feat: implement comments and activity panel in workspace

- Added CommentsPanel component for managing comments on documents. - Integrated comment creation, deletion, and resolution functionalities. - Implemented activity tracking for document interactions. - Enhanced SketchPage with editing and saving capabilities. - Introduced template management API endpoints for creating, sharing, and deleting templates. - Added runtime validation report for frontend and backend. - Created GettingStartedPanel for user onboarding with template options. - Implemented Playwright E2E tests for accessibility and export functionality.
2026-10-22 21:18:10 +05:30 · 2026-10-22 21:18:10 +05:30 · 809235e962
commit 809235e962
parent 6e354ba041
41 changed files with 2840 additions and 285 deletions
--- a/backend/app/routers/auth.py
+++ b/backend/app/routers/auth.py
@ -1,4 +1,9 @@
 from datetime import timedelta
+from urllib.parse import urlencode
+import secrets
+
+import httpx
+from fastapi.responses import RedirectResponse

 from fastapi import APIRouter, Depends, HTTPException, status
 from sqlalchemy.orm import Session
@ -20,6 +25,7 @@ from app.schemas.user import (
    UserCreate,
    UserResponse,
    UserUpdate,
+    ChangePasswordRequest,
 )
 from app.services.user_service import (
    authenticate_user,
@ -30,7 +36,14 @@ from app.services.user_service import (
    get_valid_reset_token,
    update_user,
 )
-from app.utils.security import create_access_token, create_refresh_token, hash_password
+from app.utils.security import (
+    create_access_token,
+    create_oauth_state,
+    create_refresh_token,
+    hash_password,
+    verify_oauth_state,
+    verify_password,
+)

 router = APIRouter(prefix="/auth", tags=["auth"])

@ -114,3 +127,90 @@ def reset_password(data: ResetPasswordRequest, db: Session = Depends(get_db)) ->
    db.commit()

    return MessageResponse(message="Password reset successfully. You can now log in.")
+
+
+@router.post("/change-password", response_model=MessageResponse)
+def change_password(
+    data: ChangePasswordRequest,
+    current_user: User = Depends(get_current_user),
+    db: Session = Depends(get_db),
+) -> MessageResponse:
+    if not verify_password(data.current_password, current_user.hashed_password):
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Current password is incorrect")
+    current_user.hashed_password = hash_password(data.new_password)
+    db.commit()
+    return MessageResponse(message="Password updated successfully.")
+
+
+@router.get("/google/login")
+def google_login() -> RedirectResponse:
+    if not settings.google_client_id or not settings.google_client_secret:
+        raise HTTPException(
+            status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
+            detail="Google sign-in is not configured. Set GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET.",
+        )
+    state = create_oauth_state()
+    query = urlencode({
+        "client_id": settings.google_client_id,
+        "redirect_uri": settings.google_redirect_uri,
+        "response_type": "code",
+        "scope": "openid email profile",
+        "state": state,
+        "access_type": "offline",
+        "prompt": "select_account",
+    })
+    return RedirectResponse(f"https://accounts.google.com/o/oauth2/v2/auth?{query}")
+
+
+@router.get("/google/callback")
+async def google_callback(code: str, state: str | None = None) -> RedirectResponse:
+    if not settings.google_client_id or not settings.google_client_secret:
+        raise HTTPException(status_code=status.HTTP_503_SERVICE_UNAVAILABLE, detail="Google sign-in is not configured")
+    if not code or not state or not verify_oauth_state(state):
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Google authorization was incomplete")
+    async with httpx.AsyncClient(timeout=10) as client:
+        token_response = await client.post(
+            "https://oauth2.googleapis.com/token",
+            data={
+                "code": code,
+                "client_id": settings.google_client_id,
+                "client_secret": settings.google_client_secret,
+                "redirect_uri": settings.google_redirect_uri,
+                "grant_type": "authorization_code",
+            },
+        )
+        if token_response.status_code != 200:
+            raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Google authorization failed")
+        token_data = token_response.json()
+        profile_response = await client.get(
+            "https://openidconnect.googleapis.com/v1/userinfo",
+            headers={"Authorization": f"Bearer {token_data['access_token']}"},
+        )
+    profile = profile_response.json()
+    email = str(profile.get("email", "")).lower()
+    if not email or not profile.get("email_verified"):
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Google account email is not verified")
+    from app.services.user_service import get_user_by_email
+
+    db = next(get_db())
+    try:
+        user = get_user_by_email(db, email)
+        if user is None:
+            base_username = email.split("@")[0][:90]
+            username = base_username
+            suffix = 1
+            while get_user_by_username(db, username):
+                username = f"{base_username}{suffix}"
+                suffix += 1
+            user = create_user(db, UserCreate(
+                email=email,
+                username=username,
+                password=secrets.token_urlsafe(32),
+                full_name=str(profile.get("name") or username),
+            ))
+        access_token = create_access_token(user.email)
+        refresh_token = create_refresh_token(user.email)
+    finally:
+        db.close()
+    query = urlencode({"access_token": access_token, "refresh_token": refresh_token})
+    return RedirectResponse(f"{settings.frontend_url}/auth/google/callback?{query}")
--- a/backend/app/routers/documents.py
+++ b/backend/app/routers/documents.py
@ -1,11 +1,28 @@
-from fastapi import APIRouter, Depends, HTTPException, Query, status
+from fastapi import APIRouter, Depends, HTTPException, Query, Response, status
 from motor.motor_asyncio import AsyncIOMotorDatabase
 from sqlalchemy.orm import Session

