feat: continue restart plan

Author: gustavotoyota

new-deepnotes/PLAN_PROGRESS.md

@@ -78,6 +78,10 @@ describe("api-worker", () => {
       "PATCH",
       "/api/groups/aaaaaaaaaaaaaaaaaaaaa/privacy/join-requests",
     ],
+    [
+      "POST",
+      "/api/groups/aaaaaaaaaaaaaaaaaaaaa/privacy/private",
+    ],
     ["DELETE", "/api/groups/aaaaaaaaaaaaaaaaaaaaa"],
     [
       "POST",

new-deepnotes/apps/api-worker/src/index.test.ts

@@ -8,6 +8,7 @@ import {
   groupPasswordDisableRequestSchema,
   groupPasswordEnableRequestSchema,
   groupPrivacyJoinRequestsPatchSchema,
+  groupPrivacyPrivateRequestSchema,
   groupPrivacyPublicRequestSchema,
   healthResponseSchema,
   userDefaultArrowPatchSchema,
@@ -1673,6 +1674,78 @@ app.patch("/api/groups/:groupId/privacy/join-requests", async (c) => {
   }
 });
 
+app.post("/api/groups/:groupId/privacy/private", async (c) => {
+  const sessionEnv = getSessionEnv(c.env);
+  if (sessionEnv == null) {
+    return c.json(serviceUnavailableBody, 503);
+  }
+  const hyper = c.env.HYPERDRIVE;
+  if (hyper == null) {
+    return c.json(
+      {
+        code: "SERVICE_UNAVAILABLE" as const,
+        message: "HYPERDRIVE binding is not configured.",
+      },
+      503,
+    );
+  }
+
+  let bodyJson: unknown;
+  try {
+    bodyJson = await c.req.json();
+  } catch {
+    return c.json({ code: "BAD_REQUEST", message: "Expected JSON body." }, 400);
+  }
+
+  const parsed = groupPrivacyPrivateRequestSchema.safeParse(bodyJson);
+  if (!parsed.success) {
+    return c.json(
+      {
+        code: "VALIDATION_ERROR",
+        message: parsed.error.flatten().formErrors.join("; "),
+      },
+      400,
+    );
+  }
+
+  const db = getDbForConnectionString(hyper.connectionString);
+  const cookieHeader = c.req.header("Cookie");
+  const groupId = c.req.param("groupId");
+
+  const payload = {
+    groupAccessKeyring: parsed.data.groupAccessKeyring,
+    groupEncryptedName: parsed.data.groupEncryptedName,
+    groupEncryptedContentKeyring: parsed.data.groupEncryptedContentKeyring,
+    groupPublicKeyring: parsed.data.groupPublicKeyring,
+    groupEncryptedPrivateKeyring: parsed.data.groupEncryptedPrivateKeyring,
+    groupMembers: parsed.data.groupMembers,
+    groupJoinInvitations: parsed.data.groupJoinInvitations,
+    groupJoinRequests: parsed.data.groupJoinRequests,
+    groupPages: parsed.data.groupPages,
+  };
+
+  try {
+    const { performGroupPrivacyMakePrivate } = await import("@deepnotes/session");
+    await performGroupPrivacyMakePrivate({
+      db,
+      env: sessionEnv,
+      accessCookie: readCookieHeader(cookieHeader, "accessToken"),
+      groupId,
+      payload,
+    });
+    return c.body(null, 204);
+  } catch (e) {
+    const { SessionError } = await import("@deepnotes/session");
+    if (e instanceof SessionError) {
+      return c.json(
+        { code: e.code, message: e.message },
+        e.status as ContentfulStatusCode,
+      );
+    }
+    throw e;
+  }
+});
+
 app.delete("/api/groups/:groupId", async (c) => {
   const sessionEnv = getSessionEnv(c.env);
   if (sessionEnv == null) {

