timet 1.6.3 → 1.6.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 84fa974afe30946a8b292569e74917c3992097e0ae652339320981f2951f298d
-  data.tar.gz: dc6cf2d3f5bd30feebb93db4aa07c436203e53bf1d9d0dbba5166695b622b021
+  metadata.gz: b43ddbb0c2a4744c09fede5bbe507ea736a9690daebf6cbccba07d427fcd929c
+  data.tar.gz: 9b90a62f2e4cc6c7ee089510ca9c1a023c8f35a22164fa1837140109c1cdda77
 SHA512:
-  metadata.gz: 49cf7cc38f9e44687d27bee93a8de5678963fd92a9589241e38635afcdf4b86f8229d1c401483d2d6e955ee83e5423ca10f832f4beb0101873e60f5d0ff34821
-  data.tar.gz: 2098f1a3c297277bd07425961b3e84425a1189ae5984e21c35649a3a2c517a5a175dfd5b477abb59ba49f78925a9c4ec872006d3be025ddc4ee363bf86ff7004
+  metadata.gz: dbbcb0cf64a60c26147145f010d7213782b25fe627136e4ed1827e41e4c90748b413d8de5877540cab93cde39f1eb4b093df33bc28da8e8d20d67e894a96c5ab
+  data.tar.gz: 927452644bc0201d87343845193b46481f20b836d8d197fd7b42ebbaed1a42b835deba4352af8ec5e25c81df62e800e772ab66f53dc9d31cc5e250dba61120bf

data/.rubocop.yml

@@ -6,9 +6,14 @@ AllCops:
     - timet.gemspec
     - "vendor/**/*" # Exclude vendor/bundle gems
 
+Naming/PredicateMethod:
+  Exclude:
+    - 'lib/timet/database_syncer.rb'
+
 Metrics/ModuleLength:
   Exclude:
     - 'lib/timet/tag_distribution.rb'
+    - 'lib/timet/database_syncer.rb'
 
 Metrics/MethodLength:
   Max: 15

data/CHANGELOG.md

@@ -1,3 +1,35 @@
+## [1.6.5] - 2026-08-01
+
+**Improvements:**
+
+- **Documentation:** Expanded `README.md` with detailed setup instructions for Supabase S3-compatible storage, environment variable configuration, and usage of the `timet sync` command.
+- **Dependencies:** Updated locked gem dependencies in `Gemfile.lock` including `aws-sdk`, `rubocop`, `sqlite3`, `json`, and `rake`.
+
+**Bug Fixes & Security:**
+
+- **Security Patches:** Resolved multiple security vulnerabilities by updating locked gem versions:
+  - `addressable` (`>= 2.9.0`): Addressed ReDoS vulnerability in Addressable templates ([CVE-2026-35611](https://github.com/sporkmonger/addressable/security/advisories/GHSA-h27x-rffw-24p4)).
+  - `json` (`>= 2.19.9`): Fixed heap buffer overflow when streaming to IO ([CVE-2026-54696](https://nvd.nist.gov/vuln/detail/CVE-2026-54696)).
+  - `mcp` (`>= 0.23.0`): Resolved SSE stream hijacking, session poisoning, memory exhaustion, and DNS-rebinding protection issues ([CVE-2026-33946](https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-qvqr-5cv7-wh35)).
+  - `sqlite3` (`>= 2.9.5`): Patched Use-After-Free vulnerabilities when redefining functions and in aggregate callbacks ([CVE-2026-54619](https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-54619), [CVE-2026-54620](https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-54620)).
+
+## [1.6.4] - 2026-03-26
+
+**Improvements:**
+
+- **Database Synchronization:** Refactored sync logic to use bidirectional comparison with timestamp-based conflict resolution, improving reliability during database merges.
+- **Dependencies:** Updated `icalendar` to `~> 2.12.2` and `json` to `~> 2.19`, removing unused gems.
+- **Code Quality:** Added RuboCop exclusions for predicate methods in `DatabaseSyncer` and module length for `database_syncer.rb`.
+- **Test Coverage:** Expanded test suite for bidirectional sync scenarios, including conflict resolution and remote item handling.
+
+**Bug Fixes:**
+- Fix validation editor spec to properly stub database update
+
+- **Sync Logic:** Fixed item synchronization to properly handle local-only and remote-only items with timestamp-based decision making.
+- **Database Updates:** Corrected `update_item_from_hash` method to properly bind ID parameter in SQL queries.
+- **Conflict Resolution:** Simplified remote wins logic to compare timestamps directly, removing redundant deleted flag checks.
+- **Sync Flagging:** Fixed return values in sync methods to accurately track whether local changes occurred during synchronization.
+
 ## [1.6.3] - 2026-02-28
 
