add delete api endpoint with authentication

- Added Drive_remove() function to drive_server.ts using fctdrive remove command
- Created /api/delete route with POST method, JSON body input, and authentication
- Added development mode AUTH header bypass for testing authenticated endpoints
- Updated CLAUDE.md with API testing instructions using AUTH: 1 header
- Endpoint validates user authentication and upload permissions before deletion
- Returns success response even for non-existent files (CLI ignores them)

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <[email protected]>

4 files changed, 80 insertions, 1 deletions

diff --git a/CLAUDE.md b/CLAUDE.md
index f836602..3468c48 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -44,4 +44,8 @@
 - **Mobile**: Must be mobile-friendly
 - **Architecture**: Server-side rendering, modular reusable components
 - **Updates**: Manual refresh only (no real-time)
-- the server is running at `127.0.0.1:3000` and you can use curl to test the page
\ No newline at end of file
+- the server is running at `127.0.0.1:3000` and you can use curl to test the page
+
+## API Testing
+- For testing authenticated endpoints in development, use header `AUTH: 1`
+- Example: `curl -H "AUTH: 1" -H "Content-Type: application/json" -X POST localhost:3000/api/delete -d '{"path":"/file.txt"}'`
\ No newline at end of file
diff --git a/frontend/app/api/delete/route.ts b/frontend/app/api/delete/route.ts
new file mode 100644
index 0000000..b4a27d4
--- /dev/null
+++ b/frontend/app/api/delete/route.ts
@@ -0,0 +1,48 @@
+import { NextRequest, NextResponse } from 'next/server'
+import { Auth_get_user, Auth_user_can_upload } from '@/lib/auth'
+import { Drive_remove } from '@/lib/drive_server'
+import { revalidatePath } from 'next/cache'
+
+export async function POST(request: NextRequest) {
+  try {
+    // Check user authentication and permissions
+    const user = await Auth_get_user()
+    if (!user.isLoggedIn) {
+      return NextResponse.json({ error: 'User not authenticated' }, { status: 401 })
+    }
+
+    if (!Auth_user_can_upload(user)) {
+      return NextResponse.json({ error: 'User does not have upload permissions' }, { status: 403 })
+    }
+
+    // Parse JSON body
+    const body = await request.json()
+    const path = body.path
+
+    // Validate path
+    if (!path || typeof path !== 'string') {
+      return NextResponse.json({ error: 'Path is required and must be a string' }, { status: 400 })
+    }
+
+    // Remove file/directory using Drive_remove
+    await Drive_remove(path, user.email)
+
+    // Revalidate the parent directory to refresh listings
+    const parentPath = path.split('/').slice(0, -1).join('/') || '/'
+    revalidatePath(`/drive${parentPath}`)
+    revalidatePath('/drive')
+
+    return NextResponse.json({
+      success: true,
+      message: 'Path deleted successfully',
+      deletedPath: path
+    })
+
+  } catch (error) {
+    console.error('Delete error:', error)
+    return NextResponse.json(
+      { error: error instanceof Error ? error.message : 'Internal server error' },
+      { status: 500 }
+    )
+  }
+}
\ No newline at end of file
diff --git a/frontend/lib/auth.ts b/frontend/lib/auth.ts
index fe00b11..015fddf 100644
--- a/frontend/lib/auth.ts
+++ b/frontend/lib/auth.ts
@@ -30,6 +30,22 @@ export async function Auth_extract_session_cookie(): Promise<UserSessionCookie |
 }
 
 export async function Auth_get_user(): Promise<UserAuth> {
+  // Development mode bypass for testing with AUTH header
+  if (Env_is_development()) {
+    const { headers } = await import('next/headers');
+    const headersList = await headers();
+    if (headersList.get('AUTH') === '1') {
+      return {
+        isLoggedIn: true,
+        username: 'testuser',
+        name: 'Test User',
+        email: '[email protected]',
+        provider: 'dev',
+        oauth: false
+      };
+    }
+  }
+
   const cookie = await Auth_extract_session_cookie();
   const endpoint = Auth_tinyauth_endpoint();
 
diff --git a/frontend/lib/drive_server.ts b/frontend/lib/drive_server.ts
index 91c3cb4..eba2d5a 100644
--- a/frontend/lib/drive_server.ts
+++ b/frontend/lib/drive_server.ts
@@ -72,4 +72,15 @@ export async function Drive_blob_path(blob: string): Promise<string> {
     throw new Error(`fctdrive exited with code ${result.status}: ${result.stderr}`)
   }
   return result.stdout.trim();
+}
+
+/// removes the file or directory at the given path
+export async function Drive_remove(path: string, email: string) {
+  const result = spawnSync('fctdrive', ['remove', '--email', email, path], { encoding: 'utf-8' });
+  if (result.error) {
+    throw new Error(`Failed to execute fctdrive: ${result.error.message}`);
+  }
+  if (result.status !== 0) {
+    throw new Error(`fctdrive exited with code ${result.status}: ${result.stderr}`);
+  }
 }
\ No newline at end of file