feat(workspace): implement Yjs CRDT real-time collaborative editing (resolves FLAW-01)

internal/api/server.go

@@ -3,6 +3,7 @@ package api
 import (
 	"bytes"
 	"crypto/tls"
+	"encoding/base64"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -30,6 +31,9 @@ type Server struct {
 }
 
 func NewServer(cfg *config.Config, store *storage.Store, wsHub *ws.Hub, staticFS fs.FS) *Server {
+	if wsHub != nil && store != nil {
+		wsHub.SetCRDTStore(store)
+	}
 	srv := &Server{
 		cfg:      cfg,
 		store:    store,
@@ -141,6 +145,10 @@ func (s *Server) Router() http.Handler {
 		r.Post("/api/v1/documents/{id}/lock/heartbeat", s.handleHeartbeatDocLock)
 		r.Delete("/api/v1/documents/{id}/lock", s.handleUnlockDoc)
 
+		// Document CRDT Realtime Sync
+		r.Get("/api/v1/documents/{id}/crdt", s.handleGetDocCRDT)
+		r.Put("/api/v1/documents/{id}/crdt", s.handleSaveDocCRDT)
+
 		// Shared Lists & Realtime Collaboration
 		r.Get("/api/v1/lists", s.handleGetAllLists)
 		r.Post("/api/v1/lists", s.handleCreateList)
@@ -1373,6 +1381,68 @@ func (s *Server) handleUnlockDoc(w http.ResponseWriter, r *http.Request) {
 	writeJSON(w, http.StatusOK, map[string]bool{"unlocked": released})
 }
 
+// --- DOCUMENT CRDT REALTIME SYNC ---
+
+func (s *Server) handleGetDocCRDT(w http.ResponseWriter, r *http.Request) {
+	userID := auth.GetUserID(r.Context())
+	docID := chi.URLParam(r, "id")
+	if _, err := s.store.GetDocumentByID(userID, docID); err != nil {
+		writeError(w, http.StatusNotFound, "Dokument nicht gefunden")
+		return
+	}
+	stateBlob, updates, err := s.store.GetDocumentCRDTState(docID)
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	b64State := ""
+	if len(stateBlob) > 0 {
+		b64State = base64.StdEncoding.EncodeToString(stateBlob)
+	}
+	var b64Updates []string
+	for _, u := range updates {
+		b64Updates = append(b64Updates, base64.StdEncoding.EncodeToString(u))
+	}
+	writeJSON(w, http.StatusOK, map[string]interface{}{
+		"docId":   docID,
+		"state":   b64State,
+		"updates": b64Updates,
+	})
+}
+
+func (s *Server) handleSaveDocCRDT(w http.ResponseWriter, r *http.Request) {
+	userID := auth.GetUserID(r.Context())
+	docID := chi.URLParam(r, "id")
+	doc, err := s.store.GetDocumentByID(userID, docID)
+	if err != nil {
+		writeError(w, http.StatusNotFound, "Dokument nicht gefunden")
+		return
+	}
+	if !doc.IsOwner && doc.Permission != "write" {
+		writeError(w, http.StatusForbidden, "Keine Schreibberechtigung")
+		return
+	}
+	var req struct {
+		State string `json:"state"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		writeError(w, http.StatusBadRequest, "Ungültiger Request-Body")
+		return
+	}
+	if req.State != "" {
+		raw, err := base64.StdEncoding.DecodeString(req.State)
+		if err != nil {
+			writeError(w, http.StatusBadRequest, "Ungültiges Base64 Format")
+			return
+		}
+		if err := s.store.SaveDocumentCRDTState(docID, raw, userID); err != nil {
+			writeError(w, http.StatusInternalServerError, err.Error())
+			return
+		}
+	}
+	writeJSON(w, http.StatusOK, map[string]bool{"success": true})
+}
+
 // --- REALTIME LISTS & SHARING ---
 