 **Improvements:**

data/README.md

@@ -251,7 +251,7 @@ Once configured, Timet will automatically send a notification to your Discord ch
 | `timet su [start_date]..[end_date]`              | Display a report of tracked time for a date range.                     | `timet su 2024-01-02..2024-01-03` |
 | `timet resume (r) [id]`                          | Resume tracking a task by ID or the last completed task.               | `timet resume [id]`               |
 | `timet resume (r) [id] --pomodoro=[minutes]`     | Resume tracking with a Pomodoro timer.                                 | `timet resume 1 --pomodoro=25`    |
-| `timet sync`                                     | Sync local db with remote (S3) external db                             | `timet sync`                      |
+| `timet sync`                                     | Sync local database with S3 storage (bidirectional sync).              | `timet sync`                      |
 | `timet version`                                  | Display the current version.                                           | `timet version`                   |
 
 ### Date Range in Summary
@@ -260,18 +260,47 @@ The `timet summary` command now supports specifying a date range for generating
 
 #### Examples:
 
-- **Single Date:** Display a report for a specific date.
+- **Single Date**: Display a report for a specific date.
 
   ```sh
   timet su 2024-01-03
   ```
 
-- **Date Range:** Display a report for a date range.
+- **Date Range**: Display a report for a date range.
 
   ```sh
   timet su 2024-01-02..2024-01-03
   ```
 
+### Sync Operations
+
+```bash
+# Sync local database with S3
+timet sync
+```
+
+This command performs a bidirectional sync:
+1. Creates the S3 bucket if it doesn't exist
+2. If a remote database exists, downloads it and compares with the local database using MD5 hashing
+3. If databases differ, syncs the changes
+4. If no remote database exists, uploads the local database as `timet.db`
+
+### Example Sync Workflow:
+
+```bash
+# First time setup: configure credentials
+mkdir -p ~/.timet && cd ~/.timet
+cat > .env <<-'EOF'
+S3_ENDPOINT=https://abcdefghijklmnop.supabase.co/storage/v1/object
+S3_ACCESS_KEY=your-access-key-here
+S3_SECRET_KEY=your-secret-key-here
+S3_REGION=us-east-1
+EOF
+
+# Sync your time tracking data to cloud
+timet sync
+```
+
 <a name="data"></a>
 
 ## 🗃️ Data
@@ -284,23 +313,101 @@ Timet's data is stored in `~/.timet`.
 
 Timet supports backing up and syncing your time tracking data with S3-compatible storage services (such as Supabase S3). To configure S3 backup, follow these steps:
 
-### Environment Variables
+### Setting Up Supabase S3 Storage
+
+#### 1. Create a Database Project in Supabase
 
