default.static(publicDir));
+    exports.app.use((req, res, next) => {
+        if (req.path.startsWith('/api') ||
+            req.path.startsWith('/cdn') ||
+            req.path.startsWith('/public') ||
+            req.path.startsWith('/auth') ||
+            req.path.startsWith('/api-keys') ||
+            req.path.startsWith('/provider-configs') ||
+            req.path.startsWith('/connected-accounts') ||
+            req.path.startsWith('/storage') ||
+            req.path.startsWith('/uploads') ||
+            req.path.startsWith('/files') ||
+            req.path.startsWith('/folders') ||
+            req.path.startsWith('/invites') ||
+            req.path.startsWith('/audit-logs') ||
+            req.path.startsWith('/system') ||
+            req.path.startsWith('/health')) {
+            return next();
+        }
+        if (req.method === 'GET') {
+            return res.sendFile(path_1.default.join(publicDir, 'index.html'));
+        }
+        next();
+    });
+}
+exports.app.use(error_middleware_js_1.errorMiddleware);

package/backend/dist/config/env.js

@@ -0,0 +1,75 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.env = void 0;
+const crypto_1 = __importDefault(require("crypto"));
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const dotenv_1 = __importDefault(require("dotenv"));
+const zod_1 = require("zod");
+dotenv_1.default.config();
+// Support ~/.9drive config directory for CLI & local-first zero-config mode
+const defaultDataDir = path_1.default.join(os_1.default.homedir(), '.9drive');
+const dataDir = process.env.NINEDRIVE_DATA_DIR || defaultDataDir;
+const configPath = path_1.default.join(dataDir, 'config.json');
+let fileConfig = {};
+if (fs_1.default.existsSync(configPath)) {
+    try {
+        fileConfig = JSON.parse(fs_1.default.readFileSync(configPath, 'utf-8'));
+    }
+    catch {
+        console.warn(`[9Drive] Warning: Could not parse configuration from ${configPath}`);
+    }
+}
+// Generate persistent secrets if not provided
+const defaultAccessSecret = process.env.JWT_ACCESS_SECRET ||
+    fileConfig.JWT_ACCESS_SECRET ||
+    crypto_1.default.randomBytes(32).toString('hex');
+const defaultEncryptionKey = process.env.TOKEN_ENCRYPTION_KEY ||
+    fileConfig.TOKEN_ENCRYPTION_KEY ||
+    crypto_1.default.randomBytes(32).toString('hex');
+const defaultPort = Number(process.env.APP_PORT || fileConfig.APP_PORT || 4000);
+const defaultFrontendUrl = process.env.FRONTEND_URL || fileConfig.FRONTEND_URL || `http://localhost:${defaultPort}`;
+// Standard database URL: if not given in env or config, fallback to local sqlite in ~/.9drive/9drive.db
+const defaultDbPath = path_1.default.join(dataDir, '9drive.db').replace(/\\/g, '/');
+const defaultDatabaseUrl = process.env.DATABASE_URL || fileConfig.DATABASE_URL || `file:${defaultDbPath}`;
+// Auto-save generated config if running in CLI mode or without explicit .env file
+if (!fs_1.default.existsSync(configPath) && (process.env.NINEDRIVE_CLI === 'true' || !process.env.DATABASE_URL)) {
+    try {
+        fs_1.default.mkdirSync(dataDir, { recursive: true });
+        fs_1.default.writeFileSync(configPath, JSON.stringify({
+            APP_PORT: defaultPort,
+            DATABASE_URL: defaultDatabaseUrl,
+            FRONTEND_URL: defaultFrontendUrl,
+            JWT_ACCESS_SECRET: defaultAccessSecret,
+            TOKEN_ENCRYPTION_KEY: defaultEncryptionKey,
+        }, null, 2));
+    }
+    catch { }
+}
+const envSchema = zod_1.z.object({
+    DATABASE_URL: zod_1.z.string().min(1),
+    APP_PORT: zod_1.z.coerce.number().default(4000),
+    FRONTEND_URL: zod_1.z.string().url(),
+    JWT_ACCESS_SECRET: zod_1.z.string().min(32),
+    TOKEN_ENCRYPTION_KEY: zod_1.z.string().min(32),
+    ACCESS_TOKEN_TTL_SECONDS: zod_1.z.coerce.number().default(900),
+    REFRESH_TOKEN_TTL_DAYS: zod_1.z.coerce.number().default(30),
+    MAX_UPLOAD_BYTES: zod_1.z.coerce.number().default(5 * 1024 * 1024 * 1024),
+    RECAPTCHA_SECRET_KEY: zod_1.z.string().optional(),
+    CDN_BASE_URL: zod_1.z.string().optional(),
+    SERVE_FRONTEND: zod_1.z.coerce.boolean().default(false),
+    NINEDRIVE_DATA_DIR: zod_1.z.string().default(dataDir),
+});
+exports.env = envSchema.parse({
+    ...fileConfig,
+    DATABASE_URL: defaultDatabaseUrl,
+    APP_PORT: defaultPort,
+    FRONTEND_URL: defaultFrontendUrl,
+    JWT_ACCESS_SECRET: defaultAccessSecret,
+    TOKEN_ENCRYPTION_KEY: defaultEncryptionKey,
+    ...process.env,
+});