 func (s *Server) handleGetAllLists(w http.ResponseWriter, r *http.Request) {

internal/api/server_test.go

@@ -838,3 +838,73 @@ func TestWebhookTriageBadgeAndIngestion(t *testing.T) {
 		t.Fatalf("expected thought content to contain 'Waschmaschine', got '%s'", ingestResp.Thought.Content)
 	}
 }
+
+func TestDocumentCRDTEndpoints(t *testing.T) {
+	tmpDir := t.TempDir()
+	dbPath := filepath.Join(tmpDir, "crdt_api_test.db")
+
+	store, err := storage.NewStore(dbPath)
+	if err != nil {
+		t.Fatalf("NewStore failed: %v", err)
+	}
+	defer store.Close()
+
+	cfg := &config.Config{
+		JWTSecret:         "test-jwt-secret-key",
+		AllowRegistration: true,
+	}
+	hub := ws.NewHub()
+	srv := NewServer(cfg, store, hub, nil)
+	router := srv.Router()
+
+	user, err := store.CreateUser("crdt_api@example.com", "hash", "CRDT API User", "member")
+	if err != nil {
+		t.Fatalf("CreateUser failed: %v", err)
+	}
+	token, _ := auth.GenerateToken(cfg.JWTSecret, user.ID, user.Email, user.Role)
+
+	doc, err := store.CreateDocument(user.ID, "", "API CRDT Doc", "📄", "", nil, nil, false)
+	if err != nil {
+		t.Fatalf("CreateDocument failed: %v", err)
+	}
+
+	// 1. Initial GET /api/v1/documents/{id}/crdt
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/documents/"+doc.ID+"/crdt", nil)
+	req.Header.Set("Authorization", "Bearer "+token)
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("expected 200 OK from GET crdt, got %d: %s", rec.Code, rec.Body.String())
+	}
+
+	// 2. PUT /api/v1/documents/{id}/crdt with base64 state
+	savePayload := []byte(`{"state":"AQIDBA=="}`)
+	req = httptest.NewRequest(http.MethodPut, "/api/v1/documents/"+doc.ID+"/crdt", bytes.NewReader(savePayload))
+	req.Header.Set("Authorization", "Bearer "+token)
+	req.Header.Set("Content-Type", "application/json")
+	rec = httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("expected 200 OK from PUT crdt, got %d: %s", rec.Code, rec.Body.String())
+	}
+
+	// 3. Verify state persisted
+	req = httptest.NewRequest(http.MethodGet, "/api/v1/documents/"+doc.ID+"/crdt", nil)
+	req.Header.Set("Authorization", "Bearer "+token)
+	rec = httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("expected 200 OK from GET crdt, got %d", rec.Code)
+	}
+	var crdtResp struct {
+		DocID string `json:"docId"`
+		State string `json:"state"`
+	}
+	_ = json.Unmarshal(rec.Body.Bytes(), &crdtResp)
+	if crdtResp.State != "AQIDBA==" {
+		t.Fatalf("expected state 'AQIDBA==', got '%s'", crdtResp.State)
+	}
+}

internal/storage/sqlite.go

@@ -232,6 +232,25 @@ func (s *Store) migrate() error {
 		PRIMARY KEY(user_id, tag)
 	);
 
