feat: continue restart plan

Author: gustavotoyota

new-deepnotes/PLAN_PROGRESS.md

@@ -13,7 +13,7 @@ Living checklist for the greenfield work described in [docs/RESTART_PLAN.md](../
 | **0** — OpenAPI + Drizzle inventory | **Done** | tRPC→REST/WS map: [docs/TRPC_REST_MAP.md](./docs/TRPC_REST_MAP.md). Drizzle + migration `0000_legacy_baseline` match `postgres-init.sql` core tables. Auth/CORS/forks: [docs/AUTH_AND_CORS.md](./docs/AUTH_AND_CORS.md), [docs/CLIENT_FORKS.md](./docs/CLIENT_FORKS.md). |
 | **1** — Legacy repo hygiene | **Optional / n/a** | Parallel track only if still editing the old monorepo. |
 | **2** — Repo bootstrap | **Mostly done** | Template DB integration test + CI `DATABASE_ADMIN_URL`; deploy doc: [docs/DEPLOY_CLOUDFLARE.md](./docs/DEPLOY_CLOUDFLARE.md). Optional: Wrangler deploy job. **Gap:** `apps/web` tests still no-op—see Phase 2 checklist + [Frontend / UI track](#frontend--ui-track). |
-| **3** — REST + Drizzle features | **In progress** | `POST /api/sessions/login|refresh|logout` wired via `@deepnotes/session` (Drizzle + legacy crypto + `jose` JWT + cookies). `POST /api/sessions/demo` still `501`. Next: Redis-backed login rate limits, `start-demo` / registration, `GET /api/users/me`. |
+| **3** — REST + Drizzle features | **In progress** | `POST /api/sessions/login|refresh|logout` + **`POST /api/sessions/demo`** + **`GET /api/users/me`** via `@deepnotes/session`. Optional **Upstash** (`UPSTASH_REDIS_REST_*`) wires legacy-style **failed-login rate limits**; without it, limits are skipped (local dev). **New secret:** `USER_EMAIL_ENCRYPTION_KEY` (legacy email encryption). Next: `POST /api/users` registration, pages/groups CRUD, Stripe. |
 | **4** — Client MVP | **Not started** | Auth → list → page → Yjs → groups; crypto/libs port as needed. **Parallel:** SPA structure, OpenAPI client, Vitest+DOM in CI, small E2E smoke—see [Frontend / UI track](#frontend--ui-track) (not deferred to “when MVP is done”). |
 | **5** — Cutover | **Not started** | Canary, redirect, retire `/trpc` when safe. |
 
@@ -31,11 +31,12 @@ Living checklist for the greenfield work described in [docs/RESTART_PLAN.md](../
 
 ## Phase 3 checklist (REST + Drizzle)
 
-- [x] Document **sessions** REST paths + request schemas in OpenAPI; worker returns **501** until handlers exist.
+- [x] Document **sessions** REST paths + request schemas in OpenAPI; demo + `users/me` contracts updated.
 - [x] Implement **sessions.login** / refresh / logout against Drizzle + legacy crypto semantics (JWT via `jose`; **Redis** rate limits not wired yet—parity with legacy `login` lockouts).
-- [ ] Implement **sessions.start-demo** (registration path) + **Redis** for failed-login / optional session cache.
+- [x] Implement **sessions.start-demo** (`POST /api/sessions/demo`) + **Redis** for failed-login when Upstash env is set.
 - [x] **JWT + httpOnly cookies** (`accessToken`, `refreshToken`, `loggedIn`) matching [docs/AUTH_AND_CORS.md](./docs/AUTH_AND_CORS.md).
-- [ ] **Users** registration + `GET /api/users/me` (and remaining TRPC_REST_MAP slices as needed).
+- [x] **`GET /api/users/me`** (minimal summary from `accessToken` cookie).
+- [ ] **Users** `POST /api/users` registration + remaining TRPC_REST_MAP slices as needed.
 - [ ] Pages/groups CRUD, realtime/collab, Stripe webhook (no RevenueCat).
 
