marcandClaude Opus 5
3acb8b66a4
Two rules governed version retention: the newest 50 per note, and a sweep of anything past 90 days. The second was wrong. The count already bounds what a note can accumulate, so age only ever deleted history nothing had replaced — and it bit hardest exactly where history is most wanted, a note left alone for a quarter of a year losing its whole past for having done nothing. It is off unless VERSION_RETENTION_DAYS is set. How many versions to keep is now a notebook's own setting, falling back to the server default when left empty. A reference notebook can keep fifty of everything while a scratch one keeps three. That makes freeing attachments answerable. A picture taken out of a note cannot be deleted straight away: the versions from before still show it, and restoring one would find a hole. It is released once no current note and no kept version refers to it — which, with retention by count, is when the last version holding it is pushed out. The server cannot look for itself, bodies being encrypted, so the client reports a note's attachments on every save as it already does for links, and a version inherits what the note held when it was snapshotted — by definition what that version contains. Two things make it safe rather than merely plausible. Silence is not "uses nothing": a note written before this existed has no rows, which looks identical to one with no pictures, so nothing is released for a user while any of their notes has yet to report — the prefetch that fills the search index reports for them on its first pass. And an upload has a row before the note using it does, so recent attachments are left alone. POST /api/admin/housekeeping runs the sweep on demand. Caught while testing: the same block of markup had been pasted into the create-notebook dialog as well, where the state it referenced did not exist — the dialog crashed on open. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
1607 lines
71 KiB
JavaScript
1607 lines
71 KiB
JavaScript
/*
|
|
* InkNote — Backend Sync Server
|
|
* ─────────────────────────────
|
|
* Node.js + Express + SQLite
|
|
*
|
|
* Features:
|
|
* • User registration / login (JWT)
|
|
* • CRUD for notes, notebooks, PDFs
|
|
* • Conflict-aware sync with vector clocks
|
|
* • WebSocket real-time push
|
|
* • Encrypted storage at rest (AES-256)
|
|
*
|
|
* Install:
|
|
* npm init -y
|
|
* npm install express better-sqlite3 bcryptjs jsonwebtoken ws uuid cors helmet dotenv
|
|
*
|
|
* Run:
|
|
* node server.js
|
|
*/
|
|
|
|
require("dotenv").config();
|
|
const express = require("express");
|
|
const cors = require("cors");
|
|
const helmet = require("helmet");
|
|
const bcrypt = require("bcryptjs");
|
|
const jwt = require("jsonwebtoken");
|
|
const { WebSocketServer } = require("ws");
|
|
const Database = require("better-sqlite3");
|
|
const { v4: uuid } = require("uuid");
|
|
const crypto = require("crypto");
|
|
const path = require("path");
|
|
const fs = require("fs");
|
|
const http = require("http");
|
|
|
|
/* ─────────── Config ─────────── */
|
|
const PORT = process.env.PORT || 4000;
|
|
|
|
/* Secrets must be supplied. They used to fall back to a fresh random value,
|
|
* which meant a restart without them silently made every stored note
|
|
* undecryptable — the data was still there, just lost forever. Refuse to boot
|
|
* instead, and say exactly how to generate what is missing. */
|
|
function requireSecret(name, { hexBytes } = {}) {
|
|
const v = process.env[name];
|
|
if (!v) {
|
|
const how = hexBytes ? `openssl rand -hex ${hexBytes}` : "openssl rand -base64 32";
|
|
console.error(`\n ✖ ${name} is not set. Refusing to start.`);
|
|
console.error(` Generate one with: ${how}`);
|
|
console.error(` Then put it in .env or pass it as an environment variable.\n`);
|
|
process.exit(1);
|
|
}
|
|
if (hexBytes && !new RegExp(`^[0-9a-fA-F]{${hexBytes * 2}}$`).test(v)) {
|
|
console.error(`\n ✖ ${name} must be ${hexBytes * 2} hex characters (${hexBytes} bytes).`);
|
|
console.error(` Generate one with: openssl rand -hex ${hexBytes}\n`);
|
|
process.exit(1);
|
|
}
|
|
return v;
|
|
}
|
|
const JWT_SECRET = requireSecret("JWT_SECRET");
|
|
const ENCRYPTION_KEY = requireSecret("ENCRYPTION_KEY", { hexBytes: 32 });
|
|
const ENCRYPTION_KEY_BUF = Buffer.from(ENCRYPTION_KEY, "hex");
|
|
|
|
/** Reads a positive number from the environment, or falls back. */
|
|
const envNum = (name, fallback) => {
|
|
const v = Number(process.env[name]);
|
|
return Number.isFinite(v) && v > 0 ? v : fallback;
|
|
};
|
|
const mb = (name, fallbackMb) => envNum(name, fallbackMb) * 1024 * 1024;
|
|
|
|
/* Images and PDFs are limited separately: a picture that large is almost always
|
|
* a mistake, while a scanned book legitimately is. Both are generous because
|
|
* this is a private instance — the limits exist so a runaway upload cannot fill
|
|
* the disk, not to ration anything. */
|
|
const MAX_IMAGE_BYTES = mb("INKNOTE_MAX_IMAGE_MB", 25);
|
|
const MAX_PDF_BYTES = mb("INKNOTE_MAX_PDF_MB", 200);
|
|
|
|
// Which origins may call the API. Same-origin deployments (nginx in front) need
|
|
// none; set a comma-separated list only if you serve the UI from another host.
|
|
const ALLOWED_ORIGINS = (process.env.ALLOWED_ORIGINS || "")
|
|
.split(",").map((s) => s.trim()).filter(Boolean);
|
|
|
|
const DATA_DIR = path.join(__dirname, "data");
|
|
const UPLOAD_DIR = path.join(__dirname, "uploads");
|
|
|
|
/**
|
|
* Both directories are bind mounts from the Docker host, and the container runs
|
|
* unprivileged. If the host directory belongs to someone else — usually because
|
|
* Docker created it as root when it did not exist — nothing here can work.
|
|
*
|
|
* Without this check the failure surfaces from deep inside better-sqlite3 as
|
|
* `SqliteError: unable to open database file`, which says nothing about the
|
|
* cause and sends people looking at the database instead of at `ls -ld`.
|
|
*/
|
|
function ensureWritable(dir, label) {
|
|
try {
|
|
fs.mkdirSync(dir, { recursive: true });
|
|
const probe = path.join(dir, `.write-probe-${process.pid}`);
|
|
fs.writeFileSync(probe, "");
|
|
fs.unlinkSync(probe);
|
|
} catch (err) {
|
|
const uid = typeof process.getuid === "function" ? process.getuid() : "?";
|
|
const gid = typeof process.getgid === "function" ? process.getgid() : "?";
|
|
let owner = "unknown";
|
|
try {
|
|
const s = fs.statSync(dir);
|
|
owner = `uid ${s.uid}, gid ${s.gid}, mode ${(s.mode & 0o777).toString(8)}`;
|
|
} catch {
|
|
owner = "does not exist";
|
|
}
|
|
console.error(
|
|
`\n❌ Cannot write to the ${label} directory (${dir}).\n` +
|
|
` The server runs as uid ${uid}, gid ${gid}; the directory is ${owner}.\n` +
|
|
` This is the host directory bind-mounted into the container. Fix it there:\n\n` +
|
|
` mkdir -p <INKNOTE_DATA_DIR>/{db,uploads}\n` +
|
|
` chown -R ${uid}:${gid} <INKNOTE_DATA_DIR>\n` +
|
|
` # under /root also: chmod o+x /root\n\n` +
|
|
` (${err.code || err.message})\n`
|
|
);
|
|
process.exit(1);
|
|
}
|
|
}
|
|
ensureWritable(DATA_DIR, "data");
|
|
ensureWritable(UPLOAD_DIR, "uploads");
|
|
|
|
/* ─────────── Database ─────────── */
|
|
const db = new Database(path.join(DATA_DIR, "inknote.db"));
|
|
db.pragma("journal_mode = WAL");
|
|
db.pragma("foreign_keys = ON");
|
|
|
|
db.exec(`
|
|
CREATE TABLE IF NOT EXISTS users (
|
|
id TEXT PRIMARY KEY,
|
|
username TEXT NOT NULL UNIQUE COLLATE NOCASE,
|
|
password_hash TEXT NOT NULL,
|
|
display_name TEXT,
|
|
is_admin INTEGER NOT NULL DEFAULT 0,
|
|
created_at TEXT DEFAULT (datetime('now')),
|
|
updated_at TEXT DEFAULT (datetime('now'))
|
|
);
|
|
|
|
CREATE TABLE IF NOT EXISTS notebooks (
|
|
id TEXT PRIMARY KEY,
|
|
user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
|
|
name TEXT NOT NULL,
|
|
cover_index INTEGER DEFAULT 0,
|
|
sort_order INTEGER DEFAULT 0,
|
|
created_at TEXT DEFAULT (datetime('now')),
|
|
updated_at TEXT DEFAULT (datetime('now')),
|
|
deleted_at TEXT,
|
|
version INTEGER DEFAULT 1,
|
|
device_id TEXT
|
|
);
|
|
|
|
CREATE TABLE IF NOT EXISTS notes (
|
|
id TEXT PRIMARY KEY,
|
|
user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
|
|
notebook_id TEXT REFERENCES notebooks(id) ON DELETE SET NULL,
|
|
type TEXT NOT NULL DEFAULT 'text', -- text | drawing | pdf
|
|
title TEXT NOT NULL DEFAULT 'Untitled',
|
|
content_encrypted BLOB,
|
|
drawing_data_path TEXT,
|
|
pdf_path TEXT,
|
|
annotations_path TEXT,
|
|
starred INTEGER DEFAULT 0,
|
|
sort_order INTEGER DEFAULT 0,
|
|
created_at TEXT DEFAULT (datetime('now')),
|
|
updated_at TEXT DEFAULT (datetime('now')),
|
|
deleted_at TEXT,
|
|
version INTEGER DEFAULT 1,
|
|
device_id TEXT
|
|
);
|
|
|
|
CREATE TABLE IF NOT EXISTS sync_log (
|
|
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
|
user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
|
|
entity_type TEXT NOT NULL, -- note | notebook
|
|
entity_id TEXT NOT NULL,
|
|
action TEXT NOT NULL, -- create | update | delete
|
|
payload TEXT,
|
|
device_id TEXT,
|
|
timestamp TEXT DEFAULT (datetime('now'))
|
|
);
|
|
|
|
CREATE TABLE IF NOT EXISTS devices (
|
|
id TEXT PRIMARY KEY,
|
|
user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
|
|
name TEXT,
|
|
platform TEXT,
|
|
last_sync TEXT DEFAULT (datetime('now'))
|
|
);
|
|
|
|
-- Which note references which. Note bodies are encrypted, so the server
|
|
-- cannot derive this itself; the client sends the link list when it saves.
|
|
CREATE TABLE IF NOT EXISTS note_links (
|
|
source_id TEXT NOT NULL REFERENCES notes(id) ON DELETE CASCADE,
|
|
target_id TEXT NOT NULL,
|
|
target_kind TEXT NOT NULL DEFAULT 'note',
|
|
user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
|
|
created_at TEXT DEFAULT (datetime('now')),
|
|
PRIMARY KEY (source_id, target_id, target_kind)
|
|
);
|
|
|
|
-- Past states of a note, so an accidental overwrite can be undone after the
|
|
-- fact. Content is encrypted here exactly as it is in the notes table.
