fixxed color selector in the category settings and fixxed drag and drop

subtask

backend/src/routes/sync.ts

@@ -1,8 +1,8 @@
 import { Router, Request, Response } from 'express';
 import { asyncHandler } from '../utils/asyncHandler';
 import { db } from '../db';
-import { categories, tasks, subtasks, repeatProfiles, users, friendships } from '../db/schema';
-import { eq, and, gte, lte, asc, or, inArray, sql } from 'drizzle-orm';
+import { categories, tasks, subtasks, repeatProfiles, users, friendships, tombstones, type EntityName } from '../db/schema';
+import { eq, and, gte, asc, or, inArray, sql } from 'drizzle-orm';
 import { authMiddleware } from '../utils/auth';
 import { AppError } from '../middleware/errorHandler';
 import { syncQuerySchema, pushChangesSchema, canCompleteTask } from '../utils/validation';
@@ -32,17 +32,15 @@ router.get('/', asyncHandler(async (req: Request, res: Response) => {
     .orderBy(asc(tasks.updatedAt));
 
   // Fetch subtasks changed since timestamp
-  const taskIds = changedTasks.map(t => t.id);
   let changedSubtasks: any[] = [];
-  
-  if (taskIds.length > 0) {
+  if (changedTasks.length > 0) {
     changedSubtasks = await db
       .select()
       .from(subtasks)
       .where(and(eq(subtasks.userId, userId), gte(subtasks.updatedAt, sinceDate)))
       .orderBy(asc(subtasks.updatedAt));
   } else {
-    // Also fetch subtasks for tasks that might have been deleted (we track by updatedAt)
+    // Also fetch subtasks for tasks that might have been deleted
     changedSubtasks = await db
       .select()
       .from(subtasks)
@@ -67,6 +65,13 @@ router.get('/', asyncHandler(async (req: Request, res: Response) => {
     ))
     .orderBy(asc(friendships.updatedAt));
 
+  // Fetch tombstones (deletions) changed since timestamp
+  const changedTombstones = await db
+    .select()
+    .from(tombstones)
+    .where(and(eq(tombstones.userId, userId), gte(tombstones.updatedAt, sinceDate)))
+    .orderBy(asc(tombstones.updatedAt));
+
   const timestamp = Date.now();
 
   res.json({
@@ -75,6 +80,7 @@ router.get('/', asyncHandler(async (req: Request, res: Response) => {
     subtasks: changedSubtasks,
     repeatProfiles: changedRepeatProfiles,
     friendships: changedFriendships,
+    deleted: changedTombstones.map((t) => ({ entity: t.entity, id: t.entityId, updatedAt: t.updatedAt })),
     timestamp,
   });
 }));
@@ -125,6 +131,27 @@ router.post('/push', asyncHandler(async (req: Request, res: Response) => {
         }
       }
 
+      // Sanitize assignee references: only real user ids may be stored (FK).
+      // Stale/unknown assignee ids are silently dropped to null instead of
+      // failing the whole push transaction.
+      const assigneeIds = new Set<string>();
+      for (const task of data.changes.tasks ?? []) {
+        if (task.assigneeId) assigneeIds.add(task.assigneeId);
+      }
+      for (const sub of data.changes.subtasks ?? []) {
+        if (sub.assigneeId) assigneeIds.add(sub.assigneeId);
+      }
+      const validAssignees = new Set<string>();
+      if (assigneeIds.size > 0) {
+        const rows = await tx
+          .select({ id: users.id })
+          .from(users)
+          .where(inArray(users.id, [...assigneeIds]));
+        for (const r of rows) validAssignees.add(r.id);
+      }
+      const sanitizeAssignee = (a: string | null | undefined): string | null =>
+        a && validAssignees.has(a) ? a : null;
+
       // Process categories
       if (data.changes.categories && data.changes.categories.length > 0) {
         for (const cat of data.changes.categories) {
@@ -185,7 +212,7 @@ router.post('/push', asyncHandler(async (req: Request, res: Response) => {
                 resolution: 'server_wins',
               });
               continue; // Server wins
-          }
+            }
 
             // Prevent completing tasks with future due dates
             if (task.completed === true) {
@@ -203,30 +230,32 @@ router.post('/push', asyncHandler(async (req: Request, res: Response) => {
             }
 