+	CREATE TABLE IF NOT EXISTS document_crdt_state (
+		doc_id TEXT PRIMARY KEY,
+		state_blob BLOB NOT NULL,
+		updated_at TEXT NOT NULL,
+		updated_by TEXT NOT NULL DEFAULT '',
+		FOREIGN KEY(doc_id) REFERENCES documents(id) ON DELETE CASCADE
+	);
+
+	CREATE TABLE IF NOT EXISTS document_crdt_updates (
+		id INTEGER PRIMARY KEY AUTOINCREMENT,
+		doc_id TEXT NOT NULL,
+		update_blob BLOB NOT NULL,
+		created_at TEXT NOT NULL,
+		created_by TEXT NOT NULL DEFAULT '',
+		FOREIGN KEY(doc_id) REFERENCES documents(id) ON DELETE CASCADE
+	);
+
+	CREATE INDEX IF NOT EXISTS idx_doc_crdt_updates_doc ON document_crdt_updates(doc_id);
+
 	CREATE TABLE IF NOT EXISTS lists (
 		id TEXT PRIMARY KEY,
 		user_id TEXT NOT NULL,
@@ -1559,6 +1578,59 @@ func (s *Store) PatchDocumentBlocks(userID, docID string, req domain.DocBlocksPa
 	return doc, mergedOrder, nil
 }
 
+// GetDocumentCRDTState returns the compacted CRDT state blob and any pending updates for a document.
+func (s *Store) GetDocumentCRDTState(docID string) ([]byte, [][]byte, error) {
+	var stateBlob []byte
+	err := s.db.QueryRow(`SELECT state_blob FROM document_crdt_state WHERE doc_id = ?`, docID).Scan(&stateBlob)
+	if err != nil && err != sql.ErrNoRows {
+		return nil, nil, err
+	}
+
+	rows, err := s.db.Query(`SELECT update_blob FROM document_crdt_updates WHERE doc_id = ? ORDER BY id ASC`, docID)
+	if err != nil {
+		return stateBlob, nil, nil
+	}
+	defer rows.Close()
+
+	var updates [][]byte
+	for rows.Next() {
+		var u []byte
+		if err := rows.Scan(&u); err == nil && len(u) > 0 {
+			updates = append(updates, u)
+		}
+	}
+	return stateBlob, updates, nil
+}
+
+// AppendDocumentCRDTUpdate appends a new CRDT update delta for a document.
+func (s *Store) AppendDocumentCRDTUpdate(docID string, update []byte, userID string) error {
+	now := domain.NowISO()
+	_, err := s.db.Exec(`
+		INSERT INTO document_crdt_updates (doc_id, update_blob, created_at, created_by)
+		VALUES (?, ?, ?, ?)
+	`, docID, update, now, userID)
+	return err
+}
+
+// SaveDocumentCRDTState saves a compacted snapshot of the document CRDT state and prunes older incremental updates.
+func (s *Store) SaveDocumentCRDTState(docID string, stateBlob []byte, userID string) error {
+	now := domain.NowISO()
+	_, err := s.db.Exec(`
+		INSERT INTO document_crdt_state (doc_id, state_blob, updated_at, updated_by)
+		VALUES (?, ?, ?, ?)
+		ON CONFLICT(doc_id) DO UPDATE SET
+			state_blob = excluded.state_blob,
+			updated_at = excluded.updated_at,
+			updated_by = excluded.updated_by
+	`, docID, stateBlob, now, userID)
+	if err != nil {
+		return err
+	}
+	// Prune incremental updates older than the snapshot
+	_, _ = s.db.Exec(`DELETE FROM document_crdt_updates WHERE doc_id = ?`, docID)
+	return nil
+}
+
 // GetAuthorizedDocUsers returns all user IDs who have read/write/owner access to docID.
 func (s *Store) GetAuthorizedDocUsers(docID string) ([]string, error) {
 	userSet := make(map[string]bool)

internal/storage/sqlite_test.go

@@ -683,3 +683,62 @@ func TestDatabaseFirstWorkspaceArchitecture(t *testing.T) {
 	}
 }
 