|
|
/* Which attachments a note's current body uses, and which each kept version
|
|
* used. The server cannot read either — both are encrypted — so the client
|
|
* reports the note's set on every save, and a version inherits whatever the
|
|
* note held at the moment it was snapshotted, which is by definition what
|
|
* that version contains.
|
|
*
|
|
* Together these are what make freeing an attachment safe: a picture removed
|
|
* from a note is still in the versions that came before, and deleting the file
|
|
* would leave a hole in history that restoring cannot fill. */
|
|
CREATE TABLE IF NOT EXISTS note_attachments (
|
|
note_id TEXT NOT NULL REFERENCES notes(id) ON DELETE CASCADE,
|
|
attachment_id TEXT NOT NULL,
|
|
PRIMARY KEY (note_id, attachment_id)
|
|
);
|
|
|
|
CREATE TABLE IF NOT EXISTS version_attachments (
|
|
version_id INTEGER NOT NULL REFERENCES note_versions(id) ON DELETE CASCADE,
|
|
attachment_id TEXT NOT NULL,
|
|
PRIMARY KEY (version_id, attachment_id)
|
|
);
|
|
|
|
CREATE TABLE IF NOT EXISTS note_versions (
|
|
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
|
note_id TEXT NOT NULL REFERENCES notes(id) ON DELETE CASCADE,
|
|
user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
|
|
title TEXT,
|
|
content_encrypted BLOB,
|
|
drawing_strokes BLOB,
|
|
device_id TEXT,
|
|
reason TEXT,
|
|
created_at TEXT DEFAULT (datetime('now'))
|
|
);
|
|
|
|
-- Binary blobs referenced from note bodies. Stored on disk under a content
|
|
-- hash, so the same image pasted into ten notes is kept once.
|
|
CREATE TABLE IF NOT EXISTS attachments (
|
|
id TEXT PRIMARY KEY,
|
|
user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
|
|
sha256 TEXT NOT NULL,
|
|
mime TEXT NOT NULL,
|
|
size INTEGER NOT NULL,
|
|
filename TEXT,
|
|
created_at TEXT DEFAULT (datetime('now'))
|
|
);
|
|
|
|
CREATE INDEX IF NOT EXISTS idx_note_attachments_att ON note_attachments(attachment_id);
|
|
CREATE INDEX IF NOT EXISTS idx_version_attachments_att ON version_attachments(attachment_id);
|
|
CREATE INDEX IF NOT EXISTS idx_notes_user ON notes(user_id);
|
|
CREATE UNIQUE INDEX IF NOT EXISTS idx_attachments_owner_hash ON attachments(user_id, sha256);
|
|
CREATE INDEX IF NOT EXISTS idx_note_versions ON note_versions(note_id, id DESC);
|
|
CREATE INDEX IF NOT EXISTS idx_notes_notebook ON notes(notebook_id);
|
|
CREATE INDEX IF NOT EXISTS idx_notebooks_user ON notebooks(user_id);
|
|
CREATE INDEX IF NOT EXISTS idx_sync_user ON sync_log(user_id, timestamp);
|
|
CREATE INDEX IF NOT EXISTS idx_note_links_target ON note_links(user_id, target_id);
|
|
CREATE INDEX IF NOT EXISTS idx_note_links_source ON note_links(source_id);
|
|
`);
|
|
|
|
/* ─────────── Migrations ─────────── */
|
|
const tableColumns = (t) => db.prepare(`PRAGMA table_info(${t})`).all().map((c) => c.name);
|
|
|
|
const USERNAME_RE = /^[a-zA-Z0-9._-]{3,32}$/;
|
|
const MIN_PASSWORD_LENGTH = 6;
|
|
function normalizeUsername(raw) {
|
|
const v = String(raw ?? "").trim();
|
|
return USERNAME_RE.test(v) ? v : null;
|
|
}
|
|
|
|
/** The fields of a user row that may leave the server. Never the password hash. */
|
|
const publicUser = (row) => ({
|
|
id: row.id,
|
|
username: row.username,
|
|
displayName: row.display_name,
|
|
isAdmin: !!row.is_admin,
|
|
});
|
|
|
|
// Login used to be e-mail based. Rebuild the table with a username column and
|
|
// derive each existing user's username from the local part of their address.
|
|
(function migrateEmailToUsername() {
|
|
const cols = tableColumns("users");
|
|
if (!cols.includes("email")) return;
|
|
|
|
db.pragma("foreign_keys = OFF");
|
|
db.transaction(() => {
|
|
db.exec(`
|
|
CREATE TABLE users_migrated (
|
|
id TEXT PRIMARY KEY,
|
|
username TEXT NOT NULL UNIQUE COLLATE NOCASE,
|
|
password_hash TEXT NOT NULL,
|
|
display_name TEXT,
|
|
created_at TEXT DEFAULT (datetime('now')),
|
|
updated_at TEXT DEFAULT (datetime('now'))
|
|
);
|
|
`);
|
|
const insert = db.prepare(
|
|
"INSERT INTO users_migrated (id, username, password_hash, display_name, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?)"
|
|
);
|
|
const taken = new Set();
|
|
for (const u of db.prepare("SELECT * FROM users").all()) {
|
|
const seed = String(u.email || u.display_name || "user").split("@")[0];
|
|
const base = (seed.replace(/[^a-zA-Z0-9._-]/g, "").slice(0, 32) || "user").padEnd(3, "0");
|
|
let name = base;
|
|
for (let i = 2; taken.has(name.toLowerCase()); i++) name = `${base.slice(0, 30)}${i}`;
|
|
taken.add(name.toLowerCase());
|
|
insert.run(u.id, name, u.password_hash, u.display_name || name, u.created_at, u.updated_at);
|
|
console.log(` ↪ migrated login: ${u.email} → username "${name}"`);
|
|
}
|
|
db.exec("DROP TABLE users; ALTER TABLE users_migrated RENAME TO users;");
|
|
})();
|
|
db.pragma("foreign_keys = ON");
|
|
console.log(" ✅ users table migrated from e-mail to username login");
|
|
})();
|
|
|
|
// Drawings are stored as resolution-independent vector strokes. The legacy
|
|
// raster path (drawing_data_path) stays readable for notes drawn before this.
|
|
if (!tableColumns("notes").includes("drawing_strokes")) {
|
|
db.exec("ALTER TABLE notes ADD COLUMN drawing_strokes BLOB");
|
|
}
|
|
|
|
// A PDF note points at the attachment holding its file. The old pdf_path column
|
|
// stored a filesystem path instead, which is why it never survived a container
|
|
// rebuild; attachments are content-addressed, encrypted and deduplicated.
|
|
// How many versions a notebook keeps per note. Null falls back to the global
|
|
// default, so a notebook only carries a number once someone has chosen one.
|
|
/* Whether this note's client has told us which attachments it uses.
|
|
*
|
|
* Notes written before that existed have no reference rows, which is
|
|
* indistinguishable from a note using no pictures at all — and freeing on that
|
|
* basis would delete images that are still on screen. Nothing is released for a
|
|
* user until every one of their notes has reported, which the background
|
|
* prefetch takes care of on the first pass after an upgrade. */
|
|
if (!tableColumns("notes").includes("attachments_reported")) {
|
|
db.exec("ALTER TABLE notes ADD COLUMN attachments_reported INTEGER NOT NULL DEFAULT 0");
|
|
}
|
|
|
|
if (!tableColumns("notebooks").includes("max_versions")) {
|
|
db.exec("ALTER TABLE notebooks ADD COLUMN max_versions INTEGER");
|
|
}
|
|
|
|
if (!tableColumns("notes").includes("pdf_attachment_id")) {
|
|
db.exec("ALTER TABLE notes ADD COLUMN pdf_attachment_id TEXT");
|
|
}
|
|
|
|
if (!tableColumns("users").includes("is_admin")) {
|
|
db.exec("ALTER TABLE users ADD COLUMN is_admin INTEGER NOT NULL DEFAULT 0");
|
|
}
|
|
|
|
/**
|
|
* Makes sure exactly one way in exists.
|
|
*
|
|
* There is no public sign-up: accounts are created by an admin. That leaves the
|
|
* question of where the first admin comes from, and the answer is this — a
|
|
* username and password in the environment, used only when the database has no
|
|
* users at all. An installation that already has users is never touched by the
|
|
* credentials, so leaving them in .env cannot silently reset anything.
|
|
*
|
|
* The second branch covers upgrades: a database that predates admin rights has
|
|
* users but no admin, and would otherwise be locked out of creating any more.
|
|
*/
|
|
(function ensureAdminExists() {
|
|
const wanted = normalizeUsername(process.env.INKNOTE_ADMIN_USER);
|
|
const password = process.env.INKNOTE_ADMIN_PASSWORD;
|
|
const userCount = db.prepare("SELECT COUNT(*) AS n FROM users").get().n;
|
|
|
|
if (userCount === 0) {
|
|
if (!wanted || !password) {
|
|
console.warn(
|
|
"⚠️ No users and no INKNOTE_ADMIN_USER / INKNOTE_ADMIN_PASSWORD set — nobody can log in.\n" +
|
|
" Set both in .env and restart to create the first administrator."
|
|
);
|
|
return;
|
|
}
|
|
if (String(password).length < MIN_PASSWORD_LENGTH) {
|
|
console.warn(`⚠️ INKNOTE_ADMIN_PASSWORD is shorter than ${MIN_PASSWORD_LENGTH} characters — not creating an admin.`);
|
|
return;
|
|
}
|
|
db.prepare(
|
|
"INSERT INTO users (id, username, password_hash, display_name, is_admin) VALUES (?, ?, ?, ?, 1)"
|
|
).run(uuid(), wanted, bcrypt.hashSync(String(password), 12), wanted);
|
|
console.log(` ✅ created first administrator "${wanted}" from the environment`);
|
|
return;
|
|
}
|
|
|
|
if (db.prepare("SELECT COUNT(*) AS n FROM users WHERE is_admin = 1").get().n > 0) return;
|
|
|
|
// Prefer the account named in the environment; otherwise the oldest one, so
|
|
// an existing single-user installation promotes the obvious candidate.
|
|
const promote =
|
|
(wanted && db.prepare("SELECT id, username FROM users WHERE username = ?").get(wanted)) ||
|
|
db.prepare("SELECT id, username FROM users ORDER BY created_at LIMIT 1").get();
|
|
db.prepare("UPDATE users SET is_admin = 1 WHERE id = ?").run(promote.id);
|
|
console.log(` ✅ granted administrator rights to existing user "${promote.username}"`);
|
|
})();
|
|
|
|
/* ─────────── Encryption helpers ─────────── */
|
|
/* AES-256-GCM. CBC gave confidentiality but no integrity — a flipped bit in the
|
|
* ciphertext decrypted to garbage instead of failing loudly. GCM authenticates,
|
|
* so tampering and corruption are detected. Records written before this are
|
|
* still CBC and stay readable; they re-encrypt as GCM on their next write. */
|
|
function encrypt(text) {
|
|
const iv = crypto.randomBytes(12);
|
|
const cipher = crypto.createCipheriv("aes-256-gcm", ENCRYPTION_KEY_BUF, iv);
|
|
const enc = Buffer.concat([cipher.update(String(text), "utf8"), cipher.final()]);
|
|
return `v2:${iv.toString("hex")}:${cipher.getAuthTag().toString("hex")}:${enc.toString("hex")}`;
|
|
}
|
|
|
|
/* ─── Files at rest ───
|
|
*
|
|
* Note bodies were encrypted from the start, but uploaded files were not: a
|
|
* copy of the uploads directory handed over every image in the clear while the
|
|
* notes around them stayed unreadable. Same key, same cipher, so a backup is
|
|
* worth exactly as much (or as little) as its .env either way.
