67 Commits

Author	SHA1	Message	Date
Claude Opus 4.8	fa7ae033b5	Add permission-revocation handling for live and offline sessions (#39) ... Revoking write access must terminate live sessions and let a user with pending offline edits export them rather than lose them silently. Backend (generic, reused by M5 grants #53): - packages/shared: POND_ACCESS_CHANGED_CHANNEL, the LISTEN/NOTIFY channel shared by api and collab. - api: PondAccessNotifier emits pg_notify(pond_access_changed, pondId) on a permission-relevant change; the single generic seam for revocation. Wired into pond soft-delete as the interim trigger (see==modify until #53). - collab: a dedicated-connection LISTEN listener (LISTEN is connection- bound, not pooled) that, on a notification, closes every open connection to the pond's open pages. Clients then reconnect and the api re-issues a token reflecting current access (downgrade to ro, or 403/404). Reconnects and re-LISTENs if its connection drops. Frontend: - use-collab-provider: a refused token (403/404) on (re)connect sets accessRevoked and stops the reconnect loop; exposes discardLocal. - AccessRevokedDialog: keeps local content visible and offers Markdown copy/download (derived from the live editor doc, so offline edits are included) and an explicit discard that clears IndexedDB. de+en strings. Tests: collab DB-backed integration test proves a direct NOTIFY closes a live session within seconds (AC1) and leaves unrelated ponds untouched; listener unit tests; api test asserts soft-delete fires the notifier; web test for the export Markdown derivation. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PGdhRiwU1WRL4XxJfZYipY	2026-07-09 07:01:46 +02:00
Claude Opus 4.8	af81b50fa6	Add offline editing: local persistence, PWA shell, offline resolution (#38) ... Editing continues without a connection and merges conflict-free on reconnect (ADR 0003, realtime-collaboration.md §Offline). - y-indexeddb mirrors every opened page's Y.Doc to IndexedDB, sharing the document with the collab provider. The local copy is discarded when the page is left after a successful server sync (bounding IndexedDB growth) and kept otherwise so offline edits survive to the next visit. - vite-plugin-pwa service worker precaches the app shell (build assets only) with a navigation fallback; `/api` and `/collab` are denylisted and there is no runtime caching, so API responses are never cached or poisoned. - Offline page resolution WITHOUT caching API responses: the app itself persists the small metadata it needs to reopen a visited page (page/pond ids + slugs, bounded LRU in localStorage) and the last signed-in user, so after an offline tab reload the app stays signed in, resolves the page, and restores its content from IndexedDB. Both are revalidated when the network returns (a 401 clears the cached user). - Local-only UI: a banner when there are edits held only on this device (provider `onUnsyncedChanges`), de + en. Tests: `page-cache` unit test (remember/recall + bounded eviction); a new `offline` e2e pack (validated locally against the full stack and wired into CI): edit, reload while offline (shell from the SW, content from IndexedDB), assert an API call fails offline (no SW API caching), then reconnect and a second client converges. The e2e static server serves `.webmanifest`. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PGdhRiwU1WRL4XxJfZYipY	2026-07-08 22:08:55 +02:00
Claude Opus 4.8	63fe6af6b0	Add remote cursors and a presence strip (#37) ... Seeing other participants live (ADR 0003/0004, realtime-collaboration.md §Awareness): - The collaboration-caret extension renders remote carets and selections with a name flag and a per-user colour. Colours come from a small, hand-picked palette hashed by user id (FNV-1a), so they are stable across sessions; a unit test asserts each palette colour clears WCAG AA contrast (4.5:1) against the white label text. - A presence strip at the top of the page shows an avatar (initials) per connected participant, deduplicated by user id, with an overflow count. Read-only participants appear in the strip (with a marker) but broadcast no caret — the caret render suppresses read-only users — so the same awareness feed drives both cursors and presence. Own identity (id + display name) comes from the auth context into the awareness `user` field. - Presence updates on every awareness change, so a disconnect drops the participant within seconds. The collab e2e pack gains a test: two browsers see each other in the presence strip, one participant's named caret appears in the other's editor, and disconnecting removes them. Validated locally against the full stack. de + en strings and cursor/presence styles added. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PGdhRiwU1WRL4XxJfZYipY	2026-07-08 18:22:41 +02:00