package/backend/dist/config/prisma.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.prisma = void 0;
+const client_1 = require("@prisma/client");
+const dbUrl = process.env.DATABASE_URL || '';
+const isSqlite = dbUrl.startsWith('file:') || dbUrl.startsWith('sqlite:');
+let clientInstance = null;
+if (isSqlite) {
+    try {
+        // Dynamic synchronous require for CommonJS
+        // eslint-disable-next-line @typescript-eslint/no-require-imports
+        const sqliteModule = require('../../prisma/generated/sqlite-client/index.js');
+        const SqliteClient = sqliteModule.PrismaClient;
+        clientInstance = new SqliteClient({
+            datasources: {
+                db: {
+                    url: dbUrl,
+                },
+            },
+        });
+    }
+    catch (err) {
+        console.warn('[Prisma] Could not load SQLite client from generated folder, using default client.');
+        clientInstance = new client_1.PrismaClient();
+    }
+}
+else {
+    clientInstance = new client_1.PrismaClient();
+}
+exports.prisma = clientInstance;

package/backend/dist/middleware/api-key.middleware.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.requireApiKey = requireApiKey;
+const prisma_js_1 = require("../config/prisma.js");
+const crypto_js_1 = require("../utils/crypto.js");
+function normalizeScopes(value) {
+    return Array.isArray(value) ? value.filter((item) => typeof item === 'string') : [];
+}
+function requireApiKey(scope) {
+    return async (req, res, next) => {
+        try {
+            const authHeader = req.header('Authorization');
+            const xApiKey = req.header('x-api-key');
+            let rawKey = '';
+            if (xApiKey && typeof xApiKey === 'string') {
+                rawKey = xApiKey.trim();
+            }
+            else if (authHeader?.startsWith('Bearer ')) {
+                rawKey = authHeader.slice(7).trim();
+            }
+            if (!rawKey)
+                return res.status(401).json({ code: 'API_KEY_REQUIRED', message: 'API key required (via x-api-key or Authorization: Bearer).' });
+            const apiKey = await prisma_js_1.prisma.apiKey.findUnique({ where: { keyHash: (0, crypto_js_1.hashToken)(rawKey) } });
+            if (!apiKey || apiKey.status !== 'active' || apiKey.revokedAt || (apiKey.expiresAt && apiKey.expiresAt <= new Date()))
+                return res.status(401).json({ code: 'API_KEY_INVALID', message: 'Invalid API key.' });
+            const scopes = normalizeScopes(apiKey.scopes);
+            if (!scopes.includes(scope))
+                return res.status(403).json({ code: 'API_KEY_FORBIDDEN', message: 'API key does not have required scope.' });
+            req.user = { id: apiKey.userId, sessionId: `api-key:${apiKey.id}` };
+            req.apiKey = { id: apiKey.id, scopes };
+            await prisma_js_1.prisma.apiKey.update({ where: { id: apiKey.id }, data: { lastUsedAt: new Date() } }).catch(() => undefined);
+            return next();
+        }
+        catch {
+            return res.status(401).json({ code: 'API_KEY_INVALID', message: 'Invalid API key.' });
+        }
+    };
+}

