fourge-portal/api/archive-orphan-folders.js

import { createClient } from '@supabase/supabase-js';

const FB_SOURCE = 'srv';

function normalizePath(path) {
  const raw = String(path || '/').trim();
  const parts = raw.split('/').filter(Boolean);
  const clean = [];
  for (const part of parts) {
    if (part === '.') continue;
    if (part === '..') throw new Error('Invalid path');
    clean.push(part);
  }
  return `/${clean.join('/')}`;
}

function joinPath(...parts) {
  return normalizePath(parts.join('/'));
}

function safeName(value) {
  return String(value || '')
    .trim()
    .replace(/[\\/:*?"<>|#%{}^~[\]`]+/g, '-')
    .replace(/\s+/g, ' ')
    .replace(/^-+|-+$/g, '');
}

function basename(path) {
  const parts = normalizePath(path).split('/').filter(Boolean);
  return parts[parts.length - 1] || '';
}

function getFbConfig() {
  const url = String(process.env.FILEBROWSER_URL || '').trim().replace(/\/+$/, '');
  return {
    url,
    token: process.env.FILEBROWSER_TOKEN || '',
    teamRoot: normalizePath(process.env.FILEBROWSER_TEAM_ROOT || '/Team'),
    clientRoot: normalizePath(process.env.FILEBROWSER_CLIENT_ROOT || '/Clients'),
    archiveRoot: normalizePath(process.env.FILEBROWSER_ARCHIVE_ROOT || '/Archive'),
    configured: Boolean(url) && Boolean(process.env.FILEBROWSER_TOKEN),
  };
}

async function fbFetch(config, method, endpoint, { params = {}, headers = {}, body } = {}) {
  const qs = new URLSearchParams({ source: FB_SOURCE, ...params }).toString();
  const res = await fetch(`${config.url}${endpoint}?${qs}`, {
    method,
    headers: { Authorization: `Bearer ${config.token}`, ...headers },
    body,
  });
  if (!res.ok) {
    const text = await res.text();
    const err = new Error(text || `FileBrowser ${res.status}`);
    err.status = res.status;
    throw err;
  }
  const text = await res.text();
  try { return text ? JSON.parse(text) : null; } catch { return text; }
}

async function fbExists(config, path) {
  try { await fbFetch(config, 'GET', '/api/resources', { params: { path } }); return true; }
  catch (e) { if (e.status === 404) return false; throw e; }
}

async function fbMkdir(config, path) {
  await fbFetch(config, 'POST', '/api/resources', { params: { path, isDir: 'true' } }).catch(() => {});
}

async function listFolders(config, path) {
  try {
    const data = await fbFetch(config, 'GET', '/api/resources', { params: { path } });
    return (data?.folders || []).map(f => f.name).filter(Boolean);
  } catch (e) {
    if (e.status === 404) return [];
    throw e;
  }
}

async function mergeMove(config, fbSrc, fbDstParent) {
  const name = basename(fbSrc);
  const fbDst = joinPath(fbDstParent, name);
  const destExists = await fbExists(config, fbDst);
  if (!destExists) {
    await fbFetch(config, 'PATCH', '/api/resources', {
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({
        action: 'move',
        items: [{ fromSource: FB_SOURCE, fromPath: fbSrc, toSource: FB_SOURCE, toPath: fbDst }],
        overwrite: false,
      }),
    });
    return;
  }

  const data = await fbFetch(config, 'GET', '/api/resources', { params: { path: fbSrc } });
  const dirs = (data?.folders || []).map(f => f.name);
  const files = (data?.files || []).map(f => f.name);
  await fbMkdir(config, fbDst);
  for (const dir of dirs) await mergeMove(config, joinPath(fbSrc, dir), fbDst);
  for (const file of files) {
    await fbFetch(config, 'PATCH', '/api/resources', {
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({
        action: 'move',
        items: [{ fromSource: FB_SOURCE, fromPath: joinPath(fbSrc, file), toSource: FB_SOURCE, toPath: joinPath(fbDst, file) }],
        overwrite: true,
      }),
    }).catch(() => {});
  }
  await fbFetch(config, 'DELETE', '/api/resources', { params: { path: fbSrc } }).catch(() => {});
}