+func TestDocumentCRDTState(t *testing.T) {
+	tmpDir := t.TempDir()
+	dbPath := filepath.Join(tmpDir, "crdt_test.db")
+
+	store, err := NewStore(dbPath)
+	if err != nil {
+		t.Fatalf("NewStore failed: %v", err)
+	}
+	defer store.Close()
+
+	user, err := store.CreateUser("crdt@example.com", "hash", "CRDT User", "member")
+	if err != nil {
+		t.Fatalf("CreateUser failed: %v", err)
+	}
+
+	doc, err := store.CreateDocument(user.ID, "", "CRDT Test Doc", "📝", "", nil, nil, false)
+	if err != nil {
+		t.Fatalf("CreateDocument failed: %v", err)
+	}
+
+	// 1. Initial CRDT state is empty
+	state, updates, err := store.GetDocumentCRDTState(doc.ID)
+	if err != nil {
+		t.Fatalf("GetDocumentCRDTState failed: %v", err)
+	}
+	if len(state) != 0 || len(updates) != 0 {
+		t.Fatalf("expected empty CRDT state, got state=%d updates=%d", len(state), len(updates))
+	}
+
+	// 2. Append incremental updates
+	u1 := []byte{1, 2, 3, 4}
+	u2 := []byte{5, 6, 7, 8}
+	if err := store.AppendDocumentCRDTUpdate(doc.ID, u1, user.ID); err != nil {
+		t.Fatalf("AppendDocumentCRDTUpdate 1 failed: %v", err)
+	}
+	if err := store.AppendDocumentCRDTUpdate(doc.ID, u2, user.ID); err != nil {
+		t.Fatalf("AppendDocumentCRDTUpdate 2 failed: %v", err)
+	}
+
+	_, updatesAfter, err := store.GetDocumentCRDTState(doc.ID)
+	if err != nil || len(updatesAfter) != 2 {
+		t.Fatalf("expected 2 updates, got %d (err: %v)", len(updatesAfter), err)
+	}
+
+	// 3. Compact snapshot state
+	snapshot := []byte{99, 100, 101}
+	if err := store.SaveDocumentCRDTState(doc.ID, snapshot, user.ID); err != nil {
+		t.Fatalf("SaveDocumentCRDTState failed: %v", err)
+	}
+
+	stateAfter, updatesAfterCompact, err := store.GetDocumentCRDTState(doc.ID)
+	if err != nil {
+		t.Fatalf("GetDocumentCRDTState after compact failed: %v", err)
+	}
+	if len(stateAfter) != 3 || len(updatesAfterCompact) != 0 {
+		t.Fatalf("expected compacted state of length 3 and 0 updates, got state=%d updates=%d", len(stateAfter), len(updatesAfterCompact))
+	}
+}
+

internal/ws/hub.go

@@ -1,9 +1,11 @@
 package ws
 
 import (
+	"encoding/base64"
 	"encoding/json"
 	"log"
 	"net/http"
+	"strings"
 	"sync"
 	"time"
 
@@ -12,19 +14,20 @@ import (
 )
 
 var upgrader = websocket.Upgrader{
-	ReadBufferSize:  2048,
-	WriteBufferSize: 2048,
+	ReadBufferSize:  4096,
+	WriteBufferSize: 4096,
 	CheckOrigin: func(r *http.Request) bool {
 		return true // Self-hosted reverse proxy compatible
 	},
 }
 
 type Client struct {
-	hub     *Hub
-	conn    *websocket.Conn
-	roomID  string
-	userID  string
-	send    chan []byte
+	hub             *Hub
+	conn            *websocket.Conn
+	roomID          string
+	userID          string
+	send            chan []byte
+	subscribedRooms map[string]bool
 }
 
 type docLockItem struct {
@@ -35,12 +38,19 @@ type docLockItem struct {
 	expiresAt time.Time
 }
 