|
|
*
|
|
* The header lets a file say for itself whether it is encrypted, which is what
|
|
* makes the migration below safe to run again and again: files are shared
|
|
* between users by content hash, so marking a database row would not have been
|
|
* enough to tell.
|
|
*/
|
|
const FILE_MAGIC = Buffer.from("INKENC01", "ascii"); // 8 bytes
|
|
const IV_BYTES = 12;
|
|
const TAG_BYTES = 16;
|
|
|
|
function encryptBuffer(plain) {
|
|
const iv = crypto.randomBytes(IV_BYTES);
|
|
const cipher = crypto.createCipheriv("aes-256-gcm", ENCRYPTION_KEY_BUF, iv);
|
|
const enc = Buffer.concat([cipher.update(plain), cipher.final()]);
|
|
return Buffer.concat([FILE_MAGIC, iv, cipher.getAuthTag(), enc]);
|
|
}
|
|
|
|
const isEncryptedFile = (buf) =>
|
|
buf.length >= FILE_MAGIC.length && buf.subarray(0, FILE_MAGIC.length).equals(FILE_MAGIC);
|
|
|
|
/**
|
|
* Writes through a temporary file and renames.
|
|
*
|
|
* A rename is atomic on the same filesystem, so a crash mid-write leaves either
|
|
* the old file or the new one — never a half-written attachment that would fail
|
|
* its authentication tag and read as corrupt forever after.
|
|
*/
|
|
function writeFileAtomic(filePath, bytes) {
|
|
const tmp = `${filePath}.tmp-${process.pid}-${Date.now()}`;
|
|
fs.writeFileSync(tmp, bytes);
|
|
fs.renameSync(tmp, filePath);
|
|
}
|
|
|
|
function decryptBuffer(buf) {
|
|
// Files written before this existed are still plain bytes; they read straight
|
|
// through until the sweep below gets to them.
|
|
if (!isEncryptedFile(buf)) return buf;
|
|
const at = FILE_MAGIC.length;
|
|
const iv = buf.subarray(at, at + IV_BYTES);
|
|
const tag = buf.subarray(at + IV_BYTES, at + IV_BYTES + TAG_BYTES);
|
|
const decipher = crypto.createDecipheriv("aes-256-gcm", ENCRYPTION_KEY_BUF, iv);
|
|
decipher.setAuthTag(tag);
|
|
return Buffer.concat([decipher.update(buf.subarray(at + IV_BYTES + TAG_BYTES)), decipher.final()]);
|
|
}
|
|
|
|
function decrypt(data) {
|
|
const s = String(data);
|
|
if (s.startsWith("v2:")) {
|
|
const [, ivHex, tagHex, encHex] = s.split(":");
|
|
const decipher = crypto.createDecipheriv("aes-256-gcm", ENCRYPTION_KEY_BUF, Buffer.from(ivHex, "hex"));
|
|
decipher.setAuthTag(Buffer.from(tagHex, "hex"));
|
|
return decipher.update(encHex, "hex", "utf8") + decipher.final("utf8");
|
|
}
|
|
const [ivHex, encryptedHex] = s.split(":"); // legacy AES-256-CBC
|
|
const decipher = crypto.createDecipheriv("aes-256-cbc", ENCRYPTION_KEY_BUF, Buffer.from(ivHex, "hex"));
|
|
return decipher.update(encryptedHex, "hex", "utf8") + decipher.final("utf8");
|
|
}
|
|
|
|
function detectImageMime(buffer, filePath = "") {
|
|
if (buffer && buffer.length >= 12) {
|
|
if (buffer[0] === 0x89 && buffer[1] === 0x50 && buffer[2] === 0x4e && buffer[3] === 0x47) return "image/png";
|
|
if (buffer[0] === 0xff && buffer[1] === 0xd8 && buffer[2] === 0xff) return "image/jpeg";
|
|
if (buffer.toString("ascii", 0, 4) === "RIFF" && buffer.toString("ascii", 8, 12) === "WEBP") return "image/webp";
|
|
}
|
|
const ext = path.extname(filePath).toLowerCase();
|
|
if (ext === ".jpg" || ext === ".jpeg") return "image/jpeg";
|
|
if (ext === ".webp") return "image/webp";
|
|
return "image/png";
|
|
}
|
|
|
|
/* ─────────── Conflict detection ─────────── */
|
|
/**
|
|
* Whether this write is based on a stale copy of the note.
|
|
*
|
|
* A client sends the `updatedAt` it last saw. If the note has moved on since —
|
|
* another device saved in between — the two edits are independent and one is
|
|
* about to bury the other.
|
|
*
|
|
* Nothing is rejected: refusing the write would lose whatever was just typed,
|
|
* and on a phone that was offline for a day that is the worse outcome. The
|
|
* incoming edit wins, but the version it replaces is kept with reason
|
|
* "conflict", so both exist and the newer one can be picked in the history.
|
|
*
|
|
* This deliberately replaces the vector clocks that used to sit here. They
|
|
* could tell a genuine conflict from a simple catch-up, but no client ever sent
|
|
* one, and the extra precision only pays off with a merge interface to spend it
|
|
* on. Comparing revisions needs one field and reuses the history already built.
|
|
*/
|
|
function isStaleWrite(serverUpdatedAt, clientBaseUpdatedAt) {
|
|
if (!clientBaseUpdatedAt || !serverUpdatedAt) return false;
|
|
return String(serverUpdatedAt) > String(clientBaseUpdatedAt);
|
|
}
|
|
|
|
/* ─────────── Auth middleware ─────────── */
|
|
function authMiddleware(req, res, next) {
|
|
const header = req.headers.authorization;
|
|
if (!header || !header.startsWith("Bearer ")) {
|
|
return res.status(401).json({ error: "Authentication required" });
|
|
}
|
|
try {
|
|
const token = header.slice(7);
|
|
const payload = jwt.verify(token, JWT_SECRET);
|
|
// Tokens are signed rather than stored, so there is no session to revoke
|
|
// when an admin deletes an account. Checking that the user still exists is
|
|
// what stops a deleted person's open tab from carrying on as if nothing
|
|
// happened; the client treats the 401 as a sign-out.
|
|
if (!userExists.get(payload.userId)) {
|
|
return res.status(401).json({ error: "Account no longer exists" });
|
|
}
|
|
req.userId = payload.userId;
|
|
req.deviceId = req.headers["x-device-id"] || "unknown";
|
|
next();
|
|
} catch {
|
|
res.status(401).json({ error: "Invalid token" });
|
|
}
|
|
}
|
|
const userExists = db.prepare("SELECT 1 FROM users WHERE id = ?").pluck();
|
|
|
|
/* ─────────── Express app ─────────── */
|
|
const app = express();
|
|
app.set("trust proxy", 1); // nginx sits in front; needed for real client IPs
|
|
app.use(helmet());
|
|
app.use(cors(ALLOWED_ORIGINS.length ? { origin: ALLOWED_ORIGINS } : { origin: false }));
|
|
// Images arrive base64-encoded inside JSON, which inflates them by a third;
|
|
// PDFs take the raw-body route below and never pass through here.
|
|
app.use(express.json({ limit: `${Math.ceil((MAX_IMAGE_BYTES / 1048576) * 1.4)}mb` }));
|
|
|
|
/* Password checks are deliberately slow, which makes them both a brute-force
|
|
* defence and a denial-of-service lever. Cap attempts per username+IP. */
|
|
const RATE_WINDOW_MS = 15 * 60 * 1000;
|
|
const RATE_MAX_ATTEMPTS = 10;
|
|
const loginAttempts = new Map(); // key -> { count, resetAt }
|
|
|
|
function rateLimitLogin(req, res, next) {
|
|
const key = `${req.ip}|${String(req.body?.username ?? "").toLowerCase()}`;
|
|
const now = Date.now();
|
|
const entry = loginAttempts.get(key);
|
|
if (!entry || now > entry.resetAt) {
|
|
loginAttempts.set(key, { count: 1, resetAt: now + RATE_WINDOW_MS });
|
|
return next();
|
|
}
|
|
if (entry.count >= RATE_MAX_ATTEMPTS) {
|
|
const retryAfter = Math.ceil((entry.resetAt - now) / 1000);
|
|
res.set("Retry-After", String(retryAfter));
|
|
return res.status(429).json({ error: "Too many attempts. Try again later.", retryAfter });
|
|
}
|
|
entry.count++;
|
|
next();
|
|
}
|
|
const clearLoginAttempts = (req) => {
|
|
loginAttempts.delete(`${req.ip}|${String(req.body?.username ?? "").toLowerCase()}`);
|
|
};
|
|
setInterval(() => {
|
|
const now = Date.now();
|
|
for (const [k, v] of loginAttempts) if (now > v.resetAt) loginAttempts.delete(k);
|
|
}, RATE_WINDOW_MS).unref();
|
|
|
|
// A dummy hash keeps "no such user" and "wrong password" equally slow, so the
|
|
// response time does not reveal which usernames exist.
|
|
const DUMMY_HASH = bcrypt.hashSync("not-a-real-password", 12);
|
|
|
|
|
|
/* ─── Auth routes ─── */
|
|
/* There is no registration route on purpose: this is a private instance, and
|
|
* accounts are created by an administrator under /api/admin/users. */
|
|
|
|
app.post("/api/auth/login", rateLimitLogin, async (req, res, next) => {
|
|
try {
|
|
const { username, password } = req.body;
|
|
const name = String(username ?? "").trim();
|
|
const user = name ? db.prepare("SELECT * FROM users WHERE username = ?").get(name) : null;
|
|
// Always run a comparison so timing does not leak whether the user exists.
