@doubling/compound-sync 1.11.1 → 1.12.1

package/files.js

@@ -26,7 +26,7 @@
 //   2. Delete the Firestore metadata document.
 
 import {
-  doc, getDocs, setDoc, updateDoc, deleteDoc, query, where,
+  doc, getDoc, getDocs, setDoc, updateDoc, deleteDoc, query, where,
 } from 'firebase/firestore';
 import {
   ref as storageRef, uploadBytes, deleteObject, getBytes,
@@ -206,18 +206,32 @@ export async function pushFolderToCloud({
 }
 
 /**
- * Delete the folder doc at `docPath` if it exists. Does NOT cascade
- * to children (the sync daemon's `unlinkDir` event fires after its
- * children's `unlink` events have already cleaned up child docs, so
- * by the time we reach the folder it should be empty).
+ * Delete the folder doc at `docPath` AND every descendant (files and
+ * sub-folders) in the same scope. Cascade is authoritative: it does
+ * not rely on per-child `unlink` events to clean up children first.
+ *
+ * Pre-DOU-223 this function deleted only the folder doc, on the
+ * (wrong) assumption that chokidar would emit `unlink` for every
+ * child before the `unlinkDir` for the folder. macOS FSEvents
+ * coalescing and burst-event ordering broke that assumption,
+ * leaving orphan file docs that reconstituted the folder on the web
+ * via `getFoldersAndFiles` (which derives folder names from paths).
+ * The cascade closes the gap; if children's `unlink` events also
+ * fire in time, the cascade is a no-op for them.
+ *
+ * Storage blobs for descendant files are deleted before their
+ * Firestore docs so the Storage rule (which reads the doc to
+ * authorize) still passes.
  *
  * Returns:
  *   { action: 'skipped',   reason: 'shared-scope' }
  *   { action: 'not-found' }
- *   { action: 'deleted',   folderId }
+ *   { action: 'deleted',   folderId, childCount }
  */
 export async function deleteFolderFromCloud({
   filesRef,
+  storage,
+  orgId,
   scope,
   teamId,
   userId,
@@ -226,27 +240,65 @@ export async function deleteFolderFromCloud({
   if (scope === 'shared-with-me' || scope === 'shared-by-me') {
     return { action: 'skipped', reason: 'shared-scope' };
   }
-  let q;
+  // Pull every doc in this scope; cheap because vaults are small
+  // (hundreds of docs at most). Filtering in memory avoids the
+  // Firestore composite-index requirement for a path-prefix range
+  // query and keeps the cascade contract dead simple to reason about.
+  let scopeQuery;
   if (scope === 'private') {
-    q = query(filesRef,
-      where('type', '==', 'folder'),
+    scopeQuery = query(filesRef,
       where('scope', '==', 'private'),
-      where('ownerId', '==', userId),
-      where('path', '==', docPath));
+      where('ownerId', '==', userId));
   } else if (scope === 'team' && teamId) {
-    q = query(filesRef,
-      where('type', '==', 'folder'),
+    scopeQuery = query(filesRef,
       where('scope', '==', 'team'),
-      where('teamId', '==', teamId),
-      where('path', '==', docPath));
+      where('teamId', '==', teamId));
   } else {
     return { action: 'not-found' };
   }
-  const snap = await getDocs(q);
-  if (snap.empty) return { action: 'not-found' };
-  const docSnap = snap.docs[0];
-  await deleteDoc(docSnap.ref);
-  return { action: 'deleted', folderId: docSnap.id };
+  const snap = await getDocs(scopeQuery);
+
+  const prefix = docPath + '/';
+  let folderDocSnap = null;
+  const descendants = [];
+  snap.forEach((d) => {
+    const data = d.data();
+    const p = data.path;
+    if (!p) return;
+    if (data.type === 'folder' && p === docPath) {
+      folderDocSnap = d;
+    } else if (p.startsWith(prefix)) {
+      descendants.push({ id: d.id, ref: d.ref, data });
+    }
+  });
+
+  if (!folderDocSnap && descendants.length === 0) {
+    return { action: 'not-found' };
+  }
+
+  // Delete each descendant's blob (files only) then its doc.
+  for (const { id, ref, data } of descendants) {
+    if (data.type !== 'folder') {
+      const ext = extFromPath(data.path);
+      try {
+        await deleteBlob({ storage, orgId, fileId: id, ext });
+      } catch (err) {
+        // Orphan blob is a soft failure; the doc delete is the
+        // load-bearing state transition for the user's view.
+      }
+    }
+    await deleteDoc(ref);
+  }
+
+  if (folderDocSnap) {
+    await deleteDoc(folderDocSnap.ref);
+  }
+
+  return {
+    action: 'deleted',
+    folderId: folderDocSnap ? folderDocSnap.id : null,
+    childCount: descendants.length,
+  };
 }
 
