16 Commits

Author	SHA1	Message	Date
xarmian	1dbe04399a	fix(store): optimistic concurrency + sibling broadcast for collection settings (BUG-2265) (#989) ... * fix(store): optimistic concurrency for collection settings writes (BUG-2265) Collection-level settings (e.g. quick_actions) were written by reconstructing the whole settings JSON from a caller's local Collection snapshot, and UpdateCollection replaced the column with no concurrency check. Two ItemDetails in the same collection (full-page pane host master + pane) hold independent snapshots and clobbered each other. Mirror the item optimistic-concurrency pattern (IDEA-1480): add CollectionUpdate.ExpectedUpdatedAt; when set, UpdateCollection re-reads updated_at atomically under the workspace write lock (SQLite BEGIN IMMEDIATE / Postgres advisory xact lock) and returns CollectionUpdateConflictError on a mismatch. Empty token keeps the legacy last-write-wins path unchanged for CLI/MCP/API callers. No DB migration — reuses collections.updated_at. Claude-Session: https://claude.ai/code/session_01EZ6yr6pAUFb1uffan912ra * feat(server): collection.updated broadcast + 409 conflict mapping (BUG-2265) - handleUpdateCollection boundary-validates expected_updated_at (400 on a malformed token) and maps store.CollectionUpdateConflictError to the shared update_conflict envelope (HTTP 409) — byte-identical wire shape to the item path, via the extracted writeUpdateConflictEnvelope helper. - Add the collection_updated EventBus type and publish it after a successful update so sibling ItemDetails / collection pages refresh their independent Collection snapshot proactively, shrinking the 409 window. Routed by Collection (slug) through the existing SSE visibility filter. Claude-Session: https://claude.ai/code/session_01EZ6yr6pAUFb1uffan912ra * fix(web): 409-aware collection settings writes + sibling refresh (BUG-2265) - CollectionUpdate carries expected_updated_at; add isUpdateConflictError. - QuickActionsMenu sends the token and, on a 409, refetches the collection, re-appends the new action onto the FRESH settings, and retries once — no silent loss, no user-visible error. - EditCollectionModal captures the token at open-time (edge-gated seed so a concurrent broadcast can't wipe in-progress edits) and shows a non-destructive "changed elsewhere, reload" message on 409 rather than auto-merging a full-form edit. - Subscribe to collection_updated over SSE: ItemDetail and the collection page refresh their own Collection snapshot (gen/slug-fenced against the persistent pane host's no-remount switch), so siblings converge before the next save. Claude-Session: https://claude.ai/code/session_01EZ6yr6pAUFb1uffan912ra * fix(store): harden collection optimistic concurrency + web fetch ordering (BUG-2265, Codex round 1) Address Codex review findings: - [P1] same-second clobber: now() is one-second precision, so two guarded writes in the same second kept an identical token. The accepted write now advances updated_at strictly past the token (only when now() hasn't already moved on), making a stale-token replay deterministically conflict. Add a same-second regression test. - [P1] tokenless-writer race on Postgres: the advisory lock only serialized writers that also took it. Replace it with a `FOR UPDATE` row lock on the in-tx re-read (Postgres) — SQLite's BEGIN IMMEDIATE already serializes every writer — so a concurrent tokenless UpdateCollection can't slip between the re-read and the UPDATE. - [P2] rename broadcast: only publish collection_updated when the slug is unchanged. A rename's old-slug event would make siblings refetch a dead slug (404) and a new-slug event can't reach old-slug visibility snapshots; renames are handled by the existing navigation path. - [P2] out-of-order refreshes: ItemDetail and the collection page now use a dedicated monotonic refresh counter so two rapid collection_updated fetches can't resolve out of order and clobber newer state (loadSeq/loadGeneration only bump on route/item loads). Claude-Session: https://claude.ai/code/session_01EZ6yr6pAUFb1uffan912ra * fix(store): make collection updated_at strictly monotonic for ALL writes (BUG-2265, Codex round 2) The previous same-second advance ran only on guarded updates, so a tokenless UpdateCollection could write the current second over a forced expected+1s, regressing the concurrency token and letting a stale guarded client clobber newer data (Codex P1). Route every collection update through one small transaction that re-reads updated_at (FOR UPDATE on Postgres; SQLite BEGIN IMMEDIATE covers it) and derives the new timestamp atomically: strictly advance past the row's current value when now() hasn't already moved on. This makes updated_at a reliable concurrency token for guarded AND tokenless writers. Add a tokenless-monotonic regression test. Claude-Session: https://claude.ai/code/session_01EZ6yr6pAUFb1uffan912ra * fix: close remaining collection-concurrency gaps (BUG-2265, Codex round 3) - [P1] Board column reordering (handleGroupReorder) rebuilt the full schema from a stale local snapshot and wrote it with no token — a lost-update path identical to the bug being fixed. Now sends expected_updated_at and, on 409, refetches, re-applies the reorder onto the fresh schema, and retries once. - [P2] The workspace settings page seeded EditCollectionModal from a page-load-time collections list, so a change that predated editing produced a false 409. It now refreshes the list on collection_updated (seq-guarded). - [P2] collection.updated is now delivered to item-grant-only SSE subscribers for collections they can see — it's itemless but leak-free (only the slug), so guests' ItemDetail schema/settings snapshots converge too. Filter test extended. Claude-Session: https://claude.ai/code/session_01EZ6yr6pAUFb1uffan912ra * fix(web): switch-safety + conflict-merge fixes for collection writes (BUG-2265, Codex round 4) - Board column reorder now ABORTS on a 409 (with a "reorder again" toast) instead of replaying a stale option order onto the fresh field, which would silently drop a concurrent option add/remove/rename. Reordering is cosmetic; never worth clobbering a real schema edit. Also captures ws/slug/base before