thandClaude Opus 4.6
d052fb5f9d
Restructure the shopping-list feature end to end:
- New public/plugins/shopping/ plugin with backend.php (proxy
routes registered via PluginManager::onApiRoute), shopping.js
(self-contained; injects the header Shopping button, owns the
picker dialog + sync loop via hyprcrd.hooks), plugin.json and a
placeholder css file. Core no longer knows about shopping —
index.php loses the static button and the proxy block, app.js
loses the initShopping wiring, the old js/modules/shopping.js
is gone.
- Phone view moves out of a standalone /shopping page and into
the relay UI as a regular `view-shopping` behind a nav-burger
entry (relay/ui/layout.php + app.js + style.css). Same session
auth as compose/chat/account — no separate login. Auto-refresh
every 4 s while the view is active; no manual refresh button.
Headings "# h1 … ###### h6" render between items for grouping.
Orphan section headings (no open items under them) are hidden.
- Sync: drop timestamp cursors (broke across SQLite-UTC / PHP
timezones and silently blocked pushes after a pull). Both sides
diff the (uid, title, body) triple instead — timezone-agnostic
and authoritative. Client ticks push-before-pull so fresh local
edits land on the relay before a stale pull can overwrite them.
Relay drops its "server newer" guard and stamps server times
with gmdate so anything left comparing to SQLite is UTC.
- Client also ticks on cards.reloaded, not just sync.tick, so
any edit path (editor save, checkbox toggle, context menu,
undo) pushes the update immediately.
- Tests: updated for the plugin (still uses the same selectors
because the plugin injects the same ids), plus a plugin-
registration check and "(no active list)" option assertion.
- Help section copy updated — references the Shopping header
button and the shopping tab in the relay UI rather than the
gone /shopping URL.
Both #einkauf and #shopping work as trigger tags; phone is
check-only, editing stays in hyprcrd. Version bumped to 1.9.21.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
76 lines
3.5 KiB
PHP
76 lines
3.5 KiB
PHP
<?php
|
|
// ── hyprcrd Relay — Multi-tenant ──
|
|
//
|
|
// Entry point. Loads bootstrap + helpers, dispatches API routes,
|
|
// renders the UI layout. The actual logic lives in inc/ and ui/.
|
|
//
|
|
// Architecture (encryption flow for cross-tenant messages):
|
|
// 1. Client A encrypts a message with A's tenant secret
|
|
// 2. POST /api/messages, server authenticates A, decrypts with A's secret
|
|
// 3. Server re-encrypts with the inter-tenant key (relay-wide shared
|
|
// key, generated at install, stored encrypted with the master key)
|
|
// 4. Stored in messages table with recipient_id = B's tenant id
|
|
// 5. B fetches /api/messages, server decrypts with inter-tenant key,
|
|
// re-encrypts with B's tenant secret, returns to client B
|
|
// 6. Client B decrypts with its own secret
|
|
//
|
|
// The relay sees plaintext briefly during the cross-tenant hop. This
|
|
// is not strict end-to-end — that requires per-pair key exchange and
|
|
// is on the roadmap for the planned encrypted chat feature. See
|
|
// README.md.
|
|
|
|
define('RELAY_BOOTSTRAPPED', true);
|
|
|
|
require_once __DIR__ . '/inc/bootstrap.php';
|
|
require_once __DIR__ . '/inc/crypto.php';
|
|
require_once __DIR__ . '/inc/tenants.php';
|
|
require_once __DIR__ . '/inc/auth.php';
|
|
|
|
// ── Routing ────────────────────────────────────────────────────────
|
|
|
|
$route = parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH);
|
|
$base = dirname($_SERVER['SCRIPT_NAME']);
|
|
if ($base !== '/') $route = substr($route, strlen($base));
|
|
$route = '/' . ltrim($route ?: '/', '/');
|
|
$method = $_SERVER['REQUEST_METHOD'];
|
|
|
|
$isSetup = tenantCount($db) === 0;
|
|
|
|
// ── API ────────────────────────────────────────────────────────────
|
|
|
|
if (str_starts_with($route, '/api/')) {
|
|
header('Content-Type: application/json');
|
|
$origin = $_SERVER['HTTP_ORIGIN'] ?? '';
|
|
if ($origin) {
|
|
header('Access-Control-Allow-Origin: ' . $origin);
|
|
header('Access-Control-Allow-Credentials: true');
|
|
header('Vary: Origin');
|
|
}
|
|
header('Access-Control-Allow-Headers: Content-Type, X-Relay-User, X-Relay-Key');
|
|
header('Access-Control-Allow-Methods: GET, POST, PATCH, DELETE, OPTIONS');
|
|
if ($method === 'OPTIONS') exit;
|
|
|
|
$contentLength = (int)($_SERVER['CONTENT_LENGTH'] ?? 0);
|
|
$sizeLimit = ($route === '/api/attachments') ? 15728640 : 262144;
|
|
if ($contentLength > $sizeLimit) jsonResponse(['error' => 'payload too large'], 413);
|
|
|
|
// Each route file contains its handlers as if-blocks that exit on
|
|
// match. Order matters: public.php sets up $sessionTenant which
|
|
// admin.php and messages.php use later in the chain.
|
|
require __DIR__ . '/inc/routes/public.php';
|
|
require __DIR__ . '/inc/routes/account.php';
|
|
require __DIR__ . '/inc/routes/admin.php';
|
|
require __DIR__ . '/inc/routes/messages.php';
|
|
require __DIR__ . '/inc/routes/chat.php';
|
|
require __DIR__ . '/inc/routes/collab-buckets.php';
|
|
require __DIR__ . '/inc/routes/collab-cards.php';
|
|
require __DIR__ . '/inc/routes/collab-locks.php';
|
|
require __DIR__ . '/inc/routes/shopping.php';
|
|
|
|
jsonResponse(['error' => 'not found'], 404);
|
|
}
|
|
|
|
// ── UI ─────────────────────────────────────────────────────────────
|
|
|
|
require __DIR__ . '/ui/layout.php';
|