             await tx
-                .update(tasks)
-                .set({
-                  title: task.title,
-                  description: task.description,
-                  categoryId: task.categoryId,
-                  priority: task.priority,
-                  completed: task.completed,
-                  dueDate: task.dueDate,
-                  dueTime: task.dueTime ?? '',
-                  endTime: task.endTime ?? '',
-                  allDay: task.allDay ?? false,
-                  repeat: task.repeat ?? 'none',
-                  repeatInterval: task.repeatInterval ?? 1,
-                  repeatDays: task.repeatDays ?? '',
-                  seriesId: task.seriesId ?? '',
-                   reminder: task.reminder ?? 'none',
-                   reminders: task.reminders ?? '',
-                   assigneeId: task.assigneeId ?? null,
-                  updatedAt: task.updatedAt,
-                })
-                .where(and(eq(tasks.id, task.id), eq(tasks.userId, userId)));
+              .update(tasks)
+              .set({
+                title: task.title,
+                description: task.description,
+                categoryId: task.categoryId,
+                priority: task.priority,
+                completed: task.completed,
+                dueDate: task.dueDate,
+                dueTime: task.dueTime ?? '',
+                endTime: task.endTime ?? '',
+                allDay: task.allDay ?? false,
+                repeat: task.repeat ?? 'none',
+                repeatInterval: task.repeatInterval ?? 1,
+                repeatDays: task.repeatDays ?? '',
+                seriesId: task.seriesId ?? '',
+                reminder: task.reminder ?? 'none',
+                reminders: task.reminders ?? '',
+                assigneeId: sanitizeAssignee(task.assigneeId),
+                completedAt: task.completedAt ?? null,
+                updatedAt: task.updatedAt,
+              })
+              .where(and(eq(tasks.id, task.id), eq(tasks.userId, userId)));
           } else {
             await tx.insert(tasks).values({
               ...task,
+              assigneeId: sanitizeAssignee(task.assigneeId),
               allDay: task.allDay ?? false,
               userId,
             });
@@ -260,6 +289,7 @@ router.post('/push', asyncHandler(async (req: Request, res: Response) => {
               .update(subtasks)
               .set({
                 taskId: sub.taskId,
+                parentSubtaskId: sub.parentSubtaskId ?? null,
                 title: sub.title,
                 description: sub.description ?? '',
                 priority: sub.priority ?? 'none',
@@ -274,7 +304,7 @@ router.post('/push', asyncHandler(async (req: Request, res: Response) => {
                 seriesId: sub.seriesId ?? '',
                 reminder: sub.reminder ?? 'none',
                 reminders: sub.reminders ?? '',
-                assigneeId: sub.assigneeId ?? null,
+                assigneeId: sanitizeAssignee(sub.assigneeId),
                 order: sub.order,
                 updatedAt: sub.updatedAt,
               })
@@ -282,6 +312,7 @@ router.post('/push', asyncHandler(async (req: Request, res: Response) => {
           } else {
             await tx.insert(subtasks).values({
               ...sub,
+              assigneeId: sanitizeAssignee(sub.assigneeId),
               userId,
             });
           }
@@ -365,6 +396,14 @@ router.post('/push', asyncHandler(async (req: Request, res: Response) => {
           }
         }
       }
+
+      // Process deletions (tombstones) - last so they see the state produced
+      // by the upserts above and resolve by last-writer-wins.
+      if (data.deleted && data.deleted.length > 0) {
+        for (const deleted of data.deleted) {
+          await applyTombstone(tx, deleted.entity, deleted.id, deleted.updatedAt, userId, conflicts);
+        }
+      }
     });
   } catch (error) {
     console.error('Sync push error:', error);
@@ -378,4 +417,197 @@ router.post('/push', asyncHandler(async (req: Request, res: Response) => {
   });
 }));
 