 from app.database import get_db
 from app.dependencies import get_current_user, get_mongo_db_dep
 from app.models.user import User
-from app.schemas.document import DocumentCreate, DocumentResponse, DocumentUpdate, ShareRequest
+from app.schemas.document import DocumentCreate, DocumentResponse, DocumentUpdate, DocumentVersionResponse, ShareRequest
+from app.schemas.collaboration import (
+    ActivityResponse,
+    CommentCreate,
+    CommentResolveRequest,
+    CommentResponse,
+    NotificationResponse,
+)
+from app.services.collaboration_service import (
+    create_comment,
+    delete_comment,
+    list_activity,
+    list_comments,
+    list_notifications,
+    mark_notifications_read,
+    mention_names,
+    resolve_comment,
+)
 from app.services.document_service import (
    add_member,
    create_document,
@ -18,14 +35,169 @@ from app.services.document_service import (
    update_document,
 )
 from app.services.user_service import get_user_by_email_or_username
+from app.services.history_service import list_versions, restore_version
+from html import escape

 router = APIRouter(prefix="/documents", tags=["documents"])


+@router.get("/{doc_id}/comments", response_model=list[CommentResponse])
+async def get_comments(
+    doc_id: str,
+    current_user: User = Depends(get_current_user),
+    db: AsyncIOMotorDatabase = Depends(get_mongo_db_dep),
+) -> list[CommentResponse]:
+    comments = await list_comments(db, doc_id, current_user.id)
+    if comments is None:
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Document not found or access denied")
+    return [CommentResponse(**comment) for comment in comments]
+
+
+@router.post("/{doc_id}/comments", response_model=CommentResponse, status_code=status.HTTP_201_CREATED)
+async def post_comment(
+    doc_id: str,
+    data: CommentCreate,
+    current_user: User = Depends(get_current_user),
+    db: AsyncIOMotorDatabase = Depends(get_mongo_db_dep),
+    sql: Session = Depends(get_db),
+) -> CommentResponse:
+    mentioned_users = []
+    for name in mention_names(data.body):
+        mentioned = get_user_by_email_or_username(sql, name.lower())
+        if mentioned is not None and mentioned.id != current_user.id:
+            mentioned_users.append({"id": mentioned.id})
+    comment = await create_comment(
+        db,
+        doc_id,
+        current_user.id,
+        current_user.full_name or current_user.username,
+        data.body,
+        data.parent_id,
+        mentioned_users,
+    )
+    if comment is None:
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Document not found or parent comment is invalid")
+    return CommentResponse(**comment)
+
+
+@router.patch("/{doc_id}/comments/{comment_id}/resolve", response_model=CommentResponse)
+async def update_comment_resolution(
+    doc_id: str,
+    comment_id: str,
+    data: CommentResolveRequest,
+    current_user: User = Depends(get_current_user),
+    db: AsyncIOMotorDatabase = Depends(get_mongo_db_dep),
+) -> CommentResponse:
+    comment = await resolve_comment(
+        db, doc_id, comment_id, current_user.id, data.resolved,
+        current_user.full_name or current_user.username,
+    )
+    if comment is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Comment not found or access denied")
+    return CommentResponse(**comment)
+
+
+@router.get("/{doc_id}/activity", response_model=list[ActivityResponse])
+async def get_activity(
+    doc_id: str,
+    current_user: User = Depends(get_current_user),
+    db: AsyncIOMotorDatabase = Depends(get_mongo_db_dep),
+) -> list[ActivityResponse]:
+    entries = await list_activity(db, doc_id, current_user.id)
+    if entries is None:
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Document not found or access denied")
+    return [ActivityResponse(**entry) for entry in entries]
+
+
+@router.get("/notifications", response_model=list[NotificationResponse])
+async def get_notifications(
+    current_user: User = Depends(get_current_user),
+    db: AsyncIOMotorDatabase = Depends(get_mongo_db_dep),
+) -> list[NotificationResponse]:
+    return [NotificationResponse(**item) for item in await list_notifications(db, current_user.id)]
+
+