the await and fences the write against a route switch. - QuickActionsMenu captures workspace + collection identity BEFORE the first await, so a mid-save navigation can't make the 409 refetch/retry target the wrong collection (no guaranteed remount). - Settings-page SSE refresh captures the workspace and drops the result if the workspace changed while fetching, so a slow refresh for workspace A can't overwrite workspace B's freshly loaded collection list. Claude-Session: https://claude.ai/code/session_01EZ6yr6pAUFb1uffan912ra * fix(store): sub-second collection updated_at token, no future drift (BUG-2265, confirming pass #6) The same-second monotonic advance manufactured whole-second FUTURE updated_at values; sustained >1 write/sec on one collection drifted arbitrarily ahead of wall-clock. collections.updated_at is TEXT on both dialects and never compared lexically (only via time.Equal + display), so switch the update write to sub-second nowNano(): same-second collisions become near-impossible, so the token advances naturally. Keep a strict-monotonicity guard but step by a single NANOSECOND on the (now near-impossible) coarse-clock/step-back collision, so any drift is bounded to nanoseconds. Dual-dialect; covered by make test-pg. Claude-Session: https://claude.ai/code/session_01EZ6yr6pAUFb1uffan912ra * fix(server): sanitize + always-broadcast collection event (BUG-2265, confirming pass #2,#3) - #2 (P1): collection_updated is delivered to item-grant guests, but the event carried ActorName/Source, leaking the owner's identity + edit source. Strip them — publishCollectionEvent now emits workspace + slug (+ new_slug) only. - #3 (P2): always broadcast (including on rename), routed by the OLD slug and carrying the NEW slug via a new Event.NewSlug field, so remote tabs on the old slug can re-target instead of silently 404ing on their next action. Tests: assert no actor/source leak on a settings update; assert a rename routes by old slug + carries new_slug. Claude-Session: https://claude.ai/code/session_01EZ6yr6pAUFb1uffan912ra * fix(web): decisive switch-safety + rename handling for collection writes (BUG-2265, confirming pass #1,#3,#4,#5) - #1 (P1): EditCollectionModal captures the target collection id/slug/name/ws + updated_at when the form is SEEDED, and handleSave/handleArchive now operate on that captured identity (not the live props). The seed effect re-seeds when the collection IDENTITY changes (not on a same-id broadcast refresh), so a reused route can't leave A's form saving/deleting to B. - #3 (P2): on a rename event the collection route navigates to the new slug (preserving the pane query) and ItemDetail refetches by new_slug; the SSE event type carries new_slug. - #4 (P2): the reorder-conflict path refetches the collection (reseeds the token) before prompting, so a missed SSE event doesn't make every retry 409 forever. - #5 (P2): QuickActionsMenu only invokes oncollectionupdated when the live workspace/slug still match the captured identity, so a reused route can't assign an old response to the newly-navigated page. Claude-Session: https://claude.ai/code/session_01EZ6yr6pAUFb1uffan912ra * fix(server): nano token round-trip, rename visibility, publish-before-migration (BUG-2265, confirming pass 2) Address the round-2 confirming-pass findings (server-only): 1. (P2) The shared update_conflict envelope formatted actual_updated_at with second precision (time.RFC3339), truncating the now sub-second collection token so the client's retry token never matched — a permanent 409 loop. Format with time.RFC3339Nano. Item tokens are zero-nanosecond, so RFC3339Nano emits no fractional part — the item 409 wire shape is byte-identical and the item path still compares via time.Equal. Added a test that the returned token round-trips as a usable retry token. 2. (P2) Rename events are routed by the OLD slug, but a subscriber that revalidated after the rename only has the NEW slug in visibleSlugSet, so the visibility check dropped the event before the new_slug branch. Accept a rename when EITHER the old slug or the (authorized) NewSlug is visible; downstream item-grant gating uses whichever slug is visible. Filter test extended. 3. (P2) The collection_updated event was published only after field migrations succeeded, but UpdateCollection already committed (updated_at advanced). On a migration failure clients got a 500 and no refresh, leaving siblings with stale tokens that 409 blindly. Publish on the commit (before the migration), so siblings always resync regardless of migration outcome. Claude-Session: https://claude.ai/code/session_01EZ6yr6pAUFb1uffan912ra * fix: atomic collection update+migration; modal same-id rename retarget (BUG-2265, confirming pass 3) Address the round-3 confirming-pass findings; defer cross-tab rename RE-NAVIGATION to BUG-2272 (placeholder) per coordinator. 1. (P1) Migration atomicity. UpdateCollection committed the schema + concurrency token BEFORE MigrateItemFieldValues ran, so a migration failure returned 500 with the row already changed → the retry was guaranteed to 409 and item values were left inconsistent with the committed schema. Made the two ATOMIC: extracted applyFieldMigrationsTx and run it inside UpdateCollection's own transaction (after taking the workspace seq lock), so a migration failure rolls back the schema AND the token — nothing changes, the retry works. The handler now passes migrations through instead of running them separately, and publishes the event only after the fully-atomic commit. store/tx work → make test-pg run green. 