@muhgholy/next-drive 4.23.23 → 4.23.25

package/dist/chunk-ZNWS7VJP.js

@@ -0,0 +1,755 @@
+import { getDriveConfig, getDriveInformation, resolveProvider, drive_default, GoogleDriveProvider, LocalStorageProvider, getImageSettings, account_default, withSignedUrl, withSignedUrls, handleUpload } from './chunk-VBFXHZBY.js';
+import path from 'path';
+import fs from 'fs';
+import crypto from 'crypto';
+import sharp from 'sharp';
+import { google } from 'googleapis';
+import { z } from 'zod';
+import { isValidObjectId } from 'mongoose';
+
+// src/server/actions/cors.ts
+var applyCorsHeaders = (req, res, config) => {
+  const cors = config.cors;
+  if (!cors?.enabled) return false;
+  const origin = req.headers.origin;
+  const allowedOrigins = cors.origins ?? "*";
+  const methods = cors.methods ?? ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"];
+  const allowedHeaders = cors.allowedHeaders ?? ["Content-Type", "Authorization", "X-Drive-Account", "Tus-Resumable", "Upload-Length", "Upload-Offset", "Upload-Metadata", "Upload-Concat", "Upload-Defer-Length"];
+  const exposedHeaders = cors.exposedHeaders ?? ["Content-Length", "Content-Type", "Content-Disposition", "Location", "Tus-Resumable", "Upload-Length", "Upload-Offset", "Upload-Metadata", "Upload-Expires", "X-Drive-Item"];
+  const credentials = cors.credentials ?? false;
+  const maxAge = cors.maxAge ?? 86400;
+  let allowOrigin = null;
+  if (origin) {
+    if (allowedOrigins === "*") {
+      allowOrigin = origin;
+    } else if (Array.isArray(allowedOrigins)) {
+      if (allowedOrigins.includes(origin)) {
+        allowOrigin = origin;
+      }
+    } else if (allowedOrigins === origin) {
+      allowOrigin = origin;
+    }
+  } else if (allowedOrigins === "*") {
+    allowOrigin = "*";
+  }
+  if (!allowOrigin) {
+    if (req.method === "OPTIONS") {
+      res.status(403).end();
+      return true;
+    }
+    return false;
+  }
+  res.setHeader("Access-Control-Allow-Origin", allowOrigin);
+  res.setHeader("Access-Control-Allow-Methods", methods.join(", "));
+  res.setHeader("Access-Control-Allow-Headers", allowedHeaders.join(", "));
+  res.setHeader("Access-Control-Expose-Headers", exposedHeaders.join(", "));
+  res.setHeader("Access-Control-Max-Age", maxAge.toString());
+  if (credentials) {
+    res.setHeader("Access-Control-Allow-Credentials", "true");
+  }
+  if (req.method === "OPTIONS") {
+    res.status(204).end();
+    return true;
+  }
+  return false;
+};
+
+// src/server/security/crypto-utils.ts
+function sanitizeContentDispositionFilename(filename) {
+  const basename = filename.replace(/^.*[\\\/]/, "");
+  return basename.replace(/["\r\n]/g, "").replace(/[^\x20-\x7E]/g, "").slice(0, 255);
+}
+
+// src/server/actions/public.ts
+var handlePublicAction = async (req, res, action, config) => {
+  if (action !== "serve" && action !== "thumbnail") {
+    return false;
+  }
+  try {
+    const { id, token } = req.query;
+    if (!id || typeof id !== "string") {
+      res.status(400).json({ status: 400, message: "Could not open file: missing or invalid file ID" });
+      return true;
+    }
+    const drive = await drive_default.findById(id);
+    if (!drive) {
+      res.status(404).json({ status: 404, message: "File not found or no longer available" });
+      return true;
+    }
+    if (config.security?.signedUrls?.enabled) {
+      if (!token || typeof token !== "string") {
+        res.status(401).json({ status: 401, message: "Access denied: this link is missing its access token" });
+        return true;
+      }
+      try {
+        const decoded = Buffer.from(token, "base64url").toString();
+        const [expiryStr, signature] = decoded.split(":");
+        const expiry = parseInt(expiryStr, 10);
+        if (Date.now() / 1e3 > expiry) {
+          res.status(401).json({ status: 401, message: "Access denied: this link has expired" });
+          return true;
+        }
+        const { secret } = config.security.signedUrls;
