refactor(notes): remove legacy whole-document saves; all block changes go through sync

Phase 5 of the collaboration plan:
- Remove PATCH /documents/{id}/blocks, PatchDocumentBlocks, the
  DOC_BLOCKS_PATCHED event and its types, FlushDocumentState and
  LoadDocumentState. PUT /documents/{id} rejects blocks (400) and only
  changes title, icon, folder and pin; editors may now change title/icon.
- The to-do overview ticks via a single operation on /docs/{id}/sync
  (new skipLog flag). Task links set the block tick with a targeted
  operation and notify open editors; creating a linked task needs edit
  rights.
- Keep the three share tables: DocRole already decides centrally, and
  rewriting the visibility queries would only add risk (documented in plan).
- Tests adapted to the new paths; share e2e test now also ticks a to-do in
  the overview.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/docsync.go

@@ -86,6 +86,7 @@ func (s *Server) handleDocSync(w http.ResponseWriter, r *http.Request) {
 			Hold    []string `json:"hold"`
 			Release []string `json:"release"`
 		} `json:"leases"`
+		SkipLog bool `json:"skipLog"` // one-off changes (e.g. ticking a to-do in the overview) need no log
 	}
 	if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, syncMaxBody)).Decode(&req); err != nil {
 		writeError(w, http.StatusBadRequest, "Ungültiges JSON")
@@ -149,12 +150,16 @@ func (s *Server) handleDocSync(w http.ResponseWriter, r *http.Request) {
 		s.afterDocChange(docID, req.Ops, resp.Results)
 	}
 
-	entries, head, err := s.store.GetDocOpsSince(docID, req.LastSeq, syncMaxLog)
+	logLimit := syncMaxLog
+	if req.SkipLog {
+		logLimit = 0
+	}
+	entries, head, err := s.store.GetDocOpsSince(docID, req.LastSeq, logLimit)
 	if err != nil {
 		writeError(w, http.StatusInternalServerError, err.Error())
 		return
 	}
-	if req.LastSeq > head {
+	if req.LastSeq > head && !req.SkipLog {
 		resp.Resync = true
 		entries = []storage.DocLogEntry{}
 	}

internal/api/server.go

@@ -159,7 +159,6 @@ func (s *Server) Router() http.Handler {
 		r.Post("/api/v1/documents", s.handleCreateDocument)
 		r.Get("/api/v1/documents/{id}", s.handleGetDocument)
 		r.Put("/api/v1/documents/{id}", s.handleUpdateDocument)
-		r.Patch("/api/v1/documents/{id}/blocks", s.handlePatchDocumentBlocks)
 		r.Put("/api/v1/documents/{id}/move", s.handleMoveDocument)
 		r.Delete("/api/v1/documents/{id}", s.handleDeleteDocument)
 		r.Post("/api/v1/documents/{id}/blocks/{blockId}/enhanced-task", s.handleCreateEnhancedTask)
@@ -903,7 +902,10 @@ func (s *Server) handleUpdateThought(w http.ResponseWriter, r *http.Request) {
 		writeStoreError(w, http.StatusBadRequest, err)
 		return
 	}
-	s.store.SyncDocBlockAndTask(userID, thoughtID, updated.IsCompleted)
+	if docID := s.store.SyncDocBlockAndTask(userID, thoughtID, updated.IsCompleted); docID != "" {
+		_, head, _ := s.store.GetDocOpsSince(docID, 0, 0)
+		s.notifyDocChanged(docID, head)
+	}
 	s.wsHub.BroadcastToUsers(append(s.taskAudience(before), s.taskAudience(updated)...), "TASK_UPDATED", updated)
 	writeJSON(w, http.StatusOK, updated)
 }
@@ -1019,59 +1021,32 @@ func (s *Server) handleUpdateDocument(w http.ResponseWriter, r *http.Request) {
 		Icon       *string                 `json:"icon"`
 		FolderPath *string                 `json:"folderPath"`
 		Blocks     *[]domain.DocumentBlock `json:"blocks"`
-		Tags       *[]string               `json:"tags"`
 		IsPinned   *bool                   `json:"isPinned"`
 	}
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
 		writeError(w, http.StatusBadRequest, "Ungültiges JSON")
 		return
 	}
+	if req.Blocks != nil {
+		writeError(w, http.StatusBadRequest, "Blöcke werden über POST /api/v1/docs/{id}/sync gespeichert")
+		return
+	}
 
-	doc, err := s.store.UpdateDocument(userID, docID, req.Title, req.Icon, req.FolderPath, req.Blocks, req.Tags, req.IsPinned)
+	doc, err := s.store.UpdateDocument(userID, docID, req.Title, req.Icon, req.FolderPath, req.IsPinned)
 	if err != nil {
 		writeError(w, http.StatusBadRequest, err.Error())
 		return
 	}
-	if req.Title != nil || req.Icon != nil || req.FolderPath != nil || req.Blocks != nil || req.Tags != nil {
+	if req.Title != nil {
+		_, head, _ := s.store.GetDocOpsSince(docID, 0, 0)
+		s.notifyDocChanged(docID, head)
+	}
+	if req.Title != nil || req.Icon != nil || req.FolderPath != nil {
 		s.broadcastDocToAuthorizedUsers(docID, "DOC_UPDATED")
 	}
 	writeJSON(w, http.StatusOK, doc)
 }
 
