auditview 0.1.0__tar.gz

auditview-0.1.0/PKG-INFO

@@ -0,0 +1,11 @@
+Metadata-Version: 2.4
+Name: auditview
+Version: 0.1.0
+Summary: Code review/audit tool
+Requires-Python: >=3.14
+Description-Content-Type: text/markdown
+Requires-Dist: flask>=3.1
+Requires-Dist: waitress>=3.0
+Requires-Dist: watchdog>=6.0
+Requires-Dist: pathspec>=0.12
+Requires-Dist: apsw>=3.49

auditview-0.1.0/auditview/__main__.py

@@ -0,0 +1,29 @@
+import argparse
+import os
+
+from waitress import serve
+from auditview.app import create_app
+
+
+def main():
+    p = argparse.ArgumentParser(description="auditview — line-level code review tool")
+    p.add_argument("path", nargs="?", default=".",
+                   help="Root folder to audit (default: current directory)")
+    p.add_argument("--db", metavar="FILE",
+                   help="SQLite database file path (default: <root>/.auditview.db)")
+    p.add_argument("--host", default="127.0.0.1", help="Bind host (default: 127.0.0.1)")
+    p.add_argument("--port", type=int, default=5000, help="Bind port (default: 5000)")
+    args = p.parse_args()
+
+    root = os.path.abspath(args.path)
+    db_path = os.path.abspath(args.db) if args.db else os.path.join(root, ".auditview.db")
+
+    app = create_app(db_path, root)
+    print(f"auditview  root={root}")
+    print(f"           db={db_path}")
+    print(f"           http://{args.host}:{args.port}")
+    serve(app, host=args.host, port=args.port)
+
+
+if __name__ == "__main__":
+    main()

auditview-0.1.0/auditview/api/checkpoints.py

@@ -0,0 +1,59 @@
+from flask import Blueprint, jsonify, current_app
+from auditview.db.connection import open_db
+from auditview.db.checkpoint import CheckpointManager
+
+bp = Blueprint("checkpoints", __name__)
+
+
+@bp.route("/sessions/<int:session_id>/checkpoints", methods=["GET"])
+def list_checkpoints(session_id):
+    conn = open_db(current_app.config["DB_PATH"])
+    is_apsw = getattr(conn, '_is_apsw', False)
+    cur = conn.cursor()
+
+    row = cur.execute("SELECT id FROM sessions WHERE id = ?", (session_id,)).fetchone()
+    if row is None:
+        return jsonify({"error": "Session not found"}), 404
+
+    rows = cur.execute(
+        "SELECT id, label, created_at FROM checkpoints WHERE session_id = ? ORDER BY id DESC",
+        (session_id,),
+    ).fetchall()
+
+    def to_dict(r):
+        if is_apsw:
+            return {"id": r[0], "label": r[1], "created_at": r[2]}
+        return {"id": r["id"], "label": r["label"], "created_at": r["created_at"]}
+
+    return jsonify([to_dict(r) for r in rows])
+
+
+@bp.route("/sessions/<int:session_id>/checkpoints/<int:checkpoint_id>/revert", methods=["POST"])
+def revert_checkpoint(session_id, checkpoint_id):
+    conn = open_db(current_app.config["DB_PATH"])
+    is_apsw = getattr(conn, '_is_apsw', False)
+    cur = conn.cursor()
+
+    row = cur.execute("SELECT id FROM sessions WHERE id = ?", (session_id,)).fetchone()
+    if row is None:
+        return jsonify({"error": "Session not found"}), 404
+
+    cm = CheckpointManager(conn)
+    if not cm.supports_checkpoints():
+        return jsonify({"error": "Checkpoints not supported: apsw not available"}), 409
+
+    cp_row = cur.execute(
+        "SELECT id FROM checkpoints WHERE id = ? AND session_id = ?",
+        (checkpoint_id, session_id),
+    ).fetchone()
+    if cp_row is None:
+        return jsonify({"error": "Checkpoint not found"}), 404
+
+    try:
+        cm.revert(checkpoint_id)
+    except KeyError as e:
+        return jsonify({"error": str(e)}), 404
+    except Exception as e:
+        return jsonify({"error": f"Revert failed: {e}"}), 500
+
+    return jsonify({"reverted": True})

