9drive 1.0.0

package/backend/dist/modules/files/stream-file.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.streamProviderFile = streamProviderFile;
+const stream_google_file_js_1 = require("./stream-google-file.js");
+const s3_service_js_1 = require("../s3/s3.service.js");
+function streamProviderFile(file, range, res, options = {}) {
+    if (file.provider === 's3')
+        return (0, s3_service_js_1.streamS3File)(file, range, res, options);
+    return (0, stream_google_file_js_1.streamGoogleFile)(file, range, res, options);
+}

package/backend/dist/modules/files/stream-google-file.js

@@ -0,0 +1,79 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.googleDownloadExportMimeTypes = void 0;
+exports.withExtension = withExtension;
+exports.normalizeHeaders = normalizeHeaders;
+exports.streamGoogleFile = streamGoogleFile;
+const google_service_js_1 = require("../google/google.service.js");
+exports.googleDownloadExportMimeTypes = {
+    'application/vnd.google-apps.document': { mimeType: 'application/pdf', extension: '.pdf' },
+    'application/vnd.google-apps.spreadsheet': { mimeType: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet', extension: '.xlsx' },
+    'application/vnd.google-apps.presentation': { mimeType: 'application/pdf', extension: '.pdf' },
+    'application/vnd.google-apps.drawing': { mimeType: 'image/png', extension: '.png' },
+};
+const googlePreviewExportMimeTypes = {
+    ...exports.googleDownloadExportMimeTypes,
+    'application/vnd.google-apps.spreadsheet': { mimeType: 'application/pdf', extension: '.pdf' },
+};
+function contentDisposition(type, fileName) {
+    return `${type}; filename="${fileName.replaceAll('"', '')}"`;
+}
+function withExtension(fileName, extension) {
+    return fileName.toLowerCase().endsWith(extension) ? fileName : `${fileName}${extension}`;
+}
+function normalizeHeaders(headers) {
+    if (headers instanceof Headers)
+        return Object.fromEntries(headers.entries());
+    return headers;
+}
+async function streamGoogleFile(file, range, res, options = {}) {
+    const auth = await (0, google_service_js_1.getAuthedGoogleClient)(file.connectedAccount);
+    const headers = normalizeHeaders(await auth.getRequestHeaders());
+    const exportTarget = (options.disposition === 'inline' ? googlePreviewExportMimeTypes : exports.googleDownloadExportMimeTypes)[file.mimeType];
+    const responseMimeType = exportTarget?.mimeType ?? file.mimeType;
+    const responseFileName = exportTarget ? withExtension(file.name, exportTarget.extension) : file.name;
+    const url = exportTarget
+        ? `https://www.googleapis.com/drive/v3/files/${file.providerFileId}/export?mimeType=${encodeURIComponent(exportTarget.mimeType)}`
+        : `https://www.googleapis.com/drive/v3/files/${file.providerFileId}?alt=media`;
+    const response = await fetch(url, {
+        headers: {
+            ...headers,
+            ...(range && !exportTarget ? { Range: range } : {}),
+        },
+    });
+    if (!response.ok) {
+        const message = await response.text().catch(() => response.statusText);
+        return res.status(response.status).json({ code: 'GOOGLE_FILE_STREAM_FAILED', message: message || response.statusText });
+    }
+    res.status(response.status);
+    res.setHeader('Content-Type', responseMimeType);
+    res.setHeader('Accept-Ranges', 'bytes');
+    if (options.disposition)
+        res.setHeader('Content-Disposition', contentDisposition(options.disposition, responseFileName));
+    if (options.headers) {
+        for (const [key, value] of Object.entries(options.headers)) {
+            res.setHeader(key, value);
+        }
+    }
+    const contentLength = response.headers.get('content-length');
+    const contentRange = response.headers.get('content-range');
+    if (contentLength)
+        res.setHeader('Content-Length', contentLength);
+    if (contentRange)
+        res.setHeader('Content-Range', contentRange);
+    if (!response.body) {
+        res.end();
+        return;
+    }
+    const reader = response.body.getReader();
+    async function pump() {
+        const { done, value } = await reader.read();
+        if (done) {
+            res.end();
+            return;
+        }
+        res.write(Buffer.from(value));
+        return pump();
+    }
+    return pump();
+}

package/backend/dist/modules/folders/folder.routes.js

@@ -0,0 +1,546 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.folderRouter = void 0;
+const express_1 = require("express");
+const googleapis_1 = require("googleapis");