+type CRDTStore interface {
+	GetDocumentCRDTState(docID string) ([]byte, [][]byte, error)
+	AppendDocumentCRDTUpdate(docID string, update []byte, userID string) error
+	SaveDocumentCRDTState(docID string, stateBlob []byte, userID string) error
+}
+
 type Hub struct {
 	mu         sync.RWMutex
 	rooms      map[string]map[*Client]bool
 	userRooms  map[string]map[*Client]bool
 	allClients map[*Client]bool
 	locks      map[string]*docLockItem
+	crdtStore  CRDTStore
 }
 
 func NewHub() *Hub {
@@ -54,6 +64,12 @@ func NewHub() *Hub {
 	return h
 }
 
+func (h *Hub) SetCRDTStore(store CRDTStore) {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	h.crdtStore = store
+}
+
 func (h *Hub) Register(c *Client) {
 	h.mu.Lock()
 	h.allClients[c] = true
@@ -90,6 +106,22 @@ func (h *Hub) Unregister(c *Client) {
 			}
 		}
 	}
+
+	var docRoomsLeft []string
+	if c.subscribedRooms != nil {
+		for rID := range c.subscribedRooms {
+			if room, ok := h.rooms[rID]; ok {
+				delete(room, c)
+				if len(room) == 0 {
+					delete(h.rooms, rID)
+				}
+			}
+			if strings.HasPrefix(rID, "doc:") {
+				docRoomsLeft = append(docRoomsLeft, strings.TrimPrefix(rID, "doc:"))
+			}
+		}
+	}
+
 	userRemaining := 0
 	if c.userID != "" && c.userID != "anonymous" {
 		if uRoom, ok := h.userRooms[c.userID]; ok {
@@ -119,6 +151,14 @@ func (h *Hub) Unregister(c *Client) {
 	for _, docID := range releasedDocIDs {
 		h.BroadcastToAll("DOC_UNLOCKED", map[string]string{"docId": docID, "doc_id": docID})
 	}
+
+	// Broadcast awareness leave for doc rooms
+	for _, docID := range docRoomsLeft {
+		h.BroadcastRoom("doc:"+docID, "CRDT_AWARENESS_LEAVE", map[string]interface{}{
+			"docId":  docID,
+			"userId": c.userID,
+		}, nil)
+	}
 }
 
 // Document Locking Methods
@@ -329,6 +369,75 @@ func (h *Hub) BroadcastListEvent(listID, event string, payload interface{}) {
 	h.Broadcast("", listID, event, payload)
 }
 
+func (h *Hub) JoinRoom(c *Client, roomID string) {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	if h.rooms[roomID] == nil {
+		h.rooms[roomID] = make(map[*Client]bool)
+	}
+	h.rooms[roomID][c] = true
+	if c.subscribedRooms == nil {
+		c.subscribedRooms = make(map[string]bool)
+	}
+	c.subscribedRooms[roomID] = true
+}
+
+func (h *Hub) LeaveRoom(c *Client, roomID string) {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	if room, ok := h.rooms[roomID]; ok {
+		delete(room, c)
+		if len(room) == 0 {
+			delete(h.rooms, roomID)
+		}
+	}
+	if c.subscribedRooms != nil {
+		delete(c.subscribedRooms, roomID)
+	}
+}
+
+func (h *Hub) BroadcastRoom(roomID, event string, payload interface{}, excludeClient *Client) {
+	msg := domain.WSMessage{
+		Event:     event,
+		Payload:   payload,
+		Timestamp: domain.NowISO(),
+	}
+	data, err := json.Marshal(msg)
+	if err != nil {
+		return
+	}
+
+	h.mu.RLock()
+	defer h.mu.RUnlock()
+
+	if room, ok := h.rooms[roomID]; ok {
+		for client := range room {
+			if excludeClient != nil && client == excludeClient {
+				continue
+			}
+			select {
+			case client.send <- data:
+			default:
+			}
+		}
+	}
+}
+
+func (c *Client) SendEvent(event string, payload interface{}) {
+	msg := domain.WSMessage{
+		Event:     event,
+		Payload:   payload,
+		Timestamp: domain.NowISO(),
+	}
+	data, err := json.Marshal(msg)
+	if err == nil {
+		select {
+		case c.send <- data:
+		default:
+		}
+	}
+}
+
 func (h *Hub) ServeWS(w http.ResponseWriter, r *http.Request, roomID, userID string) {
 	conn, err := upgrader.Upgrade(w, r, nil)
 	if err != nil {
@@ -355,7 +464,7 @@ func (c *Client) readPump() {
 		_ = c.conn.Close()
 	}()
 