package/backend/dist/middleware/auth.middleware.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.requireAuth = requireAuth;
+const prisma_js_1 = require("../config/prisma.js");
+const jwt_js_1 = require("../utils/jwt.js");
+async function requireAuth(req, res, next) {
+    try {
+        const header = req.header('Authorization');
+        if (!header?.startsWith('Bearer '))
+            return res.status(401).json({ code: 'AUTH_REQUIRED', message: 'Bearer token required.' });
+        const payload = (0, jwt_js_1.verifyAccessToken)(header.slice(7));
+        const session = await prisma_js_1.prisma.userSession.findUnique({ where: { id: payload.sid } });
+        if (!session || session.revokedAt || session.expiresAt < new Date())
+            return res.status(401).json({ code: 'AUTH_SESSION_EXPIRED', message: 'Session expired.' });
+        req.user = { id: payload.sub, sessionId: payload.sid };
+        return next();
+    }
+    catch {
+        return res.status(401).json({ code: 'AUTH_INVALID_TOKEN', message: 'Invalid token.' });
+    }
+}

package/backend/dist/middleware/error.middleware.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.errorMiddleware = errorMiddleware;
+function errorMiddleware(error, _req, res, _next) {
+    const message = error instanceof Error ? error.message : 'Internal server error';
+    return res.status(500).json({ code: 'INTERNAL_SERVER_ERROR', message });
+}

package/backend/dist/modules/api-keys/api-key.routes.js

@@ -0,0 +1,90 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.apiKeyRouter = void 0;
+const express_1 = require("express");
+const zod_1 = require("zod");
+const prisma_js_1 = require("../../config/prisma.js");
+const auth_middleware_js_1 = require("../../middleware/auth.middleware.js");
+const crypto_js_1 = require("../../utils/crypto.js");
+exports.apiKeyRouter = (0, express_1.Router)();
+exports.apiKeyRouter.use(auth_middleware_js_1.requireAuth);
+const createSchema = zod_1.z.object({ name: zod_1.z.string().trim().min(1).max(191), expiresAt: zod_1.z.string().datetime().nullable().optional() });
+const scopes = ['files:upload'];
+function serializeApiKey(apiKey) {
+    return {
+        id: apiKey.id,
+        name: apiKey.name,
+        keyPrefix: apiKey.keyPrefix,
+        scopes: Array.isArray(apiKey.scopes) ? apiKey.scopes : [],
+        status: apiKey.status,
+        lastUsedAt: apiKey.lastUsedAt?.toISOString() ?? null,
+        expiresAt: apiKey.expiresAt?.toISOString() ?? null,
+        revokedAt: apiKey.revokedAt?.toISOString() ?? null,
+        createdAt: apiKey.createdAt.toISOString(),
+    };
+}
+exports.apiKeyRouter.get('/', async (req, res, next) => {
+    try {
+        const apiKeys = await prisma_js_1.prisma.apiKey.findMany({ where: { userId: req.user.id }, orderBy: { createdAt: 'desc' } });
+        return res.json({ apiKeys: apiKeys.map(serializeApiKey) });
+    }
+    catch (error) {
+        return next(error);
+    }
+});
+exports.apiKeyRouter.post('/', async (req, res, next) => {
+    try {
+        const body = createSchema.parse(req.body);
+        const secret = `9d_live_${(0, crypto_js_1.randomToken)(32)}`;
+        const apiKey = await prisma_js_1.prisma.apiKey.create({
+            data: {
+                userId: req.user.id,
+                name: body.name,
+                keyPrefix: secret.slice(0, 16),
+                keyHash: (0, crypto_js_1.hashToken)(secret),
+                scopes,
+                expiresAt: body.expiresAt ? new Date(body.expiresAt) : null,
+            },
+        });
+        return res.status(201).json({ apiKey: serializeApiKey(apiKey), secret });
+    }
+    catch (error) {
+        return next(error);
+    }
+});
+exports.apiKeyRouter.patch('/:id/status', async (req, res, next) => {
+    try {
+        const statusSchema = zod_1.z.object({ status: zod_1.z.enum(['active', 'revoked']) });
+        const body = statusSchema.parse(req.body);
+        const key = await prisma_js_1.prisma.apiKey.findFirst({
+            where: { id: String(req.params.id), userId: req.user.id },
+        });
+        if (!key)
+            return res.status(404).json({ error: 'API key not found' });
+        const updated = await prisma_js_1.prisma.apiKey.update({
+            where: { id: key.id },
+            data: {
+                status: body.status,
+                revokedAt: body.status === 'revoked' ? new Date() : null,
+            },
+        });
+        return res.json({ apiKey: serializeApiKey(updated) });
+    }
+    catch (error) {
+        return next(error);
+    }
+});
+exports.apiKeyRouter.delete('/:id', async (req, res, next) => {
+    try {
+        const deleted = await prisma_js_1.prisma.apiKey.deleteMany({
+            where: { id: String(req.params.id), userId: req.user.id },
+        });
+        if (deleted.count === 0) {
+            return res.status(404).json({ error: 'API key not found' });
+        }
+        return res.json({ status: 'ok', deletedCount: deleted.count });
+    }
+    catch (error) {
+        return next(error);
+    }
+});