+const zod_1 = require("zod");
+const prisma_js_1 = require("../../config/prisma.js");
+const auth_middleware_js_1 = require("../../middleware/auth.middleware.js");
+const google_service_js_1 = require("../google/google.service.js");
+const audit_js_1 = require("../../utils/audit.js");
+exports.folderRouter = (0, express_1.Router)();
+exports.folderRouter.use(auth_middleware_js_1.requireAuth);
+const defaultFolderColor = '#3b82f6';
+const defaultFolderIconUrl = 'https://api.iconify.design/lucide:folder.svg';
+const iconUrlSchema = zod_1.z.string().url().startsWith('https://api.iconify.design/lucide:').max(2048);
+const colorSchema = zod_1.z.string().regex(/^(#[0-9a-fA-F]{6}|text-[a-z]+-[0-9]+)$/).max(64);
+const createSchema = zod_1.z.object({
+    name: zod_1.z.string().min(1).max(255),
+    color: colorSchema.optional(),
+    iconUrl: iconUrlSchema.nullable().optional(),
+    parentId: zod_1.z.string().nullable().optional(),
+    accountId: zod_1.z.string().optional(),
+});
+function serializeFolder(folder) {
+    return {
+        ...folder,
+        providerFolderId: folder.providerFolderId ?? null,
+        connectedAccountId: folder.connectedAccountId ?? null,
+        driveUrl: folder.providerFolderId ? `https://drive.google.com/drive/folders/${folder.providerFolderId}` : null,
+        createdAt: folder.createdAt.toISOString(),
+        updatedAt: folder.updatedAt.toISOString(),
+    };
+}
+async function ensureProviderFolderIds(folders, userId) {
+    const foldersWithoutId = folders.filter((f) => !f.providerFolderId);
+    if (foldersWithoutId.length === 0)
+        return;
+    const connectedAccount = await prisma_js_1.prisma.connectedAccount.findFirst({
+        where: { userId, provider: 'google_drive', status: 'connected' }
+    });
+    if (!connectedAccount)
+        return;
+    try {
+        const auth = await (0, google_service_js_1.getAuthedGoogleClient)(connectedAccount);
+        const drive = googleapis_1.google.drive({ version: 'v3', auth });
+        for (const folder of foldersWithoutId) {
+            try {
+                let parentGoogleId = undefined;
+                if (folder.parentId) {
+                    const parentFolder = await prisma_js_1.prisma.folder.findFirst({
+                        where: { id: folder.parentId, userId }
+                    });
+                    if (parentFolder?.providerFolderId) {
+                        parentGoogleId = parentFolder.providerFolderId;
+                    }
+                }
+                const driveFolder = await drive.files.create({
+                    requestBody: {
+                        name: folder.name,
+                        mimeType: 'application/vnd.google-apps.folder',
+                        ...(parentGoogleId ? { parents: [parentGoogleId] } : {})
+                    },
+                    fields: 'id'
+                });
+                const gId = driveFolder.data.id ?? null;
+                if (gId) {
+                    await prisma_js_1.prisma.folder.update({
+                        where: { id: folder.id },
+                        data: { providerFolderId: gId, connectedAccountId: connectedAccount.id }
+                    });
+                    folder.providerFolderId = gId;
+                }
+            }
+            catch (error) {
+                console.error(`Failed self-healing for folder ${folder.id}:`, error);
+            }
+        }
+    }
+    catch (error) {
+        console.error('Failed self-healing Google Drive auth:', error);
+    }
+}
+exports.folderRouter.get('/', async (req, res, next) => {
+    try {
+        const query = zod_1.z.object({
+            parentId: zod_1.z.string().nullable().optional(),
+            all: zod_1.z.string().optional(),
+            accountId: zod_1.z.string().optional()
+        }).parse(req.query);
+        const folders = await prisma_js_1.prisma.folder.findMany({
+            where: {
+                userId: req.user.id,
+                deletedAt: null,
+                ...(query.all === '1' ? {} : { parentId: query.parentId ?? null }),
+                ...(query.accountId ? { connectedAccountId: query.accountId } : {}),
+            },
+            select: { id: true, name: true, color: true, iconUrl: true, parentId: true, providerFolderId: true, connectedAccountId: true, createdAt: true, updatedAt: true },
+            orderBy: { updatedAt: 'desc' },
+        });
+        await ensureProviderFolderIds(folders, req.user.id);
