common: send message to subscriptions server on email confirmed

* docker: update .env and docker-compose.yml for SMTP and new services

* docker: add external MinIO, MongoDB, and GarageHQ examples with setup instructions

* docs: update README with dotenv docker setup instructions and configuration redirect for external services

* docker: update service dependency condition for setup-themes in docker-compose.yml

* chore: update example URLs in .env for public services

.env

@@ -12,21 +12,26 @@ NOTESNOOK_API_SECRET=
 # Possible values: true/false
 DISABLE_SIGNUPS=false
 
-### SMTP Configuration ###
+### SMTP Configuration (optional) ###
-# SMTP Configuration is required for sending emails for password reset, 2FA emails etc. You can get SMTP settings from your email provider.
+# ================================================================================
+# WARNING: If SMTP is not configured, email 2FA and password-reset emails will
+# NOT work. Newly created users MUST change 2FA to an Authenticator app:
+#   Settings > Auth > Change 2FA method
+# ================================================================================
+# SMTP is used for sending emails for password reset, 2FA emails etc. You can get SMTP settings from your email provider.
 
 # Description: Username for the SMTP connection (most time it is the email address of your account). Check your email provider's documentation to get the appropriate value.
-# Required: yes
+# Required: no
 SMTP_USERNAME=
 # Description: Password for the SMTP connection. Check your email provider's documentation to get the appropriate value.
-# Required: yes
+# Required: no
 SMTP_PASSWORD=
 # Description: Host on which the the SMTP connection is running. Check your email provider's documentation to get the appropriate value.
-# Required: yes
+# Required: no
 # Example: smtp.gmail.com
 SMTP_HOST=
 # Description: Port on which the the SMTP connection is running. Check your email provider's documentation to get the appropriate value.
-# Required: yes
+# Required: no
 # Example: 465
 SMTP_PORT=
 
@@ -42,6 +47,7 @@ TWILIO_AUTH_TOKEN=
 TWILIO_SERVICE_SID=
 
 # Description: Add the origins for which you want to allow CORS. Leave it empty to allow all origins to access your server. If you want to allow multiple origins, seperate each origin with a comma.
+# Note: this value is passed to the server as NOTESNOOK_CORS internally.
 # Required: no
 # Example: https://app.notesnook.com,http://localhost:3000
 NOTESNOOK_CORS_ORIGINS=
@@ -58,16 +64,20 @@ KNOWN_PROXIES=
 NOTESNOOK_APP_PUBLIC_URL=https://app.notesnook.com
 # Description: This is the public URL for the monograph frontend.
 # Required: yes
-# Example: https://monogr.ph
+# Example: https://monogr.yourdomain.com
 MONOGRAPH_PUBLIC_URL=http://localhost:6264
 # Description: This is the public URL for the Authentication server. Used for generating email confirmation & password reset URLs.
 # Required: yes
-# Example: https://auth.streetwriters.co
+# Example: https://auth.yourdomain.com
 AUTH_SERVER_PUBLIC_URL=http://localhost:8264
 # Description: This is the public URL for the S3 attachments server (minio). It'll be used by the Notesnook clients for uploading/downloading attachments.
 # Required: yes
-# Example: https://attachments.notesnook.com
+# Example: https://attachments.yourdomain.com
 ATTACHMENTS_SERVER_PUBLIC_URL=http://localhost:9000
+# Description: This is the public URL for the Notesnook sync API (browser-reachable; used by Monograph).
+# Required: yes
+# Example: https://api.yourdomain.com
+NOTESNOOK_API_PUBLIC_URL=http://localhost:5264
 
 # Description: Custom username for the root Minio account. Minio is used for storing your attachments. This must be greater than 3 characters in length.
 # Required: no
@@ -75,3 +85,15 @@ MINIO_ROOT_USER=
 # Description: Custom password for the root Minio account. Minio is used for storing your attachments. This must be greater than 8 characters in length.
 # Required: no
 MINIO_ROOT_PASSWORD=
+
+# Optional: only needed when using `docker compose --profile extras up`
+# Description: Public URL for the CORS proxy service
+CORS_PROXY_PUBLIC_URL=http://localhost:3001
+# Description: Allowed origins for the CORS proxy (* for all origins)
+CORS_PROXY_ALLOWED_ORIGINS=*
+# Description: Public URL for the Inbox API service
+INBOX_API_PUBLIC_URL=http://localhost:5181
+# Description: Public URL for the Themes server
+THEMES_SERVER_PUBLIC_URL=http://localhost:9200
+# Description: Git repository URL for the Themes server
+THEMES_REPO_URL=https://github.com/streetwriters/notesnook-themes.git

Notesnook.API/Accessors/SyncItemsRepositoryAccessor.cs

@@ -42,6 +42,7 @@ namespace Notesnook.API.Accessors
         public SyncItemsRepository Colors { get; }
         public SyncItemsRepository Vaults { get; }
         public SyncItemsRepository Tags { get; }
+        public SyncItemsRepository InboxItemsHistory { get; }
         public Repository<UserSettings> UsersSettings { get; }
         public Repository<Monograph> Monographs { get; }
         public Repository<InboxApiKey> InboxApiKey { get; }
@@ -75,6 +76,8 @@ namespace Notesnook.API.Accessors
         IMongoCollection<SyncItem> vaults,
         [FromKeyedServices(Collections.TagsKey)]
         IMongoCollection<SyncItem> tags,
+        [FromKeyedServices(Collections.InboxItemsHistoryKey)]
+        IMongoCollection<SyncItem> inboxItemsHistory,
 
         Repository<UserSettings> usersSettings,
         Repository<Monograph> monographs,
@@ -102,6 +105,7 @@ namespace Notesnook.API.Accessors
             Colors = new SyncItemsRepository(dbContext, colors, logger);
             Vaults = new SyncItemsRepository(dbContext, vaults, logger);
             Tags = new SyncItemsRepository(dbContext, tags, logger);
+            InboxItemsHistory = new SyncItemsRepository(dbContext, inboxItemsHistory, logger);
         }
     }
 }

Notesnook.API/Constants.cs

@@ -18,5 +18,6 @@ namespace Notesnook.API
         public const string InboxApiKeysKey = "inbox_api_keys";
         public const string SyncDevicesKey = "sync_devices";
         public const string DeviceIdsChunksKey = "device_ids_chunks";
+        public const string InboxItemsHistoryKey = "inbox_items_history";
     }
 }

Notesnook.API/Controllers/InboxController.cs

@@ -18,6 +18,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 
 using System;
+using System.Collections.Generic;
 using System.Security.Claims;
 using System.Text.Json;
 using System.Threading.Tasks;
@@ -72,9 +73,9 @@ namespace Notesnook.API.Controllers
                 {
                     return BadRequest(new { error = "Api key name is required." });
                 }
-                if (request.ExpiryDate <= -1)
+                if (request.ExpiryDate == null)
                 {
-                    return BadRequest(new { error = "Valid expiry date is required." });
+                    return BadRequest(new { error = "Expiry date is required." });
                 }
 
                 var count = await inboxApiKeysRepository.CountAsync(t => t.UserId == userId);
@@ -133,7 +134,7 @@ namespace Notesnook.API.Controllers
                 var userSetting = await userSettingsRepository.FindOneAsync(u => u.UserId == userId);
                 if (string.IsNullOrWhiteSpace(userSetting?.InboxKeys?.Public))
                 {
-                    return BadRequest(new { error = "Inbox public key is not configured." });
+                    return NotFound(new { error = "Inbox public key is not configured." });
                 }
                 return Ok(new { key = userSetting.InboxKeys.Public });
             }

Notesnook.API/Controllers/S3Controller.cs

@@ -183,8 +183,8 @@ namespace Notesnook.API.Controllers
             try
             {
                 var userId = this.User.GetUserId();
-                var size = await s3Service.GetObjectSizeAsync(userId, name);
+                var size = await s3Service.GetObjectSizeAsync(userId, name); Response.Headers.ContentLength = size;
-                HttpContext.Response.Headers.ContentLength = size;
+                Response.Headers["X-Object-Size"] = size.ToString();
                 return Ok();
             }
             catch (Exception ex)

Notesnook.API/Controllers/UsersController.cs

@@ -93,38 +93,39 @@ namespace Notesnook.API.Controllers
         [HttpPatch("password/{type}")]
         public async Task<IActionResult> ChangePassword([FromRoute] string type, [FromBody] ChangePasswordForm form)
         {
-            var userId = User.GetUserId();
+            return BadRequest(new { error = "Password change is currently disabled." });
-            var clientId = User.FindFirstValue("client_id");
+            // var userId = User.GetUserId();
-            var jti = User.FindFirstValue("jti");
+            // var clientId = User.FindFirstValue("client_id");
-            var isPasswordReset = type == "reset";
+            // var jti = User.FindFirstValue("jti");
-            try
+            // var isPasswordReset = type == "reset";
-            {
+            // try
-                var result = isPasswordReset ? await serviceAccessor.UserAccountService.ResetPasswordAsync(userId, form.NewPassword) : await serviceAccessor.UserAccountService.ChangePasswordAsync(userId, form.OldPassword, form.NewPassword);
+            // {
-                if (!result)
+            //     var result = isPasswordReset ? await serviceAccessor.UserAccountService.ResetPasswordAsync(userId, form.NewPassword) : await serviceAccessor.UserAccountService.ChangePasswordAsync(userId, form.OldPassword, form.NewPassword);
-                    return BadRequest("Failed to change password.");
+            //     if (!result)
+            //         return BadRequest("Failed to change password.");
 
-                await UserService.SetUserKeysAsync(userId, form.UserKeys);
+            //     await UserService.SetUserKeysAsync(userId, form.UserKeys);
 
-                await serviceAccessor.UserAccountService.ClearSessionsAsync(userId, clientId, all: false, jti, null);
+            //     await serviceAccessor.UserAccountService.ClearSessionsAsync(userId, clientId, all: false, jti, null);
 
-                await WampServers.MessengerServer.PublishMessageAsync(MessengerServerTopics.SendSSETopic, new SendSSEMessage
+            //     await WampServers.MessengerServer.PublishMessageAsync(MessengerServerTopics.SendSSETopic, new SendSSEMessage
-                {
+            //     {
-                    UserId = userId,
+            //         UserId = userId,
-                    OriginTokenId = jti,
+            //         OriginTokenId = jti,
-                    Message = new Message
+            //         Message = new Message
-                    {
+            //         {
-                        Type = "logout",
+            //             Type = "logout",
-                        Data = JsonSerializer.Serialize(new { reason = "Password changed." })
+            //             Data = JsonSerializer.Serialize(new { reason = "Password changed." })
-                    }
+            //         }
-                });
+            //     });
 
-                return Ok();
+            //     return Ok();
-            }
+            // }
-            catch (Exception ex)
+            // catch (Exception ex)
-            {
+            // {
-                logger.LogError(ex, "Failed to change password");
+            //     logger.LogError(ex, "Failed to change password");
-                return BadRequest(new { error = ex.Message });
+            //     return BadRequest(new { error = ex.Message });
-            }
+            // }
         }
 
         [HttpPost("reset")]

Notesnook.API/Hubs/SyncV2Hub.cs

@@ -57,21 +57,9 @@ namespace Notesnook.API.Hubs
         private ISyncItemsRepositoryAccessor Repositories { get; }
         private SyncDeviceService SyncDeviceService { get; }
         private readonly IUnitOfWork unit;
-        private static readonly string[] CollectionKeys = [
+        private readonly FrozenDictionary<string, Action<IEnumerable<SyncItem>, string>> UpsertActionsMap;
-            "settingitem",
+        private readonly CollectionDef[] BaseCollectionDefs;
-            "attachment",
+        private readonly CollectionDef[] V4CollectionDefs;
-            "note",
-            "notebook",
-            "content",
-            "shortcut",
-            "reminder",
-            "color",
-            "tag",
-            "vault",
-            "relation", // relations must sync at the end to prevent invalid state
-        ];
-        private readonly FrozenDictionary<string, Action<IEnumerable<SyncItem>, string, long>> UpsertActionsMap;
-        private readonly Func<string, IEnumerable<string>, bool, int, Task<IAsyncCursor<SyncItem>>>[] Collections;
         ILogger<SyncV2Hub> Logger { get; }
 
         public SyncV2Hub(ISyncItemsRepositoryAccessor syncItemsRepositoryAccessor, IUnitOfWork unitOfWork, SyncDeviceService syncDeviceService, ILogger<SyncV2Hub> logger)
@@ -81,20 +69,34 @@ namespace Notesnook.API.Hubs
             unit = unitOfWork;
             SyncDeviceService = syncDeviceService;
 
-            Collections = [
+            BaseCollectionDefs = [
-                Repositories.Settings.FindItemsById,
+                new("settingitem", Repositories.Settings.FindItemsById),
-                Repositories.Attachments.FindItemsById,
+                new("attachment", Repositories.Attachments.FindItemsById),
-                Repositories.Notes.FindItemsById,
+                new("note", Repositories.Notes.FindItemsById),
-                Repositories.Notebooks.FindItemsById,
+                new("notebook", Repositories.Notebooks.FindItemsById),
-                Repositories.Contents.FindItemsById,
+                new("content", Repositories.Contents.FindItemsById),
-                Repositories.Shortcuts.FindItemsById,
+                new("shortcut", Repositories.Shortcuts.FindItemsById),
-                Repositories.Reminders.FindItemsById,
+                new("reminder", Repositories.Reminders.FindItemsById),
-                Repositories.Colors.FindItemsById,
+                new("color", Repositories.Colors.FindItemsById),
-                Repositories.Tags.FindItemsById,
+                new("tag", Repositories.Tags.FindItemsById),
-                Repositories.Vaults.FindItemsById,
+                new("vault", Repositories.Vaults.FindItemsById),
-                Repositories.Relations.FindItemsById,
+                new("relation", Repositories.Relations.FindItemsById), // relations must sync at the end to prevent invalid state
             ];
-            UpsertActionsMap = new Dictionary<string, Action<IEnumerable<SyncItem>, string, long>> {
+            V4CollectionDefs = [
+                new("settingitem", Repositories.Settings.FindItemsById),
+                new("attachment", Repositories.Attachments.FindItemsById),
+                new("note", Repositories.Notes.FindItemsById),
+                new("notebook", Repositories.Notebooks.FindItemsById),
+                new("content", Repositories.Contents.FindItemsById),
+                new("shortcut", Repositories.Shortcuts.FindItemsById),
+                new("reminder", Repositories.Reminders.FindItemsById),
+                new("color", Repositories.Colors.FindItemsById),
+                new("tag", Repositories.Tags.FindItemsById),
+                new("vault", Repositories.Vaults.FindItemsById),
+                new("inboxitemhistory", Repositories.InboxItemsHistory.FindItemsById),
+                new("relation", Repositories.Relations.FindItemsById), // relations must sync at the end to prevent invalid state
+            ];
+            UpsertActionsMap = new Dictionary<string, Action<IEnumerable<SyncItem>, string>> {
                 { "settingitem", Repositories.Settings.UpsertMany },
                 { "attachment", Repositories.Attachments.UpsertMany },
                 { "note", Repositories.Notes.UpsertMany },
@@ -106,6 +108,7 @@ namespace Notesnook.API.Hubs
                 { "color", Repositories.Colors.UpsertMany },
                 { "vault", Repositories.Vaults.UpsertMany },
                 { "tag", Repositories.Tags.UpsertMany },
+                { "inboxitemhistory", Repositories.InboxItemsHistory.UpsertMany },
             }.ToFrozenDictionary();
         }
 
@@ -122,6 +125,19 @@ namespace Notesnook.API.Hubs
             await base.OnConnectedAsync();
         }
 