auditview-0.1.0/auditview/api/config.py

@@ -0,0 +1,11 @@
+from flask import Blueprint, jsonify, current_app
+
+bp = Blueprint("config", __name__)
+
+
+@bp.route("/config", methods=["GET"])
+def get_config():
+    return jsonify({
+        "root_path": current_app.config["ROOT_PATH"],
+        "db_path": current_app.config["DB_PATH"],
+    })

auditview-0.1.0/auditview/api/coverage.py

@@ -0,0 +1,48 @@
+from flask import Blueprint, jsonify, current_app
+from auditview.db.connection import open_db
+from auditview.db.checkpoint import CheckpointManager
+
+bp = Blueprint("coverage", __name__)
+
+
+@bp.route("/sessions/<int:session_id>/coverage", methods=["GET"])
+def get_coverage(session_id):
+    conn = open_db(current_app.config["DB_PATH"])
+    is_apsw = getattr(conn, '_is_apsw', False)
+    cur = conn.cursor()
+
+    row = cur.execute("SELECT id FROM sessions WHERE id = ?", (session_id,)).fetchone()
+    if row is None:
+        return jsonify({"error": "Session not found"}), 404
+
+    # Aggregate using cached countable_lines and indexed reviewed_lines count
+    agg = cur.execute(
+        """
+        SELECT
+            COUNT(f.id) AS total_files,
+            COALESCE(SUM(f.countable_lines), 0) AS total_countable,
+            COUNT(DISTINCT rl.file_path || '|' || rl.line_hash || '|' || rl.context_hash)
+                AS total_reviewed
+        FROM files f
+        LEFT JOIN reviewed_lines rl
+            ON rl.session_id = f.session_id AND rl.file_path = f.rel_path
+        WHERE f.session_id = ? AND f.countable_lines IS NOT NULL
+        """,
+        (session_id,),
+    ).fetchone()
+
+    total_files = agg[0] if is_apsw else agg["total_files"]
+    total_countable = agg[1] if is_apsw else agg["total_countable"]
+    total_reviewed = agg[2] if is_apsw else agg["total_reviewed"]
+
+    coverage = total_reviewed / total_countable if total_countable > 0 else 0.0
+
+    cm = CheckpointManager(conn)
+
+    return jsonify({
+        "total_files": total_files,
+        "total_countable_lines": total_countable,
+        "total_reviewed_lines": total_reviewed,
+        "coverage": coverage,
+        "supports_checkpoints": cm.supports_checkpoints(),
+    })

auditview-0.1.0/auditview/api/events.py

@@ -0,0 +1,34 @@
+import json
+import queue
+
+from flask import Blueprint, jsonify, current_app, Response
+
+from auditview.db.connection import open_db
+
+bp = Blueprint("events", __name__)
+
+
+@bp.route("/sessions/<int:session_id>/events", methods=["GET"])
+def event_stream(session_id):
+    conn = open_db(current_app.config["DB_PATH"])
+    cur = conn.cursor()
+    row = cur.execute("SELECT id FROM sessions WHERE id = ?", (session_id,)).fetchone()
+    conn.close()
+    if row is None:
+        return jsonify({"error": "Session not found"}), 404
+
+    watcher = current_app.watcher
+    q = watcher.register_client(session_id)
+
+    def generate():
+        try:
+            while True:
+                try:
+                    event = q.get(timeout=15)
+                    yield f"event: {event['type']}\ndata: {json.dumps({k: v for k, v in event.items() if k != 'type'})}\n\n"
+                except queue.Empty:
+                    yield "event: heartbeat\ndata: {}\n\n"
+        finally:
+            watcher.unregister_client(session_id, q)
+
+    return Response(generate(), content_type="text/event-stream")