+        const expectedSignature = crypto.createHmac("sha256", secret).update(`${id}:${expiry}`).digest("hex");
+        if (signature !== expectedSignature) {
+          res.status(401).json({ status: 401, message: "Access denied: this link's access token is invalid" });
+          return true;
+        }
+      } catch {
+        res.status(401).json({ status: 401, message: "Access denied: this link's access token is malformed" });
+        return true;
+      }
+    }
+    const itemProvider = drive.provider?.type === "GOOGLE" ? GoogleDriveProvider : LocalStorageProvider;
+    const itemAccountId = drive.storageAccountId ? drive.storageAccountId.toString() : void 0;
+    if (action === "thumbnail") {
+      const stream2 = await itemProvider.getThumbnail(drive, itemAccountId);
+      res.setHeader("Content-Type", "image/webp");
+      if (config.cors?.enabled) {
+        res.setHeader("Cross-Origin-Resource-Policy", "cross-origin");
+      }
+      stream2.pipe(res);
+      return true;
+    }
+    const { stream, mime, size: fileSize } = await itemProvider.openStream(drive, itemAccountId);
+    const safeFilename = sanitizeContentDispositionFilename(drive.name);
+    const format = req.query.format;
+    const quality = req.query.quality;
+    const display = req.query.display;
+    const sizePreset = req.query.size;
+    const fit = req.query.fit;
+    const position = req.query.position;
+    const isImage = mime.startsWith("image/");
+    const shouldTransform = isImage && (format || quality || display || sizePreset || fit);
+    res.setHeader("Content-Disposition", `inline; filename="${safeFilename}"`);
+    if (config.cors?.enabled) {
+      res.setHeader("Cross-Origin-Resource-Policy", "cross-origin");
+    }
+    if (shouldTransform) {
+      try {
+        const settings = getImageSettings(fileSize, quality, display, sizePreset, fit, position);
+        let targetFormat = format || mime.split("/")[1];
+        if (targetFormat === "jpg") targetFormat = "jpeg";
+        if (!["jpeg", "png", "webp", "avif"].includes(targetFormat)) {
+          targetFormat = format || "webp";
+        }
+        const cacheDir = path.join(config.storage.path, "file", drive._id.toString(), "cache");
+        const cacheKey = [
+          "opt",
+          `q${settings.quality}`,
+          `e${settings.effort}`,
+          settings.width ? `${settings.width}x${settings.height}` : "orig",
+          settings.fit || "none",
+          settings.position || "c",
+          targetFormat
+        ].join("_");
+        const cachePath = path.join(cacheDir, `${cacheKey}.bin`);
+        if (fs.existsSync(cachePath)) {
+          const cacheStat = fs.statSync(cachePath);
+          res.setHeader("Content-Type", `image/${targetFormat}`);
+          res.setHeader("Content-Length", cacheStat.size);
+          res.setHeader("Cache-Control", "public, max-age=31536000, immutable");
+          if (config.cors?.enabled) {
+            res.setHeader("Cross-Origin-Resource-Policy", "cross-origin");
+          }
+          if ("destroy" in stream) {
+            stream.destroy();
+          }
+          fs.createReadStream(cachePath).pipe(res);
+          return true;
+        }
+        if (!fs.existsSync(cacheDir)) fs.mkdirSync(cacheDir, { recursive: true });
+        let pipeline = sharp();
+        if (settings.width && settings.height) {
+          pipeline = pipeline.resize(settings.width, settings.height, {
+            fit: settings.fit || "inside",
+            position: settings.position || "center",
+            withoutEnlargement: true,
+            background: { r: 0, g: 0, b: 0, alpha: 0 }
+          });
+        }
+        if (targetFormat === "jpeg") {
+          pipeline = pipeline.jpeg({ quality: settings.quality, mozjpeg: true });
+          res.setHeader("Content-Type", "image/jpeg");
+        } else if (targetFormat === "png") {
+          pipeline = pipeline.png({ compressionLevel: settings.pngCompression, adaptiveFiltering: true });