+        public override async Task OnDisconnectedAsync(Exception? exception)
+        {
+            if (exception != null)
+            {
+                Logger.LogWarning(exception, "Connection {ConnectionId} disconnected with error (server-side drop)", Context.ConnectionId);
+            }
+            else
+            {
+                Logger.LogInformation("Connection {ConnectionId} disconnected cleanly (client-initiated)", Context.ConnectionId);
+            }
+            await base.OnDisconnectedAsync(exception);
+        }
+
 
         public async Task<int> PushItems(string deviceId, SyncTransferItemV2 pushItem)
         {
@@ -133,7 +149,7 @@ namespace Notesnook.API.Hubs
             try
             {
                 var UpsertItems = UpsertActionsMap[pushItem.Type] ?? throw new Exception($"Invalid item type: {pushItem.Type}.");
-                UpsertItems(pushItem.Items, userId, 1);
+                UpsertItems(pushItem.Items, userId);
 
                 if (!await unit.Commit()) return 0;
 
@@ -168,17 +184,17 @@ namespace Notesnook.API.Hubs
             return true;
         }
 
-        private async IAsyncEnumerable<SyncTransferItemV2> PrepareChunks(string userId, HashSet<ItemKey> ids, int size, bool resetSync, long maxBytes)
+        private async IAsyncEnumerable<SyncTransferItemV2> PrepareChunks(string userId, HashSet<ItemKey> ids, int size, bool resetSync, long maxBytes, CollectionDef[] collectionDefs)
         {
             var itemsProcessed = 0;
-            for (int i = 0; i < Collections.Length; i++)
+            foreach (var def in collectionDefs)
             {
-                var type = CollectionKeys[i];
+                var type = def.Key;
 
                 var filteredIds = ids.Where((id) => id.Type == type).Select((id) => id.ItemId).ToArray();
                 if (!resetSync && filteredIds.Length == 0) continue;
 
-                using var cursor = await Collections[i](userId, filteredIds, resetSync, size);
+                using var cursor = await def.FindItems(userId, filteredIds, resetSync, size);
 
                 var chunk = new List<SyncItem>();
                 long totalBytes = 0;
@@ -220,20 +236,25 @@ namespace Notesnook.API.Hubs
 
         public async Task<SyncV2Metadata> RequestFetch(string deviceId)
         {
-            return await HandleRequestFetch(deviceId, false, false);
+            return await HandleRequestFetch(deviceId, false, false, BaseCollectionDefs);
         }
 
         public async Task<SyncV2Metadata> RequestFetchV2(string deviceId)
         {
-            return await HandleRequestFetch(deviceId, true, false);
+            return await HandleRequestFetch(deviceId, true, false, BaseCollectionDefs);
         }
 
         public async Task<SyncV2Metadata> RequestFetchV3(string deviceId)
         {
-            return await HandleRequestFetch(deviceId, true, true);
+            return await HandleRequestFetch(deviceId, true, true, BaseCollectionDefs);
         }
 
-        private async Task<SyncV2Metadata> HandleRequestFetch(string deviceId, bool includeMonographs, bool includeInboxItems)
+        public async Task<SyncV2Metadata> RequestFetchV4(string deviceId)
+        {
+            return await HandleRequestFetch(deviceId, true, true, V4CollectionDefs);
+        }
+
+        private async Task<SyncV2Metadata> HandleRequestFetch(string deviceId, bool includeMonographs, bool includeInboxItems, CollectionDef[] collectionDefs)
         {
             var userId = Context.User?.FindFirstValue("sub") ?? throw new HubException("Please login to sync.");
 
@@ -257,7 +278,8 @@ namespace Notesnook.API.Hubs
                     ids,
                     size: 100,
                     resetSync: device.IsSyncReset,
-                    maxBytes: 3 * 1024 * 1024
+                    maxBytes: 3 * 1024 * 1024,
+                    collectionDefs
                 );
 
                 await foreach (var chunk in chunks)
@@ -312,7 +334,7 @@ namespace Notesnook.API.Hubs
                     var unsyncedInboxItemIds = ids.Where(k => k.Type == "inbox_item").Select(k => k.ItemId);
                     var userInboxItems = device.IsSyncReset
                         ? await Repositories.InboxItems.FindAsync(m => m.UserId == userId)
-                        : await Repositories.InboxItems.FindAsync(m => m.UserId == userId && unsyncedInboxItemIds.Contains(m.ItemId ?? m.Id.ToString()));
+                        : await Repositories.InboxItems.FindAsync(m => m.UserId == userId && unsyncedInboxItemIds.Contains(m.ItemId));
                     if (userInboxItems.Any() && !await Clients.Caller.SendInboxItems(userInboxItems).WaitAsync(TimeSpan.FromMinutes(10)))
                     {
                         throw new HubException("Client rejected inbox items.");
@@ -331,6 +353,11 @@ namespace Notesnook.API.Hubs
                 SyncEventCounterSource.Log.RecordFetchDuration(stopwatch.ElapsedMilliseconds);
             }
         }
+
+        private record CollectionDef(
+            string Key,
+            Func<string, IEnumerable<string>, bool, int, Task<IAsyncCursor<SyncItem>>> FindItems
+        );
     }
 
     [MessagePack.MessagePackObject]

Notesnook.API/Interfaces/ISyncItemsRepositoryAccessor.cs

@@ -38,6 +38,7 @@ namespace Notesnook.API.Interfaces
         SyncItemsRepository Colors { get; }
         SyncItemsRepository Vaults { get; }
         SyncItemsRepository Tags { get; }
+        SyncItemsRepository InboxItemsHistory { get; }
         Repository<UserSettings> UsersSettings { get; }
         Repository<Monograph> Monographs { get; }
         Repository<InboxApiKey> InboxApiKey { get; }

Notesnook.API/Notesnook.API.csproj

@@ -9,6 +9,7 @@
   <ItemGroup>
     <PackageReference Include="AngleSharp" Version="1.3.0" />
     <PackageReference Include="AspNetCore.HealthChecks.Aws.S3" Version="9.0.0" />
+    <PackageReference Include="AspNetCore.HealthChecks.Redis" Version="9.0.0" />
     <PackageReference Include="AWSSDK.Core" Version="3.7.304.31" />
     <PackageReference Include="DotNetEnv" Version="2.3.0" />
     <PackageReference Include="IdentityModel.AspNetCore.OAuth2Introspection" Version="6.2.0" />

Notesnook.API/Repositories/SyncItemsRepository.cs

@@ -55,24 +55,6 @@ namespace Notesnook.API.Repositories
             return ALGORITHMS.Contains(algorithm);
         }
 
-        public Task<long> CountItemsSyncedAfterAsync(string userId, long timestamp)
-        {
-            var filter = Builders<SyncItem>.Filter.And(Builders<SyncItem>.Filter.Gt("DateSynced", timestamp), Builders<SyncItem>.Filter.Eq("UserId", userId));
-            return Collection.CountDocumentsAsync(filter);
-        }
-        public Task<IAsyncCursor<SyncItem>> FindItemsSyncedAfter(string userId, long timestamp, int batchSize)
-        {
-            var filter = Builders<SyncItem>.Filter.And(Builders<SyncItem>.Filter.Gt("DateSynced", timestamp), Builders<SyncItem>.Filter.Eq("UserId", userId));
-            return Collection.FindAsync(filter, new FindOptions<SyncItem>
-            {
-                BatchSize = batchSize,
-                AllowDiskUse = true,
-                AllowPartialResults = false,
-                NoCursorTimeout = true,
-                Sort = new SortDefinitionBuilder<SyncItem>().Ascending("_id")
-            });
-        }
-
         public Task<IAsyncCursor<SyncItem>> FindItemsById(string userId, IEnumerable<string> ids, bool all, int batchSize)
         {
             var filters = new List<FilterDefinition<SyncItem>>(new[] { Builders<SyncItem>.Filter.Eq("UserId", userId) });
@@ -94,41 +76,7 @@ namespace Notesnook.API.Repositories
             dbContext.AddCommand((handle, ct) => Collection.DeleteManyAsync(handle, filter, null, ct));
         }
 
-        public void Upsert(SyncItem item, string userId, long dateSynced)
+        public void UpsertMany(IEnumerable<SyncItem> items, string userId)
-        {
-            if (item.Length > 15 * 1024 * 1024)
-            {
-                throw new Exception($"Size of item \"{item.ItemId}\" is too large. Maximum allowed size is 15 MB.");
-            }
-
-            if (!IsValidAlgorithm(item.Algorithm))
-            {
-                throw new Exception($"Invalid alg identifier {item.Algorithm}");
-            }
-
-            // Handle case where the cipher is corrupted.
-            if (!IsBase64String(item.Cipher))
-            {
-                logger.LogError("Corrupted item {ItemId} in collection {CollectionName}. Length: {Length}, Cipher: {Cipher}",
-                    item.ItemId, this.collectionName, item.Length, item.Cipher);
-                throw new Exception($"Corrupted item \"{item.ItemId}\" in collection \"{this.collectionName}\". Please report this error to support@streetwriters.co.");
-            }
-
-            if (item.ItemId == null)
-                throw new Exception($"Item does not have an ItemId.");
-
-            item.DateSynced = dateSynced;
-            item.UserId = userId;
-
-            var filter = Builders<SyncItem>.Filter.And(
-                Builders<SyncItem>.Filter.Eq("UserId", userId),
-                Builders<SyncItem>.Filter.Eq("ItemId", item.ItemId)
-            );
-
-            dbContext.AddCommand((handle, ct) => Collection.ReplaceOneAsync(handle, filter, item, new ReplaceOptions { IsUpsert = true }, ct));
-        }
-
-        public void UpsertMany(IEnumerable<SyncItem> items, string userId, long dateSynced)
         {
             var userIdFilter = Builders<SyncItem>.Filter.Eq("UserId", userId);
             var writes = new List<WriteModel<SyncItem>>();
@@ -160,7 +108,7 @@ namespace Notesnook.API.Repositories
                     Builders<SyncItem>.Filter.Eq("ItemId", item.ItemId)
                 );
 
-                item.DateSynced = dateSynced;
+                item.DateSynced = DateTimeOffset.UtcNow.ToUnixTimeMilliseconds();
                 item.UserId = userId;
 
                 writes.Add(new ReplaceOneModel<SyncItem>(filter, item)

Notesnook.API/Services/UserService.cs

@@ -174,18 +174,19 @@ namespace Notesnook.API.Services
                 else
                 {
                     userSettings.InboxKeys = keys.InboxKeys;
-                    var defaultInboxKey = new InboxApiKey
-                    {
-                        UserId = userId,
-                        Name = "Default",
-                        DateCreated = DateTimeOffset.UtcNow.ToUnixTimeMilliseconds(),
-                        ExpiryDate = DateTimeOffset.UtcNow.AddYears(1).ToUnixTimeMilliseconds(),
-                        LastUsedAt = 0
-                    };
-                    await Repositories.InboxApiKey.InsertAsync(defaultInboxKey);
                 }
 
                 await Repositories.InboxItems.DeleteManyAsync(t => t.UserId == userId);
+                await WampServers.MessengerServer.PublishMessageAsync(MessengerServerTopics.SendSSETopic, new SendSSEMessage
+                {
+                    OriginTokenId = null,
+                    UserId = userId,
+                    Message = new Message
+                    {
+                        Type = "inboxUpdated",
+                        Data = JsonSerializer.Serialize(new { reason = "Inbox PGP keys added, updated, or removed." })
+                    }
+                });
             }
 
             await Repositories.UsersSettings.UpdateAsync(userSettings.Id, userSettings);
@@ -208,6 +209,7 @@ namespace Notesnook.API.Services
             Repositories.Colors.DeleteByUserId(userId);
             Repositories.Tags.DeleteByUserId(userId);
             Repositories.Vaults.DeleteByUserId(userId);
+            Repositories.InboxItemsHistory.DeleteByUserId(userId);
             Repositories.UsersSettings.Delete((u) => u.UserId == userId);
             Repositories.Monographs.DeleteMany((m) => m.UserId == userId);
             Repositories.InboxApiKey.DeleteMany((t) => t.UserId == userId);
@@ -269,6 +271,7 @@ namespace Notesnook.API.Services
             Repositories.Colors.DeleteByUserId(userId);
             Repositories.Tags.DeleteByUserId(userId);
             Repositories.Vaults.DeleteByUserId(userId);
+            Repositories.InboxItemsHistory.DeleteByUserId(userId);
             Repositories.Monographs.DeleteMany((m) => m.UserId == userId);
             Repositories.InboxApiKey.DeleteMany((t) => t.UserId == userId);
             if (!await unit.Commit()) return false;

Notesnook.API/Startup.cs

@@ -25,6 +25,7 @@ using System.Text;
 using System.Text.Encodings.Web;
 using System.Threading.Tasks;
 using Amazon.Runtime;
+using StackExchange.Redis;
 using IdentityModel.AspNetCore.OAuth2Introspection;
 using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Authentication.JwtBearer;
@@ -196,7 +197,8 @@ namespace Notesnook.API
                     .AddMongoCollection(Collections.ColorsKey)
                     .AddMongoCollection(Collections.VaultsKey)
                     .AddMongoCollection(Collections.InboxItemsKey)
-                    .AddMongoCollection(Collections.InboxApiKeysKey);
+                    .AddMongoCollection(Collections.InboxApiKeysKey)
+                    .AddMongoCollection(Collections.InboxItemsHistoryKey);
 
             services.AddScoped<ISyncItemsRepositoryAccessor, SyncItemsRepositoryAccessor>();
             services.AddScoped<SyncDeviceService>();
@@ -219,7 +221,20 @@ namespace Notesnook.API
             }).AddMessagePackProtocol().AddJsonProtocol();
 
             if (!string.IsNullOrEmpty(Constants.SIGNALR_REDIS_CONNECTION_STRING))
-                signalR.AddStackExchangeRedis(Constants.SIGNALR_REDIS_CONNECTION_STRING);
+            {
+                services.AddHealthChecks()
+                        .AddRedis(Constants.SIGNALR_REDIS_CONNECTION_STRING, tags: ["ready"]);
+                signalR.AddStackExchangeRedis(options =>
+                {
+                    options.Configuration = ConfigurationOptions.Parse(Constants.SIGNALR_REDIS_CONNECTION_STRING);
+                    options.Configuration.AbortOnConnectFail = false;
+                    options.Configuration.ConnectRetry = 5;
+                    options.Configuration.ReconnectRetryPolicy = new ExponentialRetry(5000, 30000);
+                    options.Configuration.KeepAlive = 60;
+                    options.Configuration.ConnectTimeout = 5000;
+                    options.Configuration.SyncTimeout = 5000;
+                });
+            }
 
             services.AddResponseCompression(options =>
             {

Notesnook.Inbox.API/src/index.ts

@@ -17,7 +17,7 @@ const RawInboxItemSchema = z.object({
   notebookIds: z.array(z.string()).optional(),
   tagIds: z.array(z.string()).optional(),
   type: z.enum(["note"]),
-  source: z.string(),
+  source: z.string().min(1, "Source is required"),
   version: z.literal(1),
   content: z
     .object({
@@ -56,7 +56,9 @@ async function encrypt(
   };
 }
 
-async function getInboxPublicEncryptionKey(apiKey: string) {
+async function getInboxPublicEncryptionKey(
+  apiKey: string,
+): Promise<{ status: "unauthorized" } | { status: "ok"; key: string | null }> {
   const response = await fetch(
     `${NOTESNOOK_API_SERVER_URL}/inbox/public-encryption-key`,
     {
@@ -65,6 +67,9 @@ async function getInboxPublicEncryptionKey(apiKey: string) {
       },
     },
   );
+  if (response.status === 401) {
+    return { status: "unauthorized" };
+  }
   if (!response.ok) {
     throw new Error(
       `failed to fetch inbox public encryption key: ${await response.text()}`,
@@ -72,7 +77,7 @@ async function getInboxPublicEncryptionKey(apiKey: string) {
   }
 
   const data = (await response.json()) as unknown as any;
-  return (data?.key as string) || null;
+  return { status: "ok", key: (data?.key as string) || null };
 }
 
 async function postEncryptedInboxItem(
@@ -110,10 +115,14 @@ app.post("/", async (req, res) => {
       return res.status(401).json({ error: "unauthorized" });
     }
 
-    const inboxPublicKey = await getInboxPublicEncryptionKey(apiKey);
+    const encryptionKeyResult = await getInboxPublicEncryptionKey(apiKey);
-    if (!inboxPublicKey) {
+    if (encryptionKeyResult.status === "unauthorized") {
-      return res.status(403).json({ error: "inbox public key not found" });
+      return res.status(401).json({ error: "unauthorized" });
     }
+    if (!encryptionKeyResult.key) {
+      return res.status(404).json({ error: "inbox public key not found" });
+    }
+    const inboxPublicKey = encryptionKeyResult.key;
     console.log("[info] fetched inbox public key");
 
     const validationResult = RawInboxItemSchema.safeParse(req.body);

README.md

@@ -55,17 +55,26 @@ dotnet run --project Streetwriters.Identity/Streetwriters.Identity.csproj
 
 The sync server can easily be started using Docker.
 