auditview-0.1.0/auditview/api/files.py

@@ -0,0 +1,207 @@
+import os
+from flask import Blueprint, jsonify, request, current_app
+from auditview.db.connection import open_db
+from auditview.core.hashing import line_hash, context_hash
+from auditview.core.coverage import is_countable_line
+from auditview.core.reconciler import reconcile_file
+from auditview.core.scanner import scan_folder
+from auditview.api.util import safe_path
+
+bp = Blueprint("files", __name__)
+
+
+def _get_session(cur, session_id, is_apsw):
+    row = cur.execute(
+        "SELECT id, root_path, exclusion_patterns FROM sessions WHERE id = ?",
+        (session_id,),
+    ).fetchone()
+    if row is None:
+        return None
+    if is_apsw:
+        return {"id": row[0], "root_path": row[1], "exclusion_patterns": row[2]}
+    return dict(row)
+
+
+@bp.route("/sessions/<int:session_id>/files", methods=["GET"])
+def list_files(session_id):
+    conn = open_db(current_app.config["DB_PATH"])
+    is_apsw = getattr(conn, '_is_apsw', False)
+    cur = conn.cursor()
+
+    session = _get_session(cur, session_id, is_apsw)
+    if session is None:
+        return jsonify({"error": "Session not found"}), 404
+
+    root_path = session["root_path"]
+    exclusion_patterns = session["exclusion_patterns"]
+
+    rel_paths = scan_folder(root_path, exclusion_patterns)
+    rel_path_set = set(rel_paths)
+
+    for rel_path in rel_paths:
+        cur.execute(
+            "INSERT INTO files (session_id, rel_path) VALUES (?, ?) ON CONFLICT DO NOTHING",
+            (session_id, rel_path),
+        )
+
+    # Fetch cached countable_lines per file
+    file_rows = cur.execute(
+        "SELECT rel_path, countable_lines FROM files WHERE session_id = ?",
+        (session_id,),
+    ).fetchall()
+    countable_map = {}
+    uncached = []
+    for r in file_rows:
+        rp = r[0] if is_apsw else r["rel_path"]
+        cl = r[1] if is_apsw else r["countable_lines"]
+        countable_map[rp] = cl
+        if cl is None and rp in rel_path_set:
+            uncached.append(rp)
+
+    # Compute and cache for files not yet indexed
+    for rp in uncached:
+        ext = os.path.splitext(rp)[1].lower()
+        full_path = os.path.join(root_path, rp)
+        countable = 0
+        if os.path.isfile(full_path):
+            try:
+                with open(full_path, "r", encoding="utf-8", errors="replace") as f:
+                    countable = sum(1 for l in f.read().splitlines() if is_countable_line(l, ext))
+            except OSError:
+                pass
+        cur.execute(
+            "UPDATE files SET countable_lines = ? WHERE session_id = ? AND rel_path = ?",
+            (countable, session_id, rp),
+        )
+        countable_map[rp] = countable
+
+    # Batch: reviewed counts per file
+    reviewed_rows = cur.execute(
+        "SELECT file_path, COUNT(*) FROM reviewed_lines WHERE session_id = ? GROUP BY file_path",
+        (session_id,),
+    ).fetchall()
+    reviewed_map = {(r[0] if is_apsw else r["file_path"]): (r[1] if is_apsw else r[1])
+                    for r in reviewed_rows}
+
+    # Batch: note/todo counts per file (live only)
+    note_rows = cur.execute(
+        "SELECT file_path, "
+        "SUM(CASE WHEN is_todo=0 THEN 1 ELSE 0 END), "
+        "SUM(CASE WHEN is_todo=1 THEN 1 ELSE 0 END) "
+        "FROM notes WHERE session_id = ? AND is_orphaned=0 GROUP BY file_path",
+        (session_id,),
+    ).fetchall()
+    notes_map = {(r[0] if is_apsw else r["file_path"]): (
+        (r[1] if is_apsw else r[1]) or 0,
+        (r[2] if is_apsw else r[2]) or 0,
+    ) for r in note_rows}
+
+    result = []
+    for rel_path in rel_paths:
+        countable = countable_map.get(rel_path) or 0
+        reviewed = reviewed_map.get(rel_path, 0)
+        coverage = reviewed / countable if countable > 0 else 0.0
+        notes_c, todos_c = notes_map.get(rel_path, (0, 0))
+
