@knotpad/app 0.1.5 → 0.1.6

package/lib/pro-flush.ts

@@ -0,0 +1,292 @@
+/**
+ * Cloud-first sync worker for Pro workspaces.
+ *
+ * Replaces the bidirectional runSync for Pro users. Direction is strictly
+ * local → cloud: flush records written offline (pendingSync=true) to Neon,
+ * auto-merge when possible, log conflicts when not.
+ *
+ * The bidirectional runSync in sync-worker.ts is kept for reference but no
+ * longer called by the cron or trigger routes once a workspace is cloud-first.
+ */
+
+import { prisma, getCloudPrisma } from "@/lib/prisma";
+import {
+  lastWriteWins,
+  threeWayMerge,
+  isTombstoned,
+  logConflict,
+} from "@/lib/conflict-resolver";
+import {
+  getOrCreateSyncState,
+  getSnapshots,
+  saveSnapshots,
+} from "@/lib/note-sync";
+import { encryptForSync, decryptFromSync } from "@/lib/note-crypto";
+import { isWorkspacePro, isWorkspaceCloud } from "@/lib/license";
+import type { SyncResult, SyncStatus } from "@/lib/sync-worker";
+
+export type { SyncResult, SyncStatus };
+
+// Per-process concurrency guard (fast path — avoids DB round-trip when a flush
+// is already in-flight on this instance).
+const inFlight = new Set<string>();
+
+// Lock TTL: if a lock is older than this, it's considered stale (process crashed
+// mid-flush) and a new flush is allowed to proceed.
+const LOCK_TTL_MS = 120_000; // 2 minutes
+
+export async function runProFlush(workspaceId: string): Promise<SyncResult> {
+  const workspace = await prisma.workspace.findUnique({
+    where: { id: workspaceId },
+    select: { planType: true, licenseType: true },
+  });
+
+  if (!workspace || !isWorkspacePro(workspace) || !isWorkspaceCloud(workspace)) {
+    return { status: "synced", notesProcessed: 0, tasksProcessed: 0, conflictsFound: 0 };
+  }
+
+  const cloudPrisma = getCloudPrisma();
+  if (!cloudPrisma) {
+    return {
+      status: "error",
+      notesProcessed: 0,
+      tasksProcessed: 0,
+      conflictsFound: 0,
+      error: "CLOUD_DATABASE_URL is not configured",
+    };
+  }
+
+  // Fast path: per-process guard
+  if (inFlight.has(workspaceId)) {
+    return { status: "syncing", notesProcessed: 0, tasksProcessed: 0, conflictsFound: 0 };
+  }
+
+  // Distributed lock: atomically claim the lock only if there is none (or it's stale).
+  // This prevents two Node processes / Dokploy replicas from racing on the same workspace.
+  // We upsert first to ensure the row exists (first-ever sync), then attempt the update.
+  const lockCutoff = new Date(Date.now() - LOCK_TTL_MS);
+  const now = new Date();
+
+  // Ensure the SyncState row exists before we try to lock it.
+  await prisma.syncState.upsert({
+    where: { workspaceId },
+    create: { workspaceId },
+    update: {}, // no-op if it already exists; lock attempt is below
+  });
+
+  const locked = await prisma.syncState.updateMany({
+    where: {
+      workspaceId,
+      OR: [
+        { syncLockedAt: null },
+        { syncLockedAt: { lt: lockCutoff } },
+      ],
+    },
+    data: { syncLockedAt: now },
+  });
+
+  if (locked.count === 0) {
+    // Another instance holds a fresh lock
+    return { status: "syncing", notesProcessed: 0, tasksProcessed: 0, conflictsFound: 0 };
+  }
+
+  inFlight.add(workspaceId);
+  const syncStart = new Date();
+
+  try {
+    await getOrCreateSyncState(workspaceId, cloudPrisma);
+    const { snapshots } = await getSnapshots(workspaceId, cloudPrisma);
+
+    let notesProcessed = 0;
+    let tasksProcessed = 0;
+    let conflictsFound = 0;
+
+    // ── Flush pending notes ────────────────────────────────────────────────────
+
+    const pendingNotes = await prisma.note.findMany({
+      where: { workspaceId, pendingSync: true },
+      orderBy: { updatedAt: "asc" },
+    });
+
+    for (const localNote of pendingNotes) {
+      if (await isTombstoned(workspaceId, "note", localNote.id, cloudPrisma)) {
+        await prisma.note.update({ where: { id: localNote.id }, data: { pendingSync: false } });
+        continue;
+      }
+
+      const cloudNote = await cloudPrisma.note.findUnique({ where: { id: localNote.id } });
+
+      if (!cloudNote) {
+        // New note written offline — push to cloud
+        await cloudPrisma.note.upsert({
+          where: { id: localNote.id },
+          create: {
+            id: localNote.id,
+            workspaceId: localNote.workspaceId,
+            title: localNote.title,
+            content: localNote.content,
+            folderId: localNote.folderId,
+            isLocked: localNote.isLocked,
+            version: localNote.version,
+            deviceId: localNote.deviceId,
+            createdAt: localNote.createdAt,
+            updatedAt: localNote.updatedAt,
+          },
+          update: {
+            title: localNote.title,
+            content: localNote.content,
+            version: localNote.version,
+            updatedAt: localNote.updatedAt,
+          },
+        });
+        snapshots[localNote.id] = await decryptFromSync(localNote.content, workspaceId);
+        await prisma.note.update({ where: { id: localNote.id }, data: { pendingSync: false } });
+        notesProcessed++;
+        continue;
+      }
+
+      // Cloud version exists — check for conflict (dual-offline scenario)
+      if (localNote.version <= cloudNote.version && localNote.updatedAt <= cloudNote.updatedAt) {
+        // Cloud is newer; discard local buffer and pull cloud down
+        await prisma.note.update({
+          where: { id: localNote.id },
+          data: {
+            content: cloudNote.content,
