Session 2026-05-29: profile layout 2-col, file browser copy/paste, fbq-proxy/backfill fns, migrations, UI updates

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/archive-orphan-folders.js

@@ -0,0 +1,212 @@
+import { createClient } from '@supabase/supabase-js';
+
+const FB_SOURCE = 'srv';
+
+function normalizePath(path) {
+  const raw = String(path || '/').trim();
+  const parts = raw.split('/').filter(Boolean);
+  const clean = [];
+  for (const part of parts) {
+    if (part === '.') continue;
+    if (part === '..') throw new Error('Invalid path');
+    clean.push(part);
+  }
+  return `/${clean.join('/')}`;
+}
+
+function joinPath(...parts) {
+  return normalizePath(parts.join('/'));
+}
+
+function safeName(value) {
+  return String(value || '')
+    .trim()
+    .replace(/[\\/:*?"<>|#%{}^~[\]`]+/g, '-')
+    .replace(/\s+/g, ' ')
+    .replace(/^-+|-+$/g, '');
+}
+
+function basename(path) {
+  const parts = normalizePath(path).split('/').filter(Boolean);
+  return parts[parts.length - 1] || '';
+}
+
+function getFbConfig() {
+  const url = String(process.env.FILEBROWSER_URL || '').trim().replace(/\/+$/, '');
+  return {
+    url,
+    token: process.env.FILEBROWSER_TOKEN || '',
+    teamRoot: normalizePath(process.env.FILEBROWSER_TEAM_ROOT || '/Team'),
+    clientRoot: normalizePath(process.env.FILEBROWSER_CLIENT_ROOT || '/Clients'),
+    archiveRoot: normalizePath(process.env.FILEBROWSER_ARCHIVE_ROOT || '/Archive'),
+    configured: Boolean(url) && Boolean(process.env.FILEBROWSER_TOKEN),
+  };
+}
+
+async function fbFetch(config, method, endpoint, { params = {}, headers = {}, body } = {}) {
+  const qs = new URLSearchParams({ source: FB_SOURCE, ...params }).toString();
+  const res = await fetch(`${config.url}${endpoint}?${qs}`, {
+    method,
+    headers: { Authorization: `Bearer ${config.token}`, ...headers },
+    body,
+  });
+  if (!res.ok) {
+    const text = await res.text();
+    const err = new Error(text || `FileBrowser ${res.status}`);
+    err.status = res.status;
+    throw err;
+  }
+  const text = await res.text();
+  try { return text ? JSON.parse(text) : null; } catch { return text; }
+}
+
+async function fbExists(config, path) {
+  try { await fbFetch(config, 'GET', '/api/resources', { params: { path } }); return true; }
+  catch (e) { if (e.status === 404) return false; throw e; }
+}
+
+async function fbMkdir(config, path) {
+  await fbFetch(config, 'POST', '/api/resources', { params: { path, isDir: 'true' } }).catch(() => {});
+}
+
+async function listFolders(config, path) {
+  try {
+    const data = await fbFetch(config, 'GET', '/api/resources', { params: { path } });
+    return (data?.folders || []).map(f => f.name).filter(Boolean);
+  } catch (e) {
+    if (e.status === 404) return [];
+    throw e;
+  }
+}
+
+async function mergeMove(config, fbSrc, fbDstParent) {
+  const name = basename(fbSrc);
+  const fbDst = joinPath(fbDstParent, name);
+  const destExists = await fbExists(config, fbDst);
+  if (!destExists) {
+    await fbFetch(config, 'PATCH', '/api/resources', {
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        action: 'move',
+        items: [{ fromSource: FB_SOURCE, fromPath: fbSrc, toSource: FB_SOURCE, toPath: fbDst }],
+        overwrite: false,
+      }),
+    });
+    return;
+  }
+
+  const data = await fbFetch(config, 'GET', '/api/resources', { params: { path: fbSrc } });
+  const dirs = (data?.folders || []).map(f => f.name);
+  const files = (data?.files || []).map(f => f.name);
+  await fbMkdir(config, fbDst);
+  for (const dir of dirs) await mergeMove(config, joinPath(fbSrc, dir), fbDst);
+  for (const file of files) {
+    await fbFetch(config, 'PATCH', '/api/resources', {
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        action: 'move',
+        items: [{ fromSource: FB_SOURCE, fromPath: joinPath(fbSrc, file), toSource: FB_SOURCE, toPath: joinPath(fbDst, file) }],
+        overwrite: true,
+      }),