2. (P2) EditCollectionModal same-id rename. The round-1 identity capture ignores same-id prop refreshes (to preserve edits), but a concurrent RENAME changes the slug (not the id), so handleSave/handleArchive PATCHed a dead slug → 404 before the token could 409. On a same-id prop change whose slug changed, the seed effect now retargets the endpoint slug + re-captures the token WITHOUT reseeding the form (in-progress edits preserved). Deferred (BUG-2272, TODO comments added, already broken on main — no regression): - ItemDetail full-page item URL/collSlug not retargeted after a remote rename. - Collection route chained-rename events during SSE replay landing on a dead intermediate slug. Claude-Session: https://claude.ai/code/session_01EZ6yr6pAUFb1uffan912ra * fix(web): keep seeded token on same-id rename retarget (BUG-2265) On the EditCollectionModal same-id rename branch, retarget the endpoint (slug/name/ws) only — drop the token re-capture. Re-capturing let a later handleSave succeed against the renamed collection and apply the modal's stale pre-rename full form, silently REVERTING the concurrent rename (the exact stale-snapshot clobber BUG-2265 prevents). Keeping the seeded token means a concurrent rename correctly yields a 409 → the non-destructive "collection changed, reload" message. Slug-retarget without token-recapture gives both: no 404 (right URL) and no clobber (409 fires). Claude-Session: https://claude.ai/code/session_01EZ6yr6pAUFb1uffan912ra * fix: lock-order deadlock + unified collection-snapshot fences (BUG-2265, confirming pass 4) 1. (P1) DEADLOCK regression. UpdateCollection's atomic migration path took the collection-row FOR UPDATE lock and THEN the workspace seq lock, but item creation takes them in the reverse order (workspace advisory lock first, then the collection-row FK lock on INSERT) — a concurrent item-create + schema-migration ABBA-deadlocks on Postgres. Fix: acquire the workspace seq lock BEFORE the collection-row FOR UPDATE (matching item-create's order). Every store path that locks both now takes them workspace-seq → collection-row (tryCreateItem, UpdateItem, MigrateItemFieldValues, UpdateCollection). Added a concurrency regression test (item-create racing schema-migration); make test-pg green. 2+3. (P2) Cross-generation fence gap. The SSE collection refresh and route/item loads used SEPARATE counters, so a stale in-flight load could complete after a fresh SSE refresh and revert the collection + its concurrency token. Unified to a SINGLE monotonic collection-snapshot generation in BOTH the collection route and ItemDetail — every collection-snapshot write (loadCollection/loadData, the SSE refresh, reorder, and the quick-action/edit-modal callbacks) bumps it on start and gates its assignment on "still latest". ItemDetail's load keeps a switch-escape so a stale refresh for the OLD collection can't block loading a NEW one. Settings page unified the same way over its collections-list writes. 4. (P2) Settings page fed a stale editingCollection to the edit modal after a remote rename (its prop never changed → the same-id-rename retarget never fired → 404). The unified refresh now re-points editingCollection at the refreshed object for the same id, so the modal's retarget fires. Claude-Session: https://claude.ai/code/session_01EZ6yr6pAUFb1uffan912ra * fix: emit item-changes signal on field migration; QuickActions retry-by-id (BUG-2265, confirming pass 5) 1. (P1) A collection update that runs a field migration mutates item `fields` JSON and advances item `seq`, but only collection_updated was published — open item views refreshed collection METADATA and returned without reconciling the migrated items, so clients kept stale field JSON under the new schema and a later full-fields item update could UNDO the migration (a clobber). UpdateCollection now returns the migrated-item count; when > 0 the handler ALSO emits the existing bulk item-mutation signal (items_bulk_updated, Op=migrate) so open views reconcile via /items-changes. Fires only when the migration touched >= 1 item — a pure settings/quick-actions update emits nothing extra. No store SQL/locking change (Go signature + count plumbing only); make test / make test-pg both green. 2. (P2) QuickActionsMenu's 409 retry GET-by-slug 404s if the competing update renamed the collection. Resolve the fresh collection by STABLE id (list + find by id) before re-appending + retrying, mirroring EditCollectionModal's identity approach; the result-propagation guard is now id-based too so a rename doesn't spuriously drop it. Claude-Session: https://claude.ai/code/session_01EZ6yr6pAUFb1uffan912ra * fix: uniform sweep of item-grant delivery, rename routing, and 409/404 retries (BUG-2265, confirming pass 6) One pattern-sweep instead of per-site patches. Audited every event this PR publishes and every client retry path, applying three patterns uniformly: PATTERN A (item-grant SSE reconcile) + B (old-slug rename routing): instead of a SEPARATE items_bulk_updated migration event (which carries op/count for items an item-grant subscriber can't see and isn't rename-routed), FOLD a SANITIZED `items_changed` bool onto collection_updated — already item-grant-delivered (round 3) and already old-slug-routed with new_slug (round 2). On it the client triggers a /items-changes deltaSync (server-filtered to the caller's grants) and ItemDetail refetches its open item, so item-grant EDITORS reconcile migrated field JSON — closing the clobber where a stale full-fields update would UNDO the migration. Leak surface: "a collection you can see items in changed [+ renamed + had item changes]" — a bool, no per-item data. Removed the round-5 items_bulk_updated publish. The pre-existing items_bulk_updated (archive/move) is untouched and correctly stays suppressed for item-grant users. PATTERN C (409 AND 404 in retries): a competing RENAME can 404 a slug-targeted write before it can 409, bypassing recovery. Added isNotFoundError / isConflictOrNotFound helpers; every write/retry path now treats BOTH: QuickActions save resolves-by-id and retries on either; board reorder reseeds-by-id and aborts on either; EditCollectionModal save shows the reload prompt and archive resolves-by-id and retries on either. Tests: server asserts collection_updated sets items_changed on migration (not on settings-only) and stays sanitized; the SSE-filter test asserts the migration variant reaches item-grant subscribers for a visible collection; web unit tests assert 404/409 classification and a real component-driven not_found -> resolve- by-id -> retry in QuickActionsMenu. make test / make test-pg / npm run test all green. Claude-Session: https://claude.ai/code/session_01EZ6yr6pAUFb1uffan912ra * fix: stable collection-ID identity for collection events + request-based items_changed (BUG-2265, confirming pass 7) 1. (P1) Collection events were identified only by MUTABLE, reusable slugs, and events replay — so a stale rename event's old slug, once re-owned by a DIFFERENT collection, could pass a slug-based match and misroute a client (navigate away / load the wrong schema) or leak the new slug. Fix at the ROOT: carry the STABLE CollectionID on collection_updated (Event.CollectionID) and match by ID everywhere: - Server visibility: sseEventVisibleFor matches collection_updated on a new visibleCollIDSet (built from the same VisibleCollectionIDs), not the slug — so an event for a collection the subscriber can't see by ID is dropped even if its (reused) slug is in visibleSlugSet. Filter test proves the slug-reuse drop. - Clients: ItemDetail and the collection route match `event.collection_id === <their collection>.id`, not slug. Slug(s)/new_slug stay only for the rename-navigation URL. Settings refreshes its whole list (already id-safe). 