+Download `docker-compose.yml` and [`.env`](.env):
+
 ```bash
 wget https://raw.githubusercontent.com/streetwriters/notesnook-sync-server/master/docker-compose.yml
+wget https://raw.githubusercontent.com/streetwriters/notesnook-sync-server/master/.env
 ```
 
-And then use Docker Compose to start the servers:
+Edit `.env` and set at least `NOTESNOOK_API_SECRET`. See `.env` for all configuration options.
+
+Then start the stack:
 
 ```bash
 docker compose up
 ```
 
-This takes care of setting up everything including MongoDB, Minio etc.
+This sets up MongoDB, MinIO, and the Notesnook services.
+
+Optional services (`themes-server`, `cors-proxy`, `inbox-api`): `docker compose --profile extras up`
+
+For external MongoDB, MinIO, or Garage deployments, see [`examples/`](examples/).
 
 ## TODO Self-hosting
 

Streetwriters.Common/Clients.cs

@@ -42,6 +42,20 @@ namespace Streetwriters.Common
             PackageName = "com.streetwriters.notesnook",
             OnEmailConfirmed = async (userId) =>
             {
+                if (!Constants.IS_SELF_HOSTED)
+                {
+                    await WampServers.SubscriptionServer.PublishMessageAsync(
+                        SubscriptionServerTopics.EmailConfirmedTopic,
+                        new EmailConfirmedMessage
+                        {
+                            UserId = userId,
+                            ClientId = "notesnook",
+                            AppId = ApplicationType.NOTESNOOK,
+                            ConfirmedAt = DateTimeOffset.UtcNow.ToUnixTimeMilliseconds()
+                        }
+                    );
+                }
+
                 await WampServers.MessengerServer.PublishMessageAsync(MessengerServerTopics.SendSSETopic, new SendSSEMessage
                 {
                     UserId = userId,

Streetwriters.Common/Extensions/ServiceCollectionServiceExtensions.cs

@@ -52,7 +52,8 @@ namespace Streetwriters.Common.Extensions
                         b.WithOrigins(Constants.NOTESNOOK_CORS_ORIGINS);
 
                     b.AllowAnyMethod()
-                    .AllowAnyHeader();
+                    .AllowAnyHeader()
+                    .WithExposedHeaders(["X-Object-Size", "Content-Length"]);
                 });
             });
             return services;

Streetwriters.Common/Interfaces/IEmailSender.cs

@@ -1,4 +1,5 @@
 using System.Collections.Generic;
+using System.Net.Mail;
 using System.Threading.Tasks;
 using MimeKit;
 using MimeKit.Cryptography;
@@ -11,7 +12,7 @@ namespace Streetwriters.Common.Interfaces
         Task SendEmailAsync(
             string email,
             EmailTemplate template,
-            IClient client,
+            MailAddress from,
             GnuPGContext? gpgContext = null,
             Dictionary<string, byte[]>? attachments = null
         );

Streetwriters.Common/Messages/EmailConfirmedMessage.cs

@@ -0,0 +1,20 @@
+using System.Text.Json.Serialization;
+using Streetwriters.Common.Enums;
+
+namespace Streetwriters.Common.Messages
+{
+    public class EmailConfirmedMessage
+    {
+        [JsonPropertyName("userId")]
+        public required string UserId { get; set; }
+
+        [JsonPropertyName("clientId")]
+        public required string ClientId { get; set; }
+
+        [JsonPropertyName("appId")]
+        public ApplicationType AppId { get; set; }
+
+        [JsonPropertyName("confirmedAt")]
+        public long ConfirmedAt { get; set; }
+    }
+}

Streetwriters.Common/Models/GetCustomerResponse.cs

@@ -1,21 +0,0 @@
-namespace Streetwriters.Common.Models
-{
-    using System;
-    using System.Collections.Generic;
-
-    using System.Text.Json;
-    using System.Text.Json.Serialization;
-    using System.Globalization;
-
-    public partial class GetCustomerResponse : PaddleResponse
-    {
-        [JsonPropertyName("data")]
-        public PaddleCustomer? Customer { get; set; }
-    }
-
-    public class PaddleCustomer
-    {
-        [JsonPropertyName("email")]
-        public string? Email { get; set; }
-    }
-}

Streetwriters.Common/Models/GetSubscriptionResponse.cs

@@ -1,214 +0,0 @@
-namespace Streetwriters.Common.Models
-{
-    using System;
-    using System.Collections.Generic;
-
-    using System.Text.Json;
-    using System.Text.Json.Serialization;
-    using System.Globalization;
-
-    public partial class GetSubscriptionResponse : PaddleResponse
-    {
-        [JsonPropertyName("data")]
-        public Data? Data { get; set; }
-    }
-
-    public partial class Data
-    {
-        // [JsonPropertyName("id")]
-        // public string Id { get; set; }
-
-        // [JsonPropertyName("status")]
-        // public string Status { get; set; }
-
-        [JsonPropertyName("customer_id")]
-        public string? CustomerId { get; set; }
-
-        // [JsonPropertyName("address_id")]
-        // public string AddressId { get; set; }
-
-        // [JsonPropertyName("business_id")]
-        // public object BusinessId { get; set; }
-
-        // [JsonPropertyName("currency_code")]
-        // public string CurrencyCode { get; set; }
-
-        // [JsonPropertyName("created_at")]
-        // public DateTimeOffset CreatedAt { get; set; }
-
-        // [JsonPropertyName("updated_at")]
-        // public DateTimeOffset UpdatedAt { get; set; }
-
-        // [JsonPropertyName("started_at")]
-        // public DateTimeOffset StartedAt { get; set; }
-
-        [JsonPropertyName("first_billed_at")]
-        public DateTimeOffset? FirstBilledAt { get; set; }
-
-        // [JsonPropertyName("next_billed_at")]
-        // public DateTimeOffset NextBilledAt { get; set; }
-
-        // [JsonPropertyName("paused_at")]
-        // public object PausedAt { get; set; }
-
-        // [JsonPropertyName("canceled_at")]
-        // public object CanceledAt { get; set; }
-
-        // [JsonPropertyName("collection_mode")]
-        // public string CollectionMode { get; set; }
-
-        // [JsonPropertyName("billing_details")]
-        // public object BillingDetails { get; set; }
-
-        // [JsonPropertyName("current_billing_period")]
-        // public CurrentBillingPeriod CurrentBillingPeriod { get; set; }
-
-        [JsonPropertyName("billing_cycle")]
-        public BillingCycle? BillingCycle { get; set; }
-
-        // [JsonPropertyName("scheduled_change")]
-        // public object ScheduledChange { get; set; }
-
-        // [JsonPropertyName("items")]
-        // public Item[] Items { get; set; }
-
-        // [JsonPropertyName("custom_data")]
-        // public object CustomData { get; set; }
-
-        [JsonPropertyName("management_urls")]
-        public ManagementUrls? ManagementUrls { get; set; }
-
-        // [JsonPropertyName("discount")]
-        // public object Discount { get; set; }
-
-        // [JsonPropertyName("import_meta")]
-        // public object ImportMeta { get; set; }
-    }
-
-    public partial class BillingCycle
-    {
-        [JsonPropertyName("frequency")]
-        public long Frequency { get; set; }
-
-        [JsonPropertyName("interval")]
-        public string? Interval { get; set; }
-    }
-
-    // public partial class CurrentBillingPeriod
-    // {
-    //     [JsonPropertyName("starts_at")]
-    //     public DateTimeOffset StartsAt { get; set; }
-
-    //     [JsonPropertyName("ends_at")]
-    //     public DateTimeOffset EndsAt { get; set; }
-    // }
-
-    // public partial class Item
-    // {
-    //     [JsonPropertyName("status")]
-    //     public string Status { get; set; }
-
-    //     [JsonPropertyName("quantity")]
-    //     public long Quantity { get; set; }
-
-    //     [JsonPropertyName("recurring")]
-    //     public bool Recurring { get; set; }
-
-    //     [JsonPropertyName("created_at")]
-    //     public DateTimeOffset CreatedAt { get; set; }
-
-    //     [JsonPropertyName("updated_at")]
-    //     public DateTimeOffset UpdatedAt { get; set; }
-
-    //     [JsonPropertyName("previously_billed_at")]
-    //     public DateTimeOffset PreviouslyBilledAt { get; set; }
-
-    //     [JsonPropertyName("next_billed_at")]
-    //     public DateTimeOffset NextBilledAt { get; set; }
-
-    //     [JsonPropertyName("trial_dates")]
-    //     public object TrialDates { get; set; }
-
-    //     [JsonPropertyName("price")]
-    //     public Price Price { get; set; }
-    // }
-
-    // public partial class Price
-    // {
-    //     [JsonPropertyName("id")]
-    //     public string Id { get; set; }
-
-    //     [JsonPropertyName("product_id")]
-    //     public string ProductId { get; set; }
-
-    //     [JsonPropertyName("type")]
-    //     public string Type { get; set; }
-
-    //     [JsonPropertyName("description")]
-    //     public string Description { get; set; }
-
-    //     [JsonPropertyName("name")]
-    //     public string Name { get; set; }
-
-    //     [JsonPropertyName("tax_mode")]
-    //     public string TaxMode { get; set; }
-
-    //     [JsonPropertyName("billing_cycle")]
-    //     public BillingCycle BillingCycle { get; set; }
-
-    //     [JsonPropertyName("trial_period")]
-    //     public object TrialPeriod { get; set; }
-
-    //     [JsonPropertyName("unit_price")]
-    //     public UnitPrice UnitPrice { get; set; }
-
-    //     [JsonPropertyName("unit_price_overrides")]
-    //     public object[] UnitPriceOverrides { get; set; }
-
-    //     [JsonPropertyName("custom_data")]
-    //     public object CustomData { get; set; }
-
-    //     [JsonPropertyName("status")]
-    //     public string Status { get; set; }
-
-    //     [JsonPropertyName("quantity")]
-    //     public Quantity Quantity { get; set; }
-
-    //     [JsonPropertyName("import_meta")]
-    //     public object ImportMeta { get; set; }
-
-    //     [JsonPropertyName("created_at")]
-    //     public DateTimeOffset CreatedAt { get; set; }
-
-    //     [JsonPropertyName("updated_at")]
-    //     public DateTimeOffset UpdatedAt { get; set; }
-    // }
-
-    // public partial class Quantity
-    // {
-    //     [JsonPropertyName("minimum")]
-    //     public long Minimum { get; set; }
-
-    //     [JsonPropertyName("maximum")]
-    //     public long Maximum { get; set; }
-    // }
-
-    // public partial class UnitPrice
-    // {
-    //     [JsonPropertyName("amount")]
-    //     [JsonConverter(typeof(ParseStringConverter))]
-    //     public long Amount { get; set; }
-
-    //     [JsonPropertyName("currency_code")]
-    //     public string CurrencyCode { get; set; }
-    // }
-
-    public partial class ManagementUrls
-    {
-        [JsonPropertyName("update_payment_method")]
-        public Uri? UpdatePaymentMethod { get; set; }
-
-        [JsonPropertyName("cancel")]
-        public Uri? Cancel { get; set; }
-    }
-}

Streetwriters.Common/Models/GetTransactionInvoiceResponse.cs

@@ -1,21 +0,0 @@
-namespace Streetwriters.Common.Models
-{
-    using System;
-    using System.Collections.Generic;
-
-    using System.Text.Json;
-    using System.Text.Json.Serialization;
-    using System.Globalization;
-
-    public class GetTransactionInvoiceResponse : PaddleResponse
-    {
-        [JsonPropertyName("data")]
-        public Invoice? Invoice { get; set; }
-    }
-
-    public partial class Invoice
-    {
-        [JsonPropertyName("url")]
-        public string? Url { get; set; }
-    }
-}

Streetwriters.Common/Models/GetTransactionResponse.cs

@@ -1,15 +0,0 @@
-namespace Streetwriters.Common.Models
-{
-    using System;
-    using System.Collections.Generic;
-
-    using System.Text.Json;
-    using System.Text.Json.Serialization;
-    using System.Globalization;
-
-    public partial class GetTransactionResponse : PaddleResponse
-    {
-        [JsonPropertyName("data")]
-        public TransactionV2? Transaction { get; set; }
-    }
-}

Streetwriters.Common/Models/ListPaymentsResponse.cs

@@ -1,41 +0,0 @@
-using System;
-using System.Text.Json.Serialization;
-
-namespace Streetwriters.Common.Models
-{
-    public partial class ListPaymentsResponse
-    {
-        [JsonPropertyName("success")]
-        public bool Success { get; set; }
-
-        [JsonPropertyName("response")]
-        public Payment[]? Payments { get; set; }
-    }
-
-    public partial class Payment
-    {
-        [JsonPropertyName("id")]
-        public long Id { get; set; }
-
-        [JsonPropertyName("subscription_id")]
-        public long SubscriptionId { get; set; }
-
-        [JsonPropertyName("amount")]
-        public double Amount { get; set; }
-
-        [JsonPropertyName("currency")]
-        public string? Currency { get; set; }
-
-        [JsonPropertyName("payout_date")]
-        public string? PayoutDate { get; set; }
-
-        [JsonPropertyName("is_paid")]
-        public short IsPaid { get; set; }
-
-        [JsonPropertyName("is_one_off_charge")]
-        public bool IsOneOffCharge { get; set; }
-
-        [JsonPropertyName("receipt_url")]
-        public string? ReceiptUrl { get; set; }
-    }
-}

