thandClaude Opus 4.6
26ffa0e71f
End-to-end shared buckets between relay tenants. Bucket metadata + members sync through new relay routes (collab-buckets, collab-cards, collab-locks); card content rides the existing inter-tenant encryption hop. Edit locks, ownership transfer, LWW conflict stashing, undo for local-bucket destructive actions, "Make collaborative…" upgrade path, and a resilient outbox for relay-down create attempts. See plugins/collab-buckets/README.md and TODO.md for the full picture. Core hooks added so the plugin can integrate without monkey-patching: - buckets.js context menu: collab-aware rename/color/delete + Members & owner / Make collaborative entries - editor.js dispatches hyprcrd:editor-open / hyprcrd:editor-close for the per-card edit-lock heartbeat - app.js exposes window.state for the plugin's MutationObserver - index.php POST/PATCH/DELETE on /api/buckets refuse to mutate collab buckets directly (must go through the relay) - Database.php adds buckets.collab_uid column + unique partial index - import handler now restores color and collab_uid (was silently dropping color, which caused the test runner's auto-restore to wipe custom bucket colors) - relay bootstrap creates collab_buckets, collab_bucket_members, collab_cards, collab_card_locks tables and prunes tombstones / expired locks on every request Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
76 lines
3.9 KiB
PHP
76 lines
3.9 KiB
PHP
<?php
|
|
// Collab card lock routes (Phase 4 — advisory edit locks):
|
|
// POST /api/collab-locks acquire/refresh a lock
|
|
// DELETE /api/collab-locks/{bucket}/{card} release own lock
|
|
// GET /api/collab-locks list locks visible to caller
|
|
//
|
|
// Membership is enforced on every operation. A lock refresh just extends
|
|
// the TTL (60 seconds from now). Expired rows are pruned on every request
|
|
// via bootstrap.php cleanup, so the GET list never contains stale locks.
|
|
|
|
if (!defined('RELAY_BOOTSTRAPPED')) { http_response_code(404); exit; }
|
|
|
|
$clientTenant = $clientTenant ?? authClient($db);
|
|
|
|
function collabLocksIsMember(PDO $db, string $bucketUid, int $tenantId): bool {
|
|
$stmt = $db->prepare('SELECT 1 FROM collab_bucket_members WHERE bucket_uid = :b AND tenant_id = :t');
|
|
$stmt->execute(['b' => $bucketUid, 't' => $tenantId]);
|
|
return (bool)$stmt->fetchColumn();
|
|
}
|
|
|
|
// ── POST: acquire/refresh ────────────────────────────────────────
|
|
|
|
if ($route === '/api/collab-locks' && $method === 'POST') {
|
|
if (!$clientTenant) jsonResponse(['error' => 'unauthorized'], 401);
|
|
if (isRateLimited($db, 'collab-locks-post', 240)) jsonResponse(['error' => 'rate limited'], 429);
|
|
$input = json_decode(file_get_contents('php://input'), true) ?: [];
|
|
$bucketUid = trim((string)($input['bucket_uid'] ?? ''));
|
|
$cardUid = trim((string)($input['card_uid'] ?? ''));
|
|
if ($bucketUid === '' || $cardUid === '') jsonResponse(['error' => 'bucket_uid and card_uid required'], 400);
|
|
if (!collabLocksIsMember($db, $bucketUid, (int)$clientTenant['id'])) {
|
|
jsonResponse(['error' => 'not a member of this bucket'], 403);
|
|
}
|
|
$db->prepare("
|
|
INSERT INTO collab_card_locks (bucket_uid, card_uid, holder_id, holder_username, acquired_at, expires_at)
|
|
VALUES (:b, :c, :hid, :hu, datetime('now'), datetime('now', '+60 seconds'))
|
|
ON CONFLICT(bucket_uid, card_uid, holder_id) DO UPDATE SET
|
|
expires_at = datetime('now', '+60 seconds')
|
|
")->execute([
|
|
'b' => $bucketUid,
|
|
'c' => $cardUid,
|
|
'hid' => $clientTenant['id'],
|
|
'hu' => $clientTenant['username'],
|
|
]);
|
|
jsonResponse(['ok' => true, 'expires_at' => (string)$db->query("SELECT datetime('now', '+60 seconds')")->fetchColumn()]);
|
|
}
|
|
|
|
// ── DELETE: release own lock ─────────────────────────────────────
|
|
|
|
if (preg_match('#^/api/collab-locks/([a-zA-Z0-9_-]+)/([a-zA-Z0-9_-]+)$#', $route, $m) && $method === 'DELETE') {
|
|
if (!$clientTenant) jsonResponse(['error' => 'unauthorized'], 401);
|
|
$bucketUid = $m[1];
|
|
$cardUid = $m[2];
|
|
$db->prepare('DELETE FROM collab_card_locks WHERE bucket_uid = :b AND card_uid = :c AND holder_id = :h')
|
|
->execute(['b' => $bucketUid, 'c' => $cardUid, 'h' => $clientTenant['id']]);
|
|
jsonResponse(['ok' => true]);
|
|
}
|
|
|
|
// ── GET: list locks visible to caller ────────────────────────────
|
|
|
|
if ($route === '/api/collab-locks' && $method === 'GET') {
|
|
if (!$clientTenant) jsonResponse(['error' => 'unauthorized'], 401);
|
|
if (isRateLimited($db, 'collab-locks-get', 120)) jsonResponse(['error' => 'rate limited'], 429);
|
|
// Only return locks in buckets the caller is currently a member of,
|
|
// and only non-expired rows (bootstrap cleanup + defensive filter).
|
|
$stmt = $db->prepare("
|
|
SELECT l.bucket_uid, l.card_uid, l.holder_id, l.holder_username, l.acquired_at, l.expires_at
|
|
FROM collab_card_locks l
|
|
INNER JOIN collab_bucket_members m ON m.bucket_uid = l.bucket_uid
|
|
WHERE m.tenant_id = :tid
|
|
AND l.expires_at > datetime('now')
|
|
ORDER BY l.acquired_at DESC
|
|
");
|
|
$stmt->execute(['tid' => $clientTenant['id']]);
|
|
jsonResponse(['ok' => true, 'locks' => $stmt->fetchAll()]);
|
|
}
|