2. (P1) items_changed was keyed off the affected-ROW count, delivered to item-grant subscribers → a subscriber whose own items were unaffected could infer that HIDDEN items matched the migrated value. Now keyed off whether a field MIGRATION WAS REQUESTED (len(input.Migrations) > 0), independent of row count — leaks nothing about hidden item values. Reverted round-5's UpdateCollection count-return (no longer needed). Test: a migration matching ZERO items still sets items_changed. Deferred with markers: - NOTE(BUG-2273) at ItemDetail's reconcile-skip AND updateField: the web editor's full-fields field write lacks item-level OCC (never adopted IDEA-1480/v0.14), so the migration reconcile is best-effort. - TODO(BUG-2272) at the reorder 404 reseed: it refreshes `collection` but not the route `collSlug` (renavigation, deferred). Claude-Session: https://claude.ai/code/session_01EZ6yr6pAUFb1uffan912ra * fix: archive OCC (no destructive wrong-target) + settings load fence (BUG-2265, confirming pass 8) 1. (P1) EditCollectionModal handleArchive resolved the target by stable id but the server DELETE re-resolves by the MUTABLE slug — a rename that re-owned that slug before the delete landed would archive the WRONG collection. Close the TOCTOU with an expected_updated_at OCC on the delete, mirroring the update OCC: DeleteCollection re-reads updated_at under a lock (FOR UPDATE on Postgres) and 409s on mismatch; the handler validates the token + maps the 409; the client sends it as a query param; handleArchive passes the seeded token (and the fresh token on the resolve-by-id retry). A reused slug or a concurrently-changed target now yields a clean 409 → the reload message, never a wrong-collection archive. Server test: stale token 409s (and the collection survives); current token 204s; malformed 400s; no token 204s. 2. (P2) settings load(): the generation was bumped AFTER awaiting setCurrent, so a slow load for workspace A could resume after B's load and clobber B's name/context/collections/members. Capture a dedicated loadGen at load() ENTRY (before any await) and fence EVERY continuation on it; the collections write additionally respects collectionsGen so it can't revert a fresher SSE refresh. Using a dedicated loadGen (not the SSE-shared collectionsGen) means an SSE collections-refresh mid-load doesn't drop the name/members writes. Deferred: TODO(BUG-2272) at the collection route's rename-navigation site — the global collectionStore (sidebar/pickers) isn't refreshed and the workspace layout ignores collection_updated, so the sidebar keeps the dead slug. Layout- level renavigation, deferred. Claude-Session: https://claude.ai/code/session_01EZ6yr6pAUFb1uffan912ra * fix(web): dedicated item-snapshot fence + id-based rename comparisons in ItemDetail (BUG-2265, confirming pass 9) One comprehensive ItemDetail async-snapshot fence sweep so this file's item/ collection fencing is uniform and ID-based. 1. (P1) The migration item-refetch and loadData shared loadGeneration, so the refetch could apply migrated fields and then a stale loadData response overwrite them (a later full-fields edit then undoes the migration). Added a DEDICATED itemGen (separate from loadGeneration and collectionGen), bumped at the start of BOTH loadData's item load AND the migration refetch, and gated BOTH `item = ` writes on "still latest itemGen" — neither can stale-overwrite the other. Swept the other PASSIVE item snapshot-refreshes onto itemGen too (SSE item_updated/archived/restored, onSync deleted/incremental/full, the collab refresh) so they're ordered against each other and the migration/load. 2. (P2) A settings update that follows a rename before the rename fetch completes requested the OLD slug and bumped collectionGen, cancelling the valid rename fetch. Fetch slug is now `event.new_slug || event.collection || slug`. 3. (P2) The loadData collection fence-escapes compared the stale load's SLUG vs the freshly-renamed snapshot's slug (they differ on a rename → escape let the stale result overwrite). They now compare stable collection IDs; the SSE refresh's post-fetch identity check is id-based too. Audit (site -> generation -> id?): every PASSIVE snapshot-refresh (loadData item+collection, migration refetch, SSE x3, onSync x3, collab) bumps the correct dedicated gen (item->itemGen, collection->collectionGen) and compares identity by id. The DELIBERATE user/action writes (title/field/tag/assignee/role/content/ link/version/restore saves) keep loadGeneration + item-id switch-safety; their item-snapshot concurrency vs the migration refetch is the deferred item-OCC gap (BUG-2273, best-effort) — reordering them last-started-wins is orthogonal to that. Claude-Session: https://claude.ai/code/session_01EZ6yr6pAUFb1uffan912ra	2026-07-21 09:43:05 -04:00