+@router.post("/notifications/read", status_code=status.HTTP_204_NO_CONTENT)
+async def read_notifications(
+    current_user: User = Depends(get_current_user),
+    db: AsyncIOMotorDatabase = Depends(get_mongo_db_dep),
+) -> None:
+    await mark_notifications_read(db, current_user.id)
+
+
+@router.get("/{doc_id}/history", response_model=list[DocumentVersionResponse])
+async def get_history(
+    doc_id: str,
+    current_user: User = Depends(get_current_user),
+    db: AsyncIOMotorDatabase = Depends(get_mongo_db_dep),
+) -> list[DocumentVersionResponse]:
+    versions = await list_versions(db, doc_id, current_user.id)
+    if versions is None:
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Document not found or access denied")
+    return [DocumentVersionResponse(**version) for version in versions]
+
+
+@router.post("/{doc_id}/history/{version_id}/restore", response_model=DocumentResponse)
+async def restore_history(
+    doc_id: str,
+    version_id: str,
+    current_user: User = Depends(get_current_user),
+    db: AsyncIOMotorDatabase = Depends(get_mongo_db_dep),
+) -> DocumentResponse:
+    document = await restore_version(
+        db,
+        doc_id,
+        version_id,
+        current_user.id,
+        current_user.full_name or current_user.username,
+    )
+    if document is None:
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Version not found or restore access denied")
+    from app.services.document_service import _serialize
+
+    return DocumentResponse(**_serialize(document))
+
+
+@router.get("/{doc_id}/export")
+async def export_document(
+    doc_id: str,
+    format: str = Query("html", pattern="^(html|text)$"),
+    current_user: User = Depends(get_current_user),
+    db: AsyncIOMotorDatabase = Depends(get_mongo_db_dep),
+) -> Response:
+    document = await get_document(db, doc_id, current_user.id)
+    if document is None:
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Document not found or access denied")
+    body_html = str(document["content"].get("bodyHtml", document["content"].get("body", "")))
+    if format == "text":
+        import re
+
+        return Response(re.sub(r"<[^>]+>", " ", body_html).strip(), media_type="text/plain")
+    html = (
+        "<!doctype html><html><head><meta charset='utf-8'>"
+        f"<title>{escape(document['title'])}</title></head><body>"
+        f"<h1>{escape(document['title'])}</h1>{body_html}</body></html>"
+    )
+    return Response(html, media_type="text/html")
+
+
+@router.delete("/{doc_id}/comments/{comment_id}", status_code=status.HTTP_204_NO_CONTENT)
+async def remove_comment(
+    doc_id: str,
+    comment_id: str,
+    current_user: User = Depends(get_current_user),
+    db: AsyncIOMotorDatabase = Depends(get_mongo_db_dep),
+) -> None:
+    deleted = await delete_comment(db, comment_id, current_user.id)
+    if not deleted:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Comment not found or you are not its author")
+
+
@router.get("", response_model=list[DocumentResponse])
 async def list_docs(
    type: str | None = Query(None, description="Filter by document type"),
    stead_id: str | None = Query(None, description="Filter by parent stead"),
+    parent_page_id: str | None = Query(None, description="Filter by parent page"),
    starred: bool | None = Query(None, description="Filter starred projects"),
    sort: str = Query("updated_at", description="Sort field: updated_at or last_visited_at"),
    current_user: User = Depends(get_current_user),
@ -37,6 +209,7 @@ async def list_docs(
        current_user.id,
        doc_type=type,
        stead_id=stead_id,
+        parent_page_id=parent_page_id,
        starred=starred,
        sort=sort_field,
    )
@ -72,7 +245,10 @@ async def create_doc(
    db: AsyncIOMotorDatabase = Depends(get_mongo_db_dep),
 ) -> DocumentResponse:
    created_by = current_user.full_name or current_user.username
-    doc = await create_document(db, current_user.id, created_by, data)
+    try:
+        doc = await create_document(db, current_user.id, created_by, data)
+    except ValueError as exc:
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(exc)) from exc
    return DocumentResponse(**doc)