|
|
const ok = await bcrypt.compare(String(password ?? ""), user ? user.password_hash : DUMMY_HASH);
|
|
if (!user || !ok) return res.status(401).json({ error: "Invalid credentials" });
|
|
|
|
clearLoginAttempts(req);
|
|
const token = jwt.sign({ userId: user.id }, JWT_SECRET, { expiresIn: "30d" });
|
|
res.json({ token, user: publicUser(user) });
|
|
} catch (err) { next(err); }
|
|
});
|
|
|
|
/* ─── Auth profile routes ─── */
|
|
app.get("/api/auth/me", authMiddleware, (req, res) => {
|
|
const user = db.prepare("SELECT * FROM users WHERE id = ?").get(req.userId);
|
|
if (!user) return res.status(404).json({ error: "User not found" });
|
|
res.json(publicUser(user));
|
|
});
|
|
|
|
app.put("/api/auth/profile", authMiddleware, (req, res) => {
|
|
const { displayName } = req.body;
|
|
if (!displayName || !displayName.trim()) return res.status(400).json({ error: "Display name required" });
|
|
db.prepare("UPDATE users SET display_name = ?, updated_at = datetime('now') WHERE id = ?").run(displayName.trim(), req.userId);
|
|
res.json(publicUser(db.prepare("SELECT * FROM users WHERE id = ?").get(req.userId)));
|
|
});
|
|
|
|
app.put("/api/auth/username", authMiddleware, async (req, res, next) => {
|
|
try {
|
|
const { newUsername, password } = req.body;
|
|
const name = normalizeUsername(newUsername);
|
|
if (!name || !password) return res.status(400).json({ error: "Username and password required" });
|
|
const user = db.prepare("SELECT * FROM users WHERE id = ?").get(req.userId);
|
|
if (!user) return res.status(404).json({ error: "User not found" });
|
|
if (!(await bcrypt.compare(String(password), user.password_hash))) return res.status(401).json({ error: "Wrong password" });
|
|
const exists = db.prepare("SELECT id FROM users WHERE username = ? AND id != ?").get(name, req.userId);
|
|
if (exists) return res.status(409).json({ error: "Username already taken" });
|
|
db.prepare("UPDATE users SET username = ?, updated_at = datetime('now') WHERE id = ?").run(name, req.userId);
|
|
res.json(publicUser({ ...user, username: name }));
|
|
} catch (err) { next(err); }
|
|
});
|
|
|
|
app.put("/api/auth/password", authMiddleware, async (req, res, next) => {
|
|
try {
|
|
const { currentPassword, newPassword } = req.body;
|
|
if (!currentPassword || !newPassword) return res.status(400).json({ error: "Both passwords required" });
|
|
if (String(newPassword).length < MIN_PASSWORD_LENGTH) return res.status(400).json({ error: `Password must be at least ${MIN_PASSWORD_LENGTH} characters` });
|
|
const user = db.prepare("SELECT * FROM users WHERE id = ?").get(req.userId);
|
|
if (!user) return res.status(404).json({ error: "User not found" });
|
|
if (!(await bcrypt.compare(String(currentPassword), user.password_hash))) return res.status(401).json({ error: "Current password is wrong" });
|
|
const hash = await bcrypt.hash(String(newPassword), 12);
|
|
db.prepare("UPDATE users SET password_hash = ?, updated_at = datetime('now') WHERE id = ?").run(hash, req.userId);
|
|
res.json({ success: true });
|
|
} catch (err) { next(err); }
|
|
});
|
|
|
|
/* ─── Admin routes ─── */
|
|
|
|
/** Gate for everything under /api/admin. Runs after authMiddleware. */
|
|
function requireAdmin(req, res, next) {
|
|
const me = db.prepare("SELECT is_admin FROM users WHERE id = ?").get(req.userId);
|
|
// Deliberately the same 404-ish silence an ordinary user gets elsewhere: a
|
|
// non-admin should not learn that an admin area exists.
|
|
if (!me || !me.is_admin) return res.status(403).json({ error: "Not allowed" });
|
|
next();
|
|
}
|
|
|
|
app.get("/api/admin/users", authMiddleware, requireAdmin, (req, res) => {
|
|
const rows = db
|
|
.prepare(
|
|
`SELECT u.*, (SELECT COUNT(*) FROM notes n WHERE n.user_id = u.id AND n.deleted_at IS NULL) AS note_count
|
|
FROM users u ORDER BY u.created_at`
|
|
)
|
|
.all();
|
|
res.json(
|
|
rows.map((r) => ({
|
|
...publicUser(r),
|
|
createdAt: r.created_at,
|
|
noteCount: r.note_count,
|
|
isSelf: r.id === req.userId,
|
|
}))
|
|
);
|
|
});
|
|
|
|
app.post("/api/admin/users", authMiddleware, requireAdmin, async (req, res, next) => {
|
|
try {
|
|
const { username, password, displayName } = req.body;
|
|
const name = normalizeUsername(username);
|
|
if (!name)
|
|
return res.status(400).json({ error: "Username must be 3-32 characters: letters, digits, . _ -" });
|
|
if (!password || String(password).length < MIN_PASSWORD_LENGTH)
|
|
return res.status(400).json({ error: `Password must be at least ${MIN_PASSWORD_LENGTH} characters` });
|
|
|
|
const id = uuid();
|
|
const hash = await bcrypt.hash(String(password), 12);
|
|
try {
|
|
db.prepare(
|
|
"INSERT INTO users (id, username, password_hash, display_name, is_admin) VALUES (?, ?, ?, ?, 0)"
|
|
).run(id, name, hash, String(displayName || name).trim() || name);
|
|
} catch (err) {
|
|
if (String(err.message).includes("UNIQUE"))
|
|
return res.status(409).json({ error: "Username already taken" });
|
|
throw err;
|
|
}
|
|
console.log(` 👤 admin ${req.userId} created user "${name}"`);
|
|
res.status(201).json(publicUser(db.prepare("SELECT * FROM users WHERE id = ?").get(id)));
|
|
} catch (err) {
|
|
next(err);
|
|
}
|
|
});
|
|
|
|
app.put("/api/admin/users/:id/password", authMiddleware, requireAdmin, async (req, res, next) => {
|
|
try {
|
|
const { newPassword } = req.body;
|
|
if (!newPassword || String(newPassword).length < MIN_PASSWORD_LENGTH)
|
|
return res.status(400).json({ error: `Password must be at least ${MIN_PASSWORD_LENGTH} characters` });
|
|
const target = db.prepare("SELECT * FROM users WHERE id = ?").get(req.params.id);
|
|
if (!target) return res.status(404).json({ error: "User not found" });
|
|
|
|
const hash = await bcrypt.hash(String(newPassword), 12);
|
|
db.prepare("UPDATE users SET password_hash = ?, updated_at = datetime('now') WHERE id = ?").run(
|
|
hash,
|
|
target.id
|
|
);
|
|
console.log(` 🔑 admin ${req.userId} reset the password of "${target.username}"`);
|
|
// Sessions elsewhere keep working: tokens are signed, not stored, so there
|
|
// is nothing to revoke. Resetting a password locks nobody out mid-edit.
|
|
res.json({ success: true });
|
|
} catch (err) {
|
|
next(err);
|
|
}
|
|
});
|
|
|
|
/**
|
|
* Runs the housekeeping sweep now instead of waiting for its timer.
|
|
*
|
|
* `graceSeconds` lowers the delay that protects an upload still in flight — its
|
|
* row exists before the client has had a chance to report the note that uses it.
|
|
* Only an administrator can ask, and only on their own instance; the default
|
|
* leaves the protection alone.
|
|
*/
|
|
app.post("/api/admin/housekeeping", authMiddleware, requireAdmin, (req, res) => {
|
|
const grace =
|
|
req.body?.graceSeconds === undefined
|
|
? ORPHAN_GRACE_MS
|
|
: Math.max(0, Number(req.body.graceSeconds) || 0) * 1000;
|
|
pruneSyncLog();
|
|
pruneOldVersions();
|
|
pruneUnreferencedAttachments(grace);
|
|
pruneOrphanAttachments(grace);
|
|
res.json({ success: true });
|
|
});
|
|
|
|
app.delete("/api/admin/users/:id", authMiddleware, requireAdmin, (req, res) => {
|
|
const target = db.prepare("SELECT * FROM users WHERE id = ?").get(req.params.id);
|
|
if (!target) return res.status(404).json({ error: "User not found" });
|
|
if (target.id === req.userId) return res.status(400).json({ error: "You cannot delete your own account" });
|
|
// A backstop against leaving the instance with no way to add users. Today the
|
|
// self-delete check above already covers it — the only admin can only be
|
|
// yourself — but that stops being true the moment admins can appoint admins.
|
|
if (target.is_admin && db.prepare("SELECT COUNT(*) AS n FROM users WHERE is_admin = 1").get().n <= 1)
|
|
return res.status(400).json({ error: "This is the last administrator" });
|
|
|
|
// Notes, notebooks, versions and attachment rows go with the user through
|
|
// ON DELETE CASCADE; the files behind them are swept up by pruneOrphanAttachments.
|
|
db.prepare("DELETE FROM users WHERE id = ?").run(target.id);
|
|
console.log(` 🗑️ admin ${req.userId} deleted user "${target.username}" and all their data`);
|
|
res.json({ success: true });
|
|
});
|
|
|
|
/* ─── Notebook routes ─── */
|
|
app.get("/api/notebooks", authMiddleware, (req, res) => {
|
|
const notebooks = db.prepare("SELECT * FROM notebooks WHERE user_id = ? AND deleted_at IS NULL ORDER BY sort_order").all(req.userId);
|
|
res.json(notebooks);
|
|
});
|
|
|
|
app.post("/api/notebooks", authMiddleware, (req, res) => {
|
|
const { name, coverIndex } = req.body;
|
|
const id = uuid();
|
|
db.prepare("INSERT INTO notebooks (id, user_id, name, cover_index, device_id) VALUES (?, ?, ?, ?, ?)")
|
|
.run(id, req.userId, name, coverIndex || 0, req.deviceId);
|
|
|
|
db.prepare("INSERT INTO sync_log (user_id, entity_type, entity_id, action, device_id) VALUES (?, 'notebook', ?, 'create', ?)")
|
|
.run(req.userId, id, req.deviceId);
|
|
|
|
broadcastToUser(req.userId, { type: "notebook_created", data: { id, name, coverIndex } }, req.deviceId);
|
|
res.json({ id, name, coverIndex });
|
|
});
|
|
|
|
app.put("/api/notebooks/:id", authMiddleware, (req, res) => {
|
|
const { name, coverIndex, sortOrder, maxVersions } = req.body;
|
|
const nb = db.prepare("SELECT * FROM notebooks WHERE id = ? AND user_id = ?").get(req.params.id, req.userId);
|
|
if (!nb) return res.status(404).json({ error: "Not found" });
|
|
|
|
// null clears the notebook's own setting and puts it back on the default;
|
|
// undefined leaves whatever it had.
|
|
let versions;
|
|
if (maxVersions === null) versions = null;
|
|
else if (maxVersions !== undefined) {
|
|
const n = Number(maxVersions);
|
|
if (!Number.isFinite(n) || n < 1) return res.status(400).json({ error: "maxVersions must be at least 1" });
|
|
versions = Math.min(Math.round(n), MAX_VERSIONS_CEILING);
|
|
}
|
|
|
|
db.prepare("UPDATE notebooks SET name = COALESCE(?, name), cover_index = COALESCE(?, cover_index), sort_order = COALESCE(?, sort_order), updated_at = datetime('now'), version = version + 1 WHERE id = ?")
|
|
.run(name, coverIndex, sortOrder, req.params.id);
|
|
if (maxVersions !== undefined) {
|
|
db.prepare("UPDATE notebooks SET max_versions = ? WHERE id = ?").run(versions, req.params.id);
|
|
}
|
|
|
|
broadcastToUser(req.userId, { type: "notebook_updated", data: { id: req.params.id, name, coverIndex } }, req.deviceId);
|
|
res.json({ success: true, defaultMaxVersions: MAX_VERSIONS_PER_NOTE });
|
|
});
|
|
|
|
app.delete("/api/notebooks/:id", authMiddleware, (req, res) => {
|
|
db.prepare("UPDATE notebooks SET deleted_at = datetime('now') WHERE id = ? AND user_id = ?").run(req.params.id, req.userId);
|
|
broadcastToUser(req.userId, { type: "notebook_deleted", data: { id: req.params.id } }, req.deviceId);
|
|
res.json({ success: true });
|
|
});
|
|
|
|
/* ─────────── Version history ───────────
|
|
*
|
|
* A snapshot records what a note looked like *before* a write, so the previous
|
|
* state is always recoverable.