 ---
@@ -109,6 +110,7 @@ Cross-cutting work so the new SPA does not repeat **legacy `apps/client`** patte
 
 | Date | Change |
 |------|--------|
+| 2026-04-26 | Phase 3: `POST /api/sessions/demo` (`performSessionStartDemo`), `GET /api/users/me`, Redis failed-login limits (`SessionRedisPort` + optional Upstash), `USER_EMAIL_ENCRYPTION_KEY` on `SessionEnv`; OpenAPI 200/400 for demo, 429 for login, `userMeResponseSchema`; Vitest `login-rate-limit.test.ts`. |
 | 2026-04-26 | Docs: [docs/RESTART_PLAN.md](../docs/RESTART_PLAN.md) §3.5 legacy frontend pain points, §5.8 frontend testing/CI, phased updates; this file: **Frontend / UI track** + Phase 2/4 notes on real web tests. |
 | 2026-04-26 | Phase 3: `@deepnotes/session` (login/refresh/logout + 2FA TOTP/recovery), api-worker Hyperdrive + dynamic import for Workers bundle; OpenAPI 200/401/503 for session routes; demo remains `501`; session crypto vendored in-package (no parent `@stdlib` links); `libsodium-wrappers-sumo@^0.8` override for Wrangler. |
 | 2026-04-26 | Phase 3 start: OpenAPI + Zod for `POST /api/sessions/login|refresh|logout|demo`; api-worker `501` stubs; Phase 0 marked done in snapshot. |

new-deepnotes/apps/api-worker/package.json

@@ -14,6 +14,7 @@
     "@deepnotes/api": "workspace:*",
     "@deepnotes/db": "workspace:*",
     "@deepnotes/session": "workspace:*",
+    "@upstash/redis": "^1.34.8",
     "hono": "^4.7.7"
   },
   "devDependencies": {

new-deepnotes/apps/api-worker/src/index.test.ts

@@ -26,6 +26,8 @@ describe("api-worker", () => {
     ["POST", "/api/sessions/login"],
     ["POST", "/api/sessions/refresh"],
     ["POST", "/api/sessions/logout"],
+    ["POST", "/api/sessions/demo"],
+    ["GET", "/api/users/me"],
   ] as const)("returns 503 for %s %s when auth env is not configured", async (method, path) => {
     const res = await app.request(`http://test${path}`, { method });
     expect(res.status).toBe(503);
@@ -34,13 +36,4 @@ describe("api-worker", () => {
     });
   });
 
-  it("POST /api/sessions/demo returns 501 until registration is wired", async () => {
-    const res = await app.request("http://test/api/sessions/demo", {
-      method: "POST",
-    });
-    expect(res.status).toBe(501);
-    await expect(res.json()).resolves.toMatchObject({
-      code: "NOT_IMPLEMENTED",
-    });
-  });
 });

new-deepnotes/apps/api-worker/src/index.ts

@@ -1,13 +1,15 @@
 import {
   getOpenApiDocument,
   healthResponseSchema,
+  sessionDemoRequestSchema,
   sessionLoginRequestSchema,
 } from "@deepnotes/api";
 import type { ContentfulStatusCode } from "hono/utils/http-status";
 import { Hono } from "hono";
 
 import { getDbForConnectionString } from "./db-pool.js";
 import { readCookieHeader } from "./cookies.js";
+import { getSessionRedisPort } from "./redis-port.js";
 import { getSessionEnv, type WorkerSessionBindings } from "./session-env.js";
 
 type Bindings = WorkerSessionBindings & {
@@ -17,16 +19,10 @@ type Bindings = WorkerSessionBindings & {
 
 const app = new Hono<{ Bindings: Bindings }>();
 
-const sessionNotImplementedBody = {
-  code: "NOT_IMPLEMENTED" as const,
-  message:
-    "Demo registration is not implemented yet. See OpenAPI for the contract.",
-};
-
 const serviceUnavailableBody = {
   code: "SERVICE_UNAVAILABLE" as const,
   message:
-    "Session routes require ACCESS_SECRET, REFRESH_SECRET, USER_EMAIL_SECRET, USER_REHASHED_LOGIN_HASH_ENCRYPTION_KEY, USER_AUTHENTICATOR_SECRET_ENCRYPTION_KEY, and USER_RECOVERY_CODES_ENCRYPTION_KEY (e.g. Wrangler secrets / .dev.vars).",
+    "Session routes require ACCESS_SECRET, REFRESH_SECRET, USER_EMAIL_SECRET, USER_EMAIL_ENCRYPTION_KEY, USER_REHASHED_LOGIN_HASH_ENCRYPTION_KEY, USER_AUTHENTICATOR_SECRET_ENCRYPTION_KEY, and USER_RECOVERY_CODES_ENCRYPTION_KEY (e.g. Wrangler secrets / .dev.vars).",
 };
 