Streetwriters.Common/Models/ListTransactionsResponse.cs

@@ -1,77 +0,0 @@
-namespace Streetwriters.Common.Models
-{
-    using System;
-    using System.Text.Json.Serialization;
-
-    public partial class ListTransactionsResponse
-    {
-        [JsonPropertyName("success")]
-        public bool Success { get; set; }
-
-        [JsonPropertyName("response")]
-        public Transaction[]? Transactions { get; set; }
-    }
-
-    public partial class Transaction
-    {
-        [JsonPropertyName("order_id")]
-        public string? OrderId { get; set; }
-
-        [JsonPropertyName("checkout_id")]
-        public string? CheckoutId { get; set; }
-
-        [JsonPropertyName("amount")]
-        public string? Amount { get; set; }
-
-        [JsonPropertyName("currency")]
-        public string? Currency { get; set; }
-
-        [JsonPropertyName("status")]
-        public string? Status { get; set; }
-
-        [JsonPropertyName("created_at")]
-        public string? CreatedAt { get; set; }
-
-        [JsonPropertyName("passthrough")]
-        public object? Passthrough { get; set; }
-
-        [JsonPropertyName("product_id")]
-        public long ProductId { get; set; }
-
-        [JsonPropertyName("is_subscription")]
-        public bool IsSubscription { get; set; }
-
-        [JsonPropertyName("is_one_off")]
-        public bool IsOneOff { get; set; }
-
-        [JsonPropertyName("subscription")]
-        public PaddleSubscription? Subscription { get; set; }
-
-        [JsonPropertyName("user")]
-        public PaddleTransactionUser? User { get; set; }
-
-        [JsonPropertyName("receipt_url")]
-        public string? ReceiptUrl { get; set; }
-    }
-
-    public partial class PaddleSubscription
-    {
-        [JsonPropertyName("subscription_id")]
-        public long SubscriptionId { get; set; }
-
-        [JsonPropertyName("status")]
-        public string? Status { get; set; }
-    }
-
-    public partial class PaddleTransactionUser
-    {
-        [JsonPropertyName("user_id")]
-        public long UserId { get; set; }
-
-        [JsonPropertyName("email")]
-        public string? Email { get; set; }
-
-        [JsonPropertyName("marketing_consent")]
-        public bool MarketingConsent { get; set; }
-    }
-}

Streetwriters.Common/Models/ListTransactionsResponseV2.cs

@@ -1,511 +0,0 @@
-namespace Streetwriters.Common.Models
-{
-    using System;
-    using System.Collections.Generic;
-
-    using System.Text.Json;
-    using System.Text.Json.Serialization;
-    using System.Globalization;
-
-    public partial class ListTransactionsResponseV2 : PaddleResponse
-    {
-        [JsonPropertyName("data")]
-        public TransactionV2[]? Transactions { get; set; }
-    }
-
-    public partial class TransactionV2
-    {
-        [JsonPropertyName("id")]
-        public string? Id { get; set; }
-
-        [JsonPropertyName("status")]
-        public string? Status { get; set; }
-
-        [JsonPropertyName("customer_id")]
-        public string? CustomerId { get; set; }
-
-        // [JsonPropertyName("address_id")]
-        // public string AddressId { get; set; }
-
-        // [JsonPropertyName("business_id")]
-        // public object BusinessId { get; set; }
-
-        [JsonPropertyName("custom_data")]
-        public Dictionary<string, string>? CustomData { get; set; }
-
-        [JsonPropertyName("origin")]
-        public string? Origin { get; set; }
-
-        // [JsonPropertyName("collection_mode")]
-        // public string CollectionMode { get; set; }
-
-        // [JsonPropertyName("subscription_id")]
-        // public string SubscriptionId { get; set; }
-
-        // [JsonPropertyName("invoice_id")]
-        // public string InvoiceId { get; set; }
-
-        // [JsonPropertyName("invoice_number")]
-        // public string InvoiceNumber { get; set; }
-
-        [JsonPropertyName("billing_details")]
-        public BillingDetails? BillingDetails { get; set; }
-
-        [JsonPropertyName("billing_period")]
-        public BillingPeriod? BillingPeriod { get; set; }
-
-        // [JsonPropertyName("currency_code")]
-        // public string CurrencyCode { get; set; }
-
-        // [JsonPropertyName("discount_id")]
-        // public string DiscountId { get; set; }
-
-        [JsonPropertyName("created_at")]
-        public DateTimeOffset CreatedAt { get; set; }
-
-        // [JsonPropertyName("updated_at")]
-        // public DateTimeOffset UpdatedAt { get; set; }
-
-        [JsonPropertyName("billed_at")]
-        public DateTimeOffset? BilledAt { get; set; }
-
-        [JsonPropertyName("items")]
-        public Item[]? Items { get; set; }
-
-        [JsonPropertyName("details")]
-        public Details? Details { get; set; }
-
-        // [JsonPropertyName("payments")]
-        // public Payment[] Payments { get; set; }
-
-        // [JsonPropertyName("checkout")]
-        // public Checkout Checkout { get; set; }
-    }
-
-    public partial class BillingDetails
-    {
-        // [JsonPropertyName("enable_checkout")]
-        // public bool EnableCheckout { get; set; }
-
-        [JsonPropertyName("payment_terms")]
-        public PaymentTerms? PaymentTerms { get; set; }
-
-        // [JsonPropertyName("purchase_order_number")]
-        // public string PurchaseOrderNumber { get; set; }
-
-        // [JsonPropertyName("additional_information")]
-        // public object AdditionalInformation { get; set; }
-    }
-
-    public partial class PaymentTerms
-    {
-        [JsonPropertyName("interval")]
-        public string? Interval { get; set; }
-
-        [JsonPropertyName("frequency")]
-        public long Frequency { get; set; }
-    }
-
-    public partial class BillingPeriod
-    {
-        [JsonPropertyName("starts_at")]
-        public DateTimeOffset StartsAt { get; set; }
-
-        [JsonPropertyName("ends_at")]
-        public DateTimeOffset EndsAt { get; set; }
-    }
-
-    // public partial class Checkout
-    // {
-    //     [JsonPropertyName("url")]
-    //     public Uri Url { get; set; }
-    // }
-
-    public partial class Details
-    {
-        // [JsonPropertyName("tax_rates_used")]
-        // public TaxRatesUsed[] TaxRatesUsed { get; set; }
-
-        [JsonPropertyName("totals")]
-        public Totals? Totals { get; set; }
-
-        // [JsonPropertyName("adjusted_totals")]
-        // public AdjustedTotals AdjustedTotals { get; set; }
-
-        // [JsonPropertyName("payout_totals")]
-        // public Dictionary<string, string> PayoutTotals { get; set; }
-
-        // [JsonPropertyName("adjusted_payout_totals")]
-        // public AdjustedTotals AdjustedPayoutTotals { get; set; }
-
-        [JsonPropertyName("line_items")]
-        public LineItem[]? LineItems { get; set; }
-    }
-
-    public partial class Totals
-    {
-        [JsonPropertyName("subtotal")]
-        public long Subtotal { get; set; }
-
-        [JsonPropertyName("tax")]
-        public long Tax { get; set; }
-
-        [JsonPropertyName("discount")]
-        public long Discount { get; set; }
-
-        [JsonPropertyName("total")]
-        public long Total { get; set; }
-
-        [JsonPropertyName("grand_total")]
-        public long GrandTotal { get; set; }
-
-        // [JsonPropertyName("fee")]
-        // public object Fee { get; set; }
-
-        // [JsonPropertyName("credit")]
-        // public long Credit { get; set; }
-
-        // [JsonPropertyName("credit_to_balance")]
-        // public long CreditToBalance { get; set; }
-
-        [JsonPropertyName("balance")]
-        public long Balance { get; set; }
-
-        // [JsonPropertyName("earnings")]
-        // public object Earnings { get; set; }
-
-        [JsonPropertyName("currency_code")]
-        public string? CurrencyCode { get; set; }
-    }
-    // public partial class AdjustedTotals
-    // {
-    //     [JsonPropertyName("subtotal")]
-    //     [JsonConverter(typeof(ParseStringConverter))]
-    //     public long Subtotal { get; set; }
-
-    //     [JsonPropertyName("tax")]
-    //     [JsonConverter(typeof(ParseStringConverter))]
-    //     public long Tax { get; set; }
-
-    //     [JsonPropertyName("total")]
-    //     [JsonConverter(typeof(ParseStringConverter))]
-    //     public long Total { get; set; }
-
-    //     [JsonPropertyName("fee")]
-    //     [JsonConverter(typeof(ParseStringConverter))]
-    //     public long Fee { get; set; }
-
-    //     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    //     [JsonPropertyName("chargeback_fee")]
-    //     public ChargebackFee ChargebackFee { get; set; }
-
-    //     [JsonPropertyName("earnings")]
-    //     [JsonConverter(typeof(ParseStringConverter))]
-    //     public long Earnings { get; set; }
-
-    //     [JsonPropertyName("currency_code")]
-    //     public string CurrencyCode { get; set; }
-
-    //     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    //     [JsonPropertyName("grand_total")]
-    //     [JsonConverter(typeof(ParseStringConverter))]
-    //     public long? GrandTotal { get; set; }
-    // }
-
-    // public partial class ChargebackFee
-    // {
-    //     [JsonPropertyName("amount")]
-    //     [JsonConverter(typeof(ParseStringConverter))]
-    //     public long Amount { get; set; }
-
-    //     [JsonPropertyName("original")]
-    //     public object Original { get; set; }
-    // }
-
-    public partial class LineItem
-    {
-        [JsonPropertyName("id")]
-        public string? Id { get; set; }
-
-        [JsonPropertyName("price_id")]
-        public string? PriceId { get; set; }
-
-        // [JsonPropertyName("quantity")]
-        // public long Quantity { get; set; }
-
-        // [JsonPropertyName("totals")]
-        // public Totals Totals { get; set; }
-
-        // [JsonPropertyName("product")]
-        // public Product Product { get; set; }
-
-        // [JsonPropertyName("tax_rate")]
-        // public string TaxRate { get; set; }
-
-        // [JsonPropertyName("unit_totals")]
-        // public Totals UnitTotals { get; set; }
-
-        [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-        [JsonPropertyName("proration")]
-        public Proration? Proration { get; set; }
-    }
-
-    // public partial class Product
-    // {
-    //     [JsonPropertyName("id")]
-    //     public string Id { get; set; }
-
-    //     [JsonPropertyName("name")]
-    //     public string Name { get; set; }
-
-    //     [JsonPropertyName("description")]
-    //     public string Description { get; set; }
-
-    //     [JsonPropertyName("type")]
-    //     public TypeEnum Type { get; set; }
-
-    //     [JsonPropertyName("tax_category")]
-    //     public TypeEnum TaxCategory { get; set; }
-
-    //     [JsonPropertyName("image_url")]
-    //     public Uri ImageUrl { get; set; }
-
-    //     [JsonPropertyName("custom_data")]
-    //     public CustomData CustomData { get; set; }
-
-    //     [JsonPropertyName("status")]
-    //     public Status Status { get; set; }
-
-    //     [JsonPropertyName("created_at")]
-    //     public DateTimeOffset CreatedAt { get; set; }
-
-    //     [JsonPropertyName("updated_at")]
-    //     public DateTimeOffset UpdatedAt { get; set; }
-
-    //     [JsonPropertyName("import_meta")]
-    //     public object ImportMeta { get; set; }
-    // }
-
-    // public partial class CustomData
-    // {
-    //     [JsonPropertyName("features")]
-    //     public Features Features { get; set; }
-
-    //     [JsonPropertyName("suggested_addons")]
-    //     public string[] SuggestedAddons { get; set; }
-
-    //     [JsonPropertyName("upgrade_description")]
-    //     public string UpgradeDescription { get; set; }
-    // }
-
-    // public partial class Features
-    // {
-    //     [JsonPropertyName("aircraft_performance")]
-    //     public bool AircraftPerformance { get; set; }
-
-    //     [JsonPropertyName("compliance_monitoring")]
-    //     public bool ComplianceMonitoring { get; set; }
-
-    //     [JsonPropertyName("flight_log_management")]
-    //     public bool FlightLogManagement { get; set; }
-
-    //     [JsonPropertyName("payment_by_invoice")]
-    //     public bool PaymentByInvoice { get; set; }
-
-    //     [JsonPropertyName("route_planning")]
-    //     public bool RoutePlanning { get; set; }
-
-    //     [JsonPropertyName("sso")]
-    //     public bool Sso { get; set; }
-    // }
-
-    public partial class Proration
-    {
-        [JsonPropertyName("billing_period")]
-        public BillingPeriod? BillingPeriod { get; set; }
-    }
-
-    // public partial class Totals
-    // {
-    //     [JsonPropertyName("subtotal")]
-    //     [JsonConverter(typeof(ParseStringConverter))]
-    //     public long Subtotal { get; set; }
-
-    //     [JsonPropertyName("discount")]
-    //     [JsonConverter(typeof(ParseStringConverter))]
-    //     public long Discount { get; set; }
-
-    //     [JsonPropertyName("tax")]
-    //     [JsonConverter(typeof(ParseStringConverter))]
-    //     public long Tax { get; set; }
-
-    //     [JsonPropertyName("total")]
-    //     [JsonConverter(typeof(ParseStringConverter))]
-    //     public long Total { get; set; }
-    // }
-
-    // public partial class TaxRatesUsed
-    // {
-    //     [JsonPropertyName("tax_rate")]
-    //     public string TaxRate { get; set; }
-
-    //     [JsonPropertyName("totals")]
-    //     public Totals Totals { get; set; }
-    // }
-
-    public partial class Item
-    {
-        [JsonPropertyName("price")]
-        public Price? Price { get; set; }
-
-        [JsonPropertyName("quantity")]
-        public long Quantity { get; set; }
-
-        [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-        [JsonPropertyName("proration")]
-        public Proration? Proration { get; set; }
-    }
-
-    public partial class Price
-    {
-        [JsonPropertyName("id")]
-        public string? Id { get; set; }
-
-        // [JsonPropertyName("description")]
-        // public string Description { get; set; }
-
-        // [JsonPropertyName("type")]
-        // public TypeEnum Type { get; set; }
-
-        [JsonPropertyName("name")]
-        public string? Name { get; set; }
-
-        // [JsonPropertyName("product_id")]
-        // public string ProductId { get; set; }
-
-        // [JsonPropertyName("billing_cycle")]
-        // public PaymentTerms BillingCycle { get; set; }
-
-        // [JsonPropertyName("trial_period")]
-        // public object TrialPeriod { get; set; }
-
-        // [JsonPropertyName("tax_mode")]
-        // public TaxMode TaxMode { get; set; }
-
-        // [JsonPropertyName("unit_price")]
-        // public UnitPrice UnitPrice { get; set; }
-
-        // [JsonPropertyName("unit_price_overrides")]
-        // public object[] UnitPriceOverrides { get; set; }
-
-        // [JsonPropertyName("custom_data")]
-        // public object CustomData { get; set; }
-
-        // [JsonPropertyName("quantity")]
-        // public Quantity Quantity { get; set; }
-
-        // [JsonPropertyName("status")]
-        // public Status Status { get; set; }
-
-        // [JsonPropertyName("created_at")]
-        // public DateTimeOffset CreatedAt { get; set; }
-
-        // [JsonPropertyName("updated_at")]
-        // public DateTimeOffset UpdatedAt { get; set; }
-
-        // [JsonPropertyName("import_meta")]
-        // public object ImportMeta { get; set; }
-    }
-
-    // public partial class Quantity
-    // {
-    //     [JsonPropertyName("minimum")]
-    //     public long Minimum { get; set; }
-
-    //     [JsonPropertyName("maximum")]
-    //     public long Maximum { get; set; }
-    // }
-
-    // public partial class UnitPrice
-    // {
-    //     [JsonPropertyName("amount")]
-    //     [JsonConverter(typeof(ParseStringConverter))]
-    //     public long Amount { get; set; }
-
-    //     [JsonPropertyName("currency_code")]
-    //     public CurrencyCode CurrencyCode { get; set; }
-    // }
-
-    // public partial class Payment
-    // {
-    //     [JsonPropertyName("payment_attempt_id")]
-    //     public Guid PaymentAttemptId { get; set; }
-
-    //     [JsonPropertyName("stored_payment_method_id")]
-    //     public Guid StoredPaymentMethodId { get; set; }
-
-    //     [JsonPropertyName("payment_method_id")]
-    //     public string PaymentMethodId { get; set; }
-
-    //     [JsonPropertyName("amount")]
-    //     [JsonConverter(typeof(ParseStringConverter))]
-    //     public long Amount { get; set; }
-
-    //     [JsonPropertyName("status")]
-    //     public string Status { get; set; }
-
-    //     [JsonPropertyName("error_code")]
-    //     public string ErrorCode { get; set; }
-
-    //     [JsonPropertyName("method_details")]
-    //     public MethodDetails MethodDetails { get; set; }
-
-    //     [JsonPropertyName("created_at")]
-    //     public DateTimeOffset CreatedAt { get; set; }
-
-    //     [JsonPropertyName("captured_at")]
-    //     public DateTimeOffset? CapturedAt { get; set; }
-    // }
-
-    // public partial class MethodDetails
-    // {
-    //     [JsonPropertyName("type")]
-    //     public string Type { get; set; }
-
-    //     [JsonPropertyName("card")]
-    //     public Card Card { get; set; }
-    // }
-
-    // public partial class Card
-    // {
-    //     [JsonPropertyName("type")]
-    //     public string Type { get; set; }
-
-    //     [JsonPropertyName("last4")]
-    //     public string Last4 { get; set; }
-
-    //     [JsonPropertyName("expiry_month")]
-    //     public long ExpiryMonth { get; set; }
-
-    //     [JsonPropertyName("expiry_year")]
-    //     public long ExpiryYear { get; set; }
-
-    //     [JsonPropertyName("cardholder_name")]
-    //     public string CardholderName { get; set; }
-    // }
-
-    public partial class Pagination
-    {
-        [JsonPropertyName("per_page")]
-        public long PerPage { get; set; }
-
-        [JsonPropertyName("next")]
-        public Uri? Next { get; set; }
-
-        [JsonPropertyName("has_more")]
-        public bool HasMore { get; set; }
-
-        [JsonPropertyName("estimated_total")]
-        public long EstimatedTotal { get; set; }
-    }
-}