 // ---- High-level coordinator ----
@@ -449,7 +501,29 @@ export async function deleteFileFromCloud({
   const ext = extFromPath(docPath);
   // Delete the Storage blob FIRST while the metadata doc still exists,
   // because the Storage rule's authorization check looks up the doc.
-  await deleteBlob({ storage, orgId, fileId, ext });
+  //
+  // Race tolerance (DOU-231 follow-up): a concurrent delete can remove
+  // the metadata doc between our snapshot read and our blob-delete
+  // (most commonly the cascade in deleteFolderFromCloud firing first
+  // for a path chokidar's per-file `unlink` event then re-tries via
+  // this function). After that delete, the Storage rule's
+  // `firestore.get(...).data.scope` reads null, the rule throws
+  // "Null value error", and the Storage SDK surfaces it as
+  // `storage/unauthorized`. In that specific case the desired end
+  // state (no doc, no blob) is already achieved, so treat as
+  // already-deleted instead of propagating a noisy auth error.
+  try {
+    await deleteBlob({ storage, orgId, fileId, ext });
+  } catch (err) {
+    const code = err && err.code;
+    if (code === 'storage/unauthorized') {
+      const recheck = await getDoc(docSnap.ref);
+      if (!recheck.exists()) {
+        return { action: 'not-found', fileId };
+      }
+    }
+    throw err;
+  }
   await deleteDoc(docSnap.ref);
   return { action: 'deleted', fileId };
 }

package/org-sync.js

@@ -15,7 +15,7 @@
 import chokidar from 'chokidar';
 import fs from 'fs';
 import path from 'path';
-import { collection, query, where, onSnapshot } from 'firebase/firestore';
+import { collection, query, where, onSnapshot, getDocs } from 'firebase/firestore';
 import {
   pushFileToCloud,
   deleteFileFromCloud,
@@ -600,6 +600,34 @@ export async function startOrgSync({
     }
   }
 