 function appendSetCookies(res: Response, lines: string[]): void {
@@ -93,6 +89,7 @@ app.post("/api/sessions/login", async (c) => {
   }
 
   const db = getDbForConnectionString(hyper.connectionString);
+  const redis = getSessionRedisPort(c.env);
 
   try {
     const { performSessionLogin } = await import("@deepnotes/session");
@@ -109,6 +106,7 @@ app.post("/api/sessions/login", async (c) => {
       },
       clientIp: c.req.header("CF-Connecting-IP") ?? "127.0.0.1",
       userAgent: c.req.header("User-Agent") ?? "",
+      redis,
     });
     const res = c.json(json, 200);
     appendSetCookies(res, cookieLines);
@@ -198,8 +196,103 @@ app.post("/api/sessions/logout", async (c) => {
   return res;
 });
 
-app.post("/api/sessions/demo", (c) =>
-  c.json(sessionNotImplementedBody, 501),
-);
+app.post("/api/sessions/demo", async (c) => {
+  const sessionEnv = getSessionEnv(c.env);
+  if (sessionEnv == null) {
+    return c.json(serviceUnavailableBody, 503);
+  }
+  const hyper = c.env.HYPERDRIVE;
+  if (hyper == null) {
+    return c.json(
+      {
+        code: "SERVICE_UNAVAILABLE" as const,
+        message: "HYPERDRIVE binding is not configured.",
+      },
+      503,
+    );
+  }
+
+  let bodyJson: unknown;
+  try {
+    bodyJson = await c.req.json();
+  } catch {
+    return c.json({ code: "BAD_REQUEST", message: "Expected JSON body." }, 400);
+  }
+
+  const parsed = sessionDemoRequestSchema.safeParse(bodyJson);
+  if (!parsed.success) {
+    return c.json(
+      {
+        code: "VALIDATION_ERROR",
+        message: parsed.error.flatten().formErrors.join("; "),
+      },
+      400,
+    );
+  }
+
+  const db = getDbForConnectionString(hyper.connectionString);
+
+  try {
+    const { performSessionStartDemo } = await import("@deepnotes/session");
+    const { json, cookieLines } = await performSessionStartDemo({
+      db,
+      env: sessionEnv,
+      body: parsed.data,
+      clientIp: c.req.header("CF-Connecting-IP") ?? "127.0.0.1",
+      userAgent: c.req.header("User-Agent") ?? "",
+    });
+    const res = c.json(json, 200);
+    appendSetCookies(res, cookieLines);
+    return res;
+  } catch (e) {
+    const { SessionError } = await import("@deepnotes/session");
+    if (e instanceof SessionError) {
+      return c.json(
+        { code: e.code, message: e.message },
+        e.status as ContentfulStatusCode,
+      );
+    }
+    throw e;
+  }
+});
+
+app.get("/api/users/me", async (c) => {
+  const sessionEnv = getSessionEnv(c.env);
+  if (sessionEnv == null) {
+    return c.json(serviceUnavailableBody, 503);
+  }
+  const hyper = c.env.HYPERDRIVE;
+  if (hyper == null) {
+    return c.json(
+      {
+        code: "SERVICE_UNAVAILABLE" as const,
+        message: "HYPERDRIVE binding is not configured.",
+      },
+      503,
+    );
+  }
+
+  const db = getDbForConnectionString(hyper.connectionString);
+  const cookieHeader = c.req.header("Cookie");
+
+  try {
+    const { getAuthenticatedUserSummary } = await import("@deepnotes/session");
+    const summary = await getAuthenticatedUserSummary({
+      db,
+      env: sessionEnv,
+      accessCookie: readCookieHeader(cookieHeader, "accessToken"),
+    });
+    return c.json(summary, 200);
+  } catch (e) {
+    const { SessionError } = await import("@deepnotes/session");
+    if (e instanceof SessionError) {
+      return c.json(
+        { code: e.code, message: e.message },
+        e.status as ContentfulStatusCode,
+      );
+    }
+    throw e;
+  }
+});
 
 export default app;