-Create a `.env` file in your project root (`~/.timet`) with the following variables:
+If you don't have a Supabase project yet:
+1. Go to [Supabase](https://supabase.com/) and create a new project
+2. Choose a region close to your location
+3. Complete the project setup wizard
+
+#### 2. Enable S3 Storage in Supabase
+
+1. In your Supabase project dashboard, navigate to **Settings** → **Storage**
+2. Click **Create storage bucket** or select an existing bucket
+3. Configure the bucket:
+   - **Bucket name**: Use a descriptive name like `timet-data` or `time-tracking`
+   - **File size limit**: Choose appropriate limits (e.g., 10MB per file)
+   - **Public access**: Set to **Private** for security
+
+#### 3. Generate S3 Access Credentials
+
+Supabase uses AWS-compatible S3 APIs, so it requires access keys:
+
+1. Go to your Supabase project dashboard → **Settings** → **API**
+2. Scroll down to **Service Role Secrets** or **S3 Configuration**
+3. Click **Generate New Key** or view existing credentials
+4. Copy the following values (you won't be able to see them again after leaving this page):
+   - `SERVICE_ROLE_KEY` → This is your S3_ACCESS_KEY
+   - The corresponding secret → This is your S3_SECRET_KEY
+
+> ⚠️ **Important**: If you don't see these options in Settings, check:
+> - **Security** tab in project settings
+> - **Database** → **Connection Pooling** section (sometimes under **Settings**)
+> - Contact Supabase support if credentials aren't visible
+>
+> Alternatively, create a custom S3-compatible endpoint using Supabase's API:
+> ```bash
+> # Format: https://<project-ref>.supabase.co/storage/v1/object
+> ```
+
+#### 4. Configure Environment Variables
+
+Create a `.env` file in `~/.timet/` with the following variables:
 
 ```bash
-S3_ENDPOINT=your_s3_endpoint_url
-S3_ACCESS_KEY=your_access_key
-S3_SECRET_KEY=your_secret_key
-S3_REGION=your_s3_region
+S3_ENDPOINT=https://<your-project-id>.supabase.co/storage/v1/object
+S3_ACCESS_KEY=<your-service-role-key>
+S3_SECRET_KEY=<your-service-role-secret>
+S3_REGION=us-west-1  # Or your Supabase region (e.g., europe-west3, ap-southeast-1)
 ```
 
+Replace the placeholders with your actual values from Step 3. Example:
+
+```bash
+S3_ENDPOINT=https://abcdefghijklmnop.supabase.co/storage/v1/object
+S3_ACCESS_KEY=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
+S3_SECRET_KEY=xyz987-abc123-def456-ghi789-jkl012
+S3_REGION=us-east-1
+```
+
+#### 5. Create the S3 Bucket (Optional)
+
+If you haven't created a bucket yet in Supabase, Timet can create one:
+
+```bash
+timet s3 create <bucket-name>
+```
+
+Or use the shortcut:
+
+```bash
+timet s3 create timet-data
+```
+
+
 ### Security Considerations
 
-- Keep your `.env` file private and never commit it to version control
+- Keep your `.env` file private and never commit it to version control (`.env` should be in your `.gitignore`)
 - Use strong, unique access keys
 - Regularly rotate your S3 access credentials
 - Implement appropriate IAM policies to restrict bucket access
+- For production use, consider using a dedicated service role with minimum required permissions
+
+### Verification
+
+After configuration, verify the connection:
+
+```bash
+# List objects in your bucket (if you have list permissions)
+timet s3 list-buckets
+
+# Or simply try a sync operation to upload your data
+timet sync
+```
+
+All S3 operations are logged to `~/.timet/s3_supabase.log`.
 
 ## Development
 

data/lib/timet/database_syncer.rb

@@ -55,35 +55,65 @@ module Timet
 
     def sync_databases(*args)
       local_db, remote_db, remote_storage, bucket, local_db_path = args
-      process_database_items(local_db, remote_db)
-      remote_storage.upload_file(bucket, local_db_path, 'timet.db')
+      local_items = local_db.execute_sql('SELECT * FROM items ORDER BY updated_at DESC')
+      remote_items = remote_db.execute('SELECT * FROM items ORDER BY updated_at DESC')
+
+      local_by_id = items_to_hash(local_items)
+      remote_by_id = items_to_hash(remote_items)
+
+      local_changes = process_bidirectional_sync(local_db, local_by_id, remote_by_id)
+
+      if local_changes
+        remote_storage.upload_file(bucket, local_db_path, 'timet.db')
+        puts 'Changes uploaded to remote'
+      else
+        puts 'No local changes to upload'
+      end
+
       puts 'Database sync completed'
     end
 