+        return res.json({ folders: folders.map(serializeFolder) });
+    }
+    catch (error) {
+        return next(error);
+    }
+});
+exports.folderRouter.get('/recent', async (req, res, next) => {
+    try {
+        const limit = Math.min(Number(req.query.limit ?? 4), 4);
+        const accountId = req.query.accountId;
+        const folders = await prisma_js_1.prisma.folder.findMany({
+            where: {
+                userId: req.user.id,
+                deletedAt: null,
+                ...(accountId ? { connectedAccountId: accountId } : {})
+            },
+            select: { id: true, name: true, color: true, iconUrl: true, parentId: true, providerFolderId: true, connectedAccountId: true, createdAt: true, updatedAt: true },
+            orderBy: { updatedAt: 'desc' },
+            take: limit,
+        });
+        await ensureProviderFolderIds(folders, req.user.id);
+        return res.json({ folders: folders.map(serializeFolder) });
+    }
+    catch (error) {
+        return next(error);
+    }
+});
+exports.folderRouter.post('/', async (req, res, next) => {
+    try {
+        const body = createSchema.parse(req.body);
+        let parentFolder = null;
+        if (body.parentId) {
+            parentFolder = await prisma_js_1.prisma.folder.findFirstOrThrow({
+                where: { id: body.parentId, userId: req.user.id, deletedAt: null }
+            });
+        }
+        const targetAccountId = body.accountId || parentFolder?.connectedAccountId;
+        const connectedAccount = targetAccountId
+            ? await prisma_js_1.prisma.connectedAccount.findFirst({
+                where: { id: targetAccountId, userId: req.user.id, status: 'connected' }
+            })
+            : await prisma_js_1.prisma.connectedAccount.findFirst({
+                where: { userId: req.user.id, provider: 'google_drive', status: 'connected' }
+            });
+        let providerFolderId = null;
+        if (connectedAccount) {
+            try {
+                const auth = await (0, google_service_js_1.getAuthedGoogleClient)(connectedAccount);
+                const drive = googleapis_1.google.drive({ version: 'v3', auth });
+                let googleParentId = undefined;
+                if (parentFolder && parentFolder.providerFolderId) {
+                    googleParentId = parentFolder.providerFolderId;
+                }
+                const driveFolder = await drive.files.create({
+                    requestBody: {
+                        name: body.name,
+                        mimeType: 'application/vnd.google-apps.folder',
+                        ...(googleParentId ? { parents: [googleParentId] } : {}),
+                    },
+                    fields: 'id'
+                });
+                providerFolderId = driveFolder.data.id ?? null;
+            }
+            catch (error) {
+                console.error('Failed to create folder on Google Drive:', error);
+            }
+        }
+        const folder = await prisma_js_1.prisma.folder.create({
+            data: {
+                userId: req.user.id,
+                name: body.name,
+                color: body.color ?? defaultFolderColor,
+                iconUrl: body.iconUrl ?? defaultFolderIconUrl,
+                parentId: body.parentId ?? null,
+                providerFolderId,
+                connectedAccountId: connectedAccount?.id ?? null
+            },
+            select: { id: true, name: true, color: true, iconUrl: true, parentId: true, providerFolderId: true, connectedAccountId: true, createdAt: true, updatedAt: true },
+        });
+        await (0, audit_js_1.createAuditLog)(req.user.id, 'CREATE_FOLDER', 'folder', folder.id, { name: folder.name });
+        return res.status(201).json({ folder: serializeFolder(folder) });
+    }
+    catch (error) {
+        return next(error);
+    }
+});
+exports.folderRouter.patch('/:id', async (req, res, next) => {
+    try {
+        const body = createSchema.partial().parse(req.body);
+        const folderId = String(req.params.id);
+        if (body.parentId === folderId)
+            return res.status(400).json({ code: 'FOLDER_INVALID_PARENT', message: 'Folder cannot be moved into itself.' });
+        const folderRecord = await prisma_js_1.prisma.folder.findFirstOrThrow({
+            where: { id: folderId, userId: req.user.id, deletedAt: null },
+            include: { connectedAccount: true }
+        });
+        if (body.parentId) {