+        if countable == 0:
+            status = "empty"
+        elif reviewed == 0:
+            status = "not_viewed"
+        elif reviewed >= countable:
+            status = "reviewed"
+        else:
+            status = "partial"
+
+        result.append({
+            "rel_path": rel_path,
+            "countable_lines": countable,
+            "reviewed_lines": reviewed,
+            "coverage": coverage,
+            "status": status,
+            "notes_count": notes_c,
+            "todos_count": todos_c,
+        })
+
+    return jsonify(result)
+
+
+@bp.route("/sessions/<int:session_id>/files/<path:fpath>", methods=["GET"])
+def get_file(session_id, fpath):
+    conn = open_db(current_app.config["DB_PATH"])
+    is_apsw = getattr(conn, '_is_apsw', False)
+    cur = conn.cursor()
+
+    session = _get_session(cur, session_id, is_apsw)
+    if session is None:
+        return jsonify({"error": "Session not found"}), 404
+
+    root_path = session["root_path"]
+    full_path = safe_path(root_path, fpath)
+    if full_path is None:
+        return jsonify({"error": "Invalid path"}), 400
+
+    if not os.path.isfile(full_path):
+        return jsonify({"error": "File not found"}), 404
+
+    file_row = cur.execute(
+        "SELECT last_mtime FROM files WHERE session_id = ? AND rel_path = ?",
+        (session_id, fpath),
+    ).fetchone()
+    if file_row is None:
+        return jsonify({"error": "File not tracked in this session — call list_files first"}), 404
+
+    current_mtime = os.path.getmtime(full_path)
+    stored_mtime = file_row[0] if is_apsw else file_row["last_mtime"]
+    if stored_mtime is None or abs(stored_mtime - current_mtime) > 1e-6:
+        reconcile_file(conn, session_id, fpath, root_path)
+
+    skip_comments = request.args.get("skip_comments", "1") != "0"
+    ext = os.path.splitext(fpath)[1].lower()
+
+    with open(full_path, "r", encoding="utf-8", errors="replace") as f:
+        content = f.read()
+    lines = content.splitlines()
+
+    reviewed_rows = cur.execute(
+        "SELECT line_hash, context_hash FROM reviewed_lines "
+        "WHERE session_id = ? AND file_path = ?",
+        (session_id, fpath),
+    ).fetchall()
+
+    if is_apsw:
+        reviewed_set = {(r[0], r[1]) for r in reviewed_rows}
+    else:
+        reviewed_set = {(r["line_hash"], r["context_hash"]) for r in reviewed_rows}
+
+    result_lines = []
+    for i, line_content in enumerate(lines):
+        prev_content = lines[i - 1] if i > 0 else ""
+        next_content = lines[i + 1] if i < len(lines) - 1 else ""
+        lh = line_hash(line_content)
+        ch = context_hash(prev_content, line_content, next_content)
+        result_lines.append({
+            "line_no": i + 1,
+            "content": line_content,
+            "line_hash": lh,
+            "context_hash": ch,
+            "is_reviewed": (lh, ch) in reviewed_set,
+            "is_countable": is_countable_line(line_content, ext, skip_comments),
+        })
+
+    note_rows = cur.execute(
+        "SELECT id, start_line, end_line, content, is_todo, is_orphaned, snapshot_text, created_at "
+        "FROM notes WHERE session_id = ? AND file_path = ? ORDER BY start_line",
+        (session_id, fpath),
+    ).fetchall()
+
+    def note_to_dict(r):
+        if is_apsw:
+            return {"id": r[0], "start_line": r[1], "end_line": r[2], "content": r[3],
+                    "is_todo": bool(r[4]), "is_orphaned": bool(r[5]),
+                    "snapshot_text": r[6], "created_at": r[7]}
+        return {"id": r["id"], "start_line": r["start_line"], "end_line": r["end_line"],
+                "content": r["content"], "is_todo": bool(r["is_todo"]),
+                "is_orphaned": bool(r["is_orphaned"]),
+                "snapshot_text": r["snapshot_text"], "created_at": r["created_at"]}
+
+    return jsonify({"lines": result_lines, "notes": [note_to_dict(r) for r in note_rows]})