+    }).catch(() => {});
+  }
+  await fbFetch(config, 'DELETE', '/api/resources', { params: { path: fbSrc } }).catch(() => {});
+}
+
+function json(res, status, body) {
+  return res.status(status).json(body);
+}
+
+export default async function handler(req, res) {
+  if (req.method !== 'POST') return json(res, 405, { error: 'Method not allowed' });
+
+  const secret = process.env.SUPABASE_WEBHOOK_SECRET;
+  if (secret) {
+    const incoming = req.headers['x-webhook-secret'] || '';
+    if (incoming.trim() !== secret.trim()) return json(res, 401, { error: 'Unauthorized' });
+  }
+
+  const supabaseUrl = process.env.VITE_SUPABASE_URL || process.env.SUPABASE_URL;
+  const serviceRoleKey = process.env.SUPABASE_SERVICE_ROLE_KEY;
+  if (!supabaseUrl || !serviceRoleKey) return json(res, 500, { error: 'Supabase env not configured' });
+
+  const admin = createClient(supabaseUrl, serviceRoleKey, {
+    auth: { persistSession: false, autoRefreshToken: false },
+  });
+
+  const config = getFbConfig();
+  if (!config.configured) return json(res, 200, { ok: true, skipped: 'FileBrowser not configured' });
+
+  const results = {
+    archivedTeamFolders: [],
+    archivedProjectFolders: [],
+    errors: [],
+  };
+
+  await fbMkdir(config, config.archiveRoot);
+  await fbMkdir(config, joinPath(config.archiveRoot, 'Team'));
+  await fbMkdir(config, joinPath(config.archiveRoot, 'Clients'));
+
+  const { data: profiles, error: profilesError } = await admin
+    .from('profiles')
+    .select('name, role')
+    .in('role', ['team', 'external']);
+  if (profilesError) return json(res, 500, { error: profilesError.message });
+
+  const validTeamFolders = new Set((profiles || []).map(profile => safeName(profile.name)).filter(Boolean));
+  const teamFolders = await listFolders(config, config.teamRoot);
+  for (const folder of teamFolders) {
+    if (validTeamFolders.has(folder)) continue;
+    try {
+      await mergeMove(config, joinPath(config.teamRoot, folder), joinPath(config.archiveRoot, 'Team'));
+      results.archivedTeamFolders.push(folder);
+    } catch (e) {
+      results.errors.push(`team:${folder}: ${e.message}`);
+    }
+  }
+
+  const { data: companies, error: companiesError } = await admin
+    .from('companies')
+    .select('id, name');
+  if (companiesError) return json(res, 500, { error: companiesError.message });
+
+  const { data: projects, error: projectsError } = await admin
+    .from('projects')
+    .select('name, company_id');
+  if (projectsError) return json(res, 500, { error: projectsError.message });
+
+  const projectsByCompany = new Map();
+  for (const project of projects || []) {
+    if (!project?.company_id || !project?.name) continue;
+    const key = project.company_id;
+    if (!projectsByCompany.has(key)) projectsByCompany.set(key, new Set());
+    projectsByCompany.get(key).add(safeName(project.name));
+  }
+
+  for (const company of companies || []) {
+    const companyFolder = safeName(company.name);
+    if (!companyFolder) continue;
+    const validProjects = projectsByCompany.get(company.id) || new Set();
+    const projectsRoot = joinPath(config.clientRoot, companyFolder, 'Projects');
+    const projectFolders = await listFolders(config, projectsRoot);
+
+    await fbMkdir(config, joinPath(config.archiveRoot, 'Clients', companyFolder));
+    await fbMkdir(config, joinPath(config.archiveRoot, 'Clients', companyFolder, 'Projects'));
+
+    for (const folder of projectFolders) {
+      if (validProjects.has(folder)) continue;
+      try {
+        await mergeMove(
+          config,
+          joinPath(projectsRoot, folder),
+          joinPath(config.archiveRoot, 'Clients', companyFolder, 'Projects'),
+        );
+        results.archivedProjectFolders.push(`${companyFolder}/${folder}`);
+      } catch (e) {
+        results.errors.push(`project:${companyFolder}/${folder}: ${e.message}`);
+      }
+    }
+  }
+
+  return json(res, 200, { ok: true, ...results });
+}

