---

const FOLDER_NAME = 'Listate CRM — исходный код';
const NAME_PATTERN = /^listate-crm-[0-9A-Za-z._-]+$/;
const MAX_BYTES = 50 * 1024 * 1024;

function doPost(e) {
  const props = PropertiesService.getScriptProperties();

  let request;
  try {
    request = JSON.parse(e.postData.contents);
  } catch (err) {
    return reply('bad-request');
  }
  if (!request.token || request.token !== props.getProperty('TOKEN')) {
    return reply('forbidden');
  }

  const files = request.files || [];
  const blobs = [];
  for (const file of files) {
    if (!NAME_PATTERN.test(file.name)) return reply('bad-name');
    const bytes = Utilities.base64Decode(file.data);
    if (bytes.length > MAX_BYTES) return reply('too-big');
    blobs.push(Utilities.newBlob(bytes, 'application/octet-stream', file.name));
  }

  const folder = DriveApp.getFolderById(props.getProperty('FOLDER_ID'));
  const saved = blobs.map((blob) => folder.createFile(blob).getName());
  return reply('ok', saved);
}

// Запускается один раз руками: создаёт папку и пароль.
function setup() {
  const props = PropertiesService.getScriptProperties();
  if (!props.getProperty('FOLDER_ID')) {
    props.setProperty('FOLDER_ID', DriveApp.createFolder(FOLDER_NAME).getId());
  }
  if (!props.getProperty('TOKEN')) {
    props.setProperty('TOKEN', Utilities.getUuid() + Utilities.getUuid());
  }
  Logger.log('Пароль для разработчика: ' + props.getProperty('TOKEN'));
}

function reply(status, files) {
  return ContentService
    .createTextOutput(JSON.stringify({ status: status, files: files || [] }))
    .setMimeType(ContentService.MimeType.JSON);
}