+          res.setHeader("Content-Type", "image/png");
+        } else if (targetFormat === "webp") {
+          const webpEffort = Math.min(settings.effort, 6);
+          pipeline = pipeline.webp({ quality: settings.quality, effort: webpEffort });
+          res.setHeader("Content-Type", "image/webp");
+        } else if (targetFormat === "avif") {
+          pipeline = pipeline.avif({ quality: settings.quality, effort: settings.effort });
+          res.setHeader("Content-Type", "image/avif");
+        }
+        res.setHeader("Cache-Control", "public, max-age=31536000, immutable");
+        pipeline.on("error", (err) => {
+          console.error("[next-drive] Pipeline error:", err);
+        });
+        stream.pipe(pipeline);
+        pipeline.clone().toFile(cachePath).catch((e) => console.error("[next-drive] Cache write failed:", e));
+        pipeline.clone().pipe(res);
+        return true;
+      } catch (e) {
+        console.error("[next-drive] Image transformation failed:", e);
+      }
+    }
+    res.setHeader("Content-Type", mime);
+    if (fileSize) res.setHeader("Content-Length", fileSize);
+    stream.pipe(res);
+    return true;
+  } catch (error) {
+    console.error(`[next-drive] Error in ${action}:`, error);
+    const detail = error instanceof Error ? error.message : "Something went wrong while serving the file";
+    res.status(500).json({ status: 500, message: `Request "${action}" failed: ${detail}` });
+    return true;
+  }
+};
+var handleAuthAction = async (req, res, action, config, owner) => {
+  if (!["getAuthUrl", "callback", "listAccounts", "removeAccount"].includes(action)) {
+    return false;
+  }
+  switch (action) {
+    case "getAuthUrl": {
+      const { provider } = req.query;
+      if (provider === "GOOGLE") {
+        const { clientId, clientSecret, redirectUri } = config.storage?.google || {};
+        if (!clientId || !clientSecret || !redirectUri) {
+          res.status(500).json({ status: 500, message: "Google Drive is not configured on the server" });
+          return true;
+        }
+        const callbackUri = new URL(redirectUri);
+        callbackUri.searchParams.set("action", "callback");
+        const oAuth2Client = new google.auth.OAuth2(clientId, clientSecret, callbackUri.toString());
+        const state = Buffer.from(JSON.stringify({ owner })).toString("base64");
+        const url = oAuth2Client.generateAuthUrl({
+          access_type: "offline",
+          scope: ["https://www.googleapis.com/auth/drive", "https://www.googleapis.com/auth/userinfo.email"],
+          state,
+          prompt: "consent"
+        });
+        res.status(200).json({ status: 200, message: "Auth URL generated", data: { url } });
+        return true;
+      }
+      res.status(400).json({ status: 400, message: "Unknown storage provider requested" });
+      return true;
+    }
+    case "callback": {
+      const { code } = req.query;
+      if (!code) {
+        res.status(400).json({ status: 400, message: "Google sign-in failed: authorization code missing" });
+        return true;
+      }
+      const { clientId, clientSecret, redirectUri } = config.storage?.google || {};
+      if (!clientId || !clientSecret || !redirectUri) {
+        res.status(500).json({ status: 500, message: "Google Drive sign-in is not configured on the server" });
+        return true;
+      }
+      const callbackUri = new URL(redirectUri);
+      callbackUri.searchParams.set("action", "callback");
+      const oAuth2Client = new google.auth.OAuth2(clientId, clientSecret, callbackUri.toString());
+      const { tokens } = await oAuth2Client.getToken(code);
+      oAuth2Client.setCredentials(tokens);
+      const oauth2 = google.oauth2({ version: "v2", auth: oAuth2Client });
+      const userInfo = await oauth2.userinfo.get();
+      const existing = await account_default.findOne({ owner, "metadata.google.email": userInfo.data.email, "metadata.provider": "GOOGLE" });