Streetwriters.Common/Models/ListUsersResponse.cs

@@ -1,47 +0,0 @@
-using System;
-using System.Text.Json.Serialization;
-
-namespace Streetwriters.Common.Models
-{
-    public partial class ListUsersResponse
-    {
-        [JsonPropertyName("success")]
-        public bool Success { get; set; }
-
-        [JsonPropertyName("response")]
-        public PaddleUser[]? Users { get; set; }
-    }
-
-    public class PaddleUser
-    {
-        [JsonPropertyName("subscription_id")]
-        public long SubscriptionId { get; set; }
-
-        [JsonPropertyName("plan_id")]
-        public long PlanId { get; set; }
-
-        [JsonPropertyName("user_id")]
-        public long UserId { get; set; }
-
-        [JsonPropertyName("user_email")]
-        public string? UserEmail { get; set; }
-
-        [JsonPropertyName("marketing_consent")]
-        public bool MarketingConsent { get; set; }
-
-        [JsonPropertyName("update_url")]
-        public string? UpdateUrl { get; set; }
-
-        [JsonPropertyName("cancel_url")]
-        public string? CancelUrl { get; set; }
-
-        [JsonPropertyName("state")]
-        public string? State { get; set; }
-
-        [JsonPropertyName("signup_date")]
-        public string? SignupDate { get; set; }
-
-        [JsonPropertyName("quantity")]
-        public long Quantity { get; set; }
-    }
-}

Streetwriters.Common/Models/PaddleResponse.cs

@@ -1,24 +0,0 @@
-namespace Streetwriters.Common.Models
-{
-    using System;
-    using System.Collections.Generic;
-
-    using System.Text.Json;
-    using System.Text.Json.Serialization;
-    using System.Globalization;
-
-    public partial class PaddleResponse
-    {
-        [JsonPropertyName("error")]
-        public PaddleError? Error { get; set; }
-    }
-
-    public class PaddleError
-    {
-        public string? Type { get; set; }
-        public string? Code { get; set; }
-        public string? Detail { get; set; }
-        [JsonPropertyName("documentation_url")]
-        public string? DocumentationUrl { get; set; }
-    }
-}

Streetwriters.Common/Models/RefundPaymentResponse.cs

@@ -1,20 +0,0 @@
-using System;
-using System.Text.Json.Serialization;
-
-namespace Streetwriters.Common.Models
-{
-    public partial class RefundPaymentResponse
-    {
-        [JsonPropertyName("success")]
-        public bool Success { get; set; }
-
-        [JsonPropertyName("response")]
-        public required Refund Refund { get; set; }
-    }
-
-    public partial class Refund
-    {
-        [JsonPropertyName("refund_request_id")]
-        public long RefundRequestId { get; set; }
-    }
-}

Streetwriters.Common/Models/Subscription.cs

@@ -93,6 +93,9 @@ namespace Streetwriters.Common.Models
         [JsonPropertyName("trialsAvailed")]
         public SubscriptionPlan[]? TrialsAvailed { get; set; }
 
+        [JsonPropertyName("extensionsAvailed")]
+        public SubscriptionExtension[]? ExtensionsAvailed { get; set; }
+
         [JsonPropertyName("updatedAt")]
         public long UpdatedAt { get; set; }
 
@@ -104,4 +107,16 @@ namespace Streetwriters.Common.Models
         [JsonPropertyName("status")]
         public SubscriptionStatus Status { get; set; }
     }
+
+    public class SubscriptionExtension
+    {
+        [JsonPropertyName("timestamp")]
+        public required long Timestamp { get; set; }
+
+        [JsonPropertyName("expiry")]
+        public required long ExpiryDate { get; set; }
+
+        [JsonPropertyName("type")]
+        public required string Type { get; set; }
+    }
 }

Streetwriters.Common/Models/SubscriptionPreviewResponse.cs

@@ -1,57 +0,0 @@
-namespace Streetwriters.Common.Models
-{
-    using System;
-    using System.Collections.Generic;
-
-    using System.Text.Json;
-    using System.Text.Json.Serialization;
-    using System.Globalization;
-
-    public partial class SubscriptionPreviewResponse : PaddleResponse
-    {
-        [JsonPropertyName("data")]
-        public SubscriptionPreviewData? Data { get; set; }
-    }
-
-    public partial class SubscriptionPreviewData
-    {
-        [JsonPropertyName("currency_code")]
-        public string? CurrencyCode { get; set; }
-
-        [JsonPropertyName("billing_cycle")]
-        public BillingCycle? BillingCycle { get; set; }
-
-        [JsonPropertyName("update_summary")]
-        public UpdateSummary? UpdateSummary { get; set; }
-
-        [JsonPropertyName("immediate_transaction")]
-        public TransactionV2? ImmediateTransaction { get; set; }
-
-        [JsonPropertyName("next_transaction")]
-        public TransactionV2? NextTransaction { get; set; }
-
-        [JsonPropertyName("recurring_transaction_details")]
-        public Details? RecurringTransactionDetails { get; set; }
-    }
-
-    public partial class UpdateSummary
-    {
-        [JsonPropertyName("charge")]
-        public UpdateSummaryItem? Charge { get; set; }
-
-        [JsonPropertyName("credit")]
-        public UpdateSummaryItem? Credit { get; set; }
-
-        [JsonPropertyName("result")]
-        public UpdateSummaryItem? Result { get; set; }
-    }
-
-    public partial class UpdateSummaryItem
-    {
-        [JsonPropertyName("amount")]
-        public long Amount { get; set; }
-
-        [JsonPropertyName("action")]
-        public string? Action { get; set; }
-    }
-}

Streetwriters.Common/Services/EmailSender.cs

@@ -27,7 +27,7 @@ namespace Streetwriters.Common.Services
         public async Task SendEmailAsync(
             string email,
             EmailTemplate template,
-            IClient client,
+            System.Net.Mail.MailAddress from,
             GnuPGContext? gpgContext = null,
             Dictionary<string, byte[]>? attachments = null
         )
@@ -55,8 +55,7 @@ namespace Streetwriters.Common.Services
                 );
 
             var message = new MimeMessage();
-            var sender = new MailboxAddress(client.SenderName, client.SenderEmail);
+            message.From.Add(new MailboxAddress(from.DisplayName, from.Address));
-            message.From.Add(sender);
             message.To.Add(new MailboxAddress("", email));
             message.Subject = await Template.Parse(template.Subject).RenderAsync(template.Data);
 
@@ -65,8 +64,7 @@ namespace Streetwriters.Common.Services
 
             message.Body = await GetEmailBodyAsync(
                 template,
-                client,
+                new MailboxAddress(from.DisplayName, from.Address),
-                sender,
                 gpgContext,
                 attachments
             );
@@ -76,7 +74,6 @@ namespace Streetwriters.Common.Services
 
         private async Task<MimeEntity> GetEmailBodyAsync(
             EmailTemplate template,
-            IClient client,
             MailboxAddress sender,
             GnuPGContext? gpgContext = null,
             Dictionary<string, byte[]>? attachments = null
@@ -107,7 +104,7 @@ namespace Streetwriters.Common.Services
                         }
                         outputStream.Seek(0, SeekOrigin.Begin);
                         builder.Attachments.Add(
-                            $"{client.Id}_pub.asc",
+                            $"pub.asc",
                             Encoding.ASCII.GetBytes(
                                 Encoding.ASCII.GetString(outputStream.ToArray())
                             )

Streetwriters.Common/Services/PaddleBillingService.cs

@@ -1,138 +0,0 @@
-using System.Collections.Generic;
-using System.Net.Http;
-using System.Net.Http.Headers;
-using System.Net.Http.Json;
-using System.Threading.Tasks;
-using Microsoft.AspNetCore.WebUtilities;
-using Streetwriters.Common.Models;
-
-namespace Streetwriters.Common.Services
-{
-    public class PaddleBillingService
-    {
-#if DEBUG
-        private const string PADDLE_BASE_URI = "https://sandbox-api.paddle.com";
-#else
-        private const string PADDLE_BASE_URI = "https://api.paddle.com";
-#endif
-        private readonly HttpClient httpClient = new();
-        public PaddleBillingService(string paddleApiKey)
-        {
-            httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", paddleApiKey);
-        }
-
-        public async Task<GetSubscriptionResponse?> GetSubscriptionAsync(string subscriptionId)
-        {
-            var url = $"{PADDLE_BASE_URI}/subscriptions/{subscriptionId}";
-            var response = await httpClient.GetAsync(url);
-            return await response.Content.ReadFromJsonAsync<GetSubscriptionResponse>();
-        }
-
-        public async Task<GetTransactionResponse?> GetTransactionAsync(string transactionId)
-        {
-            var url = $"{PADDLE_BASE_URI}/transactions/{transactionId}";
-            var response = await httpClient.GetAsync(url);
-            return await response.Content.ReadFromJsonAsync<GetTransactionResponse>();
-        }
-
-        public async Task<GetTransactionInvoiceResponse?> GetTransactionInvoiceAsync(string transactionId)
-        {
-            var url = $"{PADDLE_BASE_URI}/transactions/{transactionId}/invoice";
-            var response = await httpClient.GetAsync(url);
-            return await response.Content.ReadFromJsonAsync<GetTransactionInvoiceResponse>();
-        }
-
-        public async Task<ListTransactionsResponseV2?> ListTransactionsAsync(string? subscriptionId = null, string? customerId = null, string[]? status = null, string[]? origin = null)
-        {
-            var url = $"{PADDLE_BASE_URI}/transactions";
-            var parameters = new Dictionary<string, string?>()
-            {
-                { "subscription_id", subscriptionId },
-                { "customer_id", customerId },
-                { "status", string.Join(',', status ?? ["billed","completed"]) },
-                { "order_by", "billed_at[DESC]" }
-            };
-            if (origin is not null) parameters.Add("origin", string.Join(',', origin));
-            var response = await httpClient.GetAsync(QueryHelpers.AddQueryString(url, parameters));
-
-            return await response.Content.ReadFromJsonAsync<ListTransactionsResponseV2>();
-        }
-
-        public async Task<PaddleResponse?> RefundTransactionAsync(string transactionId, string transactionItemId, string reason = "")
-        {
-            var url = $"{PADDLE_BASE_URI}/adjustments";
-            var response = await httpClient.PostAsync(url, JsonContent.Create(new Dictionary<string, object>
-            {
-                { "action", "refund" },
-                {
-                    "items",
-                    new object[]
-                    {
-                        new Dictionary<string, string> {
-                            {"item_id", transactionItemId},
-                            {"type", "full"}
-                        }
-                    }
-                },
-                { "reason", reason },
-                { "transaction_id", transactionId }
-            }));
-            return await response.Content.ReadFromJsonAsync<PaddleResponse>();
-        }
-
-        public async Task<SubscriptionPreviewResponse?> PreviewSubscriptionChangeAsync(string subscriptionId, string newProductId, bool isTrialing)
-        {
-            var url = $"{PADDLE_BASE_URI}/subscriptions/{subscriptionId}/preview";
-            var response = await httpClient.PatchAsync(url, JsonContent.Create(new
-            {
-                proration_billing_mode = isTrialing ? "do_not_bill" : "prorated_immediately",
-                items = new[] { new { price_id = newProductId, quantity = 1 } }
-            }));
-            return await response.Content.ReadFromJsonAsync<SubscriptionPreviewResponse>();
-        }
-
-        public async Task<PaddleResponse?> ChangeSubscriptionAsync(string subscriptionId, string newProductId, bool isTrialing)
-        {
-            var url = $"{PADDLE_BASE_URI}/subscriptions/{subscriptionId}";
-            var response = await httpClient.PatchAsync(url, JsonContent.Create(new
-            {
-                proration_billing_mode = isTrialing ? "do_not_bill" : "prorated_immediately",
-                items = new[] { new { price_id = newProductId, quantity = 1 } }
-            }));
-            return await response.Content.ReadFromJsonAsync<PaddleResponse>();
-        }
-
-        public async Task<PaddleResponse?> CancelSubscriptionAsync(string subscriptionId)
-        {
-            var url = $"{PADDLE_BASE_URI}/subscriptions/{subscriptionId}/cancel";
-            var response = await httpClient.PostAsync(url, JsonContent.Create(new { effective_from = "immediately" }));
-            return await response.Content.ReadFromJsonAsync<PaddleResponse>();
-        }
-
-        public async Task<PaddleResponse?> PauseSubscriptionAsync(string subscriptionId)
-        {
-            var url = $"{PADDLE_BASE_URI}/subscriptions/{subscriptionId}/pause";
-            var response = await httpClient.PostAsync(url, JsonContent.Create(new { }));
-            return await response.Content.ReadFromJsonAsync<PaddleResponse>();
-        }
-
-        public async Task<PaddleResponse?> ResumeSubscriptionAsync(string subscriptionId)
-        {
-            var url = $"{PADDLE_BASE_URI}/subscriptions/{subscriptionId}";
-            var response = await httpClient.PatchAsync(url, JsonContent.Create(new Dictionary<string, string?>
-            {
-                {"scheduled_change", null}
-            }));
-            return await response.Content.ReadFromJsonAsync<PaddleResponse>();
-        }
-
-        public async Task<GetCustomerResponse?> FindCustomerFromTransactionAsync(string transactionId)
-        {
-            var transaction = await GetTransactionAsync(transactionId);
-            if (transaction?.Transaction?.CustomerId == null) return null;
-            var url = $"{PADDLE_BASE_URI}/customers/{transaction.Transaction.CustomerId}";
-            var response = await httpClient.GetFromJsonAsync<GetCustomerResponse>(url);
-            return response;
-        }
-    }
-}