xarmian	dfd3811eee	feat(api): bulk-mutation endpoint + single SSE batch event (TASK-1668) (#669) ... * feat(api): bulk-mutation endpoint + single SSE batch event (TASK-1668) Add POST /workspaces/{ws}/items/bulk accepting item IDs + a verb (archive, move, tag, untag, set-priority, assign). The lane-header bulk actions operate on a whole filtered lane, so the endpoint emits ONE items_bulk_updated SSE event and ONE item.bulk_updated webhook for the batch instead of per-item fan-out. Reuses the existing store paths (UpdateItemWithPreCheck / MoveItem / DeleteItem) rather than re-implementing writes; the open-children guard runs per status-bearing move exactly as the single PATCH path does (force-overridable). Per-row failures are collected into the response envelope (updated/failed/total) rather than aborting the batch. Editor/owner gated. Frontend client + TS types follow in TASK-1669; UI wiring in TASK-1672. Parent: PLAN-1667. * fix(api): per-item visibility + collection-move guard on bulk endpoint per Codex review (round 1) - Enforce per-item collection visibility (checkItemVisible) in the bulk loop so a member with collection_access="specific" can't bulk-mutate items in hidden collections by guessing refs; report invisible rows as not-found. Also gate the move target collection on visibility. - Route bulk collection moves through MoveItemWithPreCheck with the open-children guard (destination schema), closing the bypass where a collection move + terminal status could mark a parent terminal with open children. Status-only moves already ran the guard. - Tests: status-move + collection-move guard coverage (reject + force override + mutation-safety). * fix(web): consume items_bulk_updated SSE event per Codex review (round 2) The bulk endpoint emits one items_bulk_updated event, but the SSE service only listened for the fixed ITEM_EVENTS list — so a bulk mutation left other tabs/sessions stale until an unrelated sync fired. Route the batch event through the existing sync_required path: it carries item_ids + a max seq but no per-item field payload, so an incremental /items-changes delta reconciles every affected row by seq. Broadcast so peer tabs reconcile too. * fix(api): scope bulk SSE event per-collection, drop item_ids per Codex review (round 3) The batch event published with an empty Collection, which the SSE filter treats as workspace-level: restricted members received bulk events for hidden collections (leaking item_ids/op/count) while guests with grants were dropped entirely and stayed stale. Emit one items_bulk_updated event per affected collection with Collection set, so the existing visibility filter routes it like any collection-scoped event. Drop per-item IDs from the SSE payload — a batch can't be item-grant-filtered for guests on a broadcast bus, so IDs would leak; recipients reconcile via the /items-changes delta, which is visibility-filtered server-side (Seq carries the cursor). The webhook (a trusted workspace integration) keeps the full id list. Test asserts the event is collection-scoped and carries no item_ids. * fix(api): bulk collection move notifies both source and target scopes per Codex review (round 4) A cross-collection move only emitted a batch event for the target collection, so a restricted member watching the source lane wouldn't reconcile the item leaving it. Notify both the source and target collection scopes for moves (still no per-item IDs). Test asserts both events fire. * fix(api): suppress itemless batch SSE events for item-grant-only subscribers per Codex review (round 5) A guest/restricted member with only item-level grants in a collection could still receive the collection-scoped items_bulk_updated event (itemless), learning op/count/timing for items they can't see. Extract the SSE visibility filter into sseEventVisibleFor and add a rule: itemless collection-scoped events go only to subscribers with FULL collection access; item-grant-only subscribers reconcile their granted items via the next resume/reconnect /items-changes sync instead. Adds a unit test covering the visibility matrix. * fix(api): validate status override against target schema on bulk collection move per Codex review (round 6) A status override on a collection move was applied after MigrateFields but never validated against the target schema, so an out-of-options value (e.g. status=bogus) could be written. Run ValidateFields on the final field map before the move. Test asserts the invalid value is rejected per-row and the item stays put.	2026-05-30 18:41:55 -04:00
xarmian	076fb9b2e7	feat(comments): comment editing backend — user_id, UpdateComment, PATCH, SSE (TASK-1663) (#665) ... * feat(comments): comment editing backend — user_id, UpdateComment, PATCH, SSE (TASK-1663) Foundation for comment editing (PLAN-1662). No migration — comments.user_id already exists (012_users.sql) but was never written or exposed. - Populate user_id on create/reply: CreateComment takes an explicit userID param (passed from currentUserID by the handlers, not via the request body so it can't be spoofed). Expose user_id on models.Comment + all comment SELECTs/scans. The workspace export path is left as-is — imported comments keep NULL user_id (admin-only edit), matching the pre-identity fallback. - Store.UpdateComment(id, body): replaces body + bumps updated_at; the comments_fts_update trigger re-indexes. - PATCH /workspaces/{ws}/comments/{commentID}: author-or-admin only (canEditComment), rejects empty body. Editing is an authorship op, distinct from delete (item editors). NULL user_id → admin-only. - comment_updated SSE event: broadcast from the handler; added to the web sse allowlist + ItemTimeline refresh set. - web: api.comments.update(), Comment.user_id type. Tests: author edits own (200), non-author non-admin (403), admin edits anyone (200), empty body (400), NULL-user_id comment is admin-only. Parent: PLAN-1662. * fix(account): detach authored comments on account deletion per Codex review (round 1) Now that TASK-1663 populates comments.user_id (FK to users.id), DeleteAccountAtomic would fail on the FK for any user who authored a comment. Null comments.user_id for the user before deleting the row — comments live on in soft-deleted/other workspaces; the display-name author is preserved and the comment just becomes admin-only to edit. Regression test added.	2026-05-30 12:38:57 -04:00