+      if (existing) {
+        existing.metadata.google.credentials = tokens;
+        existing.markModified("metadata");
+        await existing.save();
+      } else {
+        const newAccount = new account_default({
+          owner,
+          name: userInfo.data.name || "Google Drive",
+          metadata: {
+            provider: "GOOGLE",
+            google: {
+              email: userInfo.data.email,
+              credentials: tokens
+            }
+          }
+        });
+        await newAccount.save();
+      }
+      res.setHeader("Content-Type", "text/html");
+      res.send(`<!DOCTYPE html>
+<html>
+<head><title>Authentication Complete</title></head>
+<body>
+<p>Authentication successful! This window will close automatically.</p>
+<script>
+(function() {
+	if (window.opener) {
+		try {
+			window.opener.postMessage('oauth-success', '*');
+		} catch (e) {}
+	}
+	try {
+		localStorage.setItem('next-drive-oauth-success', Date.now().toString());
+		localStorage.removeItem('next-drive-oauth-success');
+	} catch (e) {}
+	window.close();
+	setTimeout(function() {
+		document.body.innerHTML = '<p style="font-family: system-ui; text-align: center; margin-top: 50px;">Authentication successful!<br>You can close this tab now.</p>';
+	}, 500);
+})();
+</script>
+</body>
+</html>`);
+      return true;
+    }
+    case "listAccounts": {
+      const accounts = await account_default.find({ owner });
+      res.status(200).json({
+        status: 200,
+        data: {
+          accounts: accounts.map((a) => ({
+            id: a._id.toString(),
+            name: a.name,
+            email: a.metadata.google?.email || "",
+            provider: a.metadata.provider
+          }))
+        }
+      });
+      return true;
+    }
+    case "removeAccount": {
+      const { id } = req.query;
+      const account = await account_default.findOne({ _id: id, owner });
+      if (!account) {
+        res.status(404).json({ status: 404, message: "Could not disconnect: account not found" });
+        return true;
+      }
+      if (account.metadata.provider === "GOOGLE") {
+        try {
+          await GoogleDriveProvider.revokeToken(owner, account._id.toString());
+        } catch (e) {
+          console.error("Failed to revoke Google token:", e);
+        }
+      }
+      await account_default.deleteOne({ _id: id, owner });
+      await drive_default.deleteMany({ owner, storageAccountId: id });
+      res.status(200).json({ status: 200, message: "Account removed" });
+      return true;
+    }
+    default:
+      return false;
+  }
+};
+var objectIdSchema = z.string().refine((val) => isValidObjectId(val), {
+  message: "Invalid ObjectId format"
+});
+var sanitizeFilename = (name) => {
+  return name.replace(/[<>:"|?*\x00-\x1F]/g, "").replace(/^\.+/, "").replace(/\.+$/, "").replace(/\\/g, "/").replace(/\/+/g, "/").replace(/\.\.\//g, "").replace(/\.\.+/g, "").split("/").pop() || "".trim().slice(0, 255);
+};
+var sanitizeRegexInput = (input) => {
+  return input.replace(/[.*+?^${}()|[\]\\]/g, "\\$&").slice(0, 100);
+};
+var nameSchema = z.string().min(1, "Name is required").max(255, "Name too long").transform(sanitizeFilename).refine((val) => val.length > 0, { message: "Invalid name after sanitization" });
+var listQuerySchema = z.object({
+  folderId: z.union([z.literal("root"), objectIdSchema, z.undefined()]),
+  limit: z.string().optional().transform((val) => {
+    const num = parseInt(val || "50", 10);
+    return Math.min(Math.max(1, num), 100);
+  }),
+  afterId: objectIdSchema.optional()
+});
+z.object({
+  id: objectIdSchema,
+  token: z.string().optional()
+});
+z.object({
+  id: objectIdSchema,
+  size: z.enum(["small", "medium", "large"]).optional().default("medium"),
+  token: z.string().optional()
+});
+var renameBodySchema = z.object({
+  id: objectIdSchema,
+  newName: nameSchema
+});
+var deleteQuerySchema = z.object({
+  id: objectIdSchema
+});
+z.object({
