From 295f9d306091692e67c6c67a737db13dfff49661 Mon Sep 17 00:00:00 2001
From: Christian Vidal Wolf <christianvidalwolf@gmail.com>
Date: Thu, 21 May 2026 10:25:45 +0200
Subject: [PATCH] fix(dropbox): use authenticated API to bypass CDN cache on
 file download

The proxy was calling getAccessToken() but discarding the result, then
downloading via the public sharing link which is CDN-cached. Updated
data in Dropbox could take minutes/hours to propagate through the CDN,
causing all fields in the Matrix view to show stale values.

Now attempts download via /2/sharing/get_shared_link_file with Bearer
auth (no CDN cache), falling back to the sharing link if credentials
are not configured.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
---
 api/dropbox-proxy.js | 51 +++++++++++++++++++++++++++++++++-----------
 1 file changed, 39 insertions(+), 12 deletions(-)

diff --git a/api/dropbox-proxy.js b/api/dropbox-proxy.js
index a7599af..755d6c9 100644
--- a/api/dropbox-proxy.js
+++ b/api/dropbox-proxy.js
@@ -42,12 +42,6 @@ export default async function handler(req, res) {
     return res.status(403).json({ error: 'Forbidden' });
   }
 
-  try {
-    await getAccessToken();
-  } catch (err) {
-    console.warn('Token refresh optional failure (sharing link might still work):', err.message);
-  }
-
   if (req.method === 'GET' && req.query.info === '1') {
     res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
     res.setHeader('Pragma', 'no-cache');
@@ -55,17 +49,50 @@ export default async function handler(req, res) {
     return res.json({ rev: 'new-url-v1', size: 0, server_modified: new Date().toISOString() });
   }
 
+  // Strip dl=1 for the authenticated API call (browser-redirect hint, not needed for API).
+  const sharingUrlForApi = DROPBOX_SHARED_URL.replace(/[&?]dl=1/, '');
+
+  // Try authenticated Dropbox API first — bypasses CDN cache so we always get the latest version.
+  // Falls back to DROPBOX_SHARED_URL if credentials are not configured.
+  let upstream = null;
+  let usedAuth = false;
+
   try {
-    const upstream = await fetch(DROPBOX_SHARED_URL, {
-      method: 'GET',
+    const accessToken = await getAccessToken();
+    const apiRes = await fetch('https://content.dropboxapi.com/2/sharing/get_shared_link_file', {
+      method: 'POST',
       headers: {
-        'Cache-Control': 'no-cache',
-        'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36'
-      }
+        'Authorization': `Bearer ${accessToken}`,
+        'Dropbox-API-Arg': JSON.stringify({ url: sharingUrlForApi }),
+        'Content-Type': 'text/plain; charset=utf-8',
+      },
     });
+    if (apiRes.ok) {
+      upstream = apiRes;
+      usedAuth = true;
+      console.log('Dropbox: downloaded via authenticated API (no CDN cache)');
+    } else {
+      const errText = await apiRes.text();
+      console.warn('Dropbox API download failed, falling back to sharing link:', apiRes.status, errText.substring(0, 200));
+    }
+  } catch (authErr) {
+    console.warn('Dropbox auth unavailable, falling back to sharing link:', authErr.message);
+  }
+
+  try {
+    if (!upstream) {
+      upstream = await fetch(DROPBOX_SHARED_URL, {
+        method: 'GET',
+        headers: {
+          'Cache-Control': 'no-cache',
+          'Pragma': 'no-cache',
+          'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36'
+        }
+      });
+    }
 
     const contentType = upstream.headers.get('content-type');
-    if (contentType && contentType.includes('text/html')) {
+    if (!usedAuth && contentType && contentType.includes('text/html')) {
       console.error('Dropbox returned HTML instead of file');
       return res.status(500).send('Error: El enlace de Dropbox ha devuelto una página HTML en lugar del archivo. Es probable que el enlace haya caducado o necesite ser renovado.');
     }