|
|
*
|
|
* Saves arrive roughly once per second while typing, so snapshotting every one
|
|
* would be useless noise. Instead they coalesce: within the window below, the
|
|
* existing newest version already represents "before this editing session".
|
|
* A write that shrinks a note sharply bypasses the window, because that is
|
|
* exactly the case worth being able to undo. */
|
|
const num = (name, fallback) => {
|
|
const v = Number(process.env[name]);
|
|
return Number.isFinite(v) && v > 0 ? v : fallback;
|
|
};
|
|
const VERSION_COALESCE_MS = num("VERSION_COALESCE_MINUTES", 5) * 60 * 1000;
|
|
const MAX_VERSIONS_PER_NOTE = num("MAX_VERSIONS_PER_NOTE", 50);
|
|
/* A per-notebook setting is a number a user types; it needs an upper bound. */
|
|
const MAX_VERSIONS_CEILING = 500;
|
|
/* Zero means "never expire by age", and that is the default.
|
|
*
|
|
* Versions used to be dropped after 90 days as well as being capped per note.
|
|
* The cap already bounds how much a note can accumulate, so the age rule only
|
|
* ever deleted history that nothing had replaced — and it hit hardest exactly
|
|
* where history is most wanted: a note untouched for a quarter of a year lost
|
|
* its whole past, having done nothing but sit there. Set the variable to a
|
|
* number of days to bring it back. */
|
|
const VERSION_RETENTION_DAYS = num("VERSION_RETENTION_DAYS", 0);
|
|
|
|
const sqliteTimeToMs = (t) => (t ? Date.parse(`${String(t).replace(" ", "T")}Z`) : 0);
|
|
|
|
/** How many versions this note's notebook keeps — its own setting, or the default. */
|
|
function versionLimitFor(noteId) {
|
|
const row = db
|
|
.prepare(
|
|
"SELECT b.max_versions AS limit_ FROM notes n LEFT JOIN notebooks b ON b.id = n.notebook_id WHERE n.id = ?"
|
|
)
|
|
.get(noteId);
|
|
const own = Number(row?.limit_);
|
|
return Number.isFinite(own) && own > 0 ? Math.min(own, MAX_VERSIONS_CEILING) : MAX_VERSIONS_PER_NOTE;
|
|
}
|
|
|
|
function pruneNoteVersions(noteId) {
|
|
db.prepare(`
|
|
DELETE FROM note_versions
|
|
WHERE note_id = ? AND id NOT IN (
|
|
SELECT id FROM note_versions WHERE note_id = ? ORDER BY id DESC LIMIT ?
|
|
)`).run(noteId, noteId, versionLimitFor(noteId));
|
|
}
|
|
|
|
function snapshotNote(userId, noteId, deviceId, { force = false, reason = "edit" } = {}) {
|
|
const note = db.prepare(
|
|
"SELECT title, content_encrypted, drawing_strokes FROM notes WHERE id = ? AND user_id = ?"
|
|
).get(noteId, userId);
|
|
if (!note) return;
|
|
// An empty note has nothing worth going back to.
|
|
if (!note.content_encrypted && !note.drawing_strokes) return;
|
|
|
|
if (!force) {
|
|
const last = db.prepare("SELECT created_at FROM note_versions WHERE note_id = ? ORDER BY id DESC LIMIT 1").get(noteId);
|
|
if (last && Date.now() - sqliteTimeToMs(last.created_at) < VERSION_COALESCE_MS) return;
|
|
}
|
|
|
|
const inserted = db.prepare(`INSERT INTO note_versions (note_id, user_id, title, content_encrypted, drawing_strokes, device_id, reason)
|
|
VALUES (?, ?, ?, ?, ?, ?, ?)`)
|
|
.run(noteId, userId, note.title, note.content_encrypted, note.drawing_strokes, deviceId, reason);
|
|
|
|
/* The version inherits the note's attachments as they stand right now, which
|
|
* is exactly what the body being snapshotted refers to — the snapshot is taken
|
|
* before the incoming write is applied, and so is this. Without it, removing a
|
|
* picture from a note would free the file while older versions still showed it. */
|
|
db.prepare(
|
|
"INSERT OR IGNORE INTO version_attachments (version_id, attachment_id) SELECT ?, attachment_id FROM note_attachments WHERE note_id = ?"
|
|
).run(inserted.lastInsertRowid, noteId);
|
|
|
|
pruneNoteVersions(noteId);
|
|
}
|
|
|
|
/* Ciphertext length tracks plaintext length closely enough to spot a write that
|
|
* throws most of a note away, without decrypting to find out. */
|
|
function isBigShrink(previous, next) {
|
|
const before = previous ? previous.length : 0;
|
|
const after = next ? next.length : 0;
|
|
return before > 200 && after < before * 0.5;
|
|
}
|
|
|
|
/* ─── Note routes ─── */
|
|
app.get("/api/notes", authMiddleware, (req, res) => {
|
|
const notes = db.prepare("SELECT id, user_id, notebook_id, type, title, starred, sort_order, created_at, updated_at, version, pdf_attachment_id FROM notes WHERE user_id = ? AND deleted_at IS NULL ORDER BY updated_at DESC").all(req.userId);
|
|
res.json(notes);
|
|
});
|
|
|
|
app.get("/api/notes/trash", authMiddleware, (req, res) => {
|
|
const notes = db.prepare("SELECT id, user_id, notebook_id, type, title, starred, sort_order, created_at, updated_at, deleted_at, version FROM notes WHERE user_id = ? AND deleted_at IS NOT NULL ORDER BY deleted_at DESC").all(req.userId);
|
|
res.json(notes);
|
|
});
|
|
|
|
app.get("/api/notes/:id", authMiddleware, (req, res) => {
|
|
const note = db.prepare("SELECT * FROM notes WHERE id = ? AND user_id = ?").get(req.params.id, req.userId);
|
|
if (!note) return res.status(404).json({ error: "Not found" });
|
|
|
|
/* A failed decrypt used to be reported as empty content. The client then
|
|
* treated the note as blank and the next edit overwrote the real text — a
|
|
* read error turned into permanent data loss. Fail the request instead, so
|
|
* the client keeps showing its local copy. */
|
|
if (note.content_encrypted) {
|
|
try {
|
|
note.content = decrypt(note.content_encrypted.toString());
|
|
} catch (err) {
|
|
console.error(`[decrypt] note ${note.id} content unreadable:`, err.message);
|
|
return res.status(500).json({ error: "Note content could not be decrypted", id: note.id });
|
|
}
|
|
}
|
|
delete note.content_encrypted;
|
|
|
|
// Vector strokes are the source of truth for drawings.
|
|
note.drawingStrokes = null;
|
|
if (note.drawing_strokes) {
|
|
try {
|
|
note.drawingStrokes = JSON.parse(decrypt(note.drawing_strokes.toString()));
|
|
} catch (err) {
|
|
console.error(`[decrypt] note ${note.id} strokes unreadable:`, err.message);
|
|
return res.status(500).json({ error: "Note drawing could not be decrypted", id: note.id });
|
|
}
|
|
}
|
|
delete note.drawing_strokes;
|
|
|
|
// Legacy raster drawing — only for notes created before vector strokes existed.
|
|
if (note.drawing_data_path && fs.existsSync(note.drawing_data_path)) {
|
|
try {
|
|
const raw = fs.readFileSync(note.drawing_data_path);
|
|
const mime = detectImageMime(raw, note.drawing_data_path);
|
|
note.drawingData = `data:${mime};base64,` + raw.toString("base64");
|
|
} catch {
|
|
note.drawingData = null;
|
|
}
|
|
} else {
|
|
note.drawingData = null;
|
|
}
|
|
|
|
res.json(note);
|
|
});
|
|
|
|
app.post("/api/notes", authMiddleware, (req, res) => {
|
|
const { type, title, content, notebookId, starred, pdfAttachmentId } = req.body;
|
|
const id = uuid();
|
|
const encContent = content ? encrypt(content) : null;
|
|
|
|
db.prepare(`INSERT INTO notes (id, user_id, notebook_id, type, title, content_encrypted, starred, pdf_attachment_id, device_id)
|
|
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`)
|
|
.run(id, req.userId, notebookId, type || "text", title || "Untitled", encContent, starred ? 1 : 0, pdfAttachmentId || null, req.deviceId);
|
|
|
|
db.prepare("INSERT INTO sync_log (user_id, entity_type, entity_id, action, device_id) VALUES (?, 'note', ?, 'create', ?)")
|
|
.run(req.userId, id, req.deviceId);
|
|
|
|
broadcastToUser(req.userId, { type: "note_created", data: { id, type, title } }, req.deviceId);
|
|
res.json({ id });
|
|
});
|
|
|
|
/* Replaces a note's outgoing links. Called whenever its body is saved. */
|
|
const MAX_LINKS_PER_NOTE = 500;
|
|
const replaceNoteLinks = db.transaction((userId, sourceId, links) => {
|
|
db.prepare("DELETE FROM note_links WHERE source_id = ?").run(sourceId);
|
|
const insert = db.prepare(
|
|
"INSERT OR IGNORE INTO note_links (source_id, target_id, target_kind, user_id) VALUES (?, ?, ?, ?)"
|
|
);
|
|
for (const link of links.slice(0, MAX_LINKS_PER_NOTE)) {
|
|
const targetId = typeof link === "string" ? link : link?.id;
|
|
const kind = (typeof link === "object" && link?.kind) === "notebook" ? "notebook" : "note";
|
|
if (typeof targetId === "string" && targetId && targetId !== sourceId) {
|
|
insert.run(sourceId, targetId, kind, userId);
|
|
}
|
|
}
|
|
});
|
|
|
|
/* An upper bound on what one note may claim, so a malformed client cannot
|
|
* write an unbounded number of rows. */
|
|
const MAX_ATTACHMENTS_PER_NOTE = 500;
|
|
|
|
/** Records which attachments a note's body currently uses. */
|
|
const replaceNoteAttachments = db.transaction((noteId, ids) => {
|
|
db.prepare("DELETE FROM note_attachments WHERE note_id = ?").run(noteId);
|
|
db.prepare("UPDATE notes SET attachments_reported = 1 WHERE id = ?").run(noteId);
|
|
const insert = db.prepare(
|
|
"INSERT OR IGNORE INTO note_attachments (note_id, attachment_id) VALUES (?, ?)"
|
|
);
|
|
for (const id of ids.slice(0, MAX_ATTACHMENTS_PER_NOTE)) {
|
|
if (typeof id === "string" && id) insert.run(noteId, id);
|
|
}
|
|
});
|
|
|
|
app.put("/api/notes/:id", authMiddleware, (req, res) => {
|
|
const { title, content, notebookId, starred, baseUpdatedAt, links, attachments } = req.body;
|
|
const note = db.prepare("SELECT * FROM notes WHERE id = ? AND user_id = ?").get(req.params.id, req.userId);
|
|
if (!note) return res.status(404).json({ error: "Not found" });
|
|
|
|
const conflict = isStaleWrite(note.updated_at, baseUpdatedAt);
|
|
const encContent = content ? encrypt(content) : note.content_encrypted;
|
|
|
|
// Keep the state we are about to replace. A conflicting write always keeps
|
|
// one, whatever the coalescing window would otherwise say — that snapshot is
|
|
// the only copy of the other device's work.