xarmian	bd8667eadf	feat: seq-stamped SSE events + stale-event short-circuit (TASK-1358) (#505) ... * feat: seq-stamped SSE events + stale-event short-circuit (TASK-1358) ## Server - events.Event gains a `Seq int64` field (omitempty). Server populates it on item lifecycle events so SSE consumers can reason about ordering and contiguity against their /items-changes cursor. - publishItemEventWithName takes seq as a parameter; all call sites in handlers_items.go pass the item's current seq: - item_created → item.Seq - item_updated → updated.Seq - item_archived → re-fetched via GetItemIncludeDeleted (DeleteItem bumps seq but doesn't return the updated row) - item_restored → restored.Seq - move target → moved.Seq ## Web - ItemEvent gains optional `seq` (matches the server's omitempty). - localIndex.classifySSEEvent(ws, event) returns 'no-seq' | 'stale' | 'contiguous' | 'gap'. The collection page uses this to short-circuit duplicate / replayed events the server's replay buffer re-delivers after tab-resume. Non-stale events still call deltaSync because the SSE wire payload only carries metadata, not the row data; classify does NOT advance the cursor (applyDelta with real row data is the only path that does — preserving the IDB invariant from TASK-1356). Parent: PLAN-1343. * fix(events): version-restore item_updated event carries seq (Codex round 1) Version-restore in handlers_item_versions.go was publishing the item_updated event directly via events.Publish without Seq, bypassing the new seq-stamped SSE contract from TASK-1358. localIndex's classifySSEEvent would always return 'no-seq' for those events, forcing a generic /items-changes refetch instead of allowing the stale/gap fast paths. Now passes updated.Seq from the store response. Parent: PLAN-1343.	2026-05-11 20:29:50 -04:00
xarmian	bf5ab5b366	chore: clear staticcheck SA + U1000 findings on main (TASK-764) (#249) ... * chore: clear cosmetic staticcheck findings (TASK-764) Apply zero-behavior-change fixes for 8 staticcheck findings on main: - SA4023 cmd/pad/main.go:431 — drop always-true `if eventBus != nil` guard. eventBus is wrapped in metrics.NewInstrumentedBus a few lines above, which returns a concrete *InstrumentedBus that is never nil. - SA1019 cmd/pad/main.go:3926 — replace deprecated strings.Title with golang.org/x/text/cases.Title(language.English).String. golang.org/x/text was already an indirect dep; now promoted to direct. - SA4031 internal/server/handlers_changes.go:130 — delete dead `if updatedItems == nil { ... }` block. make([]T, n) always returns non-nil; the JSON marshalling already produced [] not null. - SA9003 cmd/pad/init.go:351 — delete empty if branch and fold its intent into the surrounding comment. - SA9003 internal/server/handlers_dashboard.go:125 — replace empty `if err == nil { ... }` branch with `_ = json.Unmarshal(...)` to match the sibling settings parse and document the best-effort intent. - SA4006 internal/cli/format.go:153 — drop the dead initial `titlePart := item.Title` (overwritten in both branches below); declare titlePart with `var` instead. - SA4006 internal/store/workspaces.go:70 — drop the dead first call to s.uniqueSlug; only the workspace-specific uniqueWorkspaceSlug is meaningful (workspace slugs are globally unique, not workspace- scoped like collection/item slugs). - SA4000 internal/store/store_test.go:99 — remove always-true outer `if idx := len(connStr) - len(connStr); idx >= 0` and unindent the inner '?' query-string split. go.mod side effects from `go mod tidy` under Go 1.26: golang.org/x/text moves to direct (used directly now); pquerna/otp, prometheus/client_* and trustelem/zxcvbn move from indirect to direct (they were already used directly — Go 1.26's tidy correctly classifies them). Verified: - `go build ./...` clean - `go vet ./...` clean - `go test ./...` all pass (including the replaceDBName test path) - `staticcheck -checks "SA1019,SA4000,SA4006,SA4023,SA4031,SA9003"` clean except for handlers_dashboard.go:221 (SA4006, dashboard visibility- filter dead block — handled in TASK-765) Parent: PLAN-644. * fix: clear SA5011 nil-deref in buildReconcileFindings (TASK-764) extractItemStatus(item.Fields) on the first line of the function would have panicked on a nil item before the `if item != nil && item.CodeContext == nil` guard could fire. Staticcheck SA5011 flagged the inconsistency. Drop the (item != nil) half of the guard — the function now documents its non-nil contract in the doc comment. All callers (reconcile.go:204 plus three sites in cmd/pad/reconcile_test.go) already pass non-nil, so this is documentation, not behaviour change. Verified: - `go build ./...` clean - `go test ./cmd/pad/...` passes (the existing reconcile tests cover the contract) - `staticcheck -checks SA5011 ./...` clean Parent: PLAN-644. * chore: silence SA4017 false positive in watchCmd SSE loop (TASK-764) cmd/pad/main.go SSE keepalive branch: if strings.HasPrefix(line, ":") { continue } Staticcheck SA4017 reports "HasPrefix doesn't have side effects and its return value is ignored" — but the return value IS used as the if condition. Two sibling strings.HasPrefix calls earlier in the same for-loop body (matching "event: " and "data: " prefixes) are not flagged, which strongly suggests an SSA-analysis quirk specific to this branch rather than a real defect. Suppress the finding with a //lint:ignore directive that explains the false positive in-place. Rewriting to a different form (extract to a bool var, comma-OK on a synthetic value, etc.) would be uglier than the suppression comment. Verified: - `staticcheck -checks SA4017 ./...` clean - `go build ./...