+  ids: z.array(objectIdSchema).min(1).max(1e3)
+});
+var createFolderBodySchema = z.object({
+  name: nameSchema,
+  parentId: z.union([z.literal("root"), objectIdSchema, z.string().length(0), z.undefined()]).optional()
+});
+var moveBodySchema = z.object({
+  ids: z.array(objectIdSchema).min(1).max(1e3),
+  targetFolderId: z.union([z.literal("root"), objectIdSchema, z.undefined()]).optional()
+});
+var reorderBodySchema = z.object({
+  ids: z.array(objectIdSchema).min(1).max(1e3)
+});
+var searchQuerySchema = z.object({
+  q: z.string().min(1).max(100).transform(sanitizeRegexInput),
+  folderId: z.union([z.literal("root"), objectIdSchema, z.undefined()]).optional(),
+  limit: z.string().optional().transform((val) => {
+    const num = parseInt(val || "50", 10);
+    return Math.min(Math.max(1, num), 100);
+  }),
+  trashed: z.string().optional().transform((val) => val === "true")
+});
+z.object({
+  id: objectIdSchema
+});
+z.object({
+  days: z.number().int().min(1).max(365).optional()
+});
+var driveFileSchemaZod = z.object({
+  id: z.string(),
+  file: z.object({
+    name: z.string(),
+    mime: z.string(),
+    size: z.number()
+  })
+});
+
+// src/server/actions/drive.ts
+var handleDriveAction = async (ctx) => {
+  const { req, res, action, config, owner, isRootMode, authenticated, information, provider, accountId } = ctx;
+  switch (action) {
+    case "list": {
+      if (req.method !== "GET") return void res.status(405).json({ status: 405, message: "Listing files requires a GET request" });
+      const listQuery = listQuerySchema.safeParse(req.query);
+      if (!listQuery.success) return void res.status(400).json({ status: 400, message: "Could not list files: invalid request parameters" });
+      const { folderId, limit, afterId } = listQuery.data;
+      try {
+        await provider.sync(folderId || "root", owner, accountId);
+      } catch (e) {
+        console.error("Sync failed", e);
+      }
+      const query = {
+        "provider.type": provider.name,
+        storageAccountId: accountId || null,
+        parentId: folderId === "root" || !folderId ? null : folderId,
+        trashedAt: null
+      };
+      if (!isRootMode) {
+        query.owner = owner;
+      }
+      if (afterId) query._id = { $lt: afterId };
+      const items = await drive_default.find(query, {}, { sort: { order: 1, _id: -1 }, limit });
+      const plainItems = withSignedUrls(await Promise.all(items.map((item) => item.toClient())), config);
+      res.status(200).json({ status: 200, message: "Items retrieved", data: { items: plainItems, hasMore: items.length === limit } });
+      return;
+    }
+    case "search": {
+      const searchData = searchQuerySchema.safeParse(req.query);
+      if (!searchData.success) return void res.status(400).json({ status: 400, message: "Could not search: invalid request parameters" });
+      const { q, folderId, limit, trashed } = searchData.data;
+      if (!trashed) {
+        try {
+          await provider.search(q, owner, accountId);
+        } catch (e) {
+          console.error("Search sync failed", e);
+        }
+      }
+      const query = {
+        "provider.type": provider.name,
+        storageAccountId: accountId || null,
+        trashedAt: trashed ? { $ne: null } : null,
+        name: { $regex: q, $options: "i" }
+      };
+      if (!isRootMode) {
+        query.owner = owner;
+      }
+      if (folderId && folderId !== "root") query.parentId = folderId;
+      const items = await drive_default.find(query, {}, { limit, sort: { createdAt: -1 } });
+      const plainItems = withSignedUrls(await Promise.all(items.map((i) => i.toClient())), config);
+      res.status(200).json({ status: 200, message: "Results", data: { items: plainItems } });
+      return;
+    }
+    case "upload": {
+      await handleUpload(req, res, { config, owner, authenticated, isRootMode, information, provider, accountId });
+      return;
+    }
+    case "createFolder": {
