feat: calendario bajo Social, SEO/GEO con datos live, Drive = 03-Clientes

Calendario editorial anidado en Social; Orgánico con queries/páginas GSC y landings GA4 + dashboard GEO; Biblioteca enlazada a la carpeta real del cliente bajo 03-Clientes (no carpetas homónimas); previews Ads solo en Meta/Google.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/app/api/assets/drive/route.ts

@@ -3,8 +3,11 @@ import { createClient } from '@/lib/supabase/server';
 import { isAgencyRole, userRole } from '@/lib/agency';
 import { resolveActiveTenant } from '@/lib/tenant-context';
 import {
+  findClientesRootFolder,
   getDriveDownloadUrl,
+  getDriveFileMeta,
   getTenantDriveFolderId,
+  isUnderDriveFolder,
   listFilesInFolder,
 } from '@/lib/google-drive';
 
@@ -12,7 +15,7 @@ export const dynamic = 'force-dynamic';
 
 const FOLDER_MIME = 'application/vnd.google-apps.folder';
 
-/** GET — list Drive files for tenant folder (browse with ?folderId=). */
+/** GET — exact replica of the tenant's Drive folder tree (under Clientes). */
 export async function GET(req: NextRequest) {
   const supabase = await createClient();
   const {
@@ -35,6 +38,20 @@ export async function GET(req: NextRequest) {
   const downloadId = req.nextUrl.searchParams.get('download')?.trim();
   if (downloadId) {
     try {
+      const link = await getTenantDriveFolderId(ctx.tenantId);
+      if (!link) {
+        return NextResponse.json(
+          { error: 'Sin carpeta Drive del cliente' },
+          { status: 400 }
+        );
+      }
+      const ok = await isUnderDriveFolder(downloadId, link.folderId);
+      if (!ok) {
+        return NextResponse.json(
+          { error: 'Archivo fuera de la carpeta del cliente' },
+          { status: 403 }
+        );
+      }
       const url = await getDriveDownloadUrl(downloadId);
       return NextResponse.json({ url });
     } catch (e) {
@@ -51,14 +68,45 @@ export async function GET(req: NextRequest) {
       files: [],
       linked: false,
       warning:
-        'Sin carpeta Drive enlazada. Conecta marketing@ en Agencia y ejecuta auto-match bajo «Clientes».',
+        'Sin carpeta Drive del cliente. En Agencia → auto-match bajo la carpeta «Clientes».',
     });
   }
 
+  // Soft check: linked folder should live under «Clientes»
+  let scopeWarning: string | null = null;
+  try {
+    const clientes = await findClientesRootFolder();
+    if (clientes) {
+      const ok = await isUnderDriveFolder(link.folderId, clientes.id);
+      if (!ok) {
+        scopeWarning = `La carpeta enlazada («${link.folderName || link.folderId}») no está dentro de «Clientes». Rematch en Agencia.`;
+      }
+    }
+  } catch {
+    /* ignore */
+  }
+
   const requested = req.nextUrl.searchParams.get('folderId')?.trim();
-  const folderId = requested || link.folderId;
+  let folderId = link.folderId;
+
+  if (requested && requested !== link.folderId) {
+    const allowed = await isUnderDriveFolder(requested, link.folderId);
+    if (!allowed) {
+      return NextResponse.json(
+        {
+          error:
+            'Carpeta fuera del árbol del cliente. Solo se permite navegar dentro de su carpeta en Clientes.',
+          rootFolderId: link.folderId,
+          folderName: link.folderName,
+        },
+        { status: 403 }
+      );
+    }
+    folderId = requested;
+  }
 
   try {
+    const currentMeta = await getDriveFileMeta(folderId);
     const files = await listFilesInFolder(folderId);
     const mapped = files
       .map((f) => ({
@@ -79,22 +127,22 @@ export async function GET(req: NextRequest) {
     return NextResponse.json({
       linked: true,
       rootFolderId: link.folderId,
+      rootFolderName: link.folderName,
       folderId,
-      folderName: link.folderName,
+      folderName: currentMeta?.name || link.folderName,
       driveOpenUrl: `https://drive.google.com/drive/folders/${encodeURIComponent(folderId)}`,
-      embedPossible: false,
-      embedHint:
-        'Réplica vía API (misma carpeta Clientes del cliente). Embed iframe de Drive exige carpeta pública; usamos listado nativo + Abrir en Drive.',
       files: mapped,
+      warning: scopeWarning,
     });
   } catch (e) {
     return NextResponse.json({
       linked: true,
       rootFolderId: link.folderId,
+      rootFolderName: link.folderName,
       folderId,
       folderName: link.folderName,
       files: [],
-      warning: e instanceof Error ? e.message : 'Drive error',
+      warning: scopeWarning || (e instanceof Error ? e.message : 'Drive error'),
     });
   }
 }