fix: öffentlicher Share-Endpunkt getrennt, Passwort Pflicht + Generator, kein unbegrenzter Ablauf

backend/src/tools/dateien/public-share-public.js

@@ -0,0 +1,96 @@
+// Öffentliche Endpunkte für Datei/Ordner-Download (kein Login nötig)
+const express  = require('express');
+const bcrypt   = require('bcryptjs');
+const path     = require('path');
+const fs       = require('fs');
+const db       = require('../../db');
+const router   = express.Router();
+
+const UPLOAD_DIR = process.env.UPLOAD_DIR || '/data/uploads';
+
+function getShare(token) {
+  return db.prepare(`
+    SELECT s.*, f.name as file_name, f.size as file_size, f.mime_type, f.path as file_path,
+           fo.name as folder_name
+    FROM public_file_shares s
+    LEFT JOIN files f ON f.id = s.file_id
+    LEFT JOIN folders fo ON fo.id = s.folder_id
+    WHERE s.token=?
+  `).get(token);
+}
+
+function checkExpiry(s) {
+  return s.expires_at && s.expires_at < Math.floor(Date.now() / 1000);
+}
+
+// GET /:token – Metadaten (Name, Passwort nötig, abgelaufen?)
+router.get('/:token', (req, res) => {
+  const s = getShare(req.params.token);
+  if (!s) return res.status(404).json({ error: 'Link nicht gefunden' });
+  if (checkExpiry(s)) return res.status(410).json({ error: 'Link abgelaufen' });
+  res.json({
+    label: s.label,
+    file_name: s.file_name,
+    file_size: s.file_size,
+    mime_type: s.mime_type,
+    folder_name: s.folder_name,
+    is_folder: !!s.folder_id,
+    needs_password: !!s.password_hash,
+    expires_at: s.expires_at,
+  });
+});
+
+// POST /:token/download – Datei herunterladen
+router.post('/:token/download', async (req, res) => {
+  const s = getShare(req.params.token);
+  if (!s || !s.file_id) return res.status(404).json({ error: 'Nicht gefunden' });
+  if (checkExpiry(s)) return res.status(410).json({ error: 'Link abgelaufen' });
+  if (s.password_hash) {
+    const ok = await bcrypt.compare(req.body?.password || '', s.password_hash);
+    if (!ok) return res.status(403).json({ error: 'Falsches Passwort' });
+  }
+  const filePath = path.join(UPLOAD_DIR, s.file_path);
+  if (!fs.existsSync(filePath)) return res.status(404).json({ error: 'Datei nicht gefunden' });
+  db.prepare('UPDATE public_file_shares SET download_count = download_count + 1 WHERE id=?').run(s.id);
+  res.setHeader('Content-Disposition', `attachment; filename="${encodeURIComponent(s.file_name)}"`);
+  res.setHeader('Content-Type', s.mime_type || 'application/octet-stream');
+  fs.createReadStream(filePath).pipe(res);
+});
+
+// POST /:token/folder – Ordnerinhalt abrufen
+router.post('/:token/folder', async (req, res) => {
+  const s = getShare(req.params.token);
+  if (!s || !s.folder_id) return res.status(404).json({ error: 'Nicht gefunden' });
+  if (checkExpiry(s)) return res.status(410).json({ error: 'Link abgelaufen' });
+  if (s.password_hash) {
+    const ok = await bcrypt.compare(req.body?.password || '', s.password_hash);
+    if (!ok) return res.status(403).json({ error: 'Falsches Passwort' });
+  }
+  const files = db.prepare(`
+    SELECT id, name, size, mime_type, created_at FROM files
+    WHERE folder_id=? AND user_id=? ORDER BY name
+  `).all(s.folder_id, s.user_id);
+  db.prepare('UPDATE public_file_shares SET download_count = download_count + 1 WHERE id=?').run(s.id);
+  res.json({ folder_name: s.folder_name, files, token: s.token });
+});
+
+// POST /:token/folder/:fileId – Einzelne Datei aus Ordner
+router.post('/:token/folder/:fileId', async (req, res) => {
+  const s = getShare(req.params.token);
+  if (!s || !s.folder_id) return res.status(404).json({ error: 'Nicht gefunden' });
+  if (checkExpiry(s)) return res.status(410).json({ error: 'Link abgelaufen' });
+  if (s.password_hash) {
+    const ok = await bcrypt.compare(req.body?.password || '', s.password_hash);
+    if (!ok) return res.status(403).json({ error: 'Falsches Passwort' });
+  }
+  const file = db.prepare('SELECT * FROM files WHERE id=? AND folder_id=? AND user_id=?')
+    .get(req.params.fileId, s.folder_id, s.user_id);
+  if (!file) return res.status(404).json({ error: 'Datei nicht im freigegebenen Ordner' });
+  const filePath = path.join(UPLOAD_DIR, file.path);
+  if (!fs.existsSync(filePath)) return res.status(404).json({ error: 'Datei nicht gefunden' });
+  res.setHeader('Content-Disposition', `attachment; filename="${encodeURIComponent(file.name)}"`);
+  res.setHeader('Content-Type', file.mime_type || 'application/octet-stream');
+  fs.createReadStream(filePath).pipe(res);
+});
+
+module.exports = router;

backend/src/tools/dateien/public-share.js

@@ -49,6 +49,8 @@ router.get('/', authenticate, (req, res) => {
 router.post('/', authenticate, (req, res) => {
   const { file_id, folder_id, password, expires_hours, label } = req.body;
   if (!file_id && !folder_id) return res.status(400).json({ error: 'file_id oder folder_id erforderlich' });
+  if (!password) return res.status(400).json({ error: 'Passwort ist Pflicht' });
+  if (!expires_hours || expires_hours <= 0) return res.status(400).json({ error: 'Ablaufzeit ist Pflicht' });
 
   // Sicherstellen dass die Datei/Ordner dem User gehört
   if (file_id) {