VYBECODEDDDDDDDDD

src/routes/delete.ts

@@ -0,0 +1,23 @@
+import { json, notFound } from "../http";
+import { log } from "../log";
+import { ID_PATTERN, KEY_PATTERN, secretMatches } from "../security";
+import type { Storage } from "../storage";
+
+export async function handleDelete(
+  req: Request,
+  storage: Storage,
+  rawId: string,
+): Promise<Response> {
+  if (!ID_PATTERN.test(rawId)) return notFound();
+
+  const meta = await storage.readMetadata(rawId);
+  if (!meta) return notFound();
+
+  const key = req.headers.get("x-delete-key");
+  if (!key || !KEY_PATTERN.test(key)) return notFound();
+  if (!secretMatches(meta.downloadKeyHash, key)) return notFound();
+
+  await storage.delete(rawId);
+  log("info", `deleted id=${rawId} name=${JSON.stringify(meta.originalName)}`);
+  return json({ ok: true });
+}