` clean Parent: PLAN-644. * chore: delete dead code flagged by U1000 (TASK-764) Pre-launch (no external contributors yet) — no consumer fork can be relying on these unreferenced symbols, so we delete them rather than carry the maintenance burden into v1. ## Helpers (14 functions, 1 type) cmd/pad/main.go - progressBar — never called internal/cli/format.go - stripHTMLTags — never called internal/server/handlers_dashboard_test.go - updateItem (test helper) — never called from any test internal/server/handlers_items.go - publishItemEvent — wrapper over publishItemEventWithName; all 5 call sites use the *WithName variant directly. - resolveRelationFields — never called. - resolveRelationFieldFiltersForWorkspace, resolveRelationFieldFilters, relationFilterKeys, resolveRelationFilterValue — closed loop of dead helpers (each one only called by another dead one in the family). - extractStatus — never called (cmd/pad/reconcile.go has its own copy). internal/server/handlers_versions.go - handleGetDiff (HTTP handler) — never wired into setupRouter. - diffsToChanges, diffChange (type) — only used by handleGetDiff above. - Removes now-unused imports `strconv` and `dmp` (sergi/go-diff). internal/server/middleware_ratelimit.go - writeTooManyRequests — never called; the live ratelimit middleware uses a dedicated 429 path with Retry-After-Bucket headers. internal/server/server.go - guestVisibleItemIDs — never called. handlers_events.go had a comment cross-reference; updated to drop the reference. ## Constants internal/events/redis_bus.go - reconnectDelay — never read. internal/store/api_tokens.go - defaultTokenExpiryDays — never read. ## Out of scope The 5 unwired handlers in internal/server/handlers_documents.go are left alone: they are the subject of TASK-769 (a product decision — wire up vs. delete — that may want different treatment per handler). The two SA4006/SA4010 findings on internal/server/handlers_dashboard.go visibility-filter block are similarly left for TASK-765. ## Verified - `go build ./...` clean - `go vet ./...` clean - `go test ./...` all pass - `staticcheck -checks "SA*,U1000" ./...` clean except the two TASK- 765 / TASK-769 follow-ups noted above. Parent: PLAN-644. * docs: correct caller name in buildReconcileFindings doc (TASK-764) Codex round 1 caught: the doc comment named the caller `reconcileSingle` but the actual function is `reconcileItem` (cmd/pad/reconcile.go:204). Fix the contract comment so it doesn't go stale on the first git blame.	2026-04-25 11:53:31 -04:00
xarmian	157ca4e88f	chore: bump Go toolchain to 1.26 (TASK-763) (#247) ... * chore: bump Go toolchain to 1.26 (TASK-763) Bump Go from 1.25 to 1.26 across all toolchain pins: - go.mod — go 1.25.0 → go 1.26.0 - Dockerfile — golang:1.25-alpine → golang:1.26-alpine - .github/workflows/ci.yml — three setup-go steps (Go, Go-Postgres, E2E jobs) - .github/workflows/release.yml — release pipeline No `toolchain` directive: the repo is pre-launch with no external contributors yet, so we set the floor where we want it (hard requirement). Verified locally before commit: - golangci-lint v2.11.4 builds and runs under Go 1.26.2 (pinned in CI) - golang:1.26-alpine and 1.26.2-alpine images present on Docker Hub - go build ./... clean - go vet ./... clean - go test ./... all pass Parent: PLAN-644 (OSS Repo Hygiene and Launch Polish). * chore: gofmt -w under Go 1.26 (TASK-763) Apply Go 1.26's gofmt to the codebase. ~41 files reformatted, all struct-tag whitespace realignment — no semantic changes. Verified: - gofmt -l ./cmd ./internal returns empty after - go build ./... still clean - go test ./... still passes (run before commit) Bundling the gofmt diff with the toolchain bump in the same PR because the formatting drift is a direct consequence of moving from 1.25 to 1.26; splitting them creates a mandatory two-PR ordering for no value. Parent: PLAN-644. * docs: bump documented Go floor to 1.26 (TASK-763) Match go.mod's hard 1.26.0 requirement in the source-build instructions. Caught by Codex review round 1 on PR #247. - README.md:158 — "Go 1.25+" → "Go 1.26+" - CONTRIBUTING.md:9 — "Go 1.25+" → "Go 1.26+"	2026-04-25 11:35:19 -04:00
xarmian	c5183d2a4b	feat: add SSE events for item star/unstar (#121) ... * feat: add SSE events for item star/unstar Emit real-time events for multi-tab sync (PLAN-564, TASK-571): - New event types: item_starred, item_unstarred - Emitted from handleStarItem and handleUnstarItem after success - Includes item ID, title, collection, actor, and source - Follows existing publishItemEventWithName pattern * fix: scope star/unstar SSE events to the acting user Star events are user-specific state, not workspace-wide. Changes: - Add UserID field to Event struct for user-scoped events - SSE handler filters events with UserID, only delivering them to the user who triggered the action (multi-tab sync without leaking star actions to other workspace members) - Star/unstar handlers set UserID when publishing events	2026-04-14 21:03:37 -04:00
xarmian	7ef4506cfa	fix: replace scattered tab-resume refetches with layered sync system ... When the browser tab lost focus and regained it, 5 independent onTabResume callbacks all fired simultaneously, flooding the server with redundant requests. This replaces that pattern with a 4-layer sync architecture: 1. Replay buffer — per-workspace ring buffer stores recent events with monotonic IDs. On SSE reconnect, missed events are replayed via Last-Event-ID so the client is already caught up. 2. Last-Event-ID support — SSE handler reads the header, replays from buffer, or sends sync_required if the gap is too large. 3. Incremental sync — new /changes?since=<ms> endpoint returns only modified/deleted items since a timestamp, including archived items for view consistency. 4. Centralized sync coordinator — single decision tree replaces 5 scattered callbacks. Short absences skip sync entirely, SSE-covered gaps need no API calls, and full refresh is a last resort. Key robustness details: - Global event IDs via Redis INCR for multi-instance safety - Server-time cursors to avoid client clock skew - Safe cursor management (only advances on confirmed sync) - 9 new tests for replay buffer and event ID behavior Fixes BUG-26.	2026-04-10 04:15:43 +00:00
xarmian	34ebf31fdf	fix: resolve Codex review findings across SSE, audit, metrics, and deployment ... - Make SSE limit checks atomic with subscription via SubscribeIfAllowed to prevent TOCTOU races where concurrent requests bypass connection caps - Replace fmt.Sprintf JSON assembly with json.Marshal (auditMeta helper) in all audit log call sites to prevent silent JSONB insert failures on PostgreSQL when metadata contains special characters - Pass database credentials via PGDATABASE env var instead of pg_dump/psql command-line args to avoid leaking passwords in ps/proc output - Fix audit-log query builder to rebind placeholders once after all filters are appended, preventing duplicate $1 placeholders on PostgreSQL - Replace per-workspace SSE GaugeVec with a single Gauge to avoid unbounded Prometheus label cardinality in multi-tenant deployments - Fix prod Docker Compose: override PAD_REDIS_URL with password and add authenticated Redis healthcheck when REDIS_PASSWORD is set	2026-04-07 01:13:44 +00:00