+            await prisma_js_1.prisma.folder.findFirstOrThrow({ where: { id: body.parentId, userId: req.user.id, deletedAt: null } });
+            const folders = await prisma_js_1.prisma.folder.findMany({ where: { userId: req.user.id, deletedAt: null }, select: { id: true, parentId: true } });
+            const descendantIds = new Set([folderId]);
+            let changed = true;
+            while (changed) {
+                changed = false;
+                for (const folder of folders) {
+                    if (folder.parentId && descendantIds.has(folder.parentId) && !descendantIds.has(folder.id)) {
+                        descendantIds.add(folder.id);
+                        changed = true;
+                    }
+                }
+            }
+            if (descendantIds.has(body.parentId))
+                return res.status(400).json({ code: 'FOLDER_INVALID_PARENT', message: 'Folder cannot be moved into itself or a child folder.' });
+        }
+        // Update name on Google Drive if changed
+        if (body.name && folderRecord.providerFolderId && folderRecord.connectedAccount) {
+            try {
+                const auth = await (0, google_service_js_1.getAuthedGoogleClient)(folderRecord.connectedAccount);
+                const drive = googleapis_1.google.drive({ version: 'v3', auth });
+                await drive.files.update({
+                    fileId: folderRecord.providerFolderId,
+                    requestBody: { name: body.name }
+                });
+            }
+            catch (error) {
+                console.error('Failed to rename folder on Google Drive:', error);
+            }
+        }
+        // Update parent on Google Drive if moved
+        if (body.parentId !== undefined && folderRecord.providerFolderId && folderRecord.connectedAccount) {
+            try {
+                const auth = await (0, google_service_js_1.getAuthedGoogleClient)(folderRecord.connectedAccount);
+                const drive = googleapis_1.google.drive({ version: 'v3', auth });
+                let newGoogleParentId = await (0, google_service_js_1.ensureGoogleAppFolder)(folderRecord.connectedAccount);
+                if (body.parentId) {
+                    const newParent = await prisma_js_1.prisma.folder.findFirst({ where: { id: body.parentId, userId: req.user.id } });
+                    if (newParent?.providerFolderId) {
+                        newGoogleParentId = newParent.providerFolderId;
+                    }
+                }
+                const fileInfo = await drive.files.get({ fileId: folderRecord.providerFolderId, fields: 'parents' });
+                const previousParents = fileInfo.data.parents?.join(',');
+                await drive.files.update({
+                    fileId: folderRecord.providerFolderId,
+                    addParents: newGoogleParentId,
+                    removeParents: previousParents,
+                    fields: 'id, parents'
+                });
+            }
+            catch (error) {
+                console.error('Failed to move folder on Google Drive:', error);
+            }
+        }
+        const folder = await prisma_js_1.prisma.folder.updateMany({
+            where: { id: folderId, userId: req.user.id, deletedAt: null },
+            data: { ...(body.name ? { name: body.name } : {}), ...(body.color ? { color: body.color } : {}), ...(body.iconUrl !== undefined ? { iconUrl: body.iconUrl } : {}), ...(body.parentId !== undefined ? { parentId: body.parentId } : {}) },
+        });
+        if (folder.count === 0)
+            return res.status(404).json({ code: 'FOLDER_NOT_FOUND', message: 'Folder not found.' });
+        const updated = await prisma_js_1.prisma.folder.findFirstOrThrow({
+            where: { id: folderId, userId: req.user.id },
+            select: { id: true, name: true, color: true, iconUrl: true, parentId: true, providerFolderId: true, createdAt: true, updatedAt: true },
+        });
+        await (0, audit_js_1.createAuditLog)(req.user.id, 'UPDATE_FOLDER', 'folder', updated.id, { name: updated.name, updates: body });
+        return res.json({ folder: serializeFolder(updated) });
+    }
+    catch (error) {
+        return next(error);
+    }
+});
+exports.folderRouter.delete('/:id', async (req, res, next) => {
+    try {
+        const rootId = String(req.params.id);
+        const root = await prisma_js_1.prisma.folder.findFirstOrThrow({ where: { id: rootId, userId: req.user.id, deletedAt: null } });
