# BasyaDrop Web 2.0

BasyaDrop transfers files directly between modern browsers with reliable, ordered WebRTC DataChannels. It works device-to-device in any combination: computer to computer, phone to phone, tablet to computer, and more. A session owner can approve multiple devices at once; each device gets an independent peer connection, transfer queue, progress state, and acceptance controls. The small `/api/basya-drop` service exchanges only temporary pairing and WebRTC connection metadata. File contents never pass through or remain on the Basya Entertainment server.

## Use it

1. Open `/basya-drop/` on one device and choose **Send**.
2. Create a session and share the six-character code.
3. Open the same page on any other device, choose **Receive**, and enter the code.
4. Approve each device on the session owner.
5. Choose files in any connected browser. Every incoming file must be accepted before it transfers.

Sessions expire after 30 minutes. The app does not configure a TURN relay and never falls back to uploading files to a server. If a direct WebRTC connection is blocked by guest Wi-Fi isolation, a firewall, VPN, or browser policy, BasyaDrop reports the failure.

## Browser storage behavior

Browsers that support the File System Access API stream accepted files to the save location selected by the user. Other browsers hold the accepted file in memory until transfer completion, then present a **Save file** button. The UI warns before receiving a file larger than 512 MB through this fallback.

## Signaling service

`/api/basya-drop.js` uses `HOSTING_DATABASE_URL` and creates four temporary tables in the existing `BasyaHosting` schema. It stores session codes, hashed access tokens, device labels, WebRTC offers/answers/ICE candidates, and rate-limit attempts. It never accepts file bytes. Expired rows are removed opportunistically.

For a public deployment, serve the page over HTTPS. Vercel hosts the static frontend and REST signaling endpoint; WebRTC carries the files directly between browsers. For a fully offline LAN, use the separate BasyaDrop v1.2 Windows application instead.

## Local development

Run the Basya Entertainment site with its normal local server. A database-backed signaling endpoint is required for two-browser pairing; the static page alone can be inspected but cannot create sessions. Use separate browser profiles or an incognito window to test sender and receiver states.

## Security model

- Cryptographically random six-character session codes and long private session tokens.
- Explicit sender approval and explicit per-file receiver acceptance.
- WebRTC encrypted transport with public STUN discovery and no TURN relay.
- 30-minute expiry, origin checks, request size limits, and PIN-attempt rate limiting.
- Safe displayed/downloaded filenames and no arbitrary file-system access.