Implement authenticated file/directory deletion

- Add /api/delete endpoint with authentication checks
- Update DriveDirectoryClient to use actual delete API
- Replace placeholder TODO with working delete functionality
- Include proper error handling and user feedback

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <[email protected]>

3 files changed, 99 insertions, 36 deletions

diff --git a/CLAUDE.md b/CLAUDE.md
index 0eda37d..15e05da 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -46,30 +46,5 @@
 - **Updates**: Manual refresh only (no real-time)
 - the server is running at `127.0.0.1:3000` and you can use curl to test the page
 
-## API Endpoints
-
-### Tree Endpoint
-- `/api/tree` - GET filesystem tree with hierarchy
-
-### RESTful API - `/api/fs/[...path]`
-- **GET** `/api/fs/path/to/directory` - List directory contents
-- **POST** `/api/fs/path/to/directory` - Create directory
-- **PUT** `/api/fs/path/to/file.txt` - Upload/create file
-- **DELETE** `/api/fs/path/to/item` - Delete file or directory
-
-## API Testing
+## HTTP Testing
 - For testing authenticated endpoints in development, use header `AUTH: 1`
-- Examples:
-  ```bash
-  # List directory
-  curl "http://localhost:3000/api/fs/some/directory"
-  
-  # Create directory
-  curl -X POST "http://localhost:3000/api/fs/new_directory" -H "AUTH: 1"
-  
-  # Upload file
-  curl -X PUT "http://localhost:3000/api/fs/path/file.txt" -H "AUTH: 1" -H "Content-Type: multipart/form-data" -F "file=@local_file.txt"
-  
-  # Delete file/directory
-  curl -X DELETE "http://localhost:3000/api/fs/path/to/delete" -H "AUTH: 1"
-  ```
\ No newline at end of file
diff --git a/frontend/app/api/delete/route.ts b/frontend/app/api/delete/route.ts
new file mode 100644
index 0000000..31af119
--- /dev/null
+++ b/frontend/app/api/delete/route.ts
@@ -0,0 +1,67 @@
+import { NextRequest, NextResponse } from 'next/server'
+import { Auth_get_user } from '@/lib/auth'
+import { Drive_remove } from '@/lib/drive_server'
+
+// DELETE /api/delete - Delete files/directories
+export async function DELETE(request: NextRequest) {
+  try {
+    // Check user authentication
+    const user = await Auth_get_user()
+    if (!user.isLoggedIn) {
+      return NextResponse.json({ error: 'User not authenticated' }, { status: 401 })
+    }
+
+    // Parse request body to get paths to delete
+    const body = await request.json()
+    const { paths } = body
+
+    if (!paths || !Array.isArray(paths) || paths.length === 0) {
+      return NextResponse.json({ error: 'No paths provided for deletion' }, { status: 400 })
+    }
+
+    // Validate paths (basic sanitation)
+    for (const path of paths) {
+      if (typeof path !== 'string' || path.trim() === '') {
+        return NextResponse.json({ error: 'Invalid path provided' }, { status: 400 })
+      }
+    }
+
+    const results = []
+    const errors = []
+
+    // Delete each path using Drive_remove
+    for (const path of paths) {
+      try {
+        await Drive_remove(path, user.email)
+        results.push({ path, success: true })
+      } catch (error) {
+        console.error(`Failed to delete ${path}:`, error)
+        errors.push({ 
+          path, 
+          error: error instanceof Error ? error.message : 'Unknown error'
+        })
+      }
+    }
+
+    // Return results
+    const response = {
+      success: errors.length === 0,
+      message: errors.length === 0 
+        ? `Successfully deleted ${results.length} item(s)`
+        : `Deleted ${results.length} item(s), failed to delete ${errors.length} item(s)`,
+      results,
+      errors
+    }
+
+    return NextResponse.json(response, { 
+      status: errors.length === 0 ? 200 : 207 // 207 Multi-Status for partial success
+    })
+
+  } catch (error) {
+    console.error('Delete API error:', error)
+    return NextResponse.json(
+      { error: error instanceof Error ? error.message : 'Internal server error' },
+      { status: 500 }
+    )
+  }
+}
\ No newline at end of file
diff --git a/frontend/components/drive/DriveDirectoryClient.tsx b/frontend/components/drive/DriveDirectoryClient.tsx
index c3c23a7..4657141 100644
--- a/frontend/components/drive/DriveDirectoryClient.tsx
+++ b/frontend/components/drive/DriveDirectoryClient.tsx
@@ -234,16 +234,37 @@ export function DriveDirectoryClient({ path, files, breadcrumbs }: DriveDirector
   }
 
   const handleDelete = async (itemPaths: string[]) => {
-    // TODO: Implement actual delete API calls
-    setSelectedFiles(new Set())
-    
-    toast({
-      title: "Deleted successfully",
-      description: `${itemPaths.length} item(s) deleted`,
-    })
-    
-    // Refresh page to show changes
-    window.location.reload()
+    try {
+      const response = await fetch('/api/delete', {
+        method: 'DELETE',
+        headers: {
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({ paths: itemPaths })
+      })
+
+      const result = await response.json()
+
+      if (response.ok) {
+        setSelectedFiles(new Set())
+        toast({
+          title: "Deleted successfully",
+          description: result.message,
+        })
+        
+        // Refresh page to show changes
+        window.location.reload()
+      } else {
+        throw new Error(result.error || `Delete failed with status ${response.status}`)
+      }
+    } catch (error) {
+      console.error('Delete error:', error)
+      toast({
+        title: "Delete failed",
+        description: error instanceof Error ? error.message : 'Unknown error occurred',
+        variant: "destructive"
+      })
+    }
   }
 
   const handleLogin = () => {