Claude Opus 4.8	7d04c0b594	Switch the editor to live collaboration (#36) ... The editor now edits over the collaboration server instead of REST — the moment Dorfteich becomes collaborative (ADR 0003, realtime-collaboration.md). Web: - New `useCollabProvider` hook binds a page's Y.Doc to a HocuspocusProvider. The document loads and persists through the collab server (#35); there is no REST autosave and no REST seed (a REST seed would fork the doc lineage and duplicate content). The collab token is fetched lazily on every (re)connect via an async token function, so an expired token is replaced transparently and a permission change takes effect on the next reconnect. - Connection-state UI replaces the save indicator: connecting / connected ("Live") / reconnecting / offline, driven by provider status + navigator online state. Read-only (`ro`) tokens make the editor non-editable with a reason; an oversize-document stateless error (#35) surfaces a banner. - Removed `use-page-autosave.ts` and `yjs-base64.ts` (no longer used). API: - `PUT /pages/:id/state` is retired and returns 410 `rest_state_write_retired` (the criterion deferred here from #35). Collab is the sole writer of page state; the read paths remain. Removed the now-dead `saveState` service. e2e / CI: - The e2e static server proxies the `/collab` WebSocket upgrade (mirrors Caddy); vite dev gains a `/collab` ws proxy. The auth-e2e CI job starts the collab server and runs a new collab pack. - New `collab.spec.ts`: two browsers converge on one page (the milestone headline), and offline edits continue locally and sync on reconnect. The read-only live assertion is a `test.fixme` until real read-only grants exist — under interim access seeing and modifying coincide, so no `ro` token is issued yet (that arrives with #53). Reworked the api/trash tests and the content editor-basics test off the retired REST write path. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PGdhRiwU1WRL4XxJfZYipY	2026-07-08 18:00:19 +02:00
Claude Sonnet 5	a645763679	Add page trash: soft delete, restore, and purge job (#31) ... Backend: a generic maintenance-job scheduler (SchedulerService, `jobs` table) that any later maintenance job registers with instead of growing its own timer loop. Due-ness and the run-mutex both live in the DB row (`lastRunAt` survives a restart; claiming a due job is one atomic `UPDATE ... WHERE status != 'RUNNING'`), and an injectable ClockService lets tests simulate retention elapsing without waiting or faking the global clock. Trash endpoints: GET /ponds/:id/trash (list), POST /pages/:id/restore, DELETE /pages/:id/purge (manual, bypasses retention) — all sharing the same purge logic as the scheduled daily job (default 30-day retention, new trash.retentionDays instance setting). Purging deletes a page's content cache, update log, and attachment files/quota; page_versions is a placeholder until M3 exists. Direct navigation to a trashed page now 404s with a distinguishable `page_trashed` code for editors (a plain 404 for everyone else) instead of the generic not-found. Attachment.pageId — added in #27 but never wired up — now gets set on every page state save to whichever page's document currently embeds the file, which is what lets purge find a page's files. Frontend: a per-pond trash view (restore/purge), a "move to trash" action with confirmation in the page menu, and a trash link in the sidebar for pond owners. Also fixes react-query retrying 4xx responses for several seconds by default, which was masking the trash-hint 404 in the UI (and would have affected any other not-found/permission error the same way). Closes #31	2026-07-08 12:48:17 +02:00
Claude Sonnet 5	c9011cb44f	Add Markdown copy, paste, and per-page export endpoint (#30) ... Wires docToMarkdown/markdownToDoc into the editor clipboard: copying selected content puts Markdown on text/plain alongside the browser's own HTML (so pasting into a plain-text destination yields Markdown), and pasting plain text that looks like a Markdown document converts it to rich nodes; content with real HTML on the clipboard is left to ProseMirror's normal HTML-based paste, and the heuristic requires two or more distinct Markdown-shaped lines (or a fenced code block) so ordinary prose is never mangled. Both directions need the parsed/selected doc re-hydrated against whichever schema instance is on the other side of the boundary: the canonical editorSchema (packages/shared) for markdownToDoc's output before inserting it into the live view, and the live view's schema wrapped back into editorSchema before handing a slice to docToMarkdown — they're structurally identical but not the same object, and ProseMirror's content checks are identity-based. Adds GET /pages/:id/export/markdown (downloads <slug>.md), serving the already-derived page_content_cache.markdown (#23) rather than re-decoding the Yjs state. "Copy as Markdown" and "Download as Markdown" actions in the page header both read from that same endpoint, so they always agree with each other and with the last saved state. Closes #30	2026-07-08 12:05:11 +02:00
