@doubling/compound-sync 1.1.0 → 1.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@doubling/compound-sync",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "Bidirectional sync between Compound and local markdown files",
   "type": "module",
   "bin": "./sync.js",

package/sync.js

@@ -17,11 +17,13 @@
 import { initializeApp } from 'firebase/app';
 import { getAuth, signInWithEmailAndPassword, signInWithCredential, GoogleAuthProvider } from 'firebase/auth';
 import {
-  getFirestore, collection, doc, getDocs, getDoc, addDoc, updateDoc, deleteDoc,
+  getFirestore, collection, doc, getDocs, getDoc, setDoc, addDoc, updateDoc, deleteDoc,
   query, where, onSnapshot
 } from 'firebase/firestore';
+import { getStorage, ref as storageRef, uploadString, deleteObject } from 'firebase/storage';
 import { initializeAppCheck, CustomProvider } from 'firebase/app-check';
 import chokidar from 'chokidar';
+import crypto from 'crypto';
 import fs from 'fs';
 import path from 'path';
 import readline from 'readline';
@@ -244,6 +246,13 @@ async function setupConfig() {
   const authResult = await browserAuth(fbConfig);
   const app = initializeApp(fbConfig, 'setup');
   const auth = getAuth(app);
+
+  // Initialize App Check before re-authenticating in Node.js
+  const appCheckUrl = appCheckEndpoints[projectId];
+  if (appCheckUrl && authResult.firebaseIdToken) {
+    await initAppCheckWithIdToken(app, appCheckUrl, authResult.firebaseIdToken);
+  }
+
   const db = getFirestore(app);
 
   let userCredential;
@@ -489,6 +498,43 @@ const LOCAL_PATH = expandHome(config.localPath || path.join(os.homedir(), 'Sync'
 
 const filesRef = collection(db, `orgs/${ORG_ID}/files`);
 
+// --- Cloud Storage for file blobs ---
+//
+// PR 2 of the Storage migration: dual-write file content to Cloud
+// Storage in addition to the Firestore `content` field. Reads still
+// come from Firestore until PR 5 cuts over. Storage rules require the
+// file metadata document to exist, so the ordering on create is
+// (1) write Firestore metadata, (2) upload to Storage, (3) update
+// Firestore with the hash/path/size fields.
+
+const storage = getStorage(app);
+
+function computeContentHash(content) {
+  return crypto.createHash('sha256').update(content || '', 'utf-8').digest('hex');
+}
+
+function storagePathFor(fileId) {
+  return `orgs/${ORG_ID}/files/${fileId}/current.md`;
+}
+
+async function uploadBlob(fileId, content) {
+  const blobPath = storagePathFor(fileId);
+  await uploadString(storageRef(storage, blobPath), content || '', 'raw', {
+    contentType: 'text/markdown',
+  });
+}
+
+async function deleteBlob(fileId) {
+  const blobPath = storagePathFor(fileId);
+  try {
+    await deleteObject(storageRef(storage, blobPath));
+  } catch (err) {
+    if (err && err.code !== 'storage/object-not-found') {
+      console.error(`  [storage] delete failed for ${blobPath}: ${err.message}`);
+    }
+  }
+}
+
 // --- Load teams ---
 
 const teams = new Map();
@@ -711,8 +757,15 @@ async function pushToFirestore(filePath, content) {
     snapshot = await getDocs(query(filesRef, where('path', '==', docPath)));
   }
 
+  const contentHash = computeContentHash(content);
+  const size = Buffer.byteLength(content || '', 'utf-8');
+
   if (!snapshot || snapshot.empty) {
     console.log(`  [local → firestore] CREATE ${docPath} (${scope})`);
+    // Pre-generate a doc ref so we can compute the deterministic
+    // storagePath before the first Firestore write.
+    const newDocRef = doc(filesRef);
+    const fileId = newDocRef.id;
     const fileData = {
       path: docPath,
       content,
@@ -722,14 +775,35 @@ async function pushToFirestore(filePath, content) {
       teamId: scope === 'team' ? (teamId || null) : null,
       ownerId: scope === 'private' ? USER_ID : null,
       sharedWith: [],
+      storagePath: storagePathFor(fileId),
+      contentHash,
+      size,
     };
-    await addDoc(filesRef, fileData);
+    await setDoc(newDocRef, fileData);
+    // Upload to Storage after Firestore so the Storage rule (which
+    // reads the file metadata to authorize) sees an existing doc.
+    try {
+      await uploadBlob(fileId, content);
+    } catch (err) {
+      console.error(`  [storage] upload failed for ${docPath}: ${err && err.message}`);
+    }
   } else {
     const docSnap = snapshot.docs[0];
     const existing = docSnap.data();
-    if (existing.content === content) return;
+    if (existing.content === content && existing.contentHash === contentHash) return;
     console.log(`  [local → firestore] UPDATE ${docPath} (${scope})`);
-    await updateDoc(docSnap.ref, { content, updatedAt: now });
+    await updateDoc(docSnap.ref, {
+      content,
+      updatedAt: now,
+      storagePath: storagePathFor(docSnap.id),
+      contentHash,
+      size,
+    });
+    try {
+      await uploadBlob(docSnap.id, content);
+    } catch (err) {
+      console.error(`  [storage] upload failed for ${docPath}: ${err && err.message}`);
+    }
   }
 }
 
@@ -745,7 +819,12 @@ async function deleteFromFirestore(filePath) {
     const data = snapshot.docs[0].data();
     if ((data.scope || 'team') === scope) {
       console.log(`  [local → firestore] DELETE ${docPath} (${scope})`);
+      const fileId = snapshot.docs[0].id;
       await deleteDoc(snapshot.docs[0].ref);
+      // Best-effort blob cleanup after the metadata is gone. Tolerates
+      // missing blobs (older files written before PR 2). Any leak is
+      // recoverable via a lifecycle rule or a cleanup script later.
+      await deleteBlob(fileId);
     }
   }
 }