+        const folders = await prisma_js_1.prisma.folder.findMany({ where: { userId: req.user.id, deletedAt: null }, select: { id: true, parentId: true } });
+        const folderIds = new Set([root.id]);
+        let changed = true;
+        while (changed) {
+            changed = false;
+            for (const folder of folders) {
+                if (folder.parentId && folderIds.has(folder.parentId) && !folderIds.has(folder.id)) {
+                    folderIds.add(folder.id);
+                    changed = true;
+                }
+            }
+        }
+        const files = await prisma_js_1.prisma.file.findMany({ where: { userId: req.user.id, status: 'active', folderId: { in: [...folderIds] } }, include: { connectedAccount: true } });
+        const syncedAccountIds = new Set();
+        for (const file of files) {
+            try {
+                const auth = await (0, google_service_js_1.getAuthedGoogleClient)(file.connectedAccount);
+                const drive = googleapis_1.google.drive({ version: 'v3', auth });
+                await drive.files.delete({ fileId: file.providerFileId });
+                syncedAccountIds.add(file.connectedAccountId);
+            }
+            catch {
+                // Keep going so one failure does not block the whole deletion
+            }
+        }
+        // Delete folders on Google Drive
+        const foldersToDelete = await prisma_js_1.prisma.folder.findMany({ where: { id: { in: [...folderIds] }, userId: req.user.id }, include: { connectedAccount: true } });
+        for (const f of foldersToDelete) {
+            if (f.providerFolderId && f.connectedAccount) {
+                try {
+                    const auth = await (0, google_service_js_1.getAuthedGoogleClient)(f.connectedAccount);
+                    const drive = googleapis_1.google.drive({ version: 'v3', auth });
+                    await drive.files.delete({ fileId: f.providerFolderId });
+                    if (f.connectedAccountId)
+                        syncedAccountIds.add(f.connectedAccountId);
+                }
+                catch {
+                    // ignore
+                }
+            }
+        }
+        await prisma_js_1.prisma.file.updateMany({ where: { id: { in: files.map((file) => file.id) } }, data: { status: 'deleted', deletedAt: new Date() } });
+        await prisma_js_1.prisma.folder.updateMany({ where: { id: { in: [...folderIds] }, userId: req.user.id }, data: { deletedAt: new Date() } });
+        for (const accountId of syncedAccountIds)
+            await (0, google_service_js_1.syncGoogleQuota)(accountId).catch(() => undefined);
+        await (0, audit_js_1.createAuditLog)(req.user.id, 'DELETE_FOLDER', 'folder', root.id, { name: root.name });
+        return res.json({ status: 'ok' });
+    }
+    catch (error) {
+        return next(error);
+    }
+});
+exports.folderRouter.get('/:id/permissions', async (req, res, next) => {
+    try {
+        const folderId = String(req.params.id);
+        const folder = await prisma_js_1.prisma.folder.findFirst({
+            where: {
+                OR: [
+                    { id: folderId, userId: req.user.id },
+                    { providerFolderId: folderId, userId: req.user.id },
+                    { id: folderId },
+                    { providerFolderId: folderId },
+                ],
+                deletedAt: null,
+            },
+            include: { connectedAccount: true },
+        });
+        if (!folder) {
+            return res.status(404).json({ code: 'NOT_FOUND', message: 'Folder not found.' });
+        }
+        let generalAccess = 'restricted';
+        let role = 'reader';
+        let isInherited = false;
+        let inheritedFrom = null;
+        let parentName = null;
+        if (folder.providerFolderId) {
+            const connectedAccount = folder.connectedAccount ?? (await prisma_js_1.prisma.connectedAccount.findFirst({
+                where: { userId: req.user.id, provider: 'google_drive', status: 'connected' },
+            }));
+            if (connectedAccount) {
+                try {
+                    const auth = await (0, google_service_js_1.getAuthedGoogleClient)(connectedAccount);
+                    const drive = googleapis_1.google.drive({ version: 'v3', auth });
+                    const permList = await drive.permissions.list({
+                        fileId: folder.providerFolderId,
+                        fields: 'permissions(id, role, type, permissionDetails)',
+                        supportsAllDrives: true,
+                    });