auditview-0.1.0/auditview/api/lines.py

@@ -0,0 +1,63 @@
+from flask import Blueprint, request, jsonify, current_app
+from auditview.db.connection import open_db
+from auditview.api.util import safe_path
+
+bp = Blueprint("lines", __name__)
+
+
+@bp.route("/sessions/<int:session_id>/lines/mark", methods=["POST"])
+def mark_lines(session_id):
+    conn = open_db(current_app.config["DB_PATH"])
+    is_apsw = getattr(conn, '_is_apsw', False)
+    cur = conn.cursor()
+
+    row = cur.execute(
+        "SELECT id, root_path FROM sessions WHERE id = ?", (session_id,)
+    ).fetchone()
+    if row is None:
+        return jsonify({"error": "Session not found"}), 404
+    root_path = row[1] if is_apsw else row["root_path"]
+
+    data = request.get_json(force=True, silent=True) or {}
+    file_path = data.get("file_path")
+    lines = data.get("lines")
+    reviewed = data.get("reviewed")
+
+    if not file_path or lines is None or reviewed is None:
+        return jsonify({"error": "file_path, lines, and reviewed are required"}), 400
+
+    if not isinstance(lines, list):
+        return jsonify({"error": "lines must be an array"}), 400
+
+    if safe_path(root_path, file_path) is None:
+        return jsonify({"error": "Invalid path"}), 400
+
+    count = 0
+    conn.begin()
+    try:
+        for line in lines:
+            lh = line.get("line_hash")
+            ch = line.get("context_hash")
+            ln = line.get("line_no")
+            if not lh or not ch or ln is None:
+                continue
+            if reviewed:
+                cur.execute(
+                    "INSERT OR REPLACE INTO reviewed_lines "
+                    "(session_id, file_path, line_hash, context_hash, line_no) "
+                    "VALUES (?, ?, ?, ?, ?)",
+                    (session_id, file_path, lh, ch, ln),
+                )
+            else:
+                cur.execute(
+                    "DELETE FROM reviewed_lines "
+                    "WHERE session_id = ? AND file_path = ? AND line_hash = ? AND context_hash = ?",
+                    (session_id, file_path, lh, ch),
+                )
+            count += 1
+        conn.commit()
+    except Exception:
+        conn.rollback()
+        raise
+
+    return jsonify({"updated": count})

