feat(drive): Google Drive folder sync — backend (Phase 10)

[Jason-jo17]

Design / tracking issue: #99 — part of the Google Drive folder-sync feature.

What & why

Bring-your-own-OAuth Google Drive integration — part 1 of 3 (backend). Modelled on the existing Google Calendar link (lib/google-calendar.ts, secret-box, the per-member refresh-token column) but wired to core tables (folders/docs/attachments), so verify-core-only stays green. Adds schema + idempotent migration 0073 (drive_refresh_token + drive_folder_links + drive_file_mappings), lib/google-drive.ts (OAuth + Drive REST via googleapis, configurable scope), lib/drive-sync.ts (pull text→docs / binary→attachments+R2, push docs→.md, idempotent by md5/hash), routes/drive.ts (connect/callback/status/folders/links CRUD/sync/webhook), a BullMQ queue + worker, and optional GOOGLE_DRIVE_* env (routes 503 until configured).

Linked issue

No single issue — see below.

Stacked: merge this first — the frontend + docs PRs build on it. New dep googleapis was discussed/approved (Drive changes + resumable-upload surface).

Test evidence

@boppl/api typechecks clean (tsc --noEmit: 0 errors) and builds. Schema ↔ migration 0073 verified column-for-column (17/17, 12/12, + the token column) — no table mismatch. Live OAuth + sync needs an operator’s Google Cloud OAuth app + running stack (steps in docs/connect/drive.md, shipped in the docs PR); the @boppl/api test suite needs Postgres+Redis and runs in CI.

Checklist

• One logical change; matches the surrounding code style.
• Ran the relevant checks for what I touched (see Test evidence).
• Commits are signed off for the DCO (git commit -s).
• This is a core change — not enterprise-adjacent and not in the licensing/release machinery.
• I understand this PR is merged here on GitHub once approved (authorship + DCO preserved) and ships in the next tagged release.

[CLAassistant]

All committers have signed the CLA.

[nbkdoesntknowcoding]

Really solid backend — thank you. The security model is right: it mirrors our existing Google Calendar integration (AES-GCM-encrypted per-member refresh tokens, HMAC-signed OAuth state, editor-gated + workspace-scoped routes), and it correctly avoids SSRF by going through the googleapis SDK rather than fetching arbitrary URLs. That clears the bar we set after the OnlyOffice fix.

Two things to resolve before we merge:

1. The /api/drive/webhook endpoint is currently dead code — and it's public + unauthenticated. Nothing in the PR ever registers a Drive watch channel, so drive_channel_id is never written; the webhook's channel-id lookup can never match and it always 204s. It also never verifies DRIVE_WEBHOOK_SECRET (that env var is defined but unused). We don't want to ship a public unauthenticated endpoint that looks security-relevant but does nothing. Please either:

finish it — register the changes.watch channel on link creation, persist drive_channel_id, and verify the incoming DRIVE_WEBHOOK_SECRET/x-goog-* headers; or
drop it for this PR (remove the route, the DRIVE_WEBHOOK_SECRET env var, and the channel column) and keep the working poll/manual-sync path. We can add push-sync as a follow-up.
2. Please confirm the googleapis dependency is intended. It adds ~30 transitive packages to the API bundle. We're fine with it if it's deliberate — just want an explicit yes rather than it slipping in.

Smaller nits (non-blocking, fix if easy): the per-file sync loops swallow errors silently (catch { skipped++ }) — a req.log.warn there would help debugging; and attachments.format gets raw extensions (png, csv) where the rest of the code expects docx/pdf — worth normalizing.

[Jason-jo17]

Thanks for the thorough review — addressed in 03bc143.

1. Dropped the webhook. Removed the /api/drive/webhook route, its public auth-plugin exemption, the DRIVE_WEBHOOK_SECRET env var + driveWebhookSecret() helper, and the drive_channel_id / drive_channel_expires_at columns (plus the now-unused drive_page_token) from the schema and migration 0073. Also removed the dead changes-API helpers (listChanges / getStartPageToken / getFileParents). The working manual/poll sync path stays; live Drive push-sync is a clean follow-up.
2. googleapis — yes, deliberate. It's the intended dependency for the Drive changes + resumable-upload surface (vs. hand-rolling REST like the calendar client). Explicit 👍.

Nits: per-file sync errors now console.warn with link/file context; attachments.format is normalized — binaries are limited to docx/pdf (the formats the attachment pipeline models), other accepted types are skipped with a log, and the default accepted types are now text + docx/pdf.

@boppl/api typechecks clean and schema ↔ migration 0073 match column-for-column. Docs PR #98 is updated to match (webhook refs removed).