Claude Sonnet 5	b5cc4c34b8	Add link UX: edit URL and open in new tab (#29) ... A bubble menu on link selection offers "edit URL", "open in new tab", and "remove link"; Mod-k opens the same editor for the current selection (creating a link if there isn't one yet), and the toolbar button does the same. Invalid protocols (e.g. javascript:) show a localized inline error instead of silently no-oping. Pasting a URL over selected text links it instead of replacing the text. Links always render with target="_blank" so read mode opens them in a new tab by default; edit mode suppresses the resulting navigate-on- click (Mod-click still follows it), since a plain click there should place the cursor instead. Closes #29	2026-07-08 11:50:34 +02:00
Claude Sonnet 5	c8be3cd85e	Add image paste and insert in the editor (#28) ... Paste and drag-and-drop of image files upload via the #27 API and insert a real image node only once the upload succeeds; the in-flight state is a ProseMirror decoration, not a document node, so a failed upload cannot leave anything broken behind (it shows a transient inline error instead). The toolbar's image button opens a native file picker into the same upload path. Selecting an image reveals inline alt-text and width-preset (small/medium/full) controls. Also fixes the image node's parseDOM, which had no getAttrs and would drop the required fileId attribute on internal copy/paste. Closes #28	2026-07-08 11:30:25 +02:00
Claude Sonnet 5	0fae699018	Add file storage service and image upload API (#27) ... Implements the FileStorage abstraction (uploads/<pondId>/<fileId> on the mounted volume), the attachments model, and POST /ponds/:id/files, GET /media/:fileId, DELETE /files/:id. Uploads are validated by sniffing magic bytes rather than trusting the client's Content-Type/filename (catches a renamed .html-as-.png), checked against the max_file_bytes and storage_bytes quotas, and served with nosniff + immutable caching. Closes #27	2026-07-08 10:35:03 +02:00
Claude Sonnet 5	49beb45b3e	Add pond sidebar with page list, sort modes, and pond switcher (#26) ... GET /ponds/:id/pages lists a pond's pages ordered by the pond's persisted sidebarSort setting (alpha/created; manual arrives with #45). The sidebar consumes it to show the page list with an active-page highlight, an owner-only sort switch (persists via the existing PATCH /ponds/:id), and an inline "new page" flow. The top bar gains a pond switcher; a new /p/:pondSlug route gives it somewhere to land, redirecting to the pond's first page once loaded. Sidebar collapse gains a Ctrl/Cmd+\ shortcut and a slightly refined transition. Closes #26	2026-07-06 12:37:44 +02:00
Claude Sonnet 5	076883a9a6	Add TipTap page editor with REST persistence (#25) ... TipTap is bound to the canonical ProseMirror schema (packages/shared, #24) via a generic bridge (spec-utils.ts) that re-derives every node/mark's attrs/parseDOM/toDOM from editorSchema instead of duplicating them, so the editor's schema stays byte-for-byte identical to what the api decodes Yjs states against — guarded by a schema- fidelity + real Yjs round-trip test (@tiptap/y-tiptap client encoding against y-prosemirror server decoding). Route /p/:pondSlug/:pageSlug (RequireAuth) resolves the page via a new GET /ponds/:pondId/pages/:slug endpoint, binds a local Y.Doc via @tiptap/extension-collaboration (fragment "default"), and offers a view/edit mode toggle (sidebar auto-hides in edit mode via a small AppLayout context). Page state saves debounced to PUT /pages/:id/state with a truthful saving/saved/error(retrying) indicator; title saves separately via PATCH /pages/:id. Toolbar covers headings, marks, lists, blockquote, code block, hr, table (insert/row/column/header ops via prosemirror-tables), a minimal link mark, and an image placeholder (real upload is #27/#28). Closes #25 Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-06 11:08:43 +02:00
Claude Sonnet 5	98e159ab50	Add page CRUD and Yjs state persistence (#23) ... Prisma models `pages`/`page_updates`/`page_content_cache` per data-model.md. Endpoints: POST /ponds/:id/pages (title -> empty Yjs doc state, seeded via y-prosemirror), GET /pages/:id (meta + base64 state), PUT /pages/:id/state (client-encoded Yjs state, rejected above the 5 MiB operations.md limit or if it doesn't decode into a valid document for the schema), PATCH /pages/:id (title/slug — explicit slug changes validate uniqueness per pond, title-only renames keep the slug), DELETE (soft). Access follows InterimAccessService via the page's pond, same 404-not-403 interim rule as ponds. State saves decode the Yjs update with yjs + y-prosemirror and run it through the #24 shared derivation functions (docToPlainText/ docToMarkdown/docToHtml/extractOutline) to refresh page_content_cache. The Yjs XmlFragment name ("default") and the derivation call are factored so the collab server's persistence hooks (#35) can reuse both. Raised the API's JSON body limit to 8 MiB (main.ts and the e2e test app) to fit base64-encoded page state. Closes #23	2026-07-05 22:25:41 +02:00