+// Upsert a tombstone row, keeping the latest updatedAt.
+async function upsertTombstone(
+  tx: any,
+  entity: EntityName,
+  entityId: string,
+  updatedAt: number,
+  userId: string
+): Promise<void> {
+  const existing = await tx
+    .select({ updatedAt: tombstones.updatedAt })
+    .from(tombstones)
+    .where(and(eq(tombstones.entity, entity), eq(tombstones.entityId, entityId)))
+    .limit(1);
+
+  const merged = Math.max(existing[0]?.updatedAt ?? 0, updatedAt);
+  if (existing.length > 0) {
+    await tx
+      .update(tombstones)
+      .set({ updatedAt: merged })
+      .where(and(eq(tombstones.entity, entity), eq(tombstones.entityId, entityId)));
+  } else {
+    await tx.insert(tombstones).values({ entity, entityId, userId, updatedAt: merged });
+  }
+}
+
+// Apply a client deletion. LWW: if the server row is newer than the deletion
+// timestamp, the deletion is rejected (server_wins conflict) so the client
+// re-pulls the row. Accepted deletions cascade tombstones to every FK-cascaded
+// child so all devices remove them too.
+async function applyTombstone(
+  tx: any,
+  entity: EntityName,
+  id: string,
+  deletedAt: number,
+  userId: string,
+  conflicts: any[]
+): Promise<void> {
+  const tombstoneOf = (e: EntityName, ids: string[]) => ids.forEach((i) => upsertTombstone(tx, e, i, deletedAt, userId));
+
+  if (entity === 'tasks') {
+    const row = await tx
+      .select()
+      .from(tasks)
+      .where(and(eq(tasks.id, id), eq(tasks.userId, userId)))
+      .limit(1);
+    if (row.length === 0) {
+      await upsertTombstone(tx, entity, id, deletedAt, userId);
+      return;
+    }
+    if (row[0].updatedAt > deletedAt) {
+      conflicts.push({
+        entity: 'tasks',
+        id,
+        serverVersion: row[0],
+        clientVersion: { id, updatedAt: deletedAt },
+        resolution: 'server_wins',
+      });
+      return;
+    }
+    const children = await tx
+      .select({ id: subtasks.id })
+      .from(subtasks)
+      .where(and(eq(subtasks.taskId, id), eq(subtasks.userId, userId)));
+    tombstoneOf('subtasks', children.map((c: any) => c.id));
+    await tx.delete(tasks).where(and(eq(tasks.id, id), eq(tasks.userId, userId)));
+    await upsertTombstone(tx, entity, id, deletedAt, userId);
+    return;
+  }
+
+  if (entity === 'categories') {
+    const row = await tx
+      .select()
+      .from(categories)
+      .where(and(eq(categories.id, id), eq(categories.userId, userId)))
+      .limit(1);
+    if (row.length === 0) {
+      await upsertTombstone(tx, entity, id, deletedAt, userId);
+      return;
+    }
+    if (row[0].updatedAt > deletedAt) {
+      conflicts.push({
+        entity: 'categories',
+        id,
+        serverVersion: row[0],
+        clientVersion: { id, updatedAt: deletedAt },
+        resolution: 'server_wins',
+      });
+      return;
+    }
+    // Deleting the category cascades its tasks (and their subtasks) -
+    // tombstone all of them so every client removes them.
+    const catTasks = await tx
+      .select()
+      .from(tasks)
+      .where(and(eq(tasks.categoryId, id), eq(tasks.userId, userId)));
+    for (const taskRow of catTasks) {
+      const subIds = await tx
+        .select({ id: subtasks.id })
+        .from(subtasks)
+        .where(and(eq(subtasks.taskId, taskRow.id), eq(subtasks.userId, userId)));
+      tombstoneOf('subtasks', subIds.map((s: any) => s.id));
+      tombstoneOf('tasks', [taskRow.id]);
+    }
+    await tx.delete(categories).where(and(eq(categories.id, id), eq(categories.userId, userId)));
+    await upsertTombstone(tx, entity, id, deletedAt, userId);
+    return;
+  }
+
+  if (entity === 'subtasks') {
+    const row = await tx
+      .select()
+      .from(subtasks)
+      .where(and(eq(subtasks.id, id), eq(subtasks.userId, userId)))
+      .limit(1);
+    if (row.length === 0) {
+      await upsertTombstone(tx, entity, id, deletedAt, userId);
+      return;
+    }
+    if (row[0].updatedAt > deletedAt) {
+      conflicts.push({
+        entity: 'subtasks',
+        id,
+        serverVersion: row[0],
+        clientVersion: { id, updatedAt: deletedAt },
+        resolution: 'server_wins',
+      });
+      return;
+    }
+    // Deleting a parent subtask cascades its children in PG - tombstone them.
+    const children = await tx
+      .select({ id: subtasks.id })
+      .from(subtasks)
+      .where(and(eq(subtasks.parentSubtaskId, id), eq(subtasks.userId, userId)));
+    tombstoneOf('subtasks', children.map((c: any) => c.id));
+    await tx.delete(subtasks).where(and(eq(subtasks.id, id), eq(subtasks.userId, userId)));
+    await upsertTombstone(tx, entity, id, deletedAt, userId);
+    return;
+  }
+
+  if (entity === 'repeatProfiles') {
+    const row = await tx
+      .select()
+      .from(repeatProfiles)
+      .where(and(eq(repeatProfiles.id, id), eq(repeatProfiles.userId, userId)))
+      .limit(1);
+    if (row.length === 0) {
+      await upsertTombstone(tx, entity, id, deletedAt, userId);
+      return;
+    }
+    if (row[0].updatedAt > deletedAt) {
+      conflicts.push({
+        entity: 'repeatProfiles',
+        id,
+        serverVersion: row[0],
+        clientVersion: { id, updatedAt: deletedAt },
+        resolution: 'server_wins',
+      });
+      return;
+    }
+    await tx.delete(repeatProfiles).where(and(eq(repeatProfiles.id, id), eq(repeatProfiles.userId, userId)));
+    await upsertTombstone(tx, entity, id, deletedAt, userId);
+    return;
+  }
+
+  if (entity === 'friendships') {
+    const row = await tx
+      .select()
+      .from(friendships)
+      .where(and(
+        eq(friendships.id, id),
+        or(eq(friendships.userId, userId), eq(friendships.friendId, userId))
+      ))
+      .limit(1);
+    if (row.length === 0) {
+      await upsertTombstone(tx, entity, id, deletedAt, userId);
+      return;
+    }
+    if (row[0].updatedAt > deletedAt) {
+      conflicts.push({
+        entity: 'friendships',
+        id,
+        serverVersion: row[0],
+        clientVersion: { id, updatedAt: deletedAt },
+        resolution: 'server_wins',
+      });
+      return;
+    }
+    await tx.delete(friendships).where(eq(friendships.id, id));
+    await upsertTombstone(tx, entity, id, deletedAt, userId);
+    return;
+  }
+}
+
 export default router;