@doubling/compound-sync 1.0.2 → 1.1.1

package/README.md

@@ -1,44 +1,26 @@
-# Compound Sync Daemon
+# Compound Sync
 
-Bidirectional sync between Firestore and local markdown files.
+Bidirectional sync between Compound and local markdown files. Edit files locally in your favorite editor and they sync to Compound in real time.
 
-## Prerequisites
-
-- Node.js
-- Google Cloud Application Default Credentials: `gcloud auth application-default login`
-
-## Setup
+## Quick Start
 
 ```bash
-cd sync
-npm install
+npx @doubling/compound-sync
 ```
 
-Run the interactive setup for each environment:
+That's it. A browser window will open for sign-in (Google or email/password), then the setup wizard will walk you through selecting your organization and sync folder.
 
-```bash
-node sync.js --config config-sandbox.json --setup   # Project: doubling-compound-sandbox
-node sync.js --config config-dev.json --setup        # Project: doubling-compound-dev
-node sync.js --config config-prod.json --setup       # Project: doubling-compound-prod
-```
+### Prerequisites
 
-The setup wizard will ask for:
-- **Firebase project ID** (e.g. `doubling-compound-sandbox`)
-- **Organization** to sync
-- **Email address** for private file sync
-- **Local sync folder** (e.g. `~/Compound-sandbox`)
+- [Node.js](https://nodejs.org/) (v18 or later)
 
-Config files (`config-*.json`) are gitignored and stored locally.
-
-## Running
+## What it does
 
-Run one or more environments in separate terminal tabs:
+Compound Sync watches a local folder and your Compound workspace simultaneously. Changes in either direction are synced automatically:
 
-```bash
-node sync.js --config config-sandbox.json
-node sync.js --config config-dev.json
-node sync.js --config config-prod.json
-```
+- Edit a file locally → it updates in Compound
+- Edit a file in Compound → it updates locally
+- Create or delete files in either place → synced
 