Streetwriters.Common/Services/PaddleService.cs

@@ -1,188 +0,0 @@
-using System;
-using System.Collections.Generic;
-using System.Net.Http;
-using System.Net.Http.Json;
-using System.Text.Json.Serialization;
-using System.Threading.Tasks;
-using Streetwriters.Common.Models;
-
-namespace Streetwriters.Common.Services
-{
-    public class PaddleService(string vendorId, string vendorAuthCode)
-    {
-#if (DEBUG || STAGING)
-        const string PADDLE_BASE_URI = "https://sandbox-vendors.paddle.com/api";
-#else
-        const string PADDLE_BASE_URI = "https://vendors.paddle.com/api";
-#endif
-
-        HttpClient httpClient = new HttpClient();
-
-        public async Task<ListUsersResponse?> ListUsersAsync(
-            string subscriptionId,
-            int results
-        )
-        {
-            var url = $"{PADDLE_BASE_URI}/2.0/subscription/users";
-            var httpClient = new HttpClient();
-            var response = await httpClient.PostAsync(
-                url,
-                new FormUrlEncodedContent(
-                    new Dictionary<string, string>
-                    {
-                        { "vendor_id", vendorId },
-                        { "vendor_auth_code", vendorAuthCode },
-                        { "subscription_id", subscriptionId },
-                        { "results_per_page", results.ToString() },
-                    }
-                )
-            );
-
-            return await response.Content.ReadFromJsonAsync<ListUsersResponse>();
-        }
-
-        public async Task<ListPaymentsResponse?> ListPaymentsAsync(
-            string subscriptionId,
-            long planId
-        )
-        {
-            var url = $"{PADDLE_BASE_URI}/2.0/subscription/payments";
-            var httpClient = new HttpClient();
-            var response = await httpClient.PostAsync(
-                url,
-                new FormUrlEncodedContent(
-                    new Dictionary<string, string>
-                    {
-                        { "vendor_id", vendorId },
-                        { "vendor_auth_code", vendorAuthCode },
-                        { "subscription_id", subscriptionId },
-                        { "is_paid", "1" },
-                        { "plan", planId.ToString() },
-                        { "is_one_off_charge", "0" },
-                    }
-                )
-            );
-
-            return await response.Content.ReadFromJsonAsync<ListPaymentsResponse>();
-        }
-
-        public async Task<ListTransactionsResponse?> ListTransactionsAsync(
-            string subscriptionId
-        )
-        {
-            var url = $"{PADDLE_BASE_URI}/2.0/subscription/{subscriptionId}/transactions";
-            var httpClient = new HttpClient();
-            var response = await httpClient.PostAsync(
-                url,
-                new FormUrlEncodedContent(
-                    new Dictionary<string, string>
-                    {
-                        { "vendor_id", vendorId },
-                        { "vendor_auth_code", vendorAuthCode },
-                    }
-                )
-            );
-
-            return await response.Content.ReadFromJsonAsync<ListTransactionsResponse>();
-        }
-
-        public async Task<PaddleTransactionUser?> FindUserFromOrderAsync(string orderId)
-        {
-            var url = $"{PADDLE_BASE_URI}/2.0/order/{orderId}/transactions";
-            var httpClient = new HttpClient();
-            var response = await httpClient.PostAsync(
-                url,
-                new FormUrlEncodedContent(
-                    new Dictionary<string, string>
-                    {
-                        { "vendor_id", vendorId },
-                        { "vendor_auth_code", vendorAuthCode },
-                    }
-                )
-            );
-            var transactions = await response.Content.ReadFromJsonAsync<ListTransactionsResponse>();
-            if (transactions?.Transactions == null || transactions.Transactions.Length == 0) return null;
-            return transactions.Transactions[0].User;
-        }
-
-        public async Task<bool> RefundPaymentAsync(string paymentId, string reason = "")
-        {
-            var url = $"{PADDLE_BASE_URI}/2.0/payment/refund";
-            var httpClient = new HttpClient();
-            var response = await httpClient.PostAsync(
-                url,
-                new FormUrlEncodedContent(
-                    new Dictionary<string, string>
-                    {
-                        { "vendor_id", vendorId },
-                        { "vendor_auth_code", vendorAuthCode },
-                        { "order_id", paymentId },
-                        { "reason", reason },
-                    }
-                )
-            );
-
-            var refundResponse = await response.Content.ReadFromJsonAsync<RefundPaymentResponse>();
-            return refundResponse?.Success ?? false;
-        }
-
-        public async Task<bool> CancelSubscriptionAsync(string subscriptionId)
-        {
-            var url = $"{PADDLE_BASE_URI}/2.0/subscription/users_cancel";
-            var httpClient = new HttpClient();
-            var response = await httpClient.PostAsync(
-                url,
-                new FormUrlEncodedContent(
-                    new Dictionary<string, string>
-                    {
-                        { "vendor_id", vendorId },
-                        { "vendor_auth_code", vendorAuthCode },
-                        { "subscription_id", subscriptionId },
-                    }
-                )
-            );
-
-            return response.IsSuccessStatusCode;
-        }
-
-        public async Task<bool> PauseSubscriptionAsync(string subscriptionId)
-        {
-            var url = $"{PADDLE_BASE_URI}/2.0/subscription/users/update";
-            var httpClient = new HttpClient();
-            var response = await httpClient.PostAsync(
-                url,
-                new FormUrlEncodedContent(
-                    new Dictionary<string, string>
-                    {
-                        { "vendor_id", vendorId },
-                        { "vendor_auth_code", vendorAuthCode },
-                        { "subscription_id", subscriptionId },
-                        { "pause", "true" },
-                    }
-                )
-            );
-
-            return response.IsSuccessStatusCode;
-        }
-
-        public async Task<bool> ResumeSubscriptionAsync(string subscriptionId)
-        {
-            var url = $"{PADDLE_BASE_URI}/2.0/subscription/users/update";
-            var httpClient = new HttpClient();
-            var response = await httpClient.PostAsync(
-                url,
-                new FormUrlEncodedContent(
-                    new Dictionary<string, string>
-                    {
-                        { "vendor_id", vendorId },
-                        { "vendor_auth_code", vendorAuthCode },
-                        { "subscription_id", subscriptionId },
-                        { "pause", "false" },
-                    }
-                )
-            );
-
-            return response.IsSuccessStatusCode;
-        }
-    }
-}

Streetwriters.Common/WampServers.cs

@@ -110,6 +110,7 @@ namespace Streetwriters.Common
         public const string CreateSubscriptionTopic = "co.streetwriters.subscriptions.create";
         public const string CreateSubscriptionV2Topic = "co.streetwriters.subscriptions.v2.create";
         public const string DeleteSubscriptionTopic = "co.streetwriters.subscriptions.delete";
+        public const string EmailConfirmedTopic = "co.streetwriters.subscriptions.email_confirmed";
     }
 
     public struct IdentityServerTopics

Streetwriters.Identity/Controllers/AccountController.cs

@@ -190,8 +190,8 @@ namespace Streetwriters.Identity.Controllers
             var client = Clients.FindClientById(form.ClientId);
             if (client == null) return BadRequest("Invalid client_id.");
 
-            var user = await UserManager.FindByEmailAsync(form.Email) ?? throw new Exception("User not found.");
+            var user = await UserManager.FindByEmailAsync(form.Email);
-            if (!await UserService.IsUserValidAsync(UserManager, user, form.ClientId)) return Ok();
+            if (user == null || !await UserService.IsUserValidAsync(UserManager, user, form.ClientId)) return Ok();
 
             var code = await UserManager.GenerateUserTokenAsync(user, TokenOptions.DefaultProvider, "ResetPassword");
             var callbackUrl = UrlExtensions.TokenLink(user.Id.ToString(), code, client.Id, TokenType.RESET_PASSWORD);

Streetwriters.Identity/Interfaces/ISMSSender.cs

@@ -24,7 +24,7 @@ namespace Streetwriters.Identity.Interfaces
 {
     public interface ISMSSender
     {
-        Task<string> SendOTPAsync(string number, IClient client);
+        Task<string?> SendOTPAsync(string number, IClient client);
         Task<bool> VerifyOTPAsync(string id, string code);
     }
 }

Streetwriters.Identity/Services/MFAService.cs

@@ -186,6 +186,8 @@ namespace Streetwriters.Identity.Services
                     ArgumentNullException.ThrowIfNull(form.PhoneNumber);
                     await UserManager.SetPhoneNumberAsync(user, form.PhoneNumber);
                     var id = await SMSSender.SendOTPAsync(form.PhoneNumber, client);
+                    if (string.IsNullOrEmpty(id)) throw new Exception("Failed to send SMS. Please try again.");
+
                     logger.LogInformation("SMS OTP sent for user: {UserId}, SMS ID: {SmsId}", user.Id, id);
                     await this.ReplaceClaimAsync(user, MFAService.SMS_ID_CLAIM, id);
                     break;

Streetwriters.Identity/Services/SMSSender.cs

@@ -23,36 +23,56 @@ using Streetwriters.Common;
 using Twilio.Rest.Verify.V2.Service;
 using Twilio;
 using System.Threading.Tasks;
+using System;
+using Microsoft.Extensions.Logging;
 
 namespace Streetwriters.Identity.Services
 {
     public class SMSSender : ISMSSender
     {
-        public SMSSender()
+        private readonly ILogger<SMSSender> Logger;
+        public SMSSender(ILogger<SMSSender> logger)
         {
+            Logger = logger;
             if (!string.IsNullOrEmpty(Constants.TWILIO_ACCOUNT_SID) && !string.IsNullOrEmpty(Constants.TWILIO_AUTH_TOKEN))
             {
                 TwilioClient.Init(Constants.TWILIO_ACCOUNT_SID, Constants.TWILIO_AUTH_TOKEN);
             }
         }
 
-        public async Task<string> SendOTPAsync(string number, IClient app)
+        public async Task<string?> SendOTPAsync(string number, IClient app)
         {
-            var verification = await VerificationResource.CreateAsync(
+            try
-                to: number,
+            {
-                channel: "sms",
+                var verification = await VerificationResource.CreateAsync(
-                pathServiceSid: Constants.TWILIO_SERVICE_SID
+                    to: number,
-            );
+                    channel: "sms",
-            return verification.Sid;
+                    pathServiceSid: Constants.TWILIO_SERVICE_SID
+                );
+                return verification.Sid;
+            }
+            catch (Exception ex)
+            {
+                Logger.LogError(ex, "Error sending OTP with Twilio");
+                return null;
+            }
         }
 
         public async Task<bool> VerifyOTPAsync(string id, string code)
         {
-            return (await VerificationCheckResource.CreateAsync(
+            try
-                verificationSid: id,
+            {
-                pathServiceSid: Constants.TWILIO_SERVICE_SID,
+                return (await VerificationCheckResource.CreateAsync(
-                code: code
+                    verificationSid: id,
-            )).Status == "approved";
+                    pathServiceSid: Constants.TWILIO_SERVICE_SID,
+                    code: code
+                )).Status == "approved";
+            }
+            catch (Exception ex)
+            {
+                Logger.LogError(ex, "Error verifying OTP with Twilio");
+                return false;
+            }
         }
     }
 }

Streetwriters.Identity/Services/TemplatedEmailSender.cs

@@ -104,7 +104,7 @@ namespace Streetwriters.Identity.Services
                 Subject = Email2FATemplate.Subject,
                 Data = new { app_name = client.Name, code },
             };
-            await EmailSender.SendEmailAsync(email, template, client, NNGnuPGContext);
+            await EmailSender.SendEmailAsync(email, template, new System.Net.Mail.MailAddress(client.SenderEmail, client.SenderName), NNGnuPGContext);
         }
 
         public async Task SendConfirmationEmailAsync(
@@ -120,7 +120,7 @@ namespace Streetwriters.Identity.Services
                 Subject = ConfirmEmailTemplate.Subject,
                 Data = new { app_name = client.Name, confirm_link = callbackUrl },
             };
-            await EmailSender.SendEmailAsync(email, template, client, NNGnuPGContext);
+            await EmailSender.SendEmailAsync(email, template, new System.Net.Mail.MailAddress(client.SenderEmail, client.SenderName), NNGnuPGContext);
         }
 
         public async Task SendChangeEmailConfirmationAsync(
@@ -136,7 +136,7 @@ namespace Streetwriters.Identity.Services
                 Subject = ConfirmChangeEmailTemplate.Subject,
                 Data = new { app_name = client.Name, code },
             };
-            await EmailSender.SendEmailAsync(email, template, client, NNGnuPGContext);
+            await EmailSender.SendEmailAsync(email, template, new System.Net.Mail.MailAddress(client.SenderEmail, client.SenderName), NNGnuPGContext);
         }
 
         public async Task SendPasswordResetEmailAsync(
@@ -152,7 +152,7 @@ namespace Streetwriters.Identity.Services
                 Subject = PasswordResetEmailTemplate.Subject,
                 Data = new { app_name = client.Name, reset_link = callbackUrl },
             };
-            await EmailSender.SendEmailAsync(email, template, client, NNGnuPGContext);
+            await EmailSender.SendEmailAsync(email, template, new System.Net.Mail.MailAddress(client.SenderEmail, client.SenderName), NNGnuPGContext);
         }
 
         public async Task SendFailedLoginAlertAsync(string email, string deviceInfo, IClient client)
@@ -168,7 +168,7 @@ namespace Streetwriters.Identity.Services
                     device_info = deviceInfo.Replace("\n", "<br>"),
                 },
             };
-            await EmailSender.SendEmailAsync(email, template, client, NNGnuPGContext);
+            await EmailSender.SendEmailAsync(email, template, new System.Net.Mail.MailAddress(client.SenderEmail, client.SenderName), NNGnuPGContext);
         }
     }
 

Streetwriters.Identity/Services/UserAccountService.cs

@@ -85,6 +85,13 @@ namespace Streetwriters.Identity.Services
 
             await mfaService.ResetMFAAsync(user);
             result = await userManager.AddPasswordAsync(user, newPassword);
+
+            // force change email to lowercase if it is not already
+            if (user.Email != null && user.Email != user.Email.ToLower())
+            {
+                var token = await userManager.GenerateChangeEmailTokenAsync(user, user.Email.ToLower());
+                result = await userManager.ChangeEmailAsync(user, user.Email.ToLower(), token);
+            }
             return result.Succeeded;
         }
 

Streetwriters.Identity/Templates/ConfirmEmail.html

@@ -504,7 +504,6 @@
                                                 text-align: start;
                                                 text-indent: 0px;
                                                 text-transform: none;
-                                                white-space: pre-wrap;
                                                 widows: 2;
                                                 word-spacing: 0px;
                                                 -webkit-text-stroke-width: 0px;
@@ -536,7 +535,6 @@
                                                 text-align: start;
                                                 text-indent: 0px;
                                                 text-transform: none;
-                                                white-space: pre-wrap;
                                                 widows: 2;
                                                 word-spacing: 0px;
                                                 -webkit-text-stroke-width: 0px;
@@ -567,7 +565,6 @@
                                                 text-align: start;
                                                 text-indent: 0px;
                                                 text-transform: none;
-                                                white-space: pre-wrap;
                                                 widows: 2;
                                                 word-spacing: 0px;
                                                 -webkit-text-stroke-width: 0px;

Streetwriters.Identity/Templates/Email2FACode.html

@@ -309,7 +309,6 @@
                                                 text-align: start;
                                                 text-indent: 0px;
                                                 text-transform: none;
-                                                white-space: pre-wrap;
                                                 widows: 2;
                                                 word-spacing: 0px;
                                                 -webkit-text-stroke-width: 0px;

Streetwriters.Identity/Templates/EmailChangeConfirmation.html

@@ -401,7 +401,6 @@
                                                 text-align: start;
                                                 text-indent: 0px;
                                                 text-transform: none;
-                                                white-space: pre-wrap;
                                                 word-spacing: 0px;
                                                 -webkit-text-stroke-width: 0px;
                                                 background-color: rgb(

