@knotpad/app 0.1.0

package/app/api/invites/[token]/route.tsx

@@ -0,0 +1,131 @@
+import { NextRequest, NextResponse } from "next/server";
+import { auth } from "@/auth";
+import { prisma } from "@/lib/prisma";
+import { stripe } from "@/lib/stripe";
+
+export async function GET(
+  _req: NextRequest,
+  { params }: { params: Promise<{ token: string }> }
+) {
+  const { token } = await params;
+
+  const invite = await prisma.inviteToken.findUnique({
+    where: { token },
+    include: { workspace: { select: { name: true } }, invitedBy: { select: { name: true } } },
+  });
+
+  if (!invite) return NextResponse.json({ error: "Invite not found" }, { status: 404 });
+  if (invite.acceptedAt) return NextResponse.json({ error: "Already accepted" }, { status: 410 });
+  if (invite.expiresAt < new Date()) return NextResponse.json({ error: "Invite expired" }, { status: 410 });
+
+  return NextResponse.json({
+    email: invite.email,
+    workspaceName: invite.workspace.name,
+    invitedBy: invite.invitedBy.name,
+    role: invite.role,
+  });
+}
+
+// POST = accept invite
+export async function POST(
+  _req: NextRequest,
+  { params }: { params: Promise<{ token: string }> }
+) {
+  const session = await auth();
+  if (!session) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+
+  const { token } = await params;
+
+  const invite = await prisma.inviteToken.findUnique({
+    where: { token },
+    include: { workspace: true },
+  });
+  if (!invite) return NextResponse.json({ error: "Invalid invite" }, { status: 404 });
+  if (invite.acceptedAt) return NextResponse.json({ error: "Already used" }, { status: 410 });
+  if (invite.expiresAt < new Date()) return NextResponse.json({ error: "Expired" }, { status: 410 });
+  if (invite.email !== session.user.email) {
+    return NextResponse.json({ error: "This invite was sent to a different email" }, { status: 403 });
+  }
+
+  const workspace = invite.workspace;
+
+  await prisma.$transaction(async (tx) => {
+    // Re-activate if previously revoked, otherwise create fresh
+    const existingMember = await tx.workspaceMember.findUnique({
+      where: { userId_workspaceId: { userId: session.user.id, workspaceId: workspace.id } },
+    });
+
+    if (existingMember) {
+      await tx.workspaceMember.update({
+        where: { id: existingMember.id },
+        data: { role: invite.role, revokedAt: null },
+      });
+    } else {
+      await tx.workspaceMember.create({
+        data: { userId: session.user.id, workspaceId: workspace.id, role: invite.role },
+      });
+    }
+
+    await tx.inviteToken.update({
+      where: { token },
+      data: { acceptedAt: new Date() },
+    });
+
+    await tx.notification.create({
+      data: {
+        userId: invite.invitedById,
+        type: "invite_accepted",
+        title: `${session.user.name ?? session.user.email} accepted your invite`,
+        body: `They've joined the workspace as ${invite.role.toLowerCase()}.`,
+      },
+    });
+  });
+
+  // Increment Stripe seat quantity if workspace has an active subscription
+  if (workspace.stripeSubId) {
+    try {
+      const sub = await stripe.subscriptions.retrieve(workspace.stripeSubId);
+      const item = sub.items.data[0];
+      if (item) {
+        const newQuantity = (item.quantity ?? 1) + 1;
+        await stripe.subscriptionItems.update(item.id, {
+          quantity: newQuantity,
+          proration_behavior: "create_prorations", // charge immediately for new seat
+        });
+        await prisma.workspace.update({
+          where: { id: workspace.id },
+          data: { seatCount: newQuantity },
+        });
+      }
+    } catch {
+      // Non-fatal: Stripe seat sync failure doesn't block the join.
+      // Seat count will reconcile on next webhook or manual billing check.
+    }
+  }
+
+  return NextResponse.json({ workspaceId: workspace.id });
+}
+
+// DELETE = revoke invite
+export async function DELETE(
+  _req: NextRequest,
+  { params }: { params: Promise<{ token: string }> }
+) {
+  const session = await auth();
+  if (!session) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+
+  const { token } = await params;
+
+  const invite = await prisma.inviteToken.findUnique({ where: { token } });
+  if (!invite) return NextResponse.json({ error: "Not found" }, { status: 404 });
+
+  const member = await prisma.workspaceMember.findFirst({
+    where: { userId: session.user.id, workspaceId: invite.workspaceId, revokedAt: null },
+  });
+  if (!member || member.role === "MEMBER") {
+    return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+  }
+
+  await prisma.inviteToken.delete({ where: { token } });
+  return NextResponse.json({ ok: true });
+}

