Code.gs

/**
 * docdrop — append-only Google Docs endpoint.
 * Deploy as a Web App (execute as: Me, access: Anyone) and POST to the /exec URL.
 */

const SECRET = "change-me";   // shared secret — set your own, rotate any time by redeploying
const FOLDER_ID = "";         // optional: Drive folder ID; if set, only docs inside it are writable

function doPost(e) {
  try {
    const req = JSON.parse(e.postData.contents);

    if (req.secret !== SECRET) {
      return json({ ok: false, error: "bad secret" });
    }
    if (!req.docId || !req.text) {
      return json({ ok: false, error: "docId and text are required" });
    }
    if (FOLDER_ID && !inFolder(req.docId, FOLDER_ID)) {
      return json({ ok: false, error: "doc is not in the allowed folder" });
    }

    const doc = DocumentApp.openById(req.docId);
    doc.getBody().appendParagraph(req.text);
    doc.saveAndClose();

    return json({ ok: true, action: "append", docId: req.docId, chars: req.text.length });
  } catch (err) {
    return json({ ok: false, error: String(err) });
  }
}

function inFolder(docId, folderId) {
  const parents = DriveApp.getFileById(docId).getParents();
  while (parents.hasNext()) {
    if (parents.next().getId() === folderId) return true;
  }
  return false;
}

function json(obj) {
  return ContentService
    .createTextOutput(JSON.stringify(obj))
    .setMimeType(ContentService.MimeType.JSON);
}