+            title: cloudNote.title,
+            version: cloudNote.version,
+            updatedAt: cloudNote.updatedAt,
+            pendingSync: false,
+          },
+        });
+        snapshots[localNote.id] = await decryptFromSync(cloudNote.content, workspaceId);
+        notesProcessed++;
+        continue;
+      }
+
+      const base = snapshots[localNote.id] ?? "";
+      const localPlain = await decryptFromSync(localNote.content, workspaceId);
+      const cloudPlain = await decryptFromSync(cloudNote.content, workspaceId);
+      const result = threeWayMerge(base, localPlain, cloudPlain);
+
+      if (!result.hasConflicts) {
+        const nextVersion = Math.max(localNote.version, cloudNote.version) + 1;
+        const mergedCipher = await encryptForSync(result.merged, workspaceId);
+        await Promise.all([
+          cloudPrisma.note.update({
+            where: { id: localNote.id },
+            data: { content: mergedCipher, version: nextVersion, updatedAt: new Date() },
+          }),
+          prisma.note.update({
+            where: { id: localNote.id },
+            data: { content: mergedCipher, version: nextVersion, pendingSync: false },
+          }),
+        ]);
+        snapshots[localNote.id] = result.merged;
+      } else {
+        // Genuine dual-offline conflict — log it in Neon (visible from any device)
+        await logConflict(workspaceId, "note", localNote.id, localNote.content, cloudNote.content, cloudPrisma);
+        conflictsFound++;
+        // Leave pendingSync=true so the record is retried after the conflict is resolved
+      }
+      notesProcessed++;
+    }
+
+    // ── Flush pending tasks ────────────────────────────────────────────────────
+
+    const pendingTasks = await prisma.task.findMany({
+      where: { workspaceId, pendingSync: true },
+      orderBy: { updatedAt: "asc" },
+    });
+
+    for (const localTask of pendingTasks) {
+      if (await isTombstoned(workspaceId, "task", localTask.id, cloudPrisma)) {
+        await prisma.task.update({ where: { id: localTask.id }, data: { pendingSync: false } });
+        continue;
+      }
+
+      const cloudTask = await cloudPrisma.task.findUnique({ where: { id: localTask.id } });
+
+      if (!cloudTask) {
+        await cloudPrisma.task.upsert({
+          where: { id: localTask.id },
+          create: {
+            id: localTask.id,
+            workspaceId: localTask.workspaceId,
+            noteId: localTask.noteId,
+            title: localTask.title,
+            status: localTask.status,
+            assigneeType: localTask.assigneeType,
+            assigneeId: localTask.assigneeId,
+            fileRefs: localTask.fileRefs,
+            startDate: localTask.startDate,
+            dueDate: localTask.dueDate,
+            version: localTask.version,
+            createdAt: localTask.createdAt,
+            updatedAt: localTask.updatedAt,
+          },
+          update: {
+            status: localTask.status,
+            version: localTask.version,
+            updatedAt: localTask.updatedAt,
+          },
+        });
+        await prisma.task.update({ where: { id: localTask.id }, data: { pendingSync: false } });
+        tasksProcessed++;
+        continue;
+      }
+
+      const winner = lastWriteWins(
+        { id: localTask.id, updatedAt: localTask.updatedAt, version: localTask.version },
+        { id: cloudTask.id, updatedAt: cloudTask.updatedAt, version: cloudTask.version }
+      );
+
+      if (winner === "local") {
+        await cloudPrisma.task.update({
+          where: { id: localTask.id },
+          data: { status: localTask.status, version: localTask.version, updatedAt: localTask.updatedAt },
+        });
+      } else {
+        await prisma.task.update({
+          where: { id: localTask.id },
+          data: { status: cloudTask.status, version: cloudTask.version },
+        });
+      }
+      await prisma.task.update({ where: { id: localTask.id }, data: { pendingSync: false } });
+      tasksProcessed++;
+    }
+
+    // ── Finalize ──────────────────────────────────────────────────────────────
+
+    await saveSnapshots(workspaceId, snapshots, undefined, cloudPrisma);
+    // Mirror snapshots to local PGlite so three-way merge bases are available
+    // locally (e.g. for offline resilience or future single-note merge paths).
+    await saveSnapshots(workspaceId, snapshots, undefined, prisma);
+
+    const cloudSyncState = await cloudPrisma.syncState.upsert({
+      where: { workspaceId },
+      update: { lastSyncedAt: syncStart, cloudVersion: { increment: 1 } },
+      create: { workspaceId, lastSyncedAt: syncStart },
+    });
+
+    // Mirror sync timestamp to local PGlite so the status API (which reads
+    // from local prisma) returns a fresh lastSyncedAt without requiring the
+    // user to press the sync button.
+    await prisma.syncState.updateMany({
+      where: { workspaceId },
+      data: {
+        lastSyncedAt: syncStart,
+        cloudVersion: cloudSyncState.cloudVersion,
+      },
+    });
+
+    const status: SyncStatus = conflictsFound > 0 ? "conflict" : "synced";
+    return { status, notesProcessed, tasksProcessed, conflictsFound };
+  } finally {
+    // Release both the in-process guard and the distributed DB lock.
+    inFlight.delete(workspaceId);
+    await prisma.syncState.updateMany({
+      where: { workspaceId },
+      data: { syncLockedAt: null },
+    }).catch((err) => console.error("[brief/pro-flush] failed to release sync lock:", err));
+  }
+}