function json(res, status, body) {
  return res.status(status).json(body);
}

export default async function handler(req, res) {
  if (req.method !== 'POST') return json(res, 405, { error: 'Method not allowed' });

  const secret = process.env.SUPABASE_WEBHOOK_SECRET;
  if (secret) {
    const incoming = req.headers['x-webhook-secret'] || '';
    if (incoming.trim() !== secret.trim()) return json(res, 401, { error: 'Unauthorized' });
  }

  const supabaseUrl = process.env.VITE_SUPABASE_URL || process.env.SUPABASE_URL;
  const serviceRoleKey = process.env.SUPABASE_SERVICE_ROLE_KEY;
  if (!supabaseUrl || !serviceRoleKey) return json(res, 500, { error: 'Supabase env not configured' });

  const admin = createClient(supabaseUrl, serviceRoleKey, {
    auth: { persistSession: false, autoRefreshToken: false },
  });

  const config = getFbConfig();
  if (!config.configured) return json(res, 200, { ok: true, skipped: 'FileBrowser not configured' });

  const results = {
    archivedTeamFolders: [],
    archivedProjectFolders: [],
    errors: [],
  };

  await fbMkdir(config, config.archiveRoot);
  await fbMkdir(config, joinPath(config.archiveRoot, 'Team'));
  await fbMkdir(config, joinPath(config.archiveRoot, 'Clients'));

  const { data: profiles, error: profilesError } = await admin
    .from('profiles')
    .select('name, role')
    .in('role', ['team', 'external']);
  if (profilesError) return json(res, 500, { error: profilesError.message });

  const validTeamFolders = new Set((profiles || []).map(profile => safeName(profile.name)).filter(Boolean));
  const teamFolders = await listFolders(config, config.teamRoot);
  for (const folder of teamFolders) {
    if (validTeamFolders.has(folder)) continue;
    try {
      await mergeMove(config, joinPath(config.teamRoot, folder), joinPath(config.archiveRoot, 'Team'));
      results.archivedTeamFolders.push(folder);
    } catch (e) {
      results.errors.push(`team:${folder}: ${e.message}`);
    }
  }

  const { data: companies, error: companiesError } = await admin
    .from('companies')
    .select('id, name');
  if (companiesError) return json(res, 500, { error: companiesError.message });

  const { data: projects, error: projectsError } = await admin
    .from('projects')
    .select('name, company_id');
  if (projectsError) return json(res, 500, { error: projectsError.message });

  const projectsByCompany = new Map();
  for (const project of projects || []) {
    if (!project?.company_id || !project?.name) continue;
    const key = project.company_id;
    if (!projectsByCompany.has(key)) projectsByCompany.set(key, new Set());
    projectsByCompany.get(key).add(safeName(project.name));
  }

  for (const company of companies || []) {
    const companyFolder = safeName(company.name);
    if (!companyFolder) continue;
    const validProjects = projectsByCompany.get(company.id) || new Set();
    const projectsRoot = joinPath(config.clientRoot, companyFolder, 'Projects');
    const projectFolders = await listFolders(config, projectsRoot);

    await fbMkdir(config, joinPath(config.archiveRoot, 'Clients', companyFolder));
    await fbMkdir(config, joinPath(config.archiveRoot, 'Clients', companyFolder, 'Projects'));

    for (const folder of projectFolders) {
      if (validProjects.has(folder)) continue;
      try {
        await mergeMove(
          config,
          joinPath(projectsRoot, folder),
          joinPath(config.archiveRoot, 'Clients', companyFolder, 'Projects'),
        );
        results.archivedProjectFolders.push(`${companyFolder}/${folder}`);
      } catch (e) {
        results.errors.push(`project:${companyFolder}/${folder}: ${e.message}`);
      }
    }
  }

  return json(res, 200, { ok: true, ...results });
}