+      const folderData = createFolderBodySchema.safeParse(req.body);
+      if (!folderData.success) return void res.status(400).json({ status: 400, message: folderData.error.errors[0].message });
+      const { name, parentId } = folderData.data;
+      const item = withSignedUrl(await provider.createFolder(name, parentId ?? null, owner, accountId), config);
+      res.status(201).json({ status: 201, message: "Folder created", data: { item } });
+      return;
+    }
+    case "delete": {
+      const deleteData = deleteQuerySchema.safeParse(req.query);
+      if (!deleteData.success) return void res.status(400).json({ status: 400, message: "Could not move to trash: invalid ID" });
+      const { id } = deleteData.data;
+      const drive = await drive_default.findById(id);
+      if (!drive) return void res.status(404).json({ status: 404, message: "Could not move to trash: item not found" });
+      const itemProvider = drive.provider?.type === "GOOGLE" ? GoogleDriveProvider : LocalStorageProvider;
+      const itemAccountId = drive.storageAccountId ? drive.storageAccountId.toString() : void 0;
+      try {
+        await itemProvider.trash([id], owner, itemAccountId);
+      } catch (e) {
+        console.error("Provider trash failed:", e);
+      }
+      drive.trashedAt = /* @__PURE__ */ new Date();
+      await drive.save();
+      res.status(200).json({ status: 200, message: "Moved to trash", data: null });
+      return;
+    }
+    case "deletePermanent": {
+      const deleteData = deleteQuerySchema.safeParse(req.query);
+      if (!deleteData.success) return void res.status(400).json({ status: 400, message: "Could not delete: invalid ID" });
+      const { id } = deleteData.data;
+      await provider.delete([id], owner, accountId);
+      const quota = await provider.getQuota(owner, accountId, information.storage.quotaInBytes);
+      res.status(200).json({ status: 200, message: "Deleted", statistic: { storage: quota } });
+      return;
+    }
+    case "quota": {
+      const quota = await provider.getQuota(owner, accountId, information.storage.quotaInBytes);
+      res.status(200).json({
+        status: 200,
+        message: "Quota retrieved",
+        data: {
+          usedInBytes: quota.usedInBytes,
+          totalInBytes: quota.quotaInBytes,
+          availableInBytes: Math.max(0, quota.quotaInBytes - quota.usedInBytes),
+          percentage: quota.quotaInBytes > 0 ? Math.round(quota.usedInBytes / quota.quotaInBytes * 100) : 0
+        },
+        statistic: { storage: quota }
+      });
+      return;
+    }
+    case "trash": {
+      try {
+        const { provider: trashProvider, accountId: trashAccountId } = await resolveProvider(req, owner);
+        await trashProvider.syncTrash(owner, trashAccountId);
+      } catch (e) {
+        console.error("Trash sync failed", e);
+      }
+      const query = {
+        owner,
+        "provider.type": provider.name,
+        storageAccountId: accountId || null,
+        trashedAt: { $ne: null }
+      };
+      const items = await drive_default.find(query, {}, { sort: { trashedAt: -1 } });
+      const plainItems = withSignedUrls(await Promise.all(items.map((item) => item.toClient())), config);
+      res.status(200).json({ status: 200, message: "Trash items", data: { items: plainItems, hasMore: false } });
+      return;
+    }
+    case "restore": {
+      const restoreData = deleteQuerySchema.safeParse(req.query);
+      if (!restoreData.success) return void res.status(400).json({ status: 400, message: "Could not restore: invalid ID" });
+      const { id } = restoreData.data;
+      const drive = await drive_default.findById(id);
+      if (!drive) return void res.status(404).json({ status: 404, message: "Could not restore: item not found" });
+      let targetParentId = drive.parentId;
+      if (targetParentId) {
+        const parent = await drive_default.findById(targetParentId);
+        if (parent?.trashedAt) {