package/app/api/invites/route.tsx

@@ -0,0 +1,74 @@
+import { NextRequest, NextResponse } from "next/server";
+import { auth } from "@/auth";
+import { prisma } from "@/lib/prisma";
+
+export async function POST(req: NextRequest) {
+  const session = await auth();
+  if (!session) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+
+  const body = await req.json();
+  const { email, role = "MEMBER", workspaceId } = body;
+
+  if (!email) return NextResponse.json({ error: "Email required" }, { status: 400 });
+  if (!["MEMBER", "ADMIN"].includes(role)) {
+    return NextResponse.json({ error: "Invalid role" }, { status: 400 });
+  }
+
+  // Find the workspace the caller wants to invite into
+  const member = workspaceId
+    ? await prisma.workspaceMember.findFirst({
+        where: { userId: session.user.id, workspaceId, revokedAt: null },
+        include: { workspace: true },
+      })
+    : await prisma.workspaceMember.findFirst({
+        where: { userId: session.user.id, revokedAt: null },
+        include: { workspace: true },
+        orderBy: { joinedAt: "asc" },
+      });
+
+  if (!member) return NextResponse.json({ error: "No workspace found" }, { status: 404 });
+  if (member.role === "MEMBER") {
+    return NextResponse.json({ error: "Only owners and admins can invite" }, { status: 403 });
+  }
+
+  const { workspace } = member;
+
+  // Personal workspaces cannot have invites — owner must upgrade to Team Pro first
+  if (workspace.type === "PERSONAL") {
+    return NextResponse.json(
+      {
+        error: "upgrade_required",
+        message: "Inviting members requires a Team Pro workspace.",
+      },
+      { status: 402 }
+    );
+  }
+
+  // Check if already an active member
+  const existing = await prisma.user.findUnique({
+    where: { email },
+    include: {
+      workspaces: { where: { workspaceId: workspace.id, revokedAt: null } },
+    },
+  });
+  if (existing?.workspaces.length) {
+    return NextResponse.json({ error: "User is already a member" }, { status: 409 });
+  }
+
+  const expiresAt = new Date(Date.now() + 7 * 24 * 60 * 60 * 1000);
+
+  const invite = await prisma.inviteToken.create({
+    data: {
+      email,
+      role,
+      workspaceId: workspace.id,
+      invitedById: session.user.id,
+      expiresAt,
+    },
+  });
+
+  const appUrl = process.env.NEXT_PUBLIC_APP_URL ?? "http://localhost:3000";
+  const link = `${appUrl}/invite/${invite.token}`;
+
+  return NextResponse.json({ link, token: invite.token }, { status: 201 });
+}

package/app/api/mcp/generate-token/route.tsx

@@ -0,0 +1,55 @@
+import { NextRequest, NextResponse } from "next/server";
+import { auth } from "@/auth";
+import { prisma } from "@/lib/prisma";
+import { signMcpToken } from "@/lib/mcp-auth";
+
+export async function POST(req: NextRequest) {
+  const session = await auth();
+  if (!session) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+
+  const body = await req.json().catch(() => ({}));
+  const requestedWorkspaceId: string | undefined = body?.workspaceId;
+
+  let workspaceId: string;
+
+  if (requestedWorkspaceId) {
+    const member = await prisma.workspaceMember.findFirst({
+      where: { userId: session.user.id, workspaceId: requestedWorkspaceId, revokedAt: null },
+    });
+    if (!member) return NextResponse.json({ error: "Not a member of that workspace" }, { status: 403 });
+    workspaceId = requestedWorkspaceId;
+  } else {
+    const member = await prisma.workspaceMember.findFirst({
+      where: { userId: session.user.id, revokedAt: null },
+    });
+    if (!member) return NextResponse.json({ error: "No workspace" }, { status: 404 });
+    workspaceId = member.workspaceId;
+  }
+
+  // Revoke any existing active tokens for this user+workspace
+  await prisma.mcpToken.updateMany({
+    where: { userId: session.user.id, workspaceId, revokedAt: null },
+    data: { revokedAt: new Date() },
+  });
+
+  const record = await prisma.mcpToken.create({
+    data: {
+      token: "pending",
+      userId: session.user.id,
+      workspaceId,
+    },
+  });
+
+  const jwt = await signMcpToken({
+    userId: session.user.id,
+    workspaceId,
+    tokenId: record.id,
+  });
+
+  await prisma.mcpToken.update({
+    where: { id: record.id },
+    data: { token: jwt },
+  });
+
+  return NextResponse.json({ id: record.id, token: jwt, alias: null }, { status: 201 });
+}

