feat(05-05): implement cloud.py — all 7 cloud connection management endpoints
- GET /api/cloud/oauth/initiate/{provider}: generates state token (secrets.token_urlsafe(32)),
stores in Redis with TTL 1800, redirects to Google Drive or OneDrive OAuth URL
- GET /api/cloud/oauth/callback/{provider}: validates state (single-use Redis key), exchanges
code for tokens, encrypts credentials, upserts CloudConnection, audit log, redirects to
{settings.frontend_url}/settings?cloud_connected={provider}; on error redirects with cloud_error=
- POST /api/cloud/connections/webdav: SSRF validates URL, tests health_check, encrypts creds,
upserts CloudConnection, returns CloudConnectionOut (credentials_enc excluded)
- GET /api/cloud/connections: returns {"items": [CloudConnectionOut]} — credentials_enc never exposed
- DELETE /api/cloud/connections/{connection_id}: returns 404 for wrong-owner (prevents enumeration)
- GET /api/cloud/folders/{provider}/{folder_id}: TTL-cached folder listing via get_cloud_folders_cached
- PATCH /api/users/me/default-storage: updates User.default_storage_backend
- _call_cloud_op helper: transparent token refresh + REQUIRES_REAUTH on invalid_grant
- All endpoints use Depends(get_regular_user) — admin gets 403 (D-18, D-19)
curo1305
2424f52eee