-    def process_database_items(local_db, remote_db)
-      remote_items = remote_db.execute('SELECT * FROM items ORDER BY updated_at DESC')
-      local_items = local_db.execute_sql('SELECT * FROM items ORDER BY updated_at DESC')
+    def process_bidirectional_sync(local_db, local_items_by_id, remote_items_by_id)
+      all_ids = (remote_items_by_id.keys + local_items_by_id.keys).uniq
+      local_has_changes = false
+
+      all_ids.each do |id|
+        remote_item = remote_items_by_id[id]
+        local_item = local_items_by_id[id]
 
-      sync_items_by_id(local_db, items_to_hash(local_items), items_to_hash(remote_items))
+        changed = sync_single_item_and_flag(local_db, id, local_item, remote_item)
+        local_has_changes = true if changed
+      end
+
+      local_has_changes
     end
 
-    def sync_items_by_id(local_db, local_items_by_id, remote_items_by_id)
-      all_item_ids = (remote_items_by_id.keys + local_items_by_id.keys).uniq
-      all_item_ids.each { |id| sync_single_item(local_db, id, local_items_by_id, remote_items_by_id) }
+    def sync_single_item_and_flag(local_db, id, local_item, remote_item)
+      if !remote_item && local_item
+        puts "Local item #{id} will be uploaded"
+        true
+      elsif !local_item && remote_item
+        puts "Adding remote item #{id} to local"
+        insert_item_from_hash(local_db, remote_item)
+        false
+      elsif local_item && remote_item
+        merge_and_track_changes?(local_db, id, local_item, remote_item)
+      else
+        false
+      end
     end
 
-    def sync_single_item(*args)
-      local_db, id, local_items_by_id, remote_items_by_id = args
-      remote_item = remote_items_by_id[id]
-      local_item = local_items_by_id[id]
+    def merge_and_track_changes?(local_db, id, local_item, remote_item)
+      local_time = extract_timestamp(local_item)
+      remote_time = extract_timestamp(remote_item)
 
-      if !remote_item
-        log_local_only(id)
-      elsif !local_item
-        add_remote_item(local_db, id, remote_item)
-      else
-        merge_item(local_db, id, local_item, remote_item)
+      if remote_time > local_time
+        puts "Remote item #{id} is newer - updating local"
+        update_item_from_hash(local_db, remote_item)
+      elsif local_time > remote_time
+        puts "Local item #{id} is newer - will be uploaded"
       end
+      true
     end
 
     def log_local_only(id)
@@ -132,9 +162,11 @@ module Timet
 
     def update_item_from_hash(db, item)
       fields = "#{ITEM_FIELDS.join(' = ?, ')} = ?"
+      values = get_update_values(item)
+      values << item['id']
       db.execute_sql(
         "UPDATE items SET #{fields} WHERE id = ?",
-        get_update_values(item)
+        values
       )
     end
 
@@ -147,9 +179,8 @@ module Timet
       items.to_h { |item| [item['id'], item] }
     end
 
-    def remote_wins?(remote_item, remote_time, local_time)
-      time_diff = remote_time > local_time
-      time_diff && (remote_item['deleted'].to_i == 1 || time_diff)
+    def remote_wins?(_remote_item, remote_time, local_time)
+      remote_time > local_time
     end
 
     def format_status_message(id, item, source)

data/lib/timet/version.rb

@@ -6,6 +6,6 @@ module Timet
   # @return [String] The version number in the format 'major.minor.patch'.
   #
   # @example Get the version of the Timet application
-  #   Timet::VERSION # => '1.6.3'
-  VERSION = '1.6.3'
+  #   Timet::VERSION # => '1.6.5'
+  VERSION = '1.6.5'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: timet
 version: !ruby/object:Gem::Version
-  version: 1.6.3
+  version: 1.6.5
 platform: ruby
 authors:
 - Frank Vielma
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-02-28 00:00:00.000000000 Z
+date: 2026-08-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: thor