-	c.conn.SetReadLimit(16384)
+	c.conn.SetReadLimit(4 * 1024 * 1024) // 4MB for large document CRDT updates
 	_ = c.conn.SetReadDeadline(time.Now().Add(60 * time.Second))
 	c.conn.SetPongHandler(func(string) error {
 		_ = c.conn.SetReadDeadline(time.Now().Add(60 * time.Second))
@@ -368,7 +477,7 @@ func (c *Client) readPump() {
 			break
 		}
 
-		// Handle client-initiated lock and unlock messages
+		// Handle client-initiated lock, CRDT, and presence messages
 		var incoming struct {
 			Event   string          `json:"event"`
 			DocID   string          `json:"docId"`
@@ -396,6 +505,61 @@ func (c *Client) readPump() {
 					if c.hub.ReleaseDocLock(docID, c.userID, false) {
 						c.hub.BroadcastDocEvent(docID, "DOC_UNLOCKED", map[string]string{"docId": docID, "doc_id": docID})
 					}
+				case "CRDT_JOIN":
+					c.hub.JoinRoom(c, "doc:"+docID)
+					if c.hub.crdtStore != nil {
+						stateBlob, updates, err := c.hub.crdtStore.GetDocumentCRDTState(docID)
+						if err == nil && (len(stateBlob) > 0 || len(updates) > 0) {
+							var b64Updates []string
+							for _, u := range updates {
+								b64Updates = append(b64Updates, base64.StdEncoding.EncodeToString(u))
+							}
+							b64State := ""
+							if len(stateBlob) > 0 {
+								b64State = base64.StdEncoding.EncodeToString(stateBlob)
+							}
+							c.SendEvent("CRDT_INIT", map[string]interface{}{
+								"docId":   docID,
+								"state":   b64State,
+								"updates": b64Updates,
+							})
+						}
+					}
+				case "CRDT_UPDATE":
+					var p struct {
+						Update string `json:"update"`
+					}
+					_ = json.Unmarshal(incoming.Payload, &p)
+					if p.Update != "" {
+						c.hub.BroadcastRoom("doc:"+docID, "CRDT_UPDATE", map[string]interface{}{
+							"docId":      docID,
+							"update":     p.Update,
+							"fromUserId": c.userID,
+						}, c)
+						if c.hub.crdtStore != nil {
+							if raw, err := base64.StdEncoding.DecodeString(p.Update); err == nil && len(raw) > 0 {
+								_ = c.hub.crdtStore.AppendDocumentCRDTUpdate(docID, raw, c.userID)
+							}
+						}
+					}
+				case "CRDT_COMPACT":
+					var p struct {
+						State string `json:"state"`
+					}
+					_ = json.Unmarshal(incoming.Payload, &p)
+					if p.State != "" && c.hub.crdtStore != nil {
+						if raw, err := base64.StdEncoding.DecodeString(p.State); err == nil && len(raw) > 0 {
+							_ = c.hub.crdtStore.SaveDocumentCRDTState(docID, raw, c.userID)
+						}
+					}
+				case "CRDT_AWARENESS":
+					c.hub.BroadcastRoom("doc:"+docID, "CRDT_AWARENESS", incoming.Payload, c)
+				case "CRDT_LEAVE":
+					c.hub.LeaveRoom(c, "doc:"+docID)
+					c.hub.BroadcastRoom("doc:"+docID, "CRDT_AWARENESS_LEAVE", map[string]interface{}{
+						"docId":  docID,
+						"userId": c.userID,
+					}, c)
 				}
 			}
 		}