+          targetParentId = null;
+        }
+      }
+      const itemProvider = drive.provider?.type === "GOOGLE" ? GoogleDriveProvider : LocalStorageProvider;
+      const itemAccountId = drive.storageAccountId ? drive.storageAccountId.toString() : void 0;
+      try {
+        await itemProvider.untrash([id], owner, itemAccountId);
+        if (targetParentId !== drive.parentId) {
+          await itemProvider.move(id, targetParentId?.toString() ?? null, owner, itemAccountId);
+        }
+      } catch (e) {
+        console.error("Provider restore failed:", e);
+      }
+      drive.trashedAt = null;
+      drive.parentId = targetParentId;
+      await drive.save();
+      res.status(200).json({
+        status: 200,
+        message: targetParentId === null && drive.parentId !== null ? "Restored to root (parent folder was trashed)" : "Restored",
+        data: null
+      });
+      return;
+    }
+    case "move": {
+      const moveData = moveBodySchema.safeParse(req.body);
+      if (!moveData.success) return void res.status(400).json({ status: 400, message: "Could not move: invalid request data" });
+      const { ids, targetFolderId } = moveData.data;
+      const items = [];
+      const effectiveTargetId = targetFolderId === "root" || !targetFolderId ? null : targetFolderId;
+      for (const id of ids) {
+        try {
+          const item = await provider.move(id, effectiveTargetId, owner, accountId);
+          items.push(item);
+        } catch (e) {
+          console.error(`Failed to move item ${id}`, e);
+        }
+      }
+      res.status(200).json({ status: 200, message: "Moved", data: { items: withSignedUrls(items, config) } });
+      return;
+    }
+    case "reorder": {
+      if (req.method !== "POST") {
+        return void res.status(405).json({ status: 405, message: "Reordering requires a POST request" });
+      }
+      const reorderData = reorderBodySchema.safeParse(req.body);
+      if (!reorderData.success) {
+        return void res.status(400).json({ status: 400, message: "Could not reorder: invalid request data" });
+      }
+      const { ids } = reorderData.data;
+      const query = {
+        _id: { $in: ids },
+        "provider.type": provider.name,
+        storageAccountId: accountId || null,
+        trashedAt: null
+      };
+      if (!isRootMode) {
+        query.owner = owner;
+      }
+      const existingItems = await drive_default.find(query, { _id: 1, parentId: 1 });
+      if (existingItems.length !== ids.length) {
+        return void res.status(404).json({ status: 404, message: "Could not reorder: one or more items were not found" });
+      }
+      const parentIds = new Set(existingItems.map((item) => item.parentId ? item.parentId.toString() : "root"));
+      if (parentIds.size > 1) {
+        return void res.status(400).json({ status: 400, message: "Could not reorder: all items must be in the same folder" });
+      }
+      const operations = ids.map((id, order) => ({
+        updateOne: {
+          filter: {
+            _id: id,
+            "provider.type": provider.name,
+            storageAccountId: accountId || null,
+            trashedAt: null,
+            ...isRootMode ? {} : { owner }
+          },
+          update: { $set: { order } }
+        }
+      }));
+      await drive_default.bulkWrite(operations);
+      const updatedItems = await drive_default.find(query, {}, { sort: { order: 1 } });
+      const plainItems = withSignedUrls(await Promise.all(updatedItems.map((item) => item.toClient())), config);
+      res.status(200).json({ status: 200, message: "Reordered", data: { items: plainItems } });
+      return;
+    }
+    case "rename": {
+      const renameData = renameBodySchema.safeParse({ id: req.query.id, ...req.body });
+      if (!renameData.success) return void res.status(400).json({ status: 400, message: "Could not rename: invalid request data" });
+      const { id, newName } = renameData.data;