package/backend/dist/modules/audit-logs/audit-log.routes.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.auditLogRouter = void 0;
+const express_1 = require("express");
+const prisma_js_1 = require("../../config/prisma.js");
+const auth_middleware_js_1 = require("../../middleware/auth.middleware.js");
+exports.auditLogRouter = (0, express_1.Router)();
+exports.auditLogRouter.get('/', auth_middleware_js_1.requireAuth, async (req, res, next) => {
+    try {
+        const logs = await prisma_js_1.prisma.auditLog.findMany({
+            where: { userId: req.user.id },
+            orderBy: { createdAt: 'desc' },
+            take: 100
+        });
+        return res.json({ logs });
+    }
+    catch (error) {
+        return next(error);
+    }
+});

package/backend/dist/modules/auth/auth.routes.js

@@ -0,0 +1,201 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authRouter = void 0;
+const express_1 = require("express");
+const googleapis_1 = require("googleapis");
+const zod_1 = require("zod");
+const prisma_js_1 = require("../../config/prisma.js");
+const env_js_1 = require("../../config/env.js");
+const auth_middleware_js_1 = require("../../middleware/auth.middleware.js");
+const password_js_1 = require("../../utils/password.js");
+const crypto_js_1 = require("../../utils/crypto.js");
+const jwt_js_1 = require("../../utils/jwt.js");
+const google_service_js_1 = require("../google/google.service.js");
+exports.authRouter = (0, express_1.Router)();
+const registerSchema = zod_1.z.object({ name: zod_1.z.string().min(2), email: zod_1.z.string().email(), password: zod_1.z.string().min(8), captchaToken: zod_1.z.string().optional() });
+const loginSchema = zod_1.z.object({ email: zod_1.z.string().email(), password: zod_1.z.string().min(1) });
+const refreshSchema = zod_1.z.object({ refreshToken: zod_1.z.string().min(1) });
+const googleExchangeSchema = zod_1.z.object({ token: zod_1.z.string().min(1) });
+async function createSession(userId, req) {
+    const refreshToken = (0, crypto_js_1.randomToken)();
+    const expiresAt = new Date(Date.now() + env_js_1.env.REFRESH_TOKEN_TTL_DAYS * 24 * 60 * 60 * 1000);
+    const session = await prisma_js_1.prisma.userSession.create({
+        data: {
+            userId,
+            refreshTokenHash: (0, crypto_js_1.hashToken)(refreshToken),
+            userAgent: req.header('User-Agent'),
+            ipAddress: req.ip,
+            expiresAt,
+        },
+    });
+    return { accessToken: (0, jwt_js_1.signAccessToken)({ sub: userId, sid: session.id }), refreshToken };
+}
+async function verifyCaptcha(token) {
+    if (!env_js_1.env.RECAPTCHA_SECRET_KEY)
+        return true;
+    if (!token)
+        return false;
+    const form = new URLSearchParams({ secret: env_js_1.env.RECAPTCHA_SECRET_KEY, response: token });
+    const response = await fetch('https://www.google.com/recaptcha/api/siteverify', { method: 'POST', body: form });
+    const data = await response.json();
+    return Boolean(data.success);
+}
+exports.authRouter.post('/register', async (req, res, next) => {
+    try {
+        const body = registerSchema.parse(req.body);
+        if (!(await verifyCaptcha(body.captchaToken)))
+            return res.status(400).json({ code: 'CAPTCHA_FAILED', message: 'Captcha verification failed.' });
+        const existing = await prisma_js_1.prisma.user.findUnique({ where: { email: body.email } });
+        if (existing)
+            return res.status(409).json({ code: 'AUTH_EMAIL_TAKEN', message: 'Email already registered.' });
+        const user = await prisma_js_1.prisma.user.create({ data: { name: body.name, email: body.email, passwordHash: await (0, password_js_1.hashPassword)(body.password) } });
+        const tokens = await createSession(user.id, req);
+        return res.status(201).json({ ...tokens, user: { id: user.id, name: user.name, email: user.email } });
+    }
+    catch (error) {
+        return next(error);
+    }
+});
+exports.authRouter.post('/login', async (req, res, next) => {
+    try {