Streetwriters.Identity/Templates/ResetAccountPassword.html

@@ -467,7 +467,6 @@
                                                 text-align: start;
                                                 text-indent: 0px;
                                                 text-transform: none;
-                                                white-space: pre-wrap;
                                                 widows: 2;
                                                 word-spacing: 0px;
                                                 -webkit-text-stroke-width: 0px;
@@ -483,9 +482,7 @@
                                                 display: inline;
                                               "
                                               ><em
-                                                >If you did not request to reset
+                                                >If you did not request to reset your account password, you can safely ignore this email.</em
-                                                your account password, you can
-                                                safely ignore this email.</em
                                               ></span
                                             >
                                           </div>
@@ -554,7 +551,6 @@
                                 >
                                   <tbody>
                                     <tr>
-                                      .
                                       <td
                                         style="
                                           padding: 18px 0px 18px 0px;

Streetwriters.Messenger/Helpers/SSEHelper.cs

@@ -18,28 +18,49 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 
 using System.Linq;
+using System;
+using System.Threading;
 using System.Threading.Tasks;
 using Lib.AspNetCore.ServerSentEvents;
 using System.Security.Claims;
+using System.Collections.Generic;
 
 namespace Streetwriters.Messenger.Helpers
 {
     public class SSEHelper
     {
-        public static async Task SendEventToUserAsync(string data, IServerSentEventsService sseService, string userId, string? originTokenId = null)
+        public static async Task SendEventToUserAsync(string data, IServerSentEventsService sseService, string userId, string? originTokenId = null, CancellationToken cancellationToken = default)
         {
-            var clients = sseService.GetClients().Where(c => c.User.FindFirstValue("sub") == userId);
+            var clients = sseService.GetClients()
-            foreach (var client in clients)
+                .Where(c => c.User?.FindFirstValue("sub") == userId)
-            {
+                .Where(c => originTokenId == null || c.User?.FindFirstValue("jti") != originTokenId);
-                if (originTokenId != null && client.User.FindFirstValue("jti") == originTokenId) continue;
+
-                if (!client.IsConnected) continue;
+            await SendEventToClientsAsync(clients, data, cancellationToken);
-                await client.SendEventAsync(data);
-            }
         }
 
-        public static async Task SendEventToAllUsersAsync(string data, IServerSentEventsService sseService)
+        public static async Task SendEventToAllUsersAsync(string data, IServerSentEventsService sseService, CancellationToken cancellationToken = default)
         {
-            await sseService.SendEventAsync(data);
+            await SendEventToClientsAsync(sseService.GetClients(), data, cancellationToken);
+        }
+
+        private static async Task SendEventToClientsAsync(IEnumerable<IServerSentEventsClient> clients, string data, CancellationToken cancellationToken)
+        {
+            foreach (var client in clients)
+            {
+                if (!client.IsConnected) continue;
+
+                try
+                {
+                    await client.SendEventAsync(data, cancellationToken);
+                }
+                catch (OperationCanceledException) when (cancellationToken.IsCancellationRequested)
+                {
+                    break;
+                }
+                catch
+                {
+                }
+            }
         }
     }
 }

Streetwriters.Messenger/Services/HeartbeatService.cs

@@ -21,6 +21,7 @@ using System;
 using System.Threading;
 using System.Threading.Tasks;
 using Microsoft.Extensions.Hosting;
+using Microsoft.Extensions.Logging;
 using Lib.AspNetCore.ServerSentEvents;
 using Streetwriters.Messenger.Helpers;
 using System.Text.Json;
@@ -33,12 +34,14 @@ namespace Streetwriters.Messenger.Services
         private const string HEARTBEAT_MESSAGE_FORMAT = "Streetwriters Heartbeat ({0} UTC)";
 
         private readonly IServerSentEventsService _serverSentEventsService;
+        private readonly ILogger<HeartbeatService> _logger;
         #endregion
 
         #region Constructor
-        public HeartbeatService(IServerSentEventsService serverSentEventsService)
+        public HeartbeatService(IServerSentEventsService serverSentEventsService, ILogger<HeartbeatService> logger)
         {
             _serverSentEventsService = serverSentEventsService;
+            _logger = logger;
         }
         #endregion
 
@@ -47,15 +50,28 @@ namespace Streetwriters.Messenger.Services
         {
             while (!stoppingToken.IsCancellationRequested)
             {
-                var message = JsonSerializer.Serialize(new
+                try
                 {
-                    type = "heartbeat",
+                    var message = JsonSerializer.Serialize(new
-                    data = JsonSerializer.Serialize(new
                     {
-                        t = DateTimeOffset.UtcNow.ToUnixTimeMilliseconds()
+                        type = "heartbeat",
-                    })
+                        data = JsonSerializer.Serialize(new
-                });
+                        {
-                await SSEHelper.SendEventToAllUsersAsync(message, _serverSentEventsService);
+                            t = DateTimeOffset.UtcNow.ToUnixTimeMilliseconds()
+                        })
+                    });
+
+                    await SSEHelper.SendEventToAllUsersAsync(message, _serverSentEventsService, stoppingToken);
+                }
+                catch (OperationCanceledException) when (stoppingToken.IsCancellationRequested)
+                {
+                    break;
+                }
+                catch (Exception ex)
+                {
+                    _logger.LogWarning(ex, "Failed to send SSE heartbeat to one or more clients.");
+                }
+
                 await Task.Delay(TimeSpan.FromSeconds(5), stoppingToken);
             }
         }

Streetwriters.Messenger/Streetwriters.Messenger.csproj

@@ -8,7 +8,7 @@
 
   <ItemGroup>
     <PackageReference Include="DotNetEnv" Version="2.3.0" />
-    <PackageReference Include="Lib.AspNetCore.ServerSentEvents" Version="6.0.0" />
+    <PackageReference Include="Lib.AspNetCore.ServerSentEvents" Version="9.1.0" />
     <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="5.0.0"
       NoWarn="NU1605" />
     <PackageReference Include="Microsoft.AspNetCore.Authentication.OpenIdConnect" Version="5.0.0"

docker-compose.yml

@@ -25,14 +25,11 @@ services:
           "INSTANCE_NAME"
           "NOTESNOOK_API_SECRET"
           "DISABLE_SIGNUPS"
-          "SMTP_USERNAME"
-          "SMTP_PASSWORD"
-          "SMTP_HOST"
-          "SMTP_PORT"
           "AUTH_SERVER_PUBLIC_URL"
           "NOTESNOOK_APP_PUBLIC_URL"
           "MONOGRAPH_PUBLIC_URL"
           "ATTACHMENTS_SERVER_PUBLIC_URL"
+          "NOTESNOOK_API_PUBLIC_URL"
         )
 
         # Check each required environment variable
@@ -43,6 +40,23 @@ services:
           fi
         done
 
+        if [ -z "$$SMTP_HOST" ] || [ -z "$$SMTP_PORT" ] || [ -z "$$SMTP_USERNAME" ] || [ -z "$$SMTP_PASSWORD" ]; then
+          cat <<'EOF'
+
+        ================================================================================
+         WARNING: SMTP IS NOT CONFIGURED
+        ================================================================================
+         Email-based 2FA codes and password-reset emails will NOT be sent.
+
+         Newly created users MUST switch 2FA to an Authenticator app:
+           Settings > Auth > Change 2FA method
+
+         Configure SMTP_* in .env if you need email-based 2FA or password reset.
+        ================================================================================
+
+        EOF
+        fi
+
         echo "All required environment variables are set."
     # Ensure the validate service runs first
     restart: "no"
@@ -153,6 +167,7 @@ services:
       S3_SERVICE_URL: "${ATTACHMENTS_SERVER_PUBLIC_URL}"
       S3_REGION: "us-east-1"
       S3_BUCKET_NAME: "attachments"
+      NOTESNOOK_CORS: ${NOTESNOOK_CORS_ORIGINS:-}
 
   sse-server:
     image: streetwriters/sse:latest
@@ -183,16 +198,104 @@ services:
     networks:
       - notesnook
     healthcheck:
-      test: wget --tries=1 -nv -q  http://localhost:3000/api/health -O- || exit 1
+      test: >
+        bun -e "fetch('http://127.0.0.1:3000/api/health')
+        .then(r => { if (!r.ok) process.exit(1); })
+        .catch(() => process.exit(1))"
       interval: 40s
       timeout: 30s
       retries: 3
       start_period: 60s
     environment:
       <<: *server-discovery
-      API_HOST: http://notesnook-server:5264
+      NODE_ENV: production
+      HOST: 0.0.0.0
+      API_HOST: ${NOTESNOOK_API_PUBLIC_URL:-http://localhost:5264}
       PUBLIC_URL: ${MONOGRAPH_PUBLIC_URL}
 
+  setup-themes:
+    profiles: [extras]
+    image: busybox:latest
+    networks:
+      - notesnook
+    volumes:
+      - themesdata:/data
+    command: ['sh', '-c', 'if [ ! -f /data/installs.json ]; then echo "{}" > /data/installs.json; fi']
+
+  themes-server:
+    profiles: [extras]
+    image: streetwriters/themes-server:latest
+    ports:
+      - 9200:9000
+    networks:
+      - notesnook
+    depends_on:
+      setup-themes:
+        condition: service_completed_successfully
+    healthcheck:
+      test: >
+        bun -e "fetch('http://127.0.0.1:9000/health')
+        .then(r => { if (!r.ok) process.exit(1); })
+        .catch(() => process.exit(1))"
+      interval: 40s
+      timeout: 30s
+      retries: 3
+      start_period: 60s
+    environment:
+      HOST: 0.0.0.0
+      PORT: 9000
+      THEMES_REPO_URL: ${THEMES_REPO_URL:-https://github.com/streetwriters/notesnook-themes.git}
+    volumes:
+      - type: volume
+        source: themesdata
+        target: /installs.json
+        volume:
+          subpath: installs.json
+
+  cors-proxy:
+    profiles: [extras]
+    image: streetwriters/cors-proxy:latest
+    ports:
+      - 3001:3000
+    networks:
+      - notesnook
+    healthcheck:
+      test: >
+        bun -e "fetch('http://127.0.0.1:3000/health')
+        .then(r => { if (!r.ok) process.exit(1); })
+        .catch(() => process.exit(1))"
+      interval: 40s
+      timeout: 30s
+      retries: 3
+      start_period: 60s
+    environment:
+      HOST: 0.0.0.0
+      PORT: 3000
+      ALLOWED_ORIGINS: ${CORS_PROXY_ALLOWED_ORIGINS:-*}
+
+  inbox-api:
+    profiles: [extras]
+    image: streetwriters/notesnook-inbox:latest
+    ports:
+      - 5181:5181
+    networks:
+      - notesnook
+    depends_on:
+      - notesnook-server
+    healthcheck:
+      test: >
+        bun -e "fetch('http://127.0.0.1:5181/health')
+        .then(r => { if (!r.ok) process.exit(1); })
+        .catch(() => process.exit(1))"
+      interval: 40s
+      timeout: 30s
+      retries: 3
+      start_period: 60s
+    environment:
+      HOST: 0.0.0.0
+      PORT: 5181
+      NOTESNOOK_API_SERVER_URL: http://notesnook-server:5264
+
   autoheal:
     image: willfarrell/autoheal:latest
     tty: true
@@ -212,4 +315,4 @@ networks:
 volumes:
   dbdata:
   s3data:
-
+  themesdata:

examples/README.md

@@ -0,0 +1,50 @@
+# Docker Compose Examples
+
+Reference deployments that split infrastructure from the Notesnook stack. Each example overrides the root [`docker-compose.yml`](../docker-compose.yml) instead of duplicating it.
+
+## Pattern
+
+Run all commands from the **repository root**.
+
+| Step | Compose files | Role |
+|------|---------------|------|
+| 1. Infra | `examples/<example>/infra.compose.yml` | MongoDB, MinIO, or Garage on `notesnook-shared` |
+| 2. Notesnook | `docker-compose.yml` + `examples/<example>/notesnook.override.yml` | Disables embedded services; patches connection strings |
+
+```bash
+# 1. Merge example vars into root .env (see examples/<example>/.env.example)
+# 2. Start infrastructure
+docker compose -f examples/<example>/infra.compose.yml up -d
+
+# 3. Start Notesnook (one-time setup for garage — see example README)
+docker compose -f docker-compose.yml -f examples/<example>/notesnook.override.yml up -d
+
+# Optional extras
+docker compose -f docker-compose.yml -f examples/<example>/notesnook.override.yml --profile extras up -d
+
+# Tear down (reverse order)
+docker compose -f docker-compose.yml -f examples/<example>/notesnook.override.yml down
+docker compose -f examples/<example>/infra.compose.yml down
+```
+
+## Environment
+
+The root [`.env`](../.env) is loaded automatically when running from the repository root. Each example ships a **delta-only** [`.env.example`](external-mongodb/.env.example) listing only variables that differ — merge those lines into your root `.env`.
+
+Infra-only variables (e.g. `GARAGE_RPC_SECRET`) are in `infra.env.example` where applicable; pass with `--env-file` or merge into root `.env`.
+
+## Examples
+
+| Example | External dependency | Notes |
+|---------|---------------------|-------|
+| [external-mongodb](external-mongodb/) | MongoDB | Embedded MinIO stays enabled |
+| [external-minio](external-minio/) | MinIO | Embedded MongoDB stays enabled |
+| [garage](garage/) | [GarageHQ](https://garagehq.deuxfleurs.fr/) S3 | Manual bucket setup via `setup-garage.sh` |
+
+## Shared network
+
+Infra compose files create **`notesnook-shared`**. Override files attach Notesnook services to it as an external network. Run only one infra example at a time on the same host.
+
+## Root compose
+
+The all-in-one stack: [`docker-compose.yml`](../docker-compose.yml) (no override file).

examples/external-minio/.env.example

@@ -0,0 +1,6 @@
+# Merge these into the repository root .env (see /.env for all other variables).
+#
+# MINIO_ROOT_USER and MINIO_ROOT_PASSWORD must match examples/external-minio/infra.env.example
+# when starting the external MinIO infra stack.
+MINIO_ROOT_USER=minioadmin
+MINIO_ROOT_PASSWORD=minioadmin

examples/external-minio/README.md

@@ -0,0 +1,43 @@
+# External MinIO
+
+MinIO runs in a separate compose project. The Notesnook stack uses the root [`docker-compose.yml`](../../docker-compose.yml) with [`notesnook.override.yml`](notesnook.override.yml), which disables embedded `notesnook-s3` / `setup-s3` and points at external MinIO. Embedded MongoDB is unchanged.
+
+## Setup
+
+From the **repository root**:
+
+```bash
+# Ensure MINIO_* in root .env match infra.env.example
+# Merge notesnook delta if needed (see .env.example)
+
+# 1. MinIO + bucket setup
+docker compose -f examples/external-minio/infra.compose.yml \
+  --env-file examples/external-minio/infra.env.example up -d
+
+# Wait for notesnook-minio-setup to complete
+docker compose -f examples/external-minio/infra.compose.yml ps -a
+
+# 2. Notesnook
+docker compose -f docker-compose.yml -f examples/external-minio/notesnook.override.yml up -d
+```
+
+## Environment
+
+| File | Purpose |
+|------|---------|
+| [`infra.env.example`](infra.env.example) | `MINIO_ROOT_USER` / `MINIO_ROOT_PASSWORD` for infra stack |
+| [`.env.example`](.env.example) | Notesnook delta (credentials must match infra) |
+
+Merge `MINIO_*` into root [`.env`](../../.env) so the sync server uses the same credentials.
+
+## Stop
+
+```bash
+docker compose -f docker-compose.yml -f examples/external-minio/notesnook.override.yml down
+docker compose -f examples/external-minio/infra.compose.yml down
+```
+
+## Notes
+
+- Bucket `attachments` is created by `notesnook-minio-setup` on first infra start.
+- `S3_INTERNAL_SERVICE_URL` is overridden to `http://notesnook-minio:9000`.