|
|
if (content !== undefined || conflict) {
|
|
const shrank = isBigShrink(note.content_encrypted, encContent);
|
|
snapshotNote(req.userId, req.params.id, req.deviceId, {
|
|
force: shrank || conflict,
|
|
reason: conflict ? "conflict" : shrank ? "large-deletion" : "edit",
|
|
});
|
|
if (conflict) {
|
|
console.log(` ⚠️ conflicting write to note ${req.params.id} from ${req.deviceId} — previous state kept`);
|
|
}
|
|
}
|
|
|
|
db.prepare(`UPDATE notes SET
|
|
title = COALESCE(?, title),
|
|
content_encrypted = COALESCE(?, content_encrypted),
|
|
notebook_id = COALESCE(?, notebook_id),
|
|
starred = COALESCE(?, starred),
|
|
updated_at = datetime('now'),
|
|
version = version + 1,
|
|
device_id = ?
|
|
WHERE id = ?`)
|
|
.run(title, encContent, notebookId, starred !== undefined ? (starred ? 1 : 0) : null, req.deviceId, req.params.id);
|
|
|
|
if (Array.isArray(links)) replaceNoteLinks(req.userId, req.params.id, links);
|
|
if (Array.isArray(attachments)) replaceNoteAttachments(req.params.id, attachments);
|
|
|
|
const fresh = db.prepare("SELECT updated_at FROM notes WHERE id = ?").get(req.params.id);
|
|
broadcastToUser(req.userId, { type: "note_updated", data: { id: req.params.id, title } }, req.deviceId);
|
|
// `conflict` lets the client say so; `updatedAt` is what the next write bases itself on.
|
|
res.json({ success: true, updatedAt: fresh.updated_at, conflict });
|
|
});
|
|
|
|
/* ─── Version history ─── */
|
|
app.get("/api/notes/:id/versions", authMiddleware, (req, res) => {
|
|
const note = db.prepare("SELECT id FROM notes WHERE id = ? AND user_id = ?").get(req.params.id, req.userId);
|
|
if (!note) return res.status(404).json({ error: "Not found" });
|
|
// Sizes only — sending every past body would be a large, mostly unread payload.
|
|
const rows = db.prepare(`
|
|
SELECT id, title, device_id, reason, created_at,
|
|
LENGTH(content_encrypted) AS content_size,
|
|
drawing_strokes IS NOT NULL AS has_drawing
|
|
FROM note_versions WHERE note_id = ? ORDER BY id DESC
|
|
`).all(req.params.id);
|
|
res.json(rows.map((r) => ({ ...r, has_drawing: !!r.has_drawing })));
|
|
});
|
|
|
|
app.get("/api/notes/:id/versions/:versionId", authMiddleware, (req, res) => {
|
|
const v = db.prepare("SELECT * FROM note_versions WHERE id = ? AND note_id = ? AND user_id = ?")
|
|
.get(req.params.versionId, req.params.id, req.userId);
|
|
if (!v) return res.status(404).json({ error: "Not found" });
|
|
|
|
const out = { id: v.id, title: v.title, created_at: v.created_at, device_id: v.device_id, reason: v.reason };
|
|
try {
|
|
out.content = v.content_encrypted ? decrypt(v.content_encrypted.toString()) : "";
|
|
out.drawingStrokes = v.drawing_strokes ? JSON.parse(decrypt(v.drawing_strokes.toString())) : null;
|
|
} catch (err) {
|
|
console.error(`[decrypt] version ${v.id} unreadable:`, err.message);
|
|
return res.status(500).json({ error: "This version could not be decrypted" });
|
|
}
|
|
res.json(out);
|
|
});
|
|
|
|
/* Restoring is itself an edit, so the state being replaced is snapshotted first
|
|
* — restoring the wrong version is never a one-way door. */
|
|
app.post("/api/notes/:id/versions/:versionId/restore", authMiddleware, (req, res) => {
|
|
const note = db.prepare("SELECT * FROM notes WHERE id = ? AND user_id = ?").get(req.params.id, req.userId);
|
|
if (!note) return res.status(404).json({ error: "Not found" });
|
|
const v = db.prepare("SELECT * FROM note_versions WHERE id = ? AND note_id = ? AND user_id = ?")
|
|
.get(req.params.versionId, req.params.id, req.userId);
|
|
if (!v) return res.status(404).json({ error: "Version not found" });
|
|
|
|
snapshotNote(req.userId, req.params.id, req.deviceId, { force: true, reason: "before-restore" });
|
|
|
|
db.prepare(`UPDATE notes SET content_encrypted = ?, drawing_strokes = ?,
|
|
updated_at = datetime('now'), version = version + 1, device_id = ? WHERE id = ?`)
|
|
.run(v.content_encrypted, v.drawing_strokes, req.deviceId, req.params.id);
|
|
|
|
// Links live in the restored body, so the index has to follow it back.
|
|
let links = [];
|
|
try {
|
|
if (v.content_encrypted) {
|
|
const doc = JSON.parse(decrypt(v.content_encrypted.toString()))?.doc;
|
|
const found = new Set();
|
|
(function walk(n) {
|
|
if (!n) return;
|
|
if (n.type === "noteLink" && n.attrs?.noteId) found.add(n.attrs.noteId);
|
|
if (Array.isArray(n.content)) n.content.forEach(walk);
|
|
})(doc);
|
|
links = [...found];
|
|
}
|
|
} catch { /* a v1 body has no links to recover */ }
|
|
replaceNoteLinks(req.userId, req.params.id, links);
|
|
|
|
db.prepare("INSERT INTO sync_log (user_id, entity_type, entity_id, action, payload, device_id) VALUES (?, 'note', ?, 'update', ?, ?)")
|
|
.run(req.userId, req.params.id, JSON.stringify({ restored: v.id }), req.deviceId);
|
|
broadcastToUser(req.userId, { type: "note_updated", data: { id: req.params.id, restored: true } }, req.deviceId);
|
|
|
|
res.json({ success: true, restoredFrom: v.created_at });
|
|
});
|
|
|
|
/* Notes that reference this one. Trashed sources are excluded — a backlink from
|
|
* something in the bin is noise. */
|
|
app.get("/api/notes/:id/backlinks", authMiddleware, (req, res) => {
|
|
const rows = db.prepare(`
|
|
SELECT n.id, n.title, n.notebook_id, n.updated_at, nb.name AS notebook_name
|
|
FROM note_links l
|
|
JOIN notes n ON n.id = l.source_id
|
|
LEFT JOIN notebooks nb ON nb.id = n.notebook_id
|
|
WHERE l.target_id = ? AND l.user_id = ? AND n.deleted_at IS NULL
|
|
ORDER BY n.updated_at DESC
|
|
`).all(req.params.id, req.userId);
|
|
res.json(rows);
|
|
});
|
|
|
|
/* Every link in one round trip, so the client can render backlink counts in a
|
|
* list without asking per note. */
|
|
app.get("/api/links", authMiddleware, (req, res) => {
|
|
const rows = db.prepare(`
|
|
SELECT l.source_id, l.target_id, l.target_kind
|
|
FROM note_links l
|
|
JOIN notes n ON n.id = l.source_id
|
|
WHERE l.user_id = ? AND n.deleted_at IS NULL
|
|
`).all(req.userId);
|
|
res.json(rows);
|
|
});
|
|
|
|
/* ─── Trash batch endpoint (MUST be before :id routes) ─── */
|
|
app.delete("/api/notes/trash/empty", authMiddleware, (req, res) => {
|
|
db.prepare("DELETE FROM notes WHERE user_id = ? AND deleted_at IS NOT NULL").run(req.userId);
|
|
res.json({ success: true });
|
|
});
|
|
|
|
app.delete("/api/notes/:id", authMiddleware, (req, res) => {
|
|
db.prepare("UPDATE notes SET deleted_at = datetime('now') WHERE id = ? AND user_id = ?").run(req.params.id, req.userId);
|
|
broadcastToUser(req.userId, { type: "note_deleted", data: { id: req.params.id } }, req.deviceId);
|
|
res.json({ success: true });
|
|
});
|
|
|
|
/* ─── Trash endpoints ─── */
|
|
app.put("/api/notes/:id/restore", authMiddleware, (req, res) => {
|
|
const note = db.prepare("SELECT id FROM notes WHERE id = ? AND user_id = ?").get(req.params.id, req.userId);
|
|
if (!note) return res.status(404).json({ error: "Not found" });
|
|
db.prepare("UPDATE notes SET deleted_at = NULL, updated_at = datetime('now') WHERE id = ?").run(req.params.id);
|
|
broadcastToUser(req.userId, { type: "note_restored", data: { id: req.params.id } }, req.deviceId);
|
|
res.json({ success: true });
|
|
});
|
|
|
|
app.delete("/api/notes/:id/permanent", authMiddleware, (req, res) => {
|
|
db.prepare("DELETE FROM notes WHERE id = ? AND user_id = ?").run(req.params.id, req.userId);
|
|
res.json({ success: true });
|
|
});
|
|
|
|
/* ─── Drawing data route ─── */
|
|
const MAX_STROKES = 20000;
|
|
|
|
/**
|
|
* Counts the strokes in either shape of drawing document.
|
|
*
|
|
* A note's drawing is one page: `{ w, h, strokes }`. A PDF's is one entry per
|
|
* page it has been drawn on: `{ pages: { "1": { w, h, strokes }, … } }`, because
|
|
* every PDF page has its own size and a stroke belongs to the page it was drawn
|
|
* on, not to a canvas shared by all of them.
|
|
*
|
|
* Returns null for anything that is neither, so the caller can refuse it.
|
|
*/
|
|
function countStrokes(doc) {
|
|
if (!doc || typeof doc !== "object") return null;
|
|
if (Array.isArray(doc.strokes)) return doc.strokes.length;
|
|
if (doc.pages && typeof doc.pages === "object") {
|
|
let n = 0;
|
|
for (const page of Object.values(doc.pages)) {
|
|
if (!page || !Array.isArray(page.strokes)) return null;
|
|
n += page.strokes.length;
|
|
}
|
|
return n;
|
|
}
|
|
return null;
|
|
}
|
|
|
|
app.put("/api/notes/:id/drawing", authMiddleware, (req, res) => {
|
|
const { drawingStrokes, drawingData } = req.body;
|
|
const note = db.prepare("SELECT id FROM notes WHERE id = ? AND user_id = ?").get(req.params.id, req.userId);
|
|
if (!note) return res.status(404).json({ error: "Not found" });
|
|
|
|
if (drawingStrokes !== undefined) {
|
|
// Vector strokes in the note's canonical coordinate space — the current format.
|
|
let count = 0;
|
|
if (drawingStrokes !== null) {
|
|
count = countStrokes(drawingStrokes);
|
|
if (count === null) return res.status(400).json({ error: "Invalid strokes format" });
|
|
if (count > MAX_STROKES) return res.status(413).json({ error: "Too many strokes" });
|
|
}
|
|
const empty = !drawingStrokes || count === 0;
|
|
const previous = db.prepare("SELECT drawing_strokes FROM notes WHERE id = ?").get(req.params.id);
|
|
// Clearing a drawing is always worth being able to undo.