 ## Local folder structure
 
@@ -49,3 +31,49 @@ node sync.js --config config-prod.json
   Shared by Me/            -- symlinks to files you've shared
   Shared with Me/          -- files shared with you (read-only)
 ```
+
+## Running
+
+After setup, start syncing with:
+
+```bash
+npx @doubling/compound-sync
+```
+
+The sync daemon runs until you press Ctrl+C.
+
+## Security
+
+- No credentials are stored on disk
+- Authentication happens via your browser each time you start the daemon
+- All data access respects Compound's security rules
+
+---
+
+## Internal Development
+
+For Doubling team members testing against sandbox or dev environments:
+
+```bash
+# Setup
+npx @doubling/compound-sync --env sandbox --config config-sandbox.json --setup
+npx @doubling/compound-sync --env dev --config config-dev.json --setup
+
+# Run
+npx @doubling/compound-sync --env sandbox --config config-sandbox.json
+npx @doubling/compound-sync --env dev --config config-dev.json
+```
+
+Config files (`config-*.json`) are gitignored and stored locally.
+
+### Publishing to npm
+
+After making changes to the sync daemon, publish a new version:
+
+```bash
+cd sync
+npm version patch   # or minor/major
+npm publish
+```
+
+This is required whenever sync daemon code changes — the `npx` command pulls from npm, not from the repo. Consider automating this in CI for releases.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@doubling/compound-sync",
-  "version": "1.0.2",
+  "version": "1.1.1",
   "description": "Bidirectional sync between Compound and local markdown files",
   "type": "module",
   "bin": "./sync.js",

package/sync.js

@@ -20,6 +20,7 @@ import {
   getFirestore, collection, doc, getDocs, getDoc, addDoc, updateDoc, deleteDoc,
   query, where, onSnapshot
 } from 'firebase/firestore';
+import { initializeAppCheck, CustomProvider } from 'firebase/app-check';
 import chokidar from 'chokidar';
 import fs from 'fs';
 import path from 'path';
@@ -60,6 +61,13 @@ const firebaseConfigs = {
   }
 };
 
+// App Check token endpoints per environment
+const appCheckEndpoints = {
+  'doubling-compound-prod': 'https://mintappchecktoken-oaimzbv67a-uc.a.run.app',
+  'doubling-compound-dev': 'https://mintappchecktoken-molg2wq42a-uc.a.run.app',
+  'doubling-compound-sandbox': 'https://mintappchecktoken-pbpkn3igxa-uc.a.run.app',
+};
+
 // --- Helpers ---
 
 function ask(question) {
@@ -121,9 +129,26 @@ function buildLoginPage(fbConfig) {
 import { initializeApp } from 'https://www.gstatic.com/firebasejs/11.7.1/firebase-app.js';
 import { getAuth, signInWithPopup, signInWithEmailAndPassword, GoogleAuthProvider }
   from 'https://www.gstatic.com/firebasejs/11.7.1/firebase-auth.js';
+import { initializeAppCheck, ReCaptchaEnterpriseProvider }
+  from 'https://www.gstatic.com/firebasejs/11.7.1/firebase-app-check.js';
 
 const fbConfig = ${JSON.stringify(fbConfig)};
 const app = initializeApp(fbConfig);
+
+// Initialize App Check (required for Auth enforcement)
+const recaptchaKeys = {
+  'doubling-compound-prod': '6Ld9o7IsAAAAAJDAsa3YCUq8ZeCzuvB9Mly6vlxX',
+  'doubling-compound-dev': '6Le56rIsAAAAAGfDgd1jZEoiDNgooWv8DkvoLEzu',
+  'doubling-compound-sandbox': '6LdN6LIsAAAAAICw1QXRdtIGUPkkh5XLbXLf2LfB',
+};
+const rcKey = recaptchaKeys[fbConfig.projectId];
+if (rcKey) {
+  initializeAppCheck(app, {
+    provider: new ReCaptchaEnterpriseProvider(rcKey),
+    isTokenAutoRefreshEnabled: true,
+  });
+}
+
 const auth = getAuth(app);
 
 async function sendCredential(data) {
@@ -140,10 +165,12 @@ window.googleSignIn = async function() {
   try {
     const result = await signInWithPopup(auth, new GoogleAuthProvider());
     const credential = GoogleAuthProvider.credentialFromResult(result);
+    const firebaseIdToken = await result.user.getIdToken();
     await sendCredential({
       method: 'google',
       idToken: credential.idToken,
       accessToken: credential.accessToken,
+      firebaseIdToken,
     });
   } catch (err) {
     document.getElementById('error').textContent = err.message;
@@ -154,8 +181,9 @@ window.emailSignIn = async function() {
   const email = document.getElementById('email').value;
   const password = document.getElementById('password').value;
   try {
-    await signInWithEmailAndPassword(auth, email, password);
-    await sendCredential({ method: 'email', email, password });
+    const result = await signInWithEmailAndPassword(auth, email, password);
+    const firebaseIdToken = await result.user.getIdToken();