api/backfill-request-files.js

@@ -1,6 +1,6 @@
 import { createClient } from '@supabase/supabase-js';
 
-const FB_SOURCE = 'files';
+const FB_SOURCE = 'srv';
 
 function normalizePath(path) {
   const raw = String(path || '/').trim();
@@ -31,7 +31,7 @@ function getConfig() {
   return {
     url,
     token: process.env.FILEBROWSER_TOKEN || '',
-    clientRoot: normalizePath(process.env.FILEBROWSER_CLIENT_ROOT || '/fourgebranding/Clients'),
+    clientRoot: normalizePath(process.env.FILEBROWSER_CLIENT_ROOT || '/Clients'),
     configured: Boolean(url),
   };
 }
@@ -56,6 +56,37 @@ async function mkdir(config, path) {
   }).catch(() => {});
 }
 
+async function fbExists(config, path) {
+  try {
+    await fbFetch(config, 'GET', '/api/resources', { params: { path } });
+    return true;
+  } catch (e) {
+    if (e.status === 404) return false;
+    throw e;
+  }
+}
+
+async function ensureTaskStructure(config, companyName, projectName, taskTitle) {
+  const companyDir = joinPath(config.clientRoot, safeName(companyName));
+  const projectsDir = joinPath(companyDir, 'Projects');
+  const projectDir = joinPath(projectsDir, safeName(projectName));
+  const taskDir = joinPath(projectDir, safeName(taskTitle));
+  const requestInfoDir = joinPath(taskDir, 'Request Info');
+  const workingFilesDir = joinPath(taskDir, 'Working Files');
+  const oldBooksDir = joinPath(taskDir, 'Old Books');
+
+  await mkdir(config, companyDir);
+  await mkdir(config, projectsDir);
+  await mkdir(config, projectDir);
+  await mkdir(config, joinPath(projectDir, '00 Project Files'));
+  await mkdir(config, taskDir);
+  await mkdir(config, requestInfoDir);
+  await mkdir(config, workingFilesDir);
+  await mkdir(config, oldBooksDir);
+
+  return { companyDir, projectDir, taskDir, requestInfoDir };
+}
+
 function json(res, status, body) {
   return res.status(status).json(body);
 }
@@ -80,6 +111,33 @@ export default async function handler(req, res) {
   const config = getConfig();
   if (!config.configured || !config.token) return json(res, 200, { ok: true, skipped: 'FileBrowser not configured' });
 
+  const { data: tasks, error: taskError } = await admin
+    .from('tasks')
+    .select(`
+      id, title,
+      project:projects!inner(
+        id, name,
+        company:companies!inner(name)
+      )
+    `);
+
+  if (taskError) return json(res, 500, { error: taskError.message });
+
+  const results = {
+    ensuredTasks: 0,
+    processed: 0,
+    skipped: 0,
+    errors: [],
+  };
+
+  for (const task of tasks || []) {
+    const project = task?.project;
+    const company = project?.company;
+    if (!task?.title || !project?.name || !company?.name) continue;
+    await ensureTaskStructure(config, company.name, project.name, task.title);
+    results.ensuredTasks++;
+  }
+
   // Fetch all submission files with task/project/company context
   const { data: rows, error } = await admin
     .from('submission_files')
@@ -120,52 +178,37 @@ export default async function handler(req, res) {
     }
     groups.get(key).files.push({ name: row.name, storage_path: row.storage_path });
   }
-
-  const results = { processed: 0, skipped: 0, errors: [] };
-
   for (const group of groups.values()) {
     if (group.files.length === 0) { results.skipped++; continue; }
 