|
|
snapshotNote(req.userId, req.params.id, req.deviceId, {
|
|
force: empty && !!previous?.drawing_strokes,
|
|
reason: empty ? "drawing-cleared" : "drawing",
|
|
});
|
|
// A note's legacy raster is left untouched — it renders underneath the strokes
|
|
// on the client, so migrating an old drawing never loses anything.
|
|
db.prepare("UPDATE notes SET drawing_strokes = ?, updated_at = datetime('now'), version = version + 1, device_id = ? WHERE id = ?")
|
|
.run(empty ? null : Buffer.from(encrypt(JSON.stringify(drawingStrokes))), req.deviceId, req.params.id);
|
|
} else {
|
|
// Legacy raster path, kept so older clients keep working.
|
|
if (!drawingData || typeof drawingData !== "string") return res.status(400).json({ error: "drawingStrokes or drawingData required" });
|
|
const m = drawingData.match(/^data:(image\/(?:png|jpeg|jpg|webp));base64,(.+)$/);
|
|
if (!m) return res.status(400).json({ error: "Invalid drawing format" });
|
|
const mime = m[1];
|
|
const ext = mime === "image/png" ? "png" : mime === "image/webp" ? "webp" : "jpg";
|
|
const base64Data = m[2];
|
|
const filePath = path.join(UPLOAD_DIR, `drawing_${req.params.id}.${ext}`);
|
|
|
|
// Remove older file variants from previous format writes.
|
|
for (const oldExt of ["png", "jpg", "jpeg", "webp"]) {
|
|
const oldPath = path.join(UPLOAD_DIR, `drawing_${req.params.id}.${oldExt}`);
|
|
if (oldPath !== filePath && fs.existsSync(oldPath)) {
|
|
try { fs.unlinkSync(oldPath); } catch {}
|
|
}
|
|
}
|
|
fs.writeFileSync(filePath, Buffer.from(base64Data, "base64"));
|
|
|
|
db.prepare("UPDATE notes SET drawing_data_path = ?, updated_at = datetime('now'), version = version + 1, device_id = ? WHERE id = ?")
|
|
.run(filePath, req.deviceId, req.params.id);
|
|
}
|
|
|
|
db.prepare("INSERT INTO sync_log (user_id, entity_type, entity_id, action, payload, device_id) VALUES (?, 'note', ?, 'update', ?, ?)")
|
|
.run(req.userId, req.params.id, JSON.stringify({ drawingUpdated: true }), req.deviceId);
|
|
broadcastToUser(req.userId, { type: "note_updated", data: { id: req.params.id, drawingUpdated: true } }, req.deviceId);
|
|
|
|
res.json({ success: true });
|
|
});
|
|
|
|
/* ─── Attachments ───
|
|
*
|
|
* Images used to be inlined into the note body as base64 data URIs: a few
|
|
* screenshots turned a note into megabytes that were re-encrypted and re-sent on
|
|
* every keystroke. They are now separate blobs the body only references.
|
|
*
|
|
* Files are named by SHA-256 of their bytes, so the same image pasted into
|
|
* several notes is stored once. */
|
|
const ATTACHMENT_DIR = path.join(UPLOAD_DIR, "attachments");
|
|
if (!fs.existsSync(ATTACHMENT_DIR)) fs.mkdirSync(ATTACHMENT_DIR, { recursive: true });
|
|
|
|
const ALLOWED_ATTACHMENT_MIME = new Set(["image/png", "image/jpeg", "image/webp", "image/gif", "image/avif"]);
|
|
|
|
|
|
/**
|
|
* Encrypts any attachment still lying on disk in the clear.
|
|
*
|
|
* Runs at every start and is idempotent: the header says whether a file has
|
|
* already been done, so an interrupted sweep simply resumes. Each file is
|
|
* written through a temporary name and renamed, so a crash cannot leave one
|
|
* half-encrypted — the state on disk is always either fully one or the other.
|
|
*/
|
|
(function encryptExistingAttachments() {
|
|
let files;
|
|
try {
|
|
files = fs.readdirSync(ATTACHMENT_DIR);
|
|
} catch {
|
|
return;
|
|
}
|
|
|
|
let done = 0;
|
|
let failed = 0;
|
|
for (const name of files) {
|
|
if (name.includes(".tmp-")) continue; // leftover from an interrupted run
|
|
const filePath = path.join(ATTACHMENT_DIR, name);
|
|
try {
|
|
if (!fs.statSync(filePath).isFile()) continue;
|
|
const buf = fs.readFileSync(filePath);
|
|
if (isEncryptedFile(buf)) continue;
|
|
writeFileAtomic(filePath, encryptBuffer(buf));
|
|
done++;
|
|
} catch (err) {
|
|
console.error(` ⚠️ could not encrypt attachment ${name}: ${err.message}`);
|
|
failed++;
|
|
}
|
|
}
|
|
if (done) console.log(` 🔒 encrypted ${done} attachment file(s) that were stored in the clear`);
|
|
if (failed) console.error(` ⚠️ ${failed} attachment file(s) could not be encrypted — they still read fine`);
|
|
})();
|
|
|
|
app.post("/api/attachments", authMiddleware, (req, res) => {
|
|
const { data, filename } = req.body || {};
|
|
if (typeof data !== "string") return res.status(400).json({ error: "data required" });
|
|
|
|
const m = data.match(/^data:([a-z0-9.+/-]+);base64,(.+)$/i);
|
|
if (!m) return res.status(400).json({ error: "Expected a base64 data URL" });
|
|
const mime = m[1].toLowerCase();
|
|
if (!ALLOWED_ATTACHMENT_MIME.has(mime)) return res.status(415).json({ error: `Unsupported type: ${mime}` });
|
|
|
|
const buf = Buffer.from(m[2], "base64");
|
|
if (buf.length === 0) return res.status(400).json({ error: "Empty file" });
|
|
if (buf.length > MAX_IMAGE_BYTES)
|
|
return res.status(413).json({ error: `Image is larger than ${Math.round(MAX_IMAGE_BYTES / 1048576)} MB` });
|
|
|
|
// Trust the bytes, not the declared type.
|
|
const sniffed = detectImageMime(buf);
|
|
if (mime !== "image/gif" && mime !== "image/avif" && sniffed !== mime) {
|
|
return res.status(415).json({ error: "File content does not match its type" });
|
|
}
|
|
|
|
const sha256 = crypto.createHash("sha256").update(buf).digest("hex");
|
|
const existing = db.prepare("SELECT id, mime, size FROM attachments WHERE user_id = ? AND sha256 = ?").get(req.userId, sha256);
|
|
if (existing) return res.json({ id: existing.id, mime: existing.mime, size: existing.size, deduplicated: true });
|
|
|
|
// Named by the hash of the plaintext, so identical files still land on one
|
|
// copy — encryption uses a fresh IV each time and would otherwise defeat that.
|
|
const filePath = path.join(ATTACHMENT_DIR, sha256);
|
|
if (!fs.existsSync(filePath)) writeFileAtomic(filePath, encryptBuffer(buf));
|
|
|
|
const id = uuid();
|
|
db.prepare("INSERT INTO attachments (id, user_id, sha256, mime, size, filename) VALUES (?, ?, ?, ?, ?, ?)")
|
|
.run(id, req.userId, sha256, mime, buf.length, typeof filename === "string" ? filename.slice(0, 200) : null);
|
|
|
|
res.json({ id, mime, size: buf.length, deduplicated: false });
|
|
});
|
|
|
|
/**
|
|
* Takes a PDF and stores it like any other attachment: encrypted, named by the
|
|
* hash of its contents, shared between notes that hold the same file.
|
|
*
|
|
* Raw body rather than the base64 JSON the image route uses — a scanned book
|
|
* runs to tens of megabytes, and base64 would add a third to that for no gain
|
|
* on a path that carries nothing but the file itself.
|
|
*/
|
|
app.post(
|
|
"/api/attachments/pdf",
|
|
authMiddleware,
|
|
express.raw({ type: ["application/pdf", "application/octet-stream"], limit: MAX_PDF_BYTES }),
|
|
(req, res) => {
|
|
const buf = req.body;
|
|
if (!Buffer.isBuffer(buf) || buf.length === 0) return res.status(400).json({ error: "No file" });
|
|
|
|
// Trust the bytes, not the header. Every PDF starts with %PDF-.
|
|
if (buf.subarray(0, 5).toString("ascii") !== "%PDF-") {
|
|
return res.status(415).json({ error: "That does not look like a PDF" });
|
|
}
|
|
|
|
const filename = typeof req.query.filename === "string" ? req.query.filename.slice(0, 200) : null;
|
|
const sha256 = crypto.createHash("sha256").update(buf).digest("hex");
|
|
const existing = db
|
|
.prepare("SELECT id, mime, size FROM attachments WHERE user_id = ? AND sha256 = ?")
|
|
.get(req.userId, sha256);
|
|
if (existing) {
|
|
return res.json({ id: existing.id, mime: existing.mime, size: existing.size, deduplicated: true });
|
|
}
|
|
|
|
const filePath = path.join(ATTACHMENT_DIR, sha256);
|
|
if (!fs.existsSync(filePath)) writeFileAtomic(filePath, encryptBuffer(buf));
|
|
|
|
const id = uuid();
|
|
db.prepare("INSERT INTO attachments (id, user_id, sha256, mime, size, filename) VALUES (?, ?, ?, ?, ?, ?)")
|
|
.run(id, req.userId, sha256, "application/pdf", buf.length, filename);
|
|
|
|
res.json({ id, mime: "application/pdf", size: buf.length, deduplicated: false });
|
|
}
|
|
);
|
|
|
|
app.get("/api/attachments/:id", authMiddleware, (req, res) => {
|
|
const a = db.prepare("SELECT * FROM attachments WHERE id = ? AND user_id = ?").get(req.params.id, req.userId);
|
|
if (!a) return res.status(404).json({ error: "Not found" });
|
|
|
|
// The hash comes from our own database, never from the request, so this path
|
|
// cannot be steered outside the attachment directory.
|
|
const filePath = path.join(ATTACHMENT_DIR, a.sha256);
|
|
if (!fs.existsSync(filePath)) return res.status(404).json({ error: "File missing" });
|
|
|
|
let bytes;
|
|
try {
|
|
// Read whole rather than streamed: GCM only proves the file is intact once
|
|
// the last block is in, and half a corrupt image is worse than an error.
|
|
bytes = decryptBuffer(fs.readFileSync(filePath));
|
|
} catch (err) {
|
|
console.error(` ❌ could not decrypt attachment ${a.id} (${a.sha256}): ${err.message}`);
|
|
return res.status(500).json({ error: "File could not be read" });
|
|
}
|
|
|
|
res.setHeader("Content-Type", a.mime);
|
|
res.setHeader("Content-Length", bytes.length);
|
|
res.setHeader("Cache-Control", "private, max-age=31536000, immutable"); // content-addressed: never changes
|
|
res.setHeader("X-Content-Type-Options", "nosniff");
|
|
res.end(bytes);
|
|
});
|
|
/* Two routes used to sit here and were removed on 2026-08-08:
|
|
*
|
|
* POST /api/notes/pdf accepted a PDF and stored it, but nothing could ever
|
|
* read it back — there was no retrieval route and no
|
|
* viewer, so uploads simply accumulated unreachable.