new-deepnotes/apps/api-worker/src/redis-port.ts

@@ -0,0 +1,29 @@
+import { Redis } from "@upstash/redis";
+
+import type { SessionRedisPort } from "@deepnotes/session";
+
+import type { WorkerSessionBindings } from "./session-env.js";
+
+export function getSessionRedisPort(
+  env: Pick<WorkerSessionBindings, "UPSTASH_REDIS_REST_URL" | "UPSTASH_REDIS_REST_TOKEN">,
+): SessionRedisPort | undefined {
+  const url = env.UPSTASH_REDIS_REST_URL;
+  const token = env.UPSTASH_REDIS_REST_TOKEN;
+  if (url == null || url === "" || token == null || token === "") {
+    return undefined;
+  }
+
+  const redis = new Redis({ url, token });
+  return {
+    async get(key: string) {
+      const v = await redis.get(key);
+      if (v == null) return null;
+      return typeof v === "string" ? v : String(v);
+    },
+    ttl: (key) => redis.ttl(key),
+    incr: (key) => redis.incr(key),
+    expire: async (key, seconds) => {
+      await redis.expire(key, seconds);
+    },
+  };
+}

new-deepnotes/apps/api-worker/src/session-env.ts

@@ -4,12 +4,16 @@ export type WorkerSessionBindings = {
   ACCESS_SECRET?: string;
   REFRESH_SECRET?: string;
   USER_EMAIL_SECRET?: string;
+  USER_EMAIL_ENCRYPTION_KEY?: string;
   USER_REHASHED_LOGIN_HASH_ENCRYPTION_KEY?: string;
   USER_AUTHENTICATOR_SECRET_ENCRYPTION_KEY?: string;
   USER_RECOVERY_CODES_ENCRYPTION_KEY?: string;
   DEV?: string;
   COOKIE_DOMAIN?: string;
   EMAIL_CASE_SENSITIVITY_EXCEPTIONS?: string;
+  /** Optional; when set with token, failed-login rate limits use Upstash REST Redis. */
+  UPSTASH_REDIS_REST_URL?: string;
+  UPSTASH_REDIS_REST_TOKEN?: string;
 };
 
 export function getSessionEnv(
@@ -22,6 +26,7 @@ export function getSessionEnv(
     ACCESS_SECRET,
     REFRESH_SECRET,
     USER_EMAIL_SECRET,
+    USER_EMAIL_ENCRYPTION_KEY,
     USER_REHASHED_LOGIN_HASH_ENCRYPTION_KEY,
     USER_AUTHENTICATOR_SECRET_ENCRYPTION_KEY,
     USER_RECOVERY_CODES_ENCRYPTION_KEY,
@@ -30,6 +35,7 @@ export function getSessionEnv(
     !ACCESS_SECRET ||
     !REFRESH_SECRET ||
     !USER_EMAIL_SECRET ||
+    !USER_EMAIL_ENCRYPTION_KEY ||
     !USER_REHASHED_LOGIN_HASH_ENCRYPTION_KEY ||
     !USER_AUTHENTICATOR_SECRET_ENCRYPTION_KEY ||
     !USER_RECOVERY_CODES_ENCRYPTION_KEY
@@ -40,6 +46,7 @@ export function getSessionEnv(
     ACCESS_SECRET,
     REFRESH_SECRET,
     USER_EMAIL_SECRET,
+    USER_EMAIL_ENCRYPTION_KEY,
     USER_REHASHED_LOGIN_HASH_ENCRYPTION_KEY,
     USER_AUTHENTICATOR_SECRET_ENCRYPTION_KEY,
     USER_RECOVERY_CODES_ENCRYPTION_KEY,

new-deepnotes/packages/api/src/index.ts

@@ -17,5 +17,10 @@ export {
   sessionDemoRequestSchema,
   sessionLoginEmailSchema,
   sessionLoginRequestSchema,
+  type SessionDemoRequest,
   type SessionLoginRequest,
 } from "./schemas/sessions.js";
+export {
+  userMeResponseSchema,
+  type UserMeResponse,
+} from "./schemas/users.js";

new-deepnotes/packages/api/src/openapi.test.ts

@@ -14,5 +14,6 @@ describe("getOpenApiDocument", () => {
     expect(doc.paths?.["/api/sessions/refresh"]?.post).toBeDefined();
     expect(doc.paths?.["/api/sessions/logout"]?.post).toBeDefined();
     expect(doc.paths?.["/api/sessions/demo"]?.post).toBeDefined();
+    expect(doc.paths?.["/api/users/me"]?.get).toBeDefined();
   });
 });