new-deepnotes/apps/api-worker/src/index.ts

@@ -59,6 +59,7 @@ Working checklist for Phase 0 of [docs/RESTART_PLAN.md](../../docs/RESTART_PLAN.
 | `groups.password.disable` | `DELETE /api/groups/:groupId/password` (JSON body; **implemented** — `performGroupPasswordDisable`; not Pro-gated, legacy match) |
 | `groups.privacy.makePublic` | `POST /api/groups/:groupId/privacy/public` (**implemented** — `performGroupPrivacyMakePublic`; clears `group_members` / `group_join_invitations` `encrypted_access_keyring`) |
 | `groups.privacy.setJoinRequestsAllowed` | `PATCH /api/groups/:groupId/privacy/join-requests` (**implemented** — `performGroupPrivacySetJoinRequestsAllowed`) |
+| (WS) `groups.privacy.makePrivate` step 1+2 | `POST /api/groups/:groupId/privacy/private` (**implemented** — `performGroupPrivacyMakePrivate`; single body = legacy `rotateGroupKeys` / `groupKeyRotationSchema`; omits `pages.next_key_rotation_date` bumps per RESTART_PLAN) |
 | `groups.deletion.delete` | `DELETE /api/groups/:groupId` (soft) (**implemented** — `performGroupSoftDelete`) |
 | `groups.deletion.restore` | `POST /api/groups/:groupId/restore` (**implemented** — `performGroupRestore`; grace only; not after purge) |
 | `groups.deletion.deletePermanently` | `POST /api/groups/:groupId/purge` (**implemented** — `performGroupPurge`) |
@@ -86,7 +87,7 @@ Working checklist for Phase 0 of [docs/RESTART_PLAN.md](../../docs/RESTART_PLAN.
 | `websocket/groups/join-requests/*` | same | send / accept / reject / cancel |
 | `websocket/groups/change-user-role` | `PATCH /api/groups/:groupId/members/:userId` | prefer REST if acceptable |
 | `websocket/groups/remove-user` | `DELETE /api/groups/:groupId/members/:userId` | |
-| `websocket/groups/privacy/make-private` | `POST /api/groups/:groupId/privacy/private` | |
+| `websocket/groups/privacy/make-private` | `POST /api/groups/:groupId/privacy/private` | **implemented** — see `groups.privacy.makePrivate` row above |
 | `websocket/groups/rotate-keys` | — | **removed** per RESTART_PLAN |
 | `websocket/pages/move` | `POST /api/pages/:pageId/move` | |
 | `websocket/users/account/change-password` | `POST /api/users/me/password` | **implemented** in `@deepnotes/session` (`performUserPasswordChange`) |

new-deepnotes/docs/TRPC_REST_MAP.md

@@ -35,9 +35,11 @@ export {
   groupPasswordDisableRequestSchema,
   groupPasswordEnableRequestSchema,
   groupPrivacyJoinRequestsPatchSchema,
+  groupPrivacyPrivateRequestSchema,
   groupPrivacyPublicRequestSchema,
   userGroupIdsResponseSchema,
 } from "./schemas/pages-groups.js";
+export type { GroupPrivacyPrivateRequest } from "./schemas/pages-groups.js";
 export {
   userCurrentPathResponseSchema,
   userDefaultArrowPatchSchema,

new-deepnotes/packages/api/src/index.ts

@@ -69,6 +69,9 @@ describe("getOpenApiDocument", () => {
     expect(
       doc.paths?.["/api/groups/{groupId}/privacy/join-requests"]?.patch,
     ).toBeDefined();
+    expect(
+      doc.paths?.["/api/groups/{groupId}/privacy/private"]?.post,
+    ).toBeDefined();
     expect(doc.paths?.["/api/groups/{groupId}"]?.delete).toBeDefined();
     expect(doc.paths?.["/api/groups/{groupId}/restore"]?.post).toBeDefined();
     expect(doc.paths?.["/api/groups/{groupId}/purge"]?.post).toBeDefined();

new-deepnotes/packages/api/src/openapi.test.ts

@@ -28,6 +28,7 @@ import {
   groupPasswordDisableRequestSchema,
   groupPasswordEnableRequestSchema,
   groupPrivacyJoinRequestsPatchSchema,
+  groupPrivacyPrivateRequestSchema,
   groupPrivacyPublicRequestSchema,
   userGroupIdsResponseSchema,
 } from "./schemas/pages-groups.js";
@@ -780,6 +781,37 @@ registry.registerPath({
   },
 });
 