+  // DOU-217 helper: does a doc with this path + matching contentHash
+  // exist in Firestore right now? Used to verify a baseline entry
+  // before trusting it (so a stale baseline can't silently suppress
+  // re-upload of a file whose Firestore doc was deleted out-of-band).
+  async function firestoreDocExists({ scope, teamId, docPath, contentHash }) {
+    let q;
+    if (scope === 'private') {
+      q = query(filesRef,
+        where('scope', '==', 'private'),
+        where('ownerId', '==', userId),
+        where('path', '==', docPath));
+    } else if (scope === 'team' && teamId) {
+      q = query(filesRef,
+        where('scope', '==', 'team'),
+        where('teamId', '==', teamId),
+        where('path', '==', docPath));
+    } else {
+      return false;
+    }
+    const snap = await getDocs(q);
+    if (snap.empty) return false;
+    // Also require the doc's contentHash to match the baseline. A doc
+    // with the same path but a different hash means a web edit
+    // happened that the daemon didn't observe; treat as "missing" so
+    // the push side proceeds and the pull side can reconcile.
+    return snap.docs[0].data().contentHash === contentHash;
+  }
+
   async function pushToFirestore(filePath, data, mimeType, localModifiedAt) {
     const { scope, teamId, docPath } = scopeFromLocalPath(filePath, LOCAL_PATH, teamIdsByName);
     const trackingKey = `${scope}:${docPath}`;
@@ -609,8 +637,22 @@ export async function startOrgSync({
     // re-saving or touching a file (or the watcher re-emitting it on
     // startup) must not push stale bytes over a newer server edit. Only
     // a genuine content change proceeds.
+    //
+    // DOU-217: trust the baseline ONLY after verifying the Firestore
+    // doc actually exists. The baseline is persisted across daemon
+    // restarts, so a doc deleted out-of-band (web delete the daemon
+    // missed while offline, manual cleanup, etc.) leaves a permanently
+    // stale entry that would silently suppress re-upload forever.
+    // Verifying via a single indexed read per touch is cheap; if the
+    // doc is gone, clear the baseline and fall through to push.
     const contentHash = computeContentHash(data);
-    if (lastSyncedHash.get(trackingKey) === contentHash) return;
+    if (lastSyncedHash.get(trackingKey) === contentHash) {
+      if (await firestoreDocExists({ scope, teamId, docPath, contentHash })) {
+        return;
+      }
+      console.log(`  [${orgId}] [reconcile] dropping stale baseline for ${docPath} (Firestore doc missing); re-pushing`);
+      deleteBaseline(trackingKey);
+    }
 
     const now = new Date().toISOString();
 
@@ -728,6 +770,8 @@ export async function startOrgSync({
 
     const result = await deleteFolderFromCloud({
       filesRef,
+      storage,
+      orgId,
       scope,
       teamId,
       userId,
@@ -735,7 +779,10 @@ export async function startOrgSync({
     });
 
     if (result.action === 'deleted') {
-      console.log(`  [${orgId}] [local → firestore] RMFOLDER ${docPath} (${scope})`);
+      // childCount > 0 means cascade did real work; useful in logs
+      // when investigating future folder-delete reports.
+      const childSuffix = result.childCount > 0 ? ` (+${result.childCount} children)` : '';
+      console.log(`  [${orgId}] [local → firestore] RMFOLDER ${docPath} (${scope})${childSuffix}`);
     }
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@doubling/compound-sync",
-  "version": "1.11.1",
+  "version": "1.12.1",
   "description": "Bidirectional sync between Compound and local markdown files",
   "type": "module",
   "bin": {
@@ -32,7 +32,7 @@
     "typecheck": "tsc --noEmit",
     "prepack": "npm run build",
     "test:unit": "node --import tsx --test config.test.js paths.test.js storage-helpers.test.js folder-chain.test.js team-registry.test.js auth-persistence.test.js pre-mint-app-check.test.js setup-auth-with-pre-mint.test.js sync-state.test.js yjs-file-binding.test.js yjs-binding-state.test.js",
-    "test:integration": "firebase emulators:exec --only firestore,storage 'node --import tsx --test --test-concurrency=1 files.test.js org-sync.test.js two-user-sync.test.js'",
+    "test:integration": "firebase emulators:exec --only firestore,storage 'node --import tsx --test --test-concurrency=1 files-helpers.test.js files-push-create-private.test.js files-push-create-team.test.js files-push-update-private.test.js files-push-binary.test.js files-push-staleness.test.js files-push-storage-fail.test.js files-push-no-content.test.js files-push-stamps.test.js files-push-folder.test.js files-delete.test.js files-delete-folder.test.js files-read-blob.test.js org-sync-local-edit.test.js org-sync-file-ops.test.js org-sync-mtime.test.js org-sync-rename.test.js org-sync-yjs-pull.test.js org-sync-yjs-push.test.js org-sync-cold-start.test.js two-user-sync.test.js'",
     "test": "npm run test:unit && npm run test:integration"
   },
   "dependencies": {