Upload-Freigabe: öffentlicher Upload-Link mit Passwort, Ablaufzeit, max. Größe; Admin-Verwaltung

2026-06-05 20:01:52 +02:00
parent 8a5e8cc003
commit dd9a91b5d7
6 changed files with 647 additions and 12 deletions
--- a/backend/src/tools/dateien/upload-share.js
+++ b/backend/src/tools/dateien/upload-share.js
@@ -0,0 +1,183 @@
+const express  = require('express');
+const bcrypt   = require('bcryptjs');
+const crypto   = require('crypto');
+const multer   = require('multer');
+const path     = require('path');
+const fs       = require('fs');
+const db       = require('../../db');
+const { authenticate, requireAdmin } = require('../../middleware/auth');
+const router   = express.Router();
+
+const UPLOAD_DIR = process.env.UPLOAD_DIR || '/data/uploads';
+
+// ── Hilfsfunktionen ───────────────────────────────────────────────────────────
+function generateToken() {
+  return crypto.randomBytes(20).toString('base64url');
+}
+
+function getOrCreateUploadFolder(userId) {
+  let folder = db.prepare(
+    "SELECT * FROM folders WHERE user_id=? AND is_upload_folder=1 LIMIT 1"
+  ).get(userId);
+  if (!folder) {
+    const r = db.prepare(
+      "INSERT INTO folders (user_id, name, is_upload_folder, created_at) VALUES (?,?,1,datetime('now','localtime'))"
+    ).run(userId, 'Upload-Ordner');
+    folder = db.prepare('SELECT * FROM folders WHERE id=?').get(r.lastInsertRowid);
+  }
+  return folder;
+}
+
+function canUseUploadShare(userId) {
+  const user = db.prepare('SELECT role, allow_upload_share FROM users WHERE id=?').get(userId);
+  return user && (user.role === 'admin' || !!user.allow_upload_share);
+}
+
+// ── Eigene Shares verwalten ───────────────────────────────────────────────────
+router.get('/', authenticate, (req, res) => {
+  if (!canUseUploadShare(req.user.id)) return res.status(403).json({ error: 'Keine Berechtigung' });
+  const folder = getOrCreateUploadFolder(req.user.id);
+  const shares = db.prepare(`
+    SELECT s.*, COUNT(l.id) as upload_count
+    FROM upload_shares s
+    LEFT JOIN upload_share_logs l ON l.share_id=s.id
+    WHERE s.user_id=?
+    GROUP BY s.id
+    ORDER BY s.created_at DESC
+  `).all(req.user.id);
+  res.json({ shares, folder });
+});
+
+router.post('/', authenticate, (req, res) => {
+  if (!canUseUploadShare(req.user.id)) return res.status(403).json({ error: 'Keine Berechtigung' });
+  const { password, expires_hours=24, max_size_mb=10 } = req.body;
+  if (!password?.trim()) return res.status(400).json({ error: 'Passwort erforderlich' });
+  const folder  = getOrCreateUploadFolder(req.user.id);
+  const token   = generateToken();
+  const hash    = bcrypt.hashSync(password.trim(), 10);
+  const expires = new Date(Date.now() + Number(expires_hours) * 3600000).toISOString();
+  const r = db.prepare(`
+    INSERT INTO upload_shares (user_id, token, password_hash, expires_at, max_size_mb, folder_id, created_at)
+    VALUES (?,?,?,?,?,?,datetime('now','localtime'))
+  `).run(req.user.id, token, hash, expires, Number(max_size_mb), folder.id);
+  res.json(db.prepare('SELECT * FROM upload_shares WHERE id=?').get(r.lastInsertRowid));
+});
+
+router.delete('/:id', authenticate, (req, res) => {
+  const s = db.prepare('SELECT * FROM upload_shares WHERE id=? AND user_id=?').get(req.params.id, req.user.id);
+  if (!s) return res.status(404).json({ error: 'Nicht gefunden' });
+  db.prepare('UPDATE upload_shares SET is_active=0 WHERE id=?').run(s.id);
+  res.json({ ok: true });
+});
+
+router.get('/logs', authenticate, (req, res) => {
+  if (!canUseUploadShare(req.user.id)) return res.status(403).json({ error: 'Keine Berechtigung' });
+  const logs = db.prepare(`
+    SELECT l.*, s.expires_at, s.max_size_mb
+    FROM upload_share_logs l
+    JOIN upload_shares s ON s.id=l.share_id
+    WHERE l.user_id=?