+                    const anyonePerm = permList.data.permissions?.find((p) => p.type === 'anyone');
+                    if (anyonePerm) {
+                        generalAccess = 'anyone';
+                        role = anyonePerm.role ?? 'reader';
+                        const inheritedDetail = anyonePerm?.permissionDetails?.find((d) => d.inherited);
+                        isInherited = Boolean(anyonePerm?.inherited || inheritedDetail);
+                        if (isInherited) {
+                            const origin = await (0, google_service_js_1.findInheritedPermissionOrigin)(drive, folder.providerFolderId);
+                            if (origin) {
+                                inheritedFrom = origin.id;
+                                parentName = origin.name;
+                            }
+                        }
+                    }
+                }
+                catch (err) {
+                    console.error('Failed to query folder permissions:', err.message || err);
+                }
+            }
+        }
+        const driveUrl = folder.providerFolderId ? `https://drive.google.com/drive/folders/${folder.providerFolderId}` : null;
+        return res.json({
+            folderId: folder.id,
+            name: folder.name,
+            generalAccess,
+            role,
+            isInherited,
+            inheritedFrom,
+            parentName,
+            shareUrl: driveUrl,
+            driveUrl,
+        });
+    }
+    catch (error) {
+        return next(error);
+    }
+});
+exports.folderRouter.put('/:id/permissions', async (req, res, next) => {
+    try {
+        const folderId = String(req.params.id);
+        const body = zod_1.z.object({
+            generalAccess: zod_1.z.enum(['restricted', 'anyone']),
+            role: zod_1.z.enum(['reader', 'commenter', 'writer']).default('reader'),
+            cascadeParent: zod_1.z.boolean().optional(),
+        }).parse(req.body);
+        const folder = await prisma_js_1.prisma.folder.findFirst({
+            where: {
+                OR: [
+                    { id: folderId, userId: req.user.id },
+                    { providerFolderId: folderId, userId: req.user.id },
+                    { id: folderId },
+                    { providerFolderId: folderId },
+                ],
+                deletedAt: null,
+            },
+            include: { connectedAccount: true },
+        });
+        if (!folder) {
+            return res.status(404).json({ code: 'NOT_FOUND', message: 'Folder not found.' });
+        }
+        if (!folder.providerFolderId) {
+            return res.status(400).json({ code: 'NO_PROVIDER_FOLDER_ID', message: 'Folder does not have a connected Google Drive folder.' });
+        }
+        const connectedAccount = folder.connectedAccount ?? (await prisma_js_1.prisma.connectedAccount.findFirst({
+            where: { userId: req.user.id, provider: 'google_drive', status: 'connected' },
+        }));
+        if (!connectedAccount) {
+            return res.status(400).json({ code: 'ACCOUNT_NOT_FOUND', message: 'Connected Google account not found.' });
+        }
+        const auth = await (0, google_service_js_1.getAuthedGoogleClient)(connectedAccount);
+        const drive = googleapis_1.google.drive({ version: 'v3', auth });
+        const permList = await drive.permissions.list({
+            fileId: folder.providerFolderId,
+            fields: 'permissions(id, role, type, permissionDetails)',
+            supportsAllDrives: true,
+        });
+        const anyonePerm = permList.data.permissions?.find((p) => p.type === 'anyone');
+        const inheritedDetail = anyonePerm?.permissionDetails?.find((d) => d.inherited);
+        const isInherited = Boolean(anyonePerm?.inherited || inheritedDetail);
+        if (body.generalAccess === 'restricted') {
+            if (anyonePerm?.id) {
+                if (isInherited) {
+                    const origin = await (0, google_service_js_1.findInheritedPermissionOrigin)(drive, folder.providerFolderId);
+                    const targetOriginId = origin?.id;
+                    if (body.cascadeParent && targetOriginId) {
+                        try {
+                            await drive.permissions.delete({
+                                fileId: targetOriginId,
+                                permissionId: origin?.permissionId ?? anyonePerm.id,
+                                supportsAllDrives: true,
+                            });
+                        }