+      const item = withSignedUrl(await provider.rename(id, newName, owner, accountId), config);
+      res.status(200).json({ status: 200, message: "Renamed", data: { item } });
+      return;
+    }
+    default: {
+      res.status(400).json({ status: 400, message: `Unknown action requested: "${action}"` });
+      return;
+    }
+  }
+};
+
+// src/server/index.ts
+var parseJsonBody = (req) => {
+  return new Promise((resolve) => {
+    try {
+      const chunks = [];
+      req.on("data", (chunk) => chunks.push(chunk));
+      req.on("end", () => {
+        const raw = Buffer.concat(chunks).toString();
+        if (!raw) return resolve({});
+        try {
+          resolve(JSON.parse(raw));
+        } catch {
+          resolve({});
+        }
+      });
+      req.on("error", () => resolve({}));
+    } catch {
+      resolve({});
+    }
+  });
+};
+var driveAPIHandler = async (req, res) => {
+  if (req.body === void 0 && typeof req.on === "function" && (req.headers["content-type"] || "").includes("application/json")) {
+    req.body = await parseJsonBody(req);
+  } else if (req.body === void 0) {
+    req.body = {};
+  }
+  const action = req.query.action || (req.query.code && req.query.state ? "callback" : void 0);
+  let config;
+  try {
+    config = getDriveConfig();
+  } catch (error) {
+    console.error("[next-drive] Configuration error:", error);
+    res.status(500).json({ status: 500, message: "Drive is not ready: failed to initialize configuration" });
+    return;
+  }
+  const isPreflightHandled = applyCorsHeaders(req, res, config);
+  if (isPreflightHandled) return;
+  if (!action) {
+    res.status(400).json({ status: 400, message: 'Missing "action" parameter in request' });
+    return;
+  }
+  const wasPublicHandled = await handlePublicAction(req, res, action, config);
+  if (wasPublicHandled) return;
+  try {
+    const mode = config.mode || "NORMAL";
+    if (action === "information") {
+      const { clientId, clientSecret, redirectUri } = config.storage?.google || {};
+      const googleConfigured = !!(clientId && clientSecret && redirectUri);
+      let authenticated2 = false;
+      try {
+        await getDriveInformation({ method: "REQUEST", req });
+        authenticated2 = true;
+      } catch {
+        authenticated2 = false;
+      }
+      res.status(200).json({
+        status: 200,
+        message: "Information retrieved",
+        data: {
+          providers: {
+            google: googleConfigured
+          },
+          mode,
+          authenticated: authenticated2,
+          unauthenticatedUploads: !!config.security?.unauthenticated?.enabled
+        }
+      });
+      return;
+    }
+    const isRootMode = mode === "ROOT";
+    let information;
+    let authenticated = true;
+    try {
+      information = await getDriveInformation({ method: "REQUEST", req });
+    } catch (err) {
+      if (action === "upload" && config.security?.unauthenticated?.enabled) {
+        information = { key: null, storage: { quotaInBytes: 0 } };
+        authenticated = false;
+      } else {
+        throw err;
+      }
+    }
+    const { key: owner } = information;
+    const wasAuthHandled = await handleAuthAction(req, res, action, config, owner);
+    if (wasAuthHandled) return;
+    const { provider, accountId } = await resolveProvider(req, owner);
+    await handleDriveAction({
+      req,
+      res,
+      action,
+      config,
+      owner,
+      isRootMode,
+      authenticated,
+      information,
+      provider,
+      accountId
+    });
+  } catch (error) {
+    console.error(`[next-drive] Error handling action ${action}:`, error);
+    const detail = error instanceof Error ? error.message : "Something went wrong while processing your request";
+    res.status(500).json({ status: 500, message: `Request "${action}" failed: ${detail}` });
+  }
+};
+
+export { driveAPIHandler, driveFileSchemaZod };
+//# sourceMappingURL=chunk-ZNWS7VJP.js.map
+//# sourceMappingURL=chunk-ZNWS7VJP.js.map