--- a/backend/app/routers/templates.py
+++ b/backend/app/routers/templates.py
@ -0,0 +1,63 @@
+from fastapi import APIRouter, Depends, HTTPException, status
+from motor.motor_asyncio import AsyncIOMotorDatabase
+
+from app.dependencies import get_current_user, get_mongo_db_dep
+from app.models.user import User
+from app.schemas.template import TemplateCreate, TemplateResponse, TemplateShareRequest
+from app.services.template_service import create_template, delete_template, list_templates, share_template
+from app.database import get_db
+from app.services.user_service import get_user_by_email_or_username
+from sqlalchemy.orm import Session
+
+router = APIRouter(prefix="/templates", tags=["templates"])
+
+
+@router.get("", response_model=list[TemplateResponse])
+async def get_templates(
+    current_user: User = Depends(get_current_user),
+    db: AsyncIOMotorDatabase = Depends(get_mongo_db_dep),
+) -> list[TemplateResponse]:
+    templates = await list_templates(db, current_user.id)
+    return [TemplateResponse(**template) for template in templates]
+
+
+@router.post("", response_model=TemplateResponse, status_code=status.HTTP_201_CREATED)
+async def post_template(
+    data: TemplateCreate,
+    current_user: User = Depends(get_current_user),
+    db: AsyncIOMotorDatabase = Depends(get_mongo_db_dep),
+) -> TemplateResponse:
+    template = await create_template(db, current_user.id, data.model_dump())
+    return TemplateResponse(**template)
+
+
+@router.delete("/{template_id}", status_code=status.HTTP_204_NO_CONTENT)
+async def remove_template(
+    template_id: str,
+    current_user: User = Depends(get_current_user),
+    db: AsyncIOMotorDatabase = Depends(get_mongo_db_dep),
+) -> None:
+    if not await delete_template(db, template_id, current_user.id):
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Template not found")
+
+
+@router.post("/{template_id}/share", response_model=TemplateResponse)
+async def add_template_member(
+    template_id: str,
+    data: TemplateShareRequest,
+    current_user: User = Depends(get_current_user),
+    db: AsyncIOMotorDatabase = Depends(get_mongo_db_dep),
+    sql: Session = Depends(get_db),
+) -> TemplateResponse:
+    user = get_user_by_email_or_username(sql, data.email_or_username.strip().lower())
+    if user is None or user.id == current_user.id:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="User not found")
+    template = await share_template(
+        db,
+        template_id,
+        current_user.id,
+        {"user_id": user.id, "name": user.full_name or user.username, "email": user.email},
+    )
+    if template is None:
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Only the owner can share this template")
+    return TemplateResponse(**template)