-func (s *Server) handlePatchDocumentBlocks(w http.ResponseWriter, r *http.Request) {
-	userID := auth.GetUserID(r.Context())
-	docID := chi.URLParam(r, "id")
-
-	var req domain.DocBlocksPatchRequest
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		writeError(w, http.StatusBadRequest, "Ungültiges JSON")
-		return
-	}
-
-	doc, mergedOrder, err := s.store.PatchDocumentBlocks(userID, docID, req)
-	if err != nil {
-		writeError(w, http.StatusBadRequest, err.Error())
-		return
-	}
-
-	patchEvent := domain.DocBlocksPatchEvent{
-		DocID:      docID,
-		UpdatedBy:  userID,
-		UpdatedAt:  doc.UpdatedAt,
-		Upserted:   req.Upserted,
-		DeletedIDs: req.DeletedIDs,
-		BlockOrder: mergedOrder,
-	}
-	s.wsHub.BroadcastDocEvent(docID, "DOC_BLOCKS_PATCHED", patchEvent)
-	if users, err := s.store.GetAuthorizedDocUsers(docID); err == nil {
-		for _, uid := range users {
-			s.wsHub.BroadcastToUser(uid, "DOC_BLOCKS_PATCHED", patchEvent)
-		}
-	}
-
-	writeJSON(w, http.StatusOK, doc)
-}
-
 func (s *Server) handleDeleteDocument(w http.ResponseWriter, r *http.Request) {
 	userID := auth.GetUserID(r.Context())
 	docID := chi.URLParam(r, "id")
@@ -1106,6 +1081,8 @@ func (s *Server) handleCreateEnhancedTask(w http.ResponseWriter, r *http.Request
 		writeError(w, http.StatusBadRequest, err.Error())
 		return
 	}
+	_, head, _ := s.store.GetDocOpsSince(docID, 0, 0)
+	s.notifyDocChanged(docID, head)
 
 	s.wsHub.BroadcastToUser(userID, "TASK_CREATED", thought)
 	writeJSON(w, http.StatusCreated, thought)

internal/api/server_test.go

@@ -13,6 +13,7 @@ import (
 	"time"
 
 	"github.com/sandrodach/mindsift/internal/auth"
+	"github.com/sandrodach/mindsift/internal/collab"
 	"github.com/sandrodach/mindsift/internal/config"
 	"github.com/sandrodach/mindsift/internal/domain"
 	"github.com/sandrodach/mindsift/internal/storage"
@@ -1269,17 +1270,30 @@ func TestDocumentSharingStrictlyReadOnly(t *testing.T) {
 		t.Fatalf("expected error for User B updating document, got 200 OK")
 	}
 
-	// 3. User B tries to patch document blocks -> must fail (not owner)
-	patchBody, _ := json.Marshal(domain.DocBlocksPatchRequest{
-		Upserted: []domain.DocumentBlock{{ID: "b2", Content: "Hacked by User B"}},
+	// 3. User B tries to change blocks through the sync API -> must fail (read-only)
+	hacked := "Hacked by User B"
+	syncBody, _ := json.Marshal(map[string]interface{}{
+		"clientId": "tab-b",
+		"ops":      []collab.Op{{OpID: "b-hack", Kind: collab.OpSetContent, BlockID: "b2", BaseVersion: 1, Content: &hacked}},
 	})
-	req = httptest.NewRequest(http.MethodPatch, "/api/v1/documents/"+doc.ID+"/blocks", bytes.NewReader(patchBody))
+	req = httptest.NewRequest(http.MethodPost, "/api/v1/docs/"+doc.ID+"/sync", bytes.NewReader(syncBody))
 	req.Header.Set("Authorization", "Bearer "+tokenB)
 	req.Header.Set("Content-Type", "application/json")
 	rec = httptest.NewRecorder()
 	router.ServeHTTP(rec, req)
-	if rec.Code == http.StatusOK {
-		t.Fatalf("expected error for User B patching document blocks, got 200 OK")
+	if rec.Code != http.StatusForbidden {
+		t.Fatalf("expected 403 for User B changing blocks, got %d", rec.Code)
+	}
+
+	// The old whole-document save no longer accepts blocks, not even from the owner
+	blocksBody, _ := json.Marshal(map[string]interface{}{"blocks": []domain.DocumentBlock{{ID: "b1", Content: "x"}}})
+	req = httptest.NewRequest(http.MethodPut, "/api/v1/documents/"+doc.ID, bytes.NewReader(blocksBody))
+	req.Header.Set("Authorization", "Bearer "+tokenA)
+	req.Header.Set("Content-Type", "application/json")
+	rec = httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("expected 400 for blocks via PUT, got %d", rec.Code)
 	}
 
 	// 4. User A (owner) can successfully update document