+        const body = loginSchema.parse(req.body);
+        const user = await prisma_js_1.prisma.user.findUnique({ where: { email: body.email } });
+        if (!user || !(await (0, password_js_1.verifyPassword)(user.passwordHash, body.password)))
+            return res.status(401).json({ code: 'AUTH_INVALID_CREDENTIALS', message: 'Invalid email or password.' });
+        const tokens = await createSession(user.id, req);
+        return res.json({ ...tokens, user: { id: user.id, name: user.name, email: user.email } });
+    }
+    catch (error) {
+        return next(error);
+    }
+});
+exports.authRouter.get('/google/url', async (_req, res, next) => {
+    try {
+        const config = await prisma_js_1.prisma.providerConfig.findFirstOrThrow({ where: { userId: null, provider: 'google_drive', status: 'active' }, orderBy: { createdAt: 'desc' } });
+        const state = (0, crypto_js_1.randomToken)();
+        await prisma_js_1.prisma.oauthState.create({ data: { providerConfigId: config.id, flow: 'login', stateHash: (0, crypto_js_1.hashToken)(state), expiresAt: new Date(Date.now() + 10 * 60_000) } });
+        const client = (0, google_service_js_1.createOAuthClient)(config);
+        const url = client.generateAuthUrl({
+            access_type: 'offline',
+            prompt: 'consent',
+            include_granted_scopes: true,
+            scope: config.scopes,
+            state,
+        });
+        return res.json({ url });
+    }
+    catch (error) {
+        return next(error);
+    }
+});
+exports.authRouter.get('/google/callback', async (req, res) => {
+    try {
+        const query = zod_1.z.object({ code: zod_1.z.string(), state: zod_1.z.string() }).parse(req.query);
+        const oauthState = await prisma_js_1.prisma.oauthState.findUniqueOrThrow({ where: { stateHash: (0, crypto_js_1.hashToken)(query.state) }, include: { providerConfig: true } });
+        if (oauthState.flow !== 'login' || oauthState.usedAt || oauthState.expiresAt < new Date())
+            return res.redirect(`${env_js_1.env.FRONTEND_URL}/google-auth?status=error`);
+        const client = (0, google_service_js_1.createOAuthClient)(oauthState.providerConfig);
+        const tokenResult = await client.getToken(query.code);
+        const tokens = tokenResult.tokens;
+        if (!tokens.access_token)
+            return res.redirect(`${env_js_1.env.FRONTEND_URL}/google-auth?status=error`);
+        client.setCredentials(tokens);
+        const oauth2 = googleapis_1.google.oauth2({ version: 'v2', auth: client });
+        const profile = await oauth2.userinfo.get();
+        const providerAccountId = profile.data.id;
+        const email = profile.data.email;
+        if (!providerAccountId || !email)
+            return res.redirect(`${env_js_1.env.FRONTEND_URL}/google-auth?status=error`);
+        const name = profile.data.name || email.split('@')[0] || 'Google User';
+        const user = await prisma_js_1.prisma.user.upsert({
+            where: { email },
+            create: { email, name, passwordHash: await (0, password_js_1.hashPassword)((0, crypto_js_1.randomToken)(32)) },
+            update: { name },
+        });
+        const existingAccount = await prisma_js_1.prisma.connectedAccount.findUnique({ where: { userId_provider_providerAccountId: { userId: user.id, provider: 'google_drive', providerAccountId } } });
+        const refreshTokenEncrypted = tokens.refresh_token ? (0, crypto_js_1.encryptText)(tokens.refresh_token) : existingAccount?.refreshTokenEncrypted;
+        if (!refreshTokenEncrypted)
+            return res.redirect(`${env_js_1.env.FRONTEND_URL}/google-auth?status=error`);
+        const account = await prisma_js_1.prisma.connectedAccount.upsert({
+            where: { userId_provider_providerAccountId: { userId: user.id, provider: 'google_drive', providerAccountId } },
+            create: {
+                userId: user.id,
+                providerConfigId: oauthState.providerConfigId,
+                provider: 'google_drive',