+    await sendCredential({ method: 'email', email, password, firebaseIdToken });
   } catch (err) {
     document.getElementById('error').textContent = err.message;
   }
@@ -216,6 +244,13 @@ async function setupConfig() {
   const authResult = await browserAuth(fbConfig);
   const app = initializeApp(fbConfig, 'setup');
   const auth = getAuth(app);
+
+  // Initialize App Check before re-authenticating in Node.js
+  const appCheckUrl = appCheckEndpoints[projectId];
+  if (appCheckUrl && authResult.firebaseIdToken) {
+    await initAppCheckWithIdToken(app, appCheckUrl, authResult.firebaseIdToken);
+  }
+
   const db = getFirestore(app);
 
   let userCredential;
@@ -314,6 +349,72 @@ async function setupConfig() {
   return savedConfig;
 }
 
+// --- App Check (custom provider for CLI) ---
+
+// Fetch an App Check token using a Firebase ID token (before Node.js sign-in)
+async function fetchAppCheckToken(tokenEndpoint, firebaseIdToken) {
+  const response = await fetch(tokenEndpoint, {
+    method: 'POST',
+    headers: {
+      'Authorization': `Bearer ${firebaseIdToken}`,
+      'Content-Type': 'application/json',
+    },
+  });
+
+  if (!response.ok) {
+    const errBody = await response.text().catch(() => '');
+    console.error(`App Check token request failed (${response.status}): ${errBody}`);
+    throw new Error(`App Check token request failed: ${response.status}`);
+  }
+
+  return await response.json();
+}
+
+// Initialize App Check with a pre-fetched ID token (used on first sign-in)
+async function initAppCheckWithIdToken(app, tokenEndpoint, firebaseIdToken) {
+  console.log('Initializing App Check...');
+  // Pre-fetch the first token
+  const initial = await fetchAppCheckToken(tokenEndpoint, firebaseIdToken);
+  let cachedToken = {
+    token: initial.token,
+    expireTimeMillis: Date.now() + initial.ttlMillis,
+  };
+
+  const customProvider = new CustomProvider({
+    getToken: async () => {
+      // If token is still valid, return cached
+      if (cachedToken.expireTimeMillis > Date.now() + 60000) {
+        return cachedToken;
+      }
+      // Otherwise refresh — at this point the user should be signed in
+      const auth = getAuth(app);
+      const user = auth.currentUser;
+      if (!user) return cachedToken; // fallback
+      const idToken = await user.getIdToken();
+      const refreshed = await fetchAppCheckToken(tokenEndpoint, idToken);
+      cachedToken = {
+        token: refreshed.token,
+        expireTimeMillis: Date.now() + refreshed.ttlMillis,
+      };
+      return cachedToken;
+    },
+  });
+
+  initializeAppCheck(app, {
+    provider: customProvider,
+    isTokenAutoRefreshEnabled: true,
+  });
+  console.log('App Check initialized.');
+}
+
+// Initialize App Check with an already-signed-in user (used during setup reuse)
+async function initAppCheck(app, auth, tokenEndpoint) {
+  const user = auth.currentUser;
+  if (!user) throw new Error('Not signed in');
+  const idToken = await user.getIdToken();
+  await initAppCheckWithIdToken(app, tokenEndpoint, idToken);
+}
+
 // --- Config ---
 
 const args = process.argv.slice(2);
@@ -347,6 +448,13 @@ if (config._app) {
   app = config._app;
   db = config._db;
   userId = config._userId;
+
+  // Initialize App Check if endpoint exists for this env
+  const appCheckUrl = appCheckEndpoints[config.projectId];
+  if (appCheckUrl) {
+    const auth = getAuth(app);
+    await initAppCheck(app, auth, appCheckUrl);
+  }
 } else {
   const fbConfig = firebaseConfigs[config.projectId];
   if (!fbConfig) {
@@ -358,10 +466,17 @@ if (config._app) {
   const auth = getAuth(app);
   db = getFirestore(app);
 
-  // Sign in via browser
+  // Sign in via browser (browser handles reCAPTCHA App Check)
   console.log('');
   const authResult = await browserAuth(fbConfig);
 
+  // Initialize App Check BEFORE signing in on the Node.js side
+  // Use the Firebase ID token from the browser to get an App Check token
+  const appCheckUrl = appCheckEndpoints[config.projectId];
+  if (appCheckUrl && authResult.firebaseIdToken) {
+    await initAppCheckWithIdToken(app, appCheckUrl, authResult.firebaseIdToken);
+  }
+
   if (authResult.method === 'google') {
     const credential = GoogleAuthProvider.credential(authResult.idToken, authResult.accessToken);
     const cred = await signInWithCredential(auth, credential);
@@ -372,6 +487,7 @@ if (config._app) {
     userId = cred.user.uid;
     console.log(`Signed in as ${cred.user.email}`);
   }
+
 }
 
 const ORG_ID = config.orgId;