Claude Fable 5	64928f0ac0	Quota foundation: overrides, resolution, race-safe consumption (#22) ... - quota_overrides + pond_usage models (BigInt values, unique per subject+key); migration 20260705185146_quotas - instance-default quota keys in the settings registry (editors 5, readers 50, additional ponds 0, storage 1 GiB, max file 25 MiB) - QuotaService: getEffective with pond → user → instance resolution (zero counts as a value, not a gap); assertCanCreateSharedPond and checkAndConsume serialize via pg_advisory_xact_lock inside the guarded write's transaction; release never drops below zero - pond creation enforces additional_ponds (personal ponds don't count); quota errors carry code quota_exceeded + {quotaKey, limit}, localized - seed grants fixtures an additional_ponds override (default is 0) - table-driven resolution tests, parallel-consumption test, e2e for the pond-creation limit Closes #22 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UpQz6ypHJsLfMf4S6fyQEB	2026-07-05 20:55:59 +02:00
Claude Fable 5	f0850eecd3	Ponds: data model, CRUD API, personal pond on verification (#21) ... - Pond model with pond-level trash columns (ADR 0013) and settings jsonb holding only deviations from the defaults (sidebar sort, font slots per ADR 0016); migration 20260705090100_ponds - shared: pond schemas/views and slugify (German transliteration, URL-safe, length-capped); deterministic -2/-3 suffixes for collisions - InterimAccessService: single place answering pond access questions until the real role model lands in M5 - POST/GET /ponds, GET /ponds/:slug, PATCH/DELETE /ponds/:id, Site-Admin trash + restore; personal pond auto-created on e-mail verification and for active seed fixtures; personal ponds cannot be trashed - e2e pack covering verify-flow pond creation, slug suffixes, rename, foreign-pond 404s, trash/restore; slugify unit tests Closes #21 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UpQz6ypHJsLfMf4S6fyQEB	2026-07-05 11:08:16 +02:00
Claude Fable 5	0bc80c9f93	Add auth, settings, and admin UI to the SPA ... The web app grows its account surface: login (with next-redirect, unverified-hint + resend), signup (react-hook-form + shared Zod schemas, field-level api errors, closed-registration state fed by the new public GET /auth/registration), e-mail verification, forgot/reset password; a settings page with profile (locale applies immediately), password change, and active-session management; a Site-Admin page for instance name, default locale, and registration mode. AuthProvider holds /auth/me, applies the profile locale, and backs route guards (RequireAuth/RequireAnonymous/RequireSiteAdmin); the top bar gains a user menu. All strings ship in the new auth/settings namespaces (de+ en); the exception filter now preserves handler-specific error codes. Verified live: signup → Mailpit → verify → login → profile through the Vite proxy. Closes #16 Closes #17 Closes #18 Closes #19 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-05 05:35:56 +02:00
Claude Fable 5	f00fb19f32	Add mail outbox with SMTP delivery worker and templates ... MailService renders transactional mails (verify-email, reset-password) from the new de/en `mails` i18n namespace — text plus minimal HTML with escaped interpolation — and enqueues them into mail_outbox. MailWorker delivers pending rows every 15s through an injectable transport (nodemailer; faked in tests) with quadratic backoff and a permanent FAILED state after five attempts, logged as a warning. SMTP_* and APP_BASE_URL join the environment schema with defaults matching the new Mailpit container in the dev overlay. Closes #12 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-05 00:46:12 +02:00
Claude Fable 5	e855192d23	Add i18n with i18next, German and English, and a key-parity check ... Translation resources live in packages/shared/i18n/<lang>/<ns>.json (common, errors) and ship with de and en. The web app initializes react-i18next with bundled resources (?lng= wins, then the browser language); all shell components use useTranslation and the temporary t() stub is gone. The api localizes its uniform error bodies via a minimal i18next instance negotiated from Accept-Language. `pnpm i18n:check` fails CI when any key is missing in any language, backed by tested helpers in @dorfteich/shared. Closes #5 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-04 19:23:45 +02:00