package/lib/rate-limit.ts

@@ -0,0 +1,57 @@
+/**
+ * In-process sliding-window rate limiter.
+ * Works for single-process local-first deployment.
+ * For cloud multi-process, swap the store for a Redis-backed implementation.
+ */
+
+type Window = { count: number; resetAt: number };
+const store = new Map<string, Window>();
+
+// Purge expired entries every 5 minutes to prevent memory leaks
+setInterval(() => {
+  const now = Date.now();
+  for (const [key, w] of store) {
+    if (w.resetAt < now) store.delete(key);
+  }
+}, 5 * 60_000);
+
+export type RateLimitResult =
+  | { limited: false }
+  | { limited: true; retryAfter: number };
+
+/**
+ * Check and record a hit for the given key.
+ * @param key     Unique identifier (e.g. IP + route prefix)
+ * @param max     Max requests allowed in windowMs
+ * @param windowMs  Window duration in milliseconds
+ */
+export function rateLimit(
+  key: string,
+  max: number,
+  windowMs: number
+): RateLimitResult {
+  const now = Date.now();
+  const existing = store.get(key);
+
+  if (!existing || existing.resetAt < now) {
+    store.set(key, { count: 1, resetAt: now + windowMs });
+    return { limited: false };
+  }
+
+  existing.count += 1;
+  if (existing.count > max) {
+    const retryAfter = Math.ceil((existing.resetAt - now) / 1000);
+    return { limited: true, retryAfter };
+  }
+
+  return { limited: false };
+}
+
+/** Extract client IP from Next.js request headers. */
+export function getClientIp(req: Request): string {
+  return (
+    req.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ??
+    req.headers.get("x-real-ip") ??
+    "unknown"
+  );
+}

package/lib/stripe.ts

@@ -0,0 +1,38 @@
+import Stripe from "stripe";
+
+// Hard-fail at request time if the key is missing — never silently fall back to test mode.
+// During `next build` the module is imported but stripe is never called, so this is safe.
+const _secretKey = process.env.STRIPE_SECRET_KEY;
+
+export function getStripe(): Stripe {
+  if (!_secretKey) throw new Error("STRIPE_SECRET_KEY env var is required");
+  return _stripe;
+}
+
+// Module-level instance is fine for server-side use (Node.js singleton).
+// We initialise with the real key when present, or a dummy string during build
+// (Next.js evaluates module level code at build time with empty env).
+const _stripe = new Stripe(_secretKey ?? "sk_build_placeholder_never_used", {
+  apiVersion: "2026-05-27.dahlia",
+});
+
+/**
+ * Use `stripe` for Stripe API calls. It throws at call time if STRIPE_SECRET_KEY
+ * is not set in the environment, keeping production safe.
+ */
+export const stripe: Stripe = new Proxy(_stripe, {
+  get(target, prop) {
+    if (!_secretKey) {
+      throw new Error(
+        `STRIPE_SECRET_KEY is not configured. Cannot call stripe.${String(prop)}()`
+      );
+    }
+    const val = (target as unknown as Record<string | symbol, unknown>)[prop];
+    return typeof val === "function" ? val.bind(target) : val;
+  },
+});
+
+export const PRICE_ID_PERSONAL_PRO = process.env.STRIPE_PRICE_ID_PERSONAL_PRO ?? "";
+export const PRICE_ID_TEAM_PRO = process.env.STRIPE_PRICE_ID_TEAM_PRO ?? "";
+export const APP_URL = process.env.NEXT_PUBLIC_APP_URL ?? "http://localhost:3000";
+export const STRIPE_PUBLISHABLE_KEY = process.env.NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY ?? "";