fix: use refresh token flow for permanent Dropbox access

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/dropbox-proxy.js

@@ -1,8 +1,32 @@
-const DROPBOX_ACCESS_TOKEN = process.env.DROPBOX_ACCESS_TOKEN;
+const DROPBOX_APP_KEY = process.env.DROPBOX_APP_KEY;
+const DROPBOX_APP_SECRET = process.env.DROPBOX_APP_SECRET;
+const DROPBOX_REFRESH_TOKEN = process.env.DROPBOX_REFRESH_TOKEN;
+
+async function getAccessToken() {
+  const response = await fetch('https://api.dropboxapi.com/oauth2/token', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+    body: new URLSearchParams({
+      grant_type: 'refresh_token',
+      refresh_token: DROPBOX_REFRESH_TOKEN,
+      client_id: DROPBOX_APP_KEY,
+      client_secret: DROPBOX_APP_SECRET,
+    })
+  });
+  const data = await response.json();
+  if (!data.access_token) {
+    throw new Error('Failed to get access token: ' + JSON.stringify(data));
+  }
+  return data.access_token;
+}
 
 export default async function handler(req, res) {
-  if (!DROPBOX_ACCESS_TOKEN) {
+  let accessToken;
-    return res.status(500).json({ error: 'DROPBOX_ACCESS_TOKEN not configured' });
+  try {
+    accessToken = await getAccessToken();
+  } catch (err) {
+    console.error('Token refresh error:', err);
+    return res.status(500).json({ error: err.message });
   }
 
   if (req.method === 'GET' && req.query.info === '1') {
@@ -10,17 +34,13 @@ export default async function handler(req, res) {
       const fileInfo = await fetch('https://api.dropboxapi.com/2/files/get_metadata', {
         method: 'POST',
         headers: {
-          'Authorization': `Bearer ${DROPBOX_ACCESS_TOKEN}`,
+          'Authorization': `Bearer ${accessToken}`,
           'Content-Type': 'application/json'
         },
         body: JSON.stringify({ path: '/Data-Matrix.xlsx' })
       });
       const data = await fileInfo.json();
-      return res.json({
+      return res.json({ rev: data.rev, size: data.size, server_modified: data.server_modified });
-        rev: data.rev,
-        size: data.size,
-        server_modified: data.server_modified
-      });
     } catch (err) {
       return res.status(500).json({ error: err.message });
     }
@@ -30,7 +50,7 @@ export default async function handler(req, res) {
     const upstream = await fetch('https://content.dropboxapi.com/2/files/download', {
       method: 'POST',
       headers: {
-        'Authorization': `Bearer ${DROPBOX_ACCESS_TOKEN}`,
+        'Authorization': `Bearer ${accessToken}`,
         'Dropbox-API-Arg': JSON.stringify({ path: '/Data-Matrix.xlsx' })
       }
     });
@@ -42,7 +62,6 @@ export default async function handler(req, res) {
     }
 
     const buffer = await upstream.arrayBuffer();
-
     res.setHeader('Content-Type', 'application/octet-stream');
     res.setHeader('Cache-Control', 'no-store');
     res.send(Buffer.from(buffer));