|
|
* POST /api/sync a batch sync endpoint the client never called; it
|
|
* syncs through the individual routes instead.
|
|
*
|
|
* Both are in the git history if a PDF viewer is ever built for real. */
|
|
|
|
/* ─── WebSocket for real-time sync ─── */
|
|
const server = http.createServer(app);
|
|
const wss = new WebSocketServer({ server, path: "/ws" });
|
|
const userConnections = new Map(); // userId -> Set<ws>
|
|
|
|
const AUTH_GRACE_MS = 10000;
|
|
const HEARTBEAT_MS = 30000;
|
|
|
|
wss.on("connection", (ws) => {
|
|
ws._userId = null;
|
|
ws._alive = true;
|
|
ws.on("pong", () => { ws._alive = true; });
|
|
|
|
// Drop sockets that connect and never authenticate.
|
|
const authTimer = setTimeout(() => {
|
|
if (!ws._userId) ws.close(4001, "auth timeout");
|
|
}, AUTH_GRACE_MS);
|
|
|
|
ws.on("message", (data) => {
|
|
try {
|
|
const msg = JSON.parse(data);
|
|
if (msg.type !== "auth") return;
|
|
const payload = jwt.verify(msg.token, JWT_SECRET);
|
|
ws._userId = payload.userId;
|
|
ws._deviceId = msg.deviceId || "unknown";
|
|
clearTimeout(authTimer);
|
|
|
|
// A Set, not a Map keyed by device: two tabs on one machine share a
|
|
// device id, and keying by it meant the second tab silently replaced the
|
|
// first and the first stopped receiving updates.
|
|
if (!userConnections.has(ws._userId)) userConnections.set(ws._userId, new Set());
|
|
userConnections.get(ws._userId).add(ws);
|
|
|
|
ws.send(JSON.stringify({ type: "auth_ok" }));
|
|
} catch {
|
|
try { ws.send(JSON.stringify({ type: "error", message: "Invalid message" })); } catch {}
|
|
}
|
|
});
|
|
|
|
ws.on("close", () => {
|
|
clearTimeout(authTimer);
|
|
const set = ws._userId && userConnections.get(ws._userId);
|
|
if (!set) return;
|
|
set.delete(ws);
|
|
if (set.size === 0) userConnections.delete(ws._userId);
|
|
});
|
|
ws.on("error", () => { try { ws.terminate(); } catch {} });
|
|
});
|
|
|
|
// Reap sockets that stopped answering — otherwise half-open connections from
|
|
// sleeping phones accumulate forever.
|
|
const heartbeat = setInterval(() => {
|
|
for (const ws of wss.clients) {
|
|
if (!ws._alive) { ws.terminate(); continue; }
|
|
ws._alive = false;
|
|
try { ws.ping(); } catch {}
|
|
}
|
|
}, HEARTBEAT_MS);
|
|
heartbeat.unref();
|
|
|
|
function broadcastToUser(userId, message, excludeDeviceId) {
|
|
const conns = userConnections.get(userId);
|
|
if (!conns) return;
|
|
const payload = JSON.stringify(message);
|
|
for (const ws of conns) {
|
|
if (ws._deviceId !== excludeDeviceId && ws.readyState === 1) {
|
|
try { ws.send(payload); } catch {}
|
|
}
|
|
}
|
|
}
|
|
|
|
/* ─── Health check ─── */
|
|
app.get("/api/health", (req, res) => {
|
|
res.json({ status: "ok", version: "1.0.0", uptime: process.uptime() });
|
|
});
|
|
|
|
/* ─── Error handling ─── */
|
|
app.use((req, res) => res.status(404).json({ error: "Not found" }));
|
|
|
|
// Without this, a throw inside a route hangs the request until the client times
|
|
// out, and the stack trace goes to the client in Express' default handler.
|
|
app.use((err, req, res, next) => { // eslint-disable-line no-unused-vars
|
|
console.error("[error]", req.method, req.path, err);
|
|
if (res.headersSent) return;
|
|
if (err?.type === "entity.too.large") return res.status(413).json({ error: "Payload too large" });
|
|
res.status(500).json({ error: "Internal server error" });
|
|
});
|
|
|
|
process.on("unhandledRejection", (err) => console.error("[unhandledRejection]", err));
|
|
process.on("uncaughtException", (err) => console.error("[uncaughtException]", err));
|
|
|
|
/* ─── Housekeeping ─── */
|
|
// sync_log is append-only and grew without bound; every note edit added a row.
|
|
const SYNC_LOG_RETENTION_DAYS = 30;
|
|
function pruneSyncLog() {
|
|
try {
|
|
const r = db.prepare(`DELETE FROM sync_log WHERE timestamp < datetime('now', '-${SYNC_LOG_RETENTION_DAYS} days')`).run();
|
|
if (r.changes) console.log(` 🧹 pruned ${r.changes} sync_log rows older than ${SYNC_LOG_RETENTION_DAYS} days`);
|
|
} catch (err) { console.error("[prune] failed:", err.message); }
|
|
}
|
|
|
|
/* Off unless VERSION_RETENTION_DAYS is set — the per-note count is what bounds
|
|
* growth, and see the note on that constant for why age is a poor second rule. */
|
|
function pruneOldVersions() {
|
|
if (VERSION_RETENTION_DAYS <= 0) return;
|
|
try {
|
|
const r = db.prepare(`DELETE FROM note_versions WHERE created_at < datetime('now', '-${VERSION_RETENTION_DAYS} days')`).run();
|
|
if (r.changes) console.log(` 🧹 pruned ${r.changes} note versions older than ${VERSION_RETENTION_DAYS} days`);
|
|
} catch (err) { console.error("[prune] failed:", err.message); }
|
|
}
|
|
|
|
/* Attachment rows cascade away with their owner, but the files they point at do
|
|
* not. The database is authoritative: a blob nobody has a row for is garbage.
|
|
*
|
|
* Only files that have sat untouched for an hour are considered, so an upload
|
|
* in flight — written to disk just before its row is inserted — is never hit. */
|
|
const ORPHAN_GRACE_MS = 60 * 60 * 1000;
|
|
/**
|
|
* Deletes attachments nothing refers to any more.
|
|
*
|
|
* An attachment is free once no current note body and no kept version mentions
|
|
* it. Both halves matter: a picture taken out of a note is still in the versions
|
|
* from before it was removed, and freeing it then would leave a hole that
|
|
* restoring cannot fill.
|
|
*
|
|
* So a deleted image does not vanish at once. It goes when the last version
|
|
* holding it is pushed out by newer ones — which is the point at which nothing
|
|
* can ask for it back.
|
|
*
|
|
* Rows are only considered once the note has actually reported its attachments;
|
|
* a client that has never sent the list would otherwise look like a note using
|
|
* nothing at all.
|
|
*/
|
|
function pruneUnreferencedAttachments(graceMs = ORPHAN_GRACE_MS) {
|
|
try {
|
|
const rows = db
|
|
.prepare(
|
|
`SELECT a.id, a.sha256 FROM attachments a
|
|
WHERE a.created_at < datetime('now', ?)
|
|
AND NOT EXISTS (SELECT 1 FROM note_attachments na WHERE na.attachment_id = a.id)
|
|
AND NOT EXISTS (SELECT 1 FROM version_attachments va WHERE va.attachment_id = a.id)
|
|
-- Nothing is released while any of this user's notes has yet to say
|
|
-- what it uses: silence there is not the same as "uses nothing".
|
|
AND NOT EXISTS (
|
|
SELECT 1 FROM notes n
|
|
WHERE n.user_id = a.user_id AND n.deleted_at IS NULL AND n.attachments_reported = 0
|
|
)`
|
|
)
|
|
.all(`-${Math.round(graceMs / 1000)} seconds`);
|
|
|
|
if (rows.length === 0) return;
|
|
const del = db.prepare("DELETE FROM attachments WHERE id = ?");
|
|
for (const row of rows) del.run(row.id);
|
|
console.log(` 🧹 released ${rows.length} attachment(s) no note or version refers to`);
|
|
// The files behind them go in the sweep below, which only removes blobs no
|
|
// row points at — including copies still shared with another user's row.
|
|
} catch (err) {
|
|
console.error("[prune] attachment references failed:", err.message);
|
|
}
|
|
}
|
|
|
|
function pruneOrphanAttachments(graceMs = ORPHAN_GRACE_MS) {
|
|
try {
|
|
if (!fs.existsSync(ATTACHMENT_DIR)) return;
|
|
const referenced = new Set(db.prepare("SELECT sha256 FROM attachments").all().map((r) => r.sha256));
|
|
let removed = 0;
|
|
for (const name of fs.readdirSync(ATTACHMENT_DIR)) {
|
|
if (referenced.has(name)) continue;
|
|
const full = path.join(ATTACHMENT_DIR, name);
|
|
try {
|
|
if (Date.now() - fs.statSync(full).mtimeMs < graceMs) continue;
|
|
fs.unlinkSync(full);
|
|
removed++;
|
|
} catch { /* leave anything we cannot inspect alone */ }
|
|
}
|
|
if (removed) console.log(` 🧹 removed ${removed} orphaned attachment file(s)`);
|
|
} catch (err) { console.error("[prune] attachments failed:", err.message); }
|
|
}
|
|
|
|
const housekeeping = () => { pruneSyncLog(); pruneOldVersions(); pruneUnreferencedAttachments(); pruneOrphanAttachments(); };
|
|
housekeeping();
|
|
setInterval(housekeeping, 24 * 60 * 60 * 1000).unref();
|
|
|
|
/* ─── Start server ─── */
|
|
server.listen(PORT, () => {
|
|
console.log(`\n ✏️ InkNote Server running on http://localhost:${PORT}`);
|
|
console.log(` 📡 WebSocket available at ws://localhost:${PORT}/ws`);
|
|
console.log(` 💾 Database: ${path.join(DATA_DIR, "inknote.db")}`);
|
|
console.log(` 🌐 CORS: ${ALLOWED_ORIGINS.length ? ALLOWED_ORIGINS.join(", ") : "same-origin only"}\n`);
|
|
});
|
|
|
|
/* ─── Graceful shutdown ─── */
|
|
let shuttingDown = false;
|
|
function shutdown(signal) {
|
|
if (shuttingDown) return;
|
|
shuttingDown = true;
|
|
console.log(`\n ${signal} received — shutting down...`);
|
|
clearInterval(heartbeat);
|
|
for (const ws of wss.clients) { try { ws.close(1001, "server shutting down"); } catch {} }
|
|
server.close(() => {
|
|
try { db.close(); } catch (err) { console.error("[shutdown] db.close:", err.message); }
|
|
console.log(" ✅ closed cleanly\n");
|
|
process.exit(0);
|
|
});
|
|
// Don't hang forever on a stuck connection.
|
|
setTimeout(() => { try { db.close(); } catch {} process.exit(1); }, 10000).unref();
|
|
}
|
|
process.on("SIGTERM", () => shutdown("SIGTERM"));
|
|
process.on("SIGINT", () => shutdown("SIGINT"));
|