+    ORDER BY l.uploaded_at DESC
+    LIMIT 100
+  `).all(req.user.id);
+  res.json(logs);
+});
+
+// ── Admin: alle Logs sehen ────────────────────────────────────────────────────
+router.get('/admin/logs', authenticate, requireAdmin, (req, res) => {
+  const logs = db.prepare(`
+    SELECT l.*, s.expires_at, s.max_size_mb, u.username
+    FROM upload_share_logs l
+    JOIN upload_shares s ON s.id=l.share_id
+    JOIN users u ON u.id=l.user_id
+    ORDER BY l.uploaded_at DESC
+    LIMIT 500
+  `).all();
+  res.json(logs);
+});
+
+router.get('/admin/shares', authenticate, requireAdmin, (req, res) => {
+  const shares = db.prepare(`
+    SELECT s.*, u.username, COUNT(l.id) as upload_count
+    FROM upload_shares s
+    JOIN users u ON u.id=s.user_id
+    LEFT JOIN upload_share_logs l ON l.share_id=s.id
+    GROUP BY s.id
+    ORDER BY s.created_at DESC
+  `).all();
+  res.json(shares);
+});
+
+// ── Admin: Berechtigung pro User setzen ──────────────────────────────────────
+router.post('/admin/permission', authenticate, requireAdmin, (req, res) => {
+  const { user_id, allow } = req.body;
+  db.prepare('UPDATE users SET allow_upload_share=? WHERE id=?').run(allow?1:0, user_id);
+  res.json({ ok: true });
+});
+
+// ── Öffentlicher Endpunkt: Infos zum Share ────────────────────────────────────
+router.get('/public/:token', (req, res) => {
+  const s = db.prepare(
+    "SELECT id, expires_at, max_size_mb, is_active FROM upload_shares WHERE token=?"
+  ).get(req.params.token);
+  if (!s || !s.is_active) return res.status(404).json({ error: 'Link ungültig oder deaktiviert' });
+  if (new Date(s.expires_at) < new Date()) return res.status(410).json({ error: 'Link abgelaufen' });
+  res.json({ ok: true, max_size_mb: s.max_size_mb, expires_at: s.expires_at });
+});
+
+// ── Öffentlicher Endpunkt: Passwort prüfen ────────────────────────────────────
+router.post('/public/:token/verify', (req, res) => {
+  const s = db.prepare('SELECT * FROM upload_shares WHERE token=?').get(req.params.token);
+  if (!s || !s.is_active) return res.status(404).json({ error: 'Link ungültig' });
+  if (new Date(s.expires_at) < new Date()) return res.status(410).json({ error: 'Link abgelaufen' });
+  if (!bcrypt.compareSync(req.body.password || '', s.password_hash))
+    return res.status(401).json({ error: 'Falsches Passwort' });
+  res.json({ ok: true, max_size_mb: s.max_size_mb, expires_at: s.expires_at });
+});
+
+// ── Öffentlicher Upload ───────────────────────────────────────────────────────
+router.post('/public/:token/upload', (req, res) => {
+  const s = db.prepare('SELECT * FROM upload_shares WHERE token=?').get(req.params.token);
+  if (!s || !s.is_active) return res.status(404).json({ error: 'Link ungültig' });
+  if (new Date(s.expires_at) < new Date()) return res.status(410).json({ error: 'Link abgelaufen' });
+
+  // Passwort im Header prüfen
+  const pw = req.headers['x-upload-password'] || '';
+  if (!bcrypt.compareSync(pw, s.password_hash))
+    return res.status(401).json({ error: 'Nicht autorisiert' });
+
+  const maxBytes = s.max_size_mb * 1024 * 1024;
+  const storage  = multer.diskStorage({ destination: UPLOAD_DIR });
+  const upload   = multer({
+    storage,
+    limits: { fileSize: maxBytes },
+  }).single('file');
+
+  upload(req, res, err => {
+    if (err) {
+      if (err.code === 'LIMIT_FILE_SIZE')
+        return res.status(413).json({ error: `Datei zu groß (max ${s.max_size_mb} MB)` });
+      return res.status(500).json({ error: err.message });
+    }
+    if (!req.file) return res.status(400).json({ error: 'Keine Datei' });
+
+    try {
+      const r = db.prepare(`
+        INSERT INTO files (user_id, filename, originalname, mimetype, size, folder_id, created_at)
+        VALUES (?,?,?,?,?,?,datetime('now','localtime'))
+      `).run(s.user_id, req.file.filename, req.file.originalname, req.file.mimetype, req.file.size, s.folder_id);
+
+      db.prepare(`
+        INSERT INTO upload_share_logs (share_id, user_id, originalname, size, ip_address, uploaded_at)
+        VALUES (?,?,?,?,?,datetime('now','localtime'))
+      `).run(s.id, s.user_id, req.file.originalname, req.file.size, req.ip || '');
+
+      res.json({ ok: true, filename: req.file.originalname });
+    } catch(e) {
+      try { fs.unlinkSync(path.join(UPLOAD_DIR, req.file.filename)); } catch {}
+      res.status(500).json({ error: e.message });
+    }
+  });
+});
+
+module.exports = router;