+                        catch (delParentErr) {
+                            console.error('Failed to cascade delete permission on parent folder:', delParentErr);
+                            return res.status(400).json({
+                                code: 'FAILED_CASCADE_PARENT',
+                                message: 'Gagal mengubah izin folder induk: ' + (delParentErr.message || delParentErr),
+                            });
+                        }
+                    }
+                    else {
+                        return res.status(400).json({
+                            code: 'PERMISSION_INHERITED',
+                            inheritedFrom: targetOriginId ?? null,
+                            parentName: origin?.name ?? null,
+                            message: 'Hak akses publik diwarisi dari folder induk di Google Drive. Untuk mengubahnya menjadi Restricted, ubah pengaturan sharing pada folder induknya.',
+                        });
+                    }
+                }
+                else {
+                    try {
+                        await drive.permissions.delete({
+                            fileId: folder.providerFolderId,
+                            permissionId: anyonePerm.id,
+                            supportsAllDrives: true,
+                        });
+                    }
+                    catch (deleteErr) {
+                        const msg = deleteErr?.message || String(deleteErr);
+                        if (msg.includes('inherited') || msg.includes('cannotDeletePermission')) {
+                            const origin = await (0, google_service_js_1.findInheritedPermissionOrigin)(drive, folder.providerFolderId);
+                            if (body.cascadeParent && origin?.id) {
+                                try {
+                                    await drive.permissions.delete({
+                                        fileId: origin.id,
+                                        permissionId: origin.permissionId,
+                                        supportsAllDrives: true,
+                                    });
+                                }
+                                catch (cascadeErr) {
+                                    return res.status(400).json({
+                                        code: 'FAILED_CASCADE_PARENT',
+                                        message: 'Gagal mengubah izin folder induk: ' + (cascadeErr.message || cascadeErr),
+                                    });
+                                }
+                            }
+                            else {
+                                return res.status(400).json({
+                                    code: 'PERMISSION_INHERITED',
+                                    inheritedFrom: origin?.id ?? null,
+                                    parentName: origin?.name ?? null,
+                                    message: 'Hak akses publik diwarisi dari folder induk di Google Drive. Untuk mengubahnya menjadi Restricted, ubah pengaturan sharing pada folder induknya.',
+                                });
+                            }
+                        }
+                        else {
+                            throw deleteErr;
+                        }
+                    }
+                }
+            }
+        }
+        else {
+            if (anyonePerm?.id) {
+                if (anyonePerm.role !== body.role) {
+                    await drive.permissions.update({
+                        fileId: folder.providerFolderId,
+                        permissionId: anyonePerm.id,
+                        requestBody: { role: body.role },
+                        supportsAllDrives: true,
+                    });
+                }
+            }
+            else {
+                await drive.permissions.create({
+                    fileId: folder.providerFolderId,
+                    requestBody: { role: body.role, type: 'anyone' },
+                    supportsAllDrives: true,
+                });
+            }
+        }
+        const driveUrl = `https://drive.google.com/drive/folders/${folder.providerFolderId}`;
+        return res.json({
+            status: 'ok',
+            generalAccess: body.generalAccess,
+            role: body.role,
+            isInherited: body.generalAccess === 'restricted' ? false : isInherited,
+            shareUrl: driveUrl,
+            driveUrl,
+        });
+    }
+    catch (error) {
+        return next(error);
+    }
+});