package/app/api/mcp/revoke-token/[tokenId]/route.tsx

@@ -0,0 +1,30 @@
+import { NextRequest, NextResponse } from "next/server";
+import { auth } from "@/auth";
+import { prisma } from "@/lib/prisma";
+
+export async function DELETE(
+  _req: NextRequest,
+  { params }: { params: Promise<{ tokenId: string }> }
+) {
+  const session = await auth();
+  if (!session) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+
+  const { tokenId } = await params;
+  const record = await prisma.mcpToken.findUnique({ where: { id: tokenId } });
+  if (!record || record.revokedAt) {
+    return NextResponse.json({ error: "Not found" }, { status: 404 });
+  }
+
+  if (record.userId !== session.user.id) {
+    // Workspace admins and owners may revoke any token in their workspace
+    const callerMember = await prisma.workspaceMember.findFirst({
+      where: { userId: session.user.id, workspaceId: record.workspaceId, revokedAt: null },
+    });
+    if (!callerMember || callerMember.role === "MEMBER") {
+      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+    }
+  }
+
+  await prisma.mcpToken.update({ where: { id: tokenId }, data: { revokedAt: new Date() } });
+  return NextResponse.json({ ok: true });
+}

package/app/api/mcp/update-alias/[tokenId]/route.tsx

@@ -0,0 +1,22 @@
+import { NextRequest, NextResponse } from "next/server";
+import { auth } from "@/auth";
+import { prisma } from "@/lib/prisma";
+
+export async function PATCH(
+  req: NextRequest,
+  { params }: { params: Promise<{ tokenId: string }> }
+) {
+  const session = await auth();
+  if (!session) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+
+  const { tokenId } = await params;
+  const { alias } = await req.json();
+
+  const record = await prisma.mcpToken.findUnique({ where: { id: tokenId } });
+  if (!record || record.userId !== session.user.id) {
+    return NextResponse.json({ error: "Not found" }, { status: 404 });
+  }
+
+  await prisma.mcpToken.update({ where: { id: tokenId }, data: { alias: alias || null } });
+  return NextResponse.json({ ok: true });
+}

package/app/api/notes/[noteId]/export/route.tsx

@@ -0,0 +1,45 @@
+import { NextRequest, NextResponse } from "next/server";
+import { auth } from "@/auth";
+import { prisma } from "@/lib/prisma";
+import { decryptContent } from "@/lib/note-crypto";
+import { getActiveWorkspaceId } from "@/lib/workspace";
+
+// Tolerates both legacy <!--task::STATUS--> and id-bearing <!--task::ID::STATUS-->.
+const BADGE_COMMENT_RE = /\s*<!--task::[^>]*-->/g;
+
+function toCleanMarkdown(title: string, content: string): string {
+  const lines = content
+    .split("\n")
+    .map((line) => line.replace(BADGE_COMMENT_RE, ""));
+  return `# ${title}\n\n${lines.join("\n")}`;
+}
+
+export async function GET(
+  _req: NextRequest,
+  { params }: { params: Promise<{ noteId: string }> }
+) {
+  const session = await auth();
+  if (!session) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+
+  const { noteId } = await params;
+
+  const workspaceId = await getActiveWorkspaceId(session.user.id);
+  if (!workspaceId) return NextResponse.json({ error: "No workspace" }, { status: 404 });
+
+  const note = await prisma.note.findFirst({
+    where: { id: noteId, workspaceId },
+  });
+  if (!note) return NextResponse.json({ error: "Not found" }, { status: 404 });
+
+  const plainContent = await decryptContent(note.content, workspaceId);
+  const md = toCleanMarkdown(note.title, plainContent);
+  const slug = note.title.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+  const filename = `${slug || "note"}.md`;
+
+  return new NextResponse(md, {
+    headers: {
+      "Content-Type": "text/markdown; charset=utf-8",
+      "Content-Disposition": `attachment; filename="${filename}"`,
+    },
+  });
+}