+                providerAccountId,
+                email,
+                displayName: profile.data.name,
+                avatarUrl: profile.data.picture,
+                accessTokenEncrypted: (0, crypto_js_1.encryptText)(tokens.access_token),
+                refreshTokenEncrypted,
+                tokenExpiresAt: new Date(tokens.expiry_date ?? Date.now() + 3600_000),
+                scopes: oauthState.providerConfig.scopes,
+                status: 'connected',
+            },
+            update: {
+                providerConfigId: oauthState.providerConfigId,
+                email,
+                displayName: profile.data.name,
+                avatarUrl: profile.data.picture,
+                accessTokenEncrypted: (0, crypto_js_1.encryptText)(tokens.access_token),
+                refreshTokenEncrypted,
+                tokenExpiresAt: new Date(tokens.expiry_date ?? Date.now() + 3600_000),
+                scopes: oauthState.providerConfig.scopes,
+                status: 'connected',
+            },
+        });
+        await prisma_js_1.prisma.oauthState.update({ where: { id: oauthState.id }, data: { usedAt: new Date(), userId: user.id } });
+        await (0, google_service_js_1.syncGoogleQuota)(account.id).catch(() => undefined);
+        const handoffToken = (0, crypto_js_1.randomToken)();
+        await prisma_js_1.prisma.authHandoff.create({ data: { userId: user.id, tokenHash: (0, crypto_js_1.hashToken)(handoffToken), expiresAt: new Date(Date.now() + 5 * 60_000) } });
+        return res.redirect(`${env_js_1.env.FRONTEND_URL}/google-auth?token=${handoffToken}`);
+    }
+    catch (error) {
+        console.error('Google Auth callback failed:', error);
+        return res.redirect(`${env_js_1.env.FRONTEND_URL}/google-auth?status=error`);
+    }
+});
+exports.authRouter.post('/google/exchange', async (req, res, next) => {
+    try {
+        const body = googleExchangeSchema.parse(req.body);
+        const handoff = await prisma_js_1.prisma.authHandoff.findFirst({ where: { tokenHash: (0, crypto_js_1.hashToken)(body.token), usedAt: null, expiresAt: { gt: new Date() } }, include: { user: true } });
+        if (!handoff)
+            return res.status(401).json({ code: 'AUTH_GOOGLE_HANDOFF_INVALID', message: 'Google login session expired.' });
+        await prisma_js_1.prisma.authHandoff.update({ where: { id: handoff.id }, data: { usedAt: new Date() } });
+        const tokens = await createSession(handoff.userId, req);
+        return res.json({ ...tokens, user: { id: handoff.user.id, name: handoff.user.name, email: handoff.user.email } });
+    }
+    catch (error) {
+        return next(error);
+    }
+});
+exports.authRouter.post('/refresh', async (req, res, next) => {
+    try {
+        const body = refreshSchema.parse(req.body);
+        const session = await prisma_js_1.prisma.userSession.findFirst({ where: { refreshTokenHash: (0, crypto_js_1.hashToken)(body.refreshToken), revokedAt: null, expiresAt: { gt: new Date() } } });
+        if (!session)
+            return res.status(401).json({ code: 'AUTH_SESSION_EXPIRED', message: 'Refresh token expired.' });
+        return res.json({ accessToken: (0, jwt_js_1.signAccessToken)({ sub: session.userId, sid: session.id }) });
+    }
+    catch (error) {
+        return next(error);
+    }
+});
+exports.authRouter.post('/logout', auth_middleware_js_1.requireAuth, async (req, res, next) => {
+    try {
+        await prisma_js_1.prisma.userSession.update({ where: { id: req.user.sessionId }, data: { revokedAt: new Date() } });
+        return res.json({ status: 'ok' });
+    }
+    catch (error) {
+        return next(error);
+    }
+});
+exports.authRouter.get('/me', auth_middleware_js_1.requireAuth, async (req, res, next) => {
+    try {
+        const user = await prisma_js_1.prisma.user.findUniqueOrThrow({ where: { id: req.user.id }, select: { id: true, name: true, email: true, status: true } });
+        return res.json({ user });
+    }
+    catch (error) {
+        return next(error);
+    }
+});