     const revFolder = `R${String(group.versionNumber).padStart(2, '0')}`;
-    const companyDir = joinPath(config.clientRoot, safeName(group.companyName));
-    const projectDir = joinPath(companyDir, 'Projects', safeName(group.projectName));
-    const taskDir = joinPath(projectDir, safeName(group.taskTitle));
-    const requestInfoDir = joinPath(taskDir, 'Request Info');
+    const { requestInfoDir } = await ensureTaskStructure(config, group.companyName, group.projectName, group.taskTitle);
     const revDir = joinPath(requestInfoDir, revFolder);
 
-    // Ensure all parent dirs exist
-    await mkdir(config, companyDir);
-    await mkdir(config, joinPath(companyDir, 'Projects'));
-    await mkdir(config, projectDir);
-    await mkdir(config, taskDir);
-    await mkdir(config, requestInfoDir);
     await mkdir(config, revDir);
 
     for (const file of group.files) {
       try {
-        // Get signed URL from Supabase Storage
-        const { data: signed, error: signedError } = await admin.storage
+        const { data: blob, error: downloadError } = await admin.storage
           .from('submissions')
-          .createSignedUrl(file.storage_path, 60);
-        if (signedError || !signed?.signedUrl) {
-          results.errors.push(`signed url failed: ${file.storage_path}`);
+          .download(file.storage_path);
+        if (downloadError || !blob) {
+          results.errors.push(`download failed: ${file.storage_path}`);
           continue;
         }
-
-        // Download file from Supabase Storage
-        const fileRes = await fetch(signed.signedUrl);
-        if (!fileRes.ok) {
-          results.errors.push(`download failed: ${file.name}`);
-          continue;
-        }
-        const fileBuffer = await fileRes.arrayBuffer();
+        const fileBuffer = await blob.arrayBuffer();
+        const form = new FormData();
+        form.append('file', new Blob([fileBuffer]), file.name);
 
         // Upload to FileBrowser
         const fbFilePath = joinPath(revDir, file.name);
+        if (await fbExists(config, fbFilePath)) {
+          results.skipped++;
+          continue;
+        }
         await fbFetch(config, 'POST', '/api/resources', {
-          params: { path: fbFilePath, override: 'true' },
-          headers: { 'Content-Type': 'application/octet-stream' },
-          body: fileBuffer,
+          params: { path: fbFilePath },
+          body: form,
         });
 
         results.processed++;

api/delete-project.js

@@ -1,6 +1,6 @@
 import { createClient } from '@supabase/supabase-js';
 
-const FB_SOURCE = 'files';
+const FB_SOURCE = 'srv';
 
 function normalizePath(path) {
   const raw = String(path || '/').trim();
@@ -42,8 +42,8 @@ function getFbConfig() {
   return {
     url,
     token: process.env.FILEBROWSER_TOKEN || '',
-    clientRoot: normalizePath(process.env.FILEBROWSER_CLIENT_ROOT || '/fourgebranding/Clients'),
-    archiveRoot: normalizePath(process.env.FILEBROWSER_ARCHIVE_ROOT || '/fourgebranding/Archive'),
+    clientRoot: normalizePath(process.env.FILEBROWSER_CLIENT_ROOT || '/Clients'),
+    archiveRoot: normalizePath(process.env.FILEBROWSER_ARCHIVE_ROOT || '/Archive'),
     configured: Boolean(url) && Boolean(process.env.FILEBROWSER_TOKEN),
   };
 }

api/delete-task.js

@@ -1,6 +1,6 @@
 import { createClient } from '@supabase/supabase-js';
 