auditview-0.1.0/auditview/api/notes.py

@@ -0,0 +1,185 @@
+import os
+from flask import Blueprint, request, jsonify, current_app
+from auditview.db.connection import open_db
+from auditview.core.hashing import line_hash
+from auditview.api.util import safe_path
+
+bp = Blueprint("notes", __name__)
+
+
+def _note_row(r, is_apsw):
+    if is_apsw:
+        return {
+            "id": r[0],
+            "file_path": r[1],
+            "start_line": r[2],
+            "end_line": r[3],
+            "content": r[4],
+            "is_todo": bool(r[5]),
+            "is_orphaned": bool(r[6]),
+            "snapshot_text": r[7],
+            "created_at": r[8],
+        }
+    return {
+        "id": r["id"],
+        "file_path": r["file_path"],
+        "start_line": r["start_line"],
+        "end_line": r["end_line"],
+        "content": r["content"],
+        "is_todo": bool(r["is_todo"]),
+        "is_orphaned": bool(r["is_orphaned"]),
+        "snapshot_text": r["snapshot_text"],
+        "created_at": r["created_at"],
+    }
+
+
+@bp.route("/sessions/<int:session_id>/notes", methods=["GET"])
+def list_notes(session_id):
+    conn = open_db(current_app.config["DB_PATH"])
+    is_apsw = getattr(conn, '_is_apsw', False)
+    cur = conn.cursor()
+
+    row = cur.execute("SELECT id FROM sessions WHERE id = ?", (session_id,)).fetchone()
+    if row is None:
+        return jsonify({"error": "Session not found"}), 404
+
+    rows = cur.execute(
+        "SELECT id, file_path, start_line, end_line, content, is_todo, is_orphaned, snapshot_text, created_at "
+        "FROM notes WHERE session_id = ? ORDER BY file_path, start_line",
+        (session_id,),
+    ).fetchall()
+
+    return jsonify([_note_row(r, is_apsw) for r in rows])
+
+
+@bp.route("/sessions/<int:session_id>/notes", methods=["POST"])
+def create_note(session_id):
+    conn = open_db(current_app.config["DB_PATH"])
+    is_apsw = getattr(conn, '_is_apsw', False)
+    cur = conn.cursor()
+
+    session_row = cur.execute(
+        "SELECT id, root_path FROM sessions WHERE id = ?", (session_id,)
+    ).fetchone()
+    if session_row is None:
+        return jsonify({"error": "Session not found"}), 404
+
+    root_path = session_row[1] if is_apsw else session_row["root_path"]
+
+    data = request.get_json(force=True, silent=True) or {}
+    file_path = data.get("file_path", "").strip()
+    start_line = data.get("start_line")
+    end_line = data.get("end_line")
+    content = data.get("content", "").strip()
+    is_todo = bool(data.get("is_todo", False))
+
+    if not file_path:
+        return jsonify({"error": "file_path is required"}), 400
+    if not content:
+        return jsonify({"error": "content is required"}), 400
+    if start_line is None or end_line is None:
+        return jsonify({"error": "start_line and end_line are required"}), 400
+    if not isinstance(start_line, int) or not isinstance(end_line, int):
+        return jsonify({"error": "start_line and end_line must be integers"}), 400
+    if start_line > end_line or start_line < 1:
+        return jsonify({"error": "invalid line range"}), 400
+
+    full_path = safe_path(root_path, file_path)
+    if full_path is None:
+        return jsonify({"error": "Invalid path"}), 400
+    if not os.path.isfile(full_path):
+        return jsonify({"error": "File not found"}), 404
+
+    with open(full_path, "r", encoding="utf-8", errors="replace") as f:
+        file_lines = f.read().splitlines()
+
+    if start_line > len(file_lines) or end_line > len(file_lines):
+        return jsonify({"error": "line range out of bounds"}), 400
+
+    start_idx = start_line - 1
+    end_idx = end_line - 1
+    start_hash = line_hash(file_lines[start_idx])
+    end_hash = line_hash(file_lines[end_idx])
+    snapshot_text = "\n".join(file_lines[start_idx:end_idx + 1])
+
+    cur.execute(
+        "INSERT INTO notes (session_id, file_path, start_line, end_line, start_hash, end_hash, snapshot_text, content, is_todo) "
+        "VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)",
+        (session_id, file_path, start_line, end_line, start_hash, end_hash, snapshot_text, content, int(is_todo)),
+    )
+    if is_apsw:
+        row_id = conn.last_insert_rowid()
+    else:
+        row_id = cur.lastrowid
+
+    row = cur.execute(
+        "SELECT id, file_path, start_line, end_line, content, is_todo, is_orphaned, snapshot_text, created_at "
+        "FROM notes WHERE id = ?",
+        (row_id,),
+    ).fetchone()
+
+    return jsonify(_note_row(row, is_apsw)), 201
+
+
+@bp.route("/sessions/<int:session_id>/notes/<int:note_id>", methods=["PATCH"])
+def update_note(session_id, note_id):
+    conn = open_db(current_app.config["DB_PATH"])
+    is_apsw = getattr(conn, '_is_apsw', False)
+    cur = conn.cursor()
+
+    row = cur.execute("SELECT id FROM sessions WHERE id = ?", (session_id,)).fetchone()
+    if row is None:
+        return jsonify({"error": "Session not found"}), 404
+
+    note_row = cur.execute(
+        "SELECT id FROM notes WHERE id = ? AND session_id = ?", (note_id, session_id)
+    ).fetchone()
+    if note_row is None:
+        return jsonify({"error": "Note not found"}), 404
+
+    data = request.get_json(force=True, silent=True) or {}
+    updates = {}
+    if "content" in data:
+        content = data["content"].strip()
+        if not content:
+            return jsonify({"error": "content cannot be empty"}), 400
+        updates["content"] = content
+    if "is_todo" in data:
+        updates["is_todo"] = int(bool(data["is_todo"]))
+
+    if not updates:
+        return jsonify({"error": "nothing to update"}), 400
+
+    set_clause = ", ".join(f"{k} = ?" for k in updates)
+    cur.execute(
+        f"UPDATE notes SET {set_clause} WHERE id = ?",
+        (*updates.values(), note_id),
+    )
+
+    row = cur.execute(
+        "SELECT id, file_path, start_line, end_line, content, is_todo, is_orphaned, snapshot_text, created_at "
+        "FROM notes WHERE id = ?",
+        (note_id,),
+    ).fetchone()
+    return jsonify(_note_row(row, is_apsw))
+
+
+@bp.route("/sessions/<int:session_id>/notes/<int:note_id>", methods=["DELETE"])
+def delete_note(session_id, note_id):
+    conn = open_db(current_app.config["DB_PATH"])
+    is_apsw = getattr(conn, '_is_apsw', False)
+    cur = conn.cursor()
+
+    row = cur.execute("SELECT id FROM sessions WHERE id = ?", (session_id,)).fetchone()
+    if row is None:
+        return jsonify({"error": "Session not found"}), 404
+
+    note_row = cur.execute(
+        "SELECT id FROM notes WHERE id = ? AND session_id = ?", (note_id, session_id)
+    ).fetchone()
+    if note_row is None:
+        return jsonify({"error": "Note not found"}), 404
+
+    cur.execute("DELETE FROM notes WHERE id = ?", (note_id,))
+
+    return jsonify({"deleted": True})