+registry.registerPath({
+  method: "post",
+  path: "/api/groups/{groupId}/privacy/private",
+  summary: "Make group private (Pro) — full re-key payload",
+  description:
+    "Replaces legacy WS `groups.privacy.makePrivate` (step 2 `rotateGroupKeys`) in one request. Clears `access_keyring` when `groupAccessKeyring` is omitted. Member / invitation / request / page record keys must match the DB exactly.",
+  request: {
+    params: groupIdPathSchema,
+    body: {
+      content: {
+        "application/json": {
+          schema: groupPrivacyPrivateRequestSchema,
+        },
+      },
+    },
+  },
+  responses: {
+    204: { description: "Group is private; ciphertext updated." },
+    400: {
+      description: "Already private or payload key sets do not match group.",
+      content: {
+        "application/json": { schema: sessionErrorResponseSchema },
+      },
+    },
+    401: sessionUnauthorized401,
+    403: sessionForbidden403,
+    404: sessionNotFound404,
+    503: sessionServiceUnavailable503,
+  },
+});
+
 registry.registerPath({
   method: "delete",
   path: "/api/groups/{groupId}",

new-deepnotes/packages/api/src/openapi.ts

@@ -111,3 +111,63 @@ export const groupPrivacyJoinRequestsPatchSchema = z
     areJoinRequestsAllowed: z.boolean(),
   })
   .openapi("GroupPrivacyJoinRequestsPatch");
+
+const nanoidRecordKeySchema = z
+  .string()
+  .regex(/^[A-Za-z0-9_-]{21}$/, "expected nanoid id");
+
+const groupPrivacyPrivateMemberSchema = z
+  .object({
+    encryptedAccessKeyring: byteB64.optional(),
+    encryptedInternalKeyring: byteB64,
+    encryptedName: byteB64.nullable(),
+  })
+  .openapi("GroupPrivacyPrivateMember");
+
+const groupPrivacyPrivateInvitationSchema = z
+  .object({
+    encryptedAccessKeyring: byteB64.optional(),
+    encryptedInternalKeyring: byteB64,
+    encryptedName: byteB64,
+  })
+  .openapi("GroupPrivacyPrivateInvitation");
+
+const groupPrivacyPrivateJoinRequestSchema = z
+  .object({
+    encryptedName: byteB64,
+  })
+  .openapi("GroupPrivacyPrivateJoinRequest");
+
+const groupPrivacyPrivatePageSchema = z
+  .object({
+    encryptedSymmetricKeyring: byteB64,
+  })
+  .openapi("GroupPrivacyPrivatePage");
+
+/**
+ * Re-key payload for `POST …/privacy/private` (legacy WS `groups.privacy.makePrivate` step 2 + `rotateGroupKeys` in one call).
+ * Record keys are user ids (members, invitations, requests) or page ids; must match current DB rows exactly.
+ */
+export const groupPrivacyPrivateRequestSchema = z
+  .object({
+    groupAccessKeyring: byteB64.optional(),
+    groupEncryptedName: byteB64,
+    groupEncryptedContentKeyring: byteB64,
+    groupPublicKeyring: byteB64,
+    groupEncryptedPrivateKeyring: byteB64,
+    groupMembers: z.record(nanoidRecordKeySchema, groupPrivacyPrivateMemberSchema),
+    groupJoinInvitations: z.record(
+      nanoidRecordKeySchema,
+      groupPrivacyPrivateInvitationSchema,
+    ),
+    groupJoinRequests: z.record(
+      nanoidRecordKeySchema,
+      groupPrivacyPrivateJoinRequestSchema,
+    ),
+    groupPages: z.record(nanoidRecordKeySchema, groupPrivacyPrivatePageSchema),
+  })
+  .openapi("GroupPrivacyPrivateRequest");
+
+export type GroupPrivacyPrivateRequest = z.infer<
+  typeof groupPrivacyPrivateRequestSchema
+>;