-const FB_SOURCE = 'files';
+const FB_SOURCE = 'srv';
 
 function normalizePath(path) {
   const raw = String(path || '/').trim();
@@ -36,8 +36,8 @@ function getFbConfig() {
   return {
     url,
     token: process.env.FILEBROWSER_TOKEN || '',
-    clientRoot: normalizePath(process.env.FILEBROWSER_CLIENT_ROOT || '/fourgebranding/Clients'),
-    archiveRoot: normalizePath(process.env.FILEBROWSER_ARCHIVE_ROOT || '/fourgebranding/Archive'),
+    clientRoot: normalizePath(process.env.FILEBROWSER_CLIENT_ROOT || '/Clients'),
+    archiveRoot: normalizePath(process.env.FILEBROWSER_ARCHIVE_ROOT || '/Archive'),
     configured: Boolean(url) && Boolean(process.env.FILEBROWSER_TOKEN),
   };
 }

api/sync-company-folder.js

@@ -1,4 +1,4 @@
-const FB_SOURCE = 'files';
+const FB_SOURCE = 'srv';
 
 function normalizePath(path) {
   const raw = String(path || '/').trim();
@@ -35,7 +35,7 @@ function getConfig() {
   return {
     url,
     token: process.env.FILEBROWSER_TOKEN || '',
-    clientRoot: normalizePath(process.env.FILEBROWSER_CLIENT_ROOT || '/fourgebranding/Clients'),
+    clientRoot: normalizePath(process.env.FILEBROWSER_CLIENT_ROOT || '/Clients'),
     configured: Boolean(url),
   };
 }

api/sync-profile-folder.js

@@ -1,4 +1,4 @@
-const FB_SOURCE = 'files';
+const FB_SOURCE = 'srv';
 const MEMBER_ROLES = new Set(['team', 'external']);
 
 function normalizePath(path) {
@@ -36,7 +36,7 @@ function getConfig() {
   return {
     url,
     token: process.env.FILEBROWSER_TOKEN || '',
-    membersRoot: normalizePath(process.env.FILEBROWSER_MEMBERS_ROOT || '/fourgebranding/Team'),
+    membersRoot: normalizePath(process.env.FILEBROWSER_MEMBERS_ROOT || '/Team'),
     configured: Boolean(url),
   };
 }

api/sync-project-folder.js

@@ -1,6 +1,6 @@
 import { createClient } from '@supabase/supabase-js';
 
-const FB_SOURCE = 'files';
+const FB_SOURCE = 'srv';
 
 function normalizePath(path) {
   const raw = String(path || '/').trim();
@@ -31,7 +31,7 @@ function getConfig() {
   return {
     url,
     token: process.env.FILEBROWSER_TOKEN || '',
-    clientRoot: normalizePath(process.env.FILEBROWSER_CLIENT_ROOT || '/fourgebranding/Clients'),
+    clientRoot: normalizePath(process.env.FILEBROWSER_CLIENT_ROOT || '/Clients'),
     configured: Boolean(url),
   };
 }

api/sync-task-folder.js

@@ -1,4 +1,4 @@
-const FB_SOURCE = 'files';
+const FB_SOURCE = 'srv';
 
 function normalizePath(path) {
   const raw = String(path || '/').trim();
@@ -29,7 +29,7 @@ function getConfig() {
   return {
     url,
     token: process.env.FILEBROWSER_TOKEN || '',
-    clientRoot: normalizePath(process.env.FILEBROWSER_CLIENT_ROOT || '/fourgebranding/Clients'),
+    clientRoot: normalizePath(process.env.FILEBROWSER_CLIENT_ROOT || '/Clients'),
     configured: Boolean(url),
   };
 }
@@ -100,6 +100,7 @@ export default async function handler(req, res) {
   await mkdir(config, taskDir);
   await mkdir(config, joinPath(taskDir, 'Working Files'));
   await mkdir(config, joinPath(taskDir, 'Request Info'));
+  await mkdir(config, joinPath(taskDir, 'Old Books'));
 
   res.status(200).json({ ok: true, type, company: record.company_name, project: record.project_name, task: record.title });
 }