xarmian	82e93d6014	feat: implement SSE connection limits ... Add configurable global and per-workspace SSE connection limits to prevent memory exhaustion from unbounded connections. Returns HTTP 429 when limits are reached. Logs warnings at 80% capacity. Configurable via PAD_SSE_MAX_CONNECTIONS (default 1000) and PAD_SSE_MAX_PER_WORKSPACE (default 100), or config.toml. Adds WorkspaceSubscriberCount to EventBus interface for per-workspace tracking (MemoryBus iterates subscribers, RedisBus uses existing wsCounts map). Resolves TASK-165	2026-04-06 01:23:34 +00:00
xarmian	b9d0a89195	feat: add Redis pub/sub EventBus for multi-instance SSE (TASK-158) ... - Extract EventBus interface (Subscribe, Unsubscribe, Publish, Close) - Rename Bus → MemoryBus, keeping it as the default for single-instance - Add RedisBus implementation with per-workspace channel subscriptions - Lazy Redis subscribe/unsubscribe as SSE clients connect/disconnect - Configure via PAD_REDIS_URL env var; falls back to in-memory without it - Update Server.SetEventBus to accept the EventBus interface	2026-04-05 15:16:57 +00:00
xarmian	e7f4448028	feat: add readiness probe and structured logging (TASK-161) ... - Add /health/live (liveness) and /health/ready (readiness with DB check) endpoints - Add Store.Ping() for database connectivity verification - Create internal/logging package using stdlib log/slog - Support PAD_LOG_LEVEL (debug/info/warn/error) and PAD_LOG_FORMAT (text/json) env vars - Add structured request logging middleware replacing chi's default Logger - Migrate all log.Printf calls to slog with proper levels and key-value attrs - Exempt health probe endpoints from auth middleware	2026-04-05 15:02:54 +00:00
xarmian	dab6d6c9c9	feat: implement graceful shutdown with request draining (TASK-159) ... - Add signal handler for SIGINT/SIGTERM with 30s grace period - Add Server.Shutdown() for graceful HTTP connection draining - Add EventBus.Close() to cleanly terminate SSE subscribers - Configure HTTP server timeouts (read: 15s, header: 5s, idle: 120s) - Fix SetWebUI nil router panic by calling ensureRouter() - Add Server.Handler() for httptest compatibility	2026-04-05 14:56:56 +00:00
xarmian	998716ae49	feat: unified item timeline with comment-on-update, threading, and reactions (#54) ... * feat: unified item timeline with comment-on-update, threading, and reactions (IDEA-115) Replace the separate Comments section and Version History modal on the item detail page with a single chronological timeline that interleaves comments, activities, and content versions. Key changes: - Add --comment flag to `pad item update` so agents/users can explain status changes inline (creates a comment linked to the activity) - Add threaded replies (parent_id on comments) with inline reply UI - Add emoji reactions on comments (new comment_reactions table) - New /timeline API endpoint merges comments, activities, and versions server-side with dedup and collapsing of rapid edits - New Svelte timeline components: ItemTimeline, TimelineCommentCard, TimelineActivityCard, TimelineVersionCard, ReactionPicker - Remove Implementation Notes and Decision Log inputs from web UI - Update skill docs to encourage --comment on status changes * fix: address review findings for PR #54 (iteration 1) - Use ListItemVersions instead of ListVersions in timeline endpoint so item content history renders correctly - Add workspace validation to reply and reaction handlers to prevent cross-workspace comment mutation - Raise activity cap from 500 to 10000 to avoid silently truncating long timelines - Fix toggleReaction to always POST (idempotent) instead of incorrectly matching other users' reactions for DELETE - Await onReply promise before clearing draft to prevent duplicate submissions and lost drafts on failure - Register reaction_added/reaction_removed in SSE ITEM_EVENTS so reactions from other sessions appear in real-time Co-Authored-By: Claude <noreply@anthropic.com> * fix: address review findings for PR #54 (iteration 2) - Fix nil pointer dereference in timeline handler when item not found - Store empty string instead of NULL for reaction user_id so UNIQUE constraint works correctly in SQLite - Add workspace validation to handleDeleteComment (cross-workspace deletion was possible) - Fix SKILL.md duplicate numbering (4. appeared twice) - Remove || true debug artifacts from reaction conditionals - Replace SvelteMap with plain Map in non-reactive groupReactions - Use != null checks for timeline API params to handle offset=0 - Log warning on comment creation failure during item update Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com>	2026-04-03 07:25:56 -04:00
xarmian	4003772538	feat: show user names in activity feeds and real-time events (#17) ... Activity entries now display the authenticated user's name instead of generic "user"/"You" labels. The user_id (already present in the activities table from migration 012) is persisted when logging activity and joined against the users table when querying, so actor_name flows through the API without extra lookups. Falls back to the actor field value when no user is associated (e.g. pre-auth activities or deleted users). Backend: - Activity model gains UserID and ActorName fields - Store queries LEFT JOIN users to populate actor_name - logActivityWithMeta now records currentUserID on every activity - Dashboard API includes actor_name in recent_activity - SSE Event struct carries ActorName for real-time toasts - Item-level activity endpoint added (GET /items/{slug}/activity) Frontend: - Activity page shows user name badge (green) instead of "web" - Dashboard recent activity shows user name inline - ActivityFeed component displays user name instead of "You" - SSE toast notifications show user name instead of "CLI"	2026-03-28 19:11:42 -04:00
xarmian	81579847c6	Initial release ... Pad — project management for developers and AI agents. Single Go binary with embedded SvelteKit web UI, SQLite storage, CLI, and Claude Code /pad skill integration. https://getpad.dev	2026-03-26 01:52:36 +00:00