examples/external-minio/infra.compose.yml

@@ -0,0 +1,47 @@
+name: notesnook-external-minio-infra
+
+services:
+  notesnook-minio:
+    image: minio/minio:RELEASE.2024-07-29T22-14-52Z
+    hostname: notesnook-minio
+    ports:
+      - 9000:9000
+    networks:
+      - notesnook-shared
+    volumes:
+      - s3data:/data/s3
+    environment:
+      MINIO_ROOT_USER: ${MINIO_ROOT_USER:-minioadmin}
+      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:-minioadmin}
+      MINIO_BROWSER: "on"
+    command: server /data/s3 --console-address :9090
+    healthcheck:
+      test: timeout 5s bash -c ':> /dev/tcp/127.0.0.1/9000' || exit 1
+      interval: 40s
+      timeout: 30s
+      retries: 3
+      start_period: 60s
+
+  notesnook-minio-setup:
+    image: minio/mc:RELEASE.2024-07-26T13-08-44Z
+    depends_on:
+      notesnook-minio:
+        condition: service_healthy
+    networks:
+      - notesnook-shared
+    environment:
+      MINIO_ROOT_USER: ${MINIO_ROOT_USER:-minioadmin}
+      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:-minioadmin}
+    command:
+      - /bin/bash
+      - -c
+      - |
+        mc alias set minio http://notesnook-minio:9000 ${MINIO_ROOT_USER:-minioadmin} ${MINIO_ROOT_PASSWORD:-minioadmin}
+        mc mb minio/attachments -p
+
+networks:
+  notesnook-shared:
+    name: notesnook-shared
+
+volumes:
+  s3data:

examples/external-minio/infra.env.example

@@ -0,0 +1,2 @@
+MINIO_ROOT_USER=minioadmin
+MINIO_ROOT_PASSWORD=minioadmin

examples/external-minio/notesnook.override.yml

@@ -0,0 +1,20 @@
+services:
+  notesnook-s3:
+    profiles: [embedded-disabled]
+
+  setup-s3:
+    profiles: [embedded-disabled]
+
+  notesnook-server:
+    networks:
+      - notesnook
+      - notesnook-shared
+    depends_on: !override
+      identity-server:
+        condition: service_started
+    environment:
+      S3_INTERNAL_SERVICE_URL: "http://notesnook-minio:9000"
+
+networks:
+  notesnook-shared:
+    external: true

examples/external-mongodb/.env.example

@@ -0,0 +1,4 @@
+# Merge these into the repository root .env (see /.env for all other variables).
+
+MONGODB_CONNECTION_STRING_IDENTITY=mongodb://notesnook-mongodb:27017/identity?replSet=rs0
+MONGODB_CONNECTION_STRING=mongodb://notesnook-mongodb:27017/?replSet=rs0

examples/external-mongodb/README.md

@@ -0,0 +1,36 @@
+# External MongoDB
+
+MongoDB runs in a separate compose project. The Notesnook stack uses the root [`docker-compose.yml`](../../docker-compose.yml) with [`notesnook.override.yml`](notesnook.override.yml), which disables the embedded `notesnook-db` service and points at external Mongo. Embedded MinIO is unchanged.
+
+## Setup
+
+From the **repository root**:
+
+```bash
+# Merge into root .env
+cat examples/external-mongodb/.env.example >> .env
+# set NOTESNOOK_API_SECRET and other required root .env values
+
+# 1. MongoDB
+docker compose -f examples/external-mongodb/infra.compose.yml up -d
+
+# 2. Notesnook
+docker compose -f docker-compose.yml -f examples/external-mongodb/notesnook.override.yml up -d
+```
+
+## Environment (delta)
+
+See [`.env.example`](.env.example) — only `MONGODB_CONNECTION_STRING*` overrides are needed beyond the root `.env`.
+
+## Stop
+
+```bash
+docker compose -f docker-compose.yml -f examples/external-mongodb/notesnook.override.yml down
+docker compose -f examples/external-mongodb/infra.compose.yml down
+```
+
+## Notes
+
+- Replica set `rs0` is required; the infra healthcheck initializes it.
+- Host port `27017` is exposed for debugging.
+- If infra stops, `identity-server` and `notesnook-server` fail until MongoDB is back.

examples/external-mongodb/infra.compose.yml

@@ -0,0 +1,26 @@
+name: notesnook-external-mongodb-infra
+
+services:
+  notesnook-mongodb:
+    image: mongo:7.0.12
+    hostname: notesnook-mongodb
+    ports:
+      - 27017:27017
+    volumes:
+      - dbdata:/data/db
+    networks:
+      - notesnook-shared
+    command: --replSet rs0 --bind_ip_all
+    healthcheck:
+      test: echo 'try { rs.status() } catch (err) { rs.initiate() }; db.runCommand("ping").ok' | mongosh mongodb://localhost:27017 --quiet
+      interval: 40s
+      timeout: 30s
+      retries: 3
+      start_period: 60s
+
+networks:
+  notesnook-shared:
+    name: notesnook-shared
+
+volumes:
+  dbdata:

examples/external-mongodb/notesnook.override.yml

@@ -0,0 +1,31 @@
+services:
+  notesnook-db:
+    profiles: [embedded-disabled]
+
+  identity-server:
+    depends_on: !override
+      validate:
+        condition: service_completed_successfully
+    networks:
+      - notesnook
+      - notesnook-shared
+    environment:
+      MONGODB_CONNECTION_STRING: ${MONGODB_CONNECTION_STRING_IDENTITY}
+
+  notesnook-server:
+    networks:
+      - notesnook
+      - notesnook-shared
+    depends_on: !override
+      notesnook-s3:
+        condition: service_started
+      setup-s3:
+        condition: service_started
+      identity-server:
+        condition: service_started
+    environment:
+      MONGODB_CONNECTION_STRING: ${MONGODB_CONNECTION_STRING}
+
+networks:
+  notesnook-shared:
+    external: true

examples/garage/.env.example

@@ -0,0 +1,6 @@
+# Merge these into the repository root .env (see /.env for all other variables).
+# Fill after running examples/garage/setup-garage.sh
+
+GARAGE_ACCESS_KEY_ID=
+GARAGE_ACCESS_KEY_SECRET=
+ATTACHMENTS_SERVER_PUBLIC_URL=http://localhost:3900

examples/garage/README.md

@@ -0,0 +1,57 @@
+# GarageHQ S3
+
+[Garage](https://garagehq.deuxfleurs.fr/) replaces embedded MinIO. The Notesnook stack uses the root [`docker-compose.yml`](../../docker-compose.yml) with [`notesnook.override.yml`](notesnook.override.yml). MongoDB stays embedded.
+
+Based on [PR #79](https://github.com/streetwriters/notesnook-sync-server/pull/79), with community review adjustments:
+
+- Notesnook uses **presigned URLs** — no public bucket policy required.
+- Do **not** use `aws s3api put-bucket-policy` for public read ([Garage S3 compatibility](https://garagehq.deuxfleurs.fr/documentation/reference-manual/s3-compatibility/)).
+- Use port **3900** (S3 API) for `ATTACHMENTS_SERVER_PUBLIC_URL` when not behind a reverse proxy.
+
+## Setup
+
+From the **repository root**:
+
+```bash
+# 1. Generate RPC secret and add to root .env or use --env-file
+openssl rand -hex 32
+# add GARAGE_RPC_SECRET=... to .env (see infra.env.example)
+
+# 2. Garage infra
+docker compose -f examples/garage/infra.compose.yml up -d
+
+# 3. One-time bucket/key setup (from repo root)
+./examples/garage/setup-garage.sh
+
+# 4. Merge keys into root .env (see .env.example)
+# 5. Notesnook
+docker compose -f docker-compose.yml -f examples/garage/notesnook.override.yml up -d
+```
+
+`notesnook-server` may stay unhealthy until valid `GARAGE_ACCESS_KEY_*` values are in root `.env`:
+
+```bash
+docker compose -f docker-compose.yml -f examples/garage/notesnook.override.yml up -d --force-recreate notesnook-server
+```
+
+## Environment
+
+| File | Purpose |
+|------|---------|
+| [`infra.env.example`](infra.env.example) | `GARAGE_RPC_SECRET` for infra |
+| [`.env.example`](.env.example) | `GARAGE_ACCESS_KEY_*` and `ATTACHMENTS_SERVER_PUBLIC_URL` (merge into root `.env`) |
+
+## Stop
+
+```bash
+docker compose -f docker-compose.yml -f examples/garage/notesnook.override.yml down
+docker compose -f examples/garage/infra.compose.yml down
+```
+
+## Manual setup
+
+If `setup-garage.sh` fails, follow PR #79 layout/bucket/key steps manually. Skip public bucket policy. Optional bucket alias only for Garage web port 3902.
+
+## MongoDB
+
+This example only externalizes S3. For external MongoDB, combine with [external-mongodb](../external-mongodb/) or use the root all-in-one compose.

examples/garage/garage.toml

@@ -0,0 +1,21 @@
+metadata_dir = "/var/lib/garage/meta"
+data_dir = "/var/lib/garage/data"
+db_engine = "lmdb"
+
+replication_factor = 1
+consistency_mode = "consistent"
+
+rpc_bind_addr = "[::]:3901"
+rpc_public_addr = "127.0.0.1:3901"
+
+[s3_api]
+s3_region = "us-east-1"
+api_bind_addr = "[::]:3900"
+root_domain = ".s3.garage"
+
+[s3_web]
+bind_addr = "[::]:3902"
+root_domain = ".web.garage"
+
+[admin]
+api_bind_addr = "[::]:3903"

examples/garage/infra.compose.yml

@@ -0,0 +1,31 @@
+name: notesnook-garage-infra
+
+services:
+  notesnook-garage:
+    image: dxflrs/garage:v2.3.0
+    hostname: notesnook-garage
+    restart: unless-stopped
+    ports:
+      - 3900:3900
+      - 3901:3901
+      - 3902:3902
+    networks:
+      - notesnook-shared
+    volumes:
+      - s3data:/var/lib/garage
+      - ./garage.toml:/etc/garage.toml:ro
+    environment:
+      GARAGE_RPC_SECRET: ${GARAGE_RPC_SECRET}
+    healthcheck:
+      test: ["CMD", "/garage", "status"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 30s
+
+networks:
+  notesnook-shared:
+    name: notesnook-shared
+
+volumes:
+  s3data:

examples/garage/infra.env.example

@@ -0,0 +1,2 @@
+# Generate with: openssl rand -hex 32
+GARAGE_RPC_SECRET=

examples/garage/notesnook.override.yml

@@ -0,0 +1,22 @@
+services:
+  notesnook-s3:
+    profiles: [embedded-disabled]
+
+  setup-s3:
+    profiles: [embedded-disabled]
+
+  notesnook-server:
+    networks:
+      - notesnook
+      - notesnook-shared
+    depends_on: !override
+      identity-server:
+        condition: service_started
+    environment:
+      S3_INTERNAL_SERVICE_URL: "http://notesnook-garage:3900"
+      S3_ACCESS_KEY_ID: "${GARAGE_ACCESS_KEY_ID}"
+      S3_ACCESS_KEY: "${GARAGE_ACCESS_KEY_SECRET}"
+
+networks:
+  notesnook-shared:
+    external: true

examples/garage/setup-garage.sh

@@ -0,0 +1,107 @@
+#!/bin/bash
+set -euo pipefail
+
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+RED='\033[0;31m'
+NC='\033[0m'
+
+BUCKET="${GARAGE_BUCKET:-attachments}"
+ZONE="${GARAGE_ZONE:-us-east-1}"
+CAPACITY="${GARAGE_CAPACITY:-10G}"
+KEY_NAME="${GARAGE_KEY_NAME:-notesnook-key}"
+ENDPOINT="${GARAGE_S3_ENDPOINT:-http://127.0.0.1:3900}"
+
+echo -e "${GREEN}--- Notesnook Garage setup ---${NC}"
+
+CONTAINER_NAME="${GARAGE_CONTAINER_NAME:-}"
+if [ -z "$CONTAINER_NAME" ]; then
+  CONTAINER_NAME=$(docker ps --format '{{.Names}}' | grep -E 'notesnook-garage|garage' | head -n 1 || true)
+fi
+
+if [ -z "$CONTAINER_NAME" ]; then
+  echo -e "${RED}Error: no running Garage container found.${NC}"
+  echo "Start infra first (from repo root): docker compose -f examples/garage/infra.compose.yml up -d"
+  exit 1
+fi
+
+echo -e "Using container: ${GREEN}${CONTAINER_NAME}${NC}"
+
+echo -e "\n${YELLOW}[1/5] Layout${NC}"
+NODE_ID=""
+for _ in $(seq 1 10); do
+  NODE_ID=$(docker exec "$CONTAINER_NAME" /garage node id -q | cut -d '@' -f 1 || true)
+  [ -n "$NODE_ID" ] && break
+  sleep 2
+done
+
+if [ -z "$NODE_ID" ]; then
+  echo -e "${RED}Error: could not read Garage node id.${NC}"
+  exit 1
+fi
+
+echo "Node ID: $NODE_ID"
+docker exec "$CONTAINER_NAME" /garage layout assign -z "$ZONE" -c "$CAPACITY" "$NODE_ID"
+echo "yes" | docker exec -i "$CONTAINER_NAME" /garage layout apply --version 1
+
+echo -e "\n${YELLOW}[2/5] Bucket${NC}"
+docker exec "$CONTAINER_NAME" /garage bucket create "$BUCKET" || true
+
+if [ -n "${GARAGE_BUCKET_ALIAS:-}" ]; then
+  echo "Aliasing bucket to ${GARAGE_BUCKET_ALIAS} (optional website access)"
+  docker exec "$CONTAINER_NAME" /garage bucket alias "$BUCKET" "$GARAGE_BUCKET_ALIAS"
+fi
+
+echo -e "\n${YELLOW}[3/5] API key${NC}"
+KEY_INFO=$(docker exec "$CONTAINER_NAME" /garage key create "$KEY_NAME")
+echo "$KEY_INFO"
+
+KEY_ID=$(echo "$KEY_INFO" | awk '/Key ID:/ {print $3}')
+SECRET_KEY=$(echo "$KEY_INFO" | awk '/Secret key:/ {print $3}')
+
+if [ -z "$KEY_ID" ] || [ -z "$SECRET_KEY" ]; then
+  echo -e "${RED}Error: failed to parse key id/secret from garage output.${NC}"
+  exit 1
+fi
+
+echo -e "\n${YELLOW}[4/5] Bucket permissions${NC}"
+docker exec "$CONTAINER_NAME" /garage bucket allow "$BUCKET" --read --write --owner --key "$KEY_ID"
+
+echo -e "\n${YELLOW}[5/5] CORS (aws-cli)${NC}"
+docker run --rm \
+  --env AWS_ACCESS_KEY_ID="$KEY_ID" \
+  --env AWS_SECRET_ACCESS_KEY="$SECRET_KEY" \
+  --add-host=host.docker.internal:host-gateway \
+  amazon/aws-cli \
+  --endpoint-url "$ENDPOINT" \
+  s3api put-bucket-cors --bucket "$BUCKET" --cors-configuration '{
+    "CORSRules": [
+      {
+        "AllowedHeaders": ["*"],
+        "AllowedMethods": ["GET", "PUT", "POST", "DELETE", "HEAD"],
+        "AllowedOrigins": ["*"],
+        "ExposeHeaders": ["ETag"]
+      }
+    ]
+  }'
+
+cat <<EOF
+
+${GREEN}--- Setup complete ---${NC}
+
+Merge these into the repository root .env (see examples/garage/.env.example):
+
+  GARAGE_ACCESS_KEY_ID=$KEY_ID
+  GARAGE_ACCESS_KEY_SECRET=$SECRET_KEY
+  ATTACHMENTS_SERVER_PUBLIC_URL=$ENDPOINT
+
+Notes:
+  - Notesnook uses presigned URLs for attachments; public bucket policies are not required.
+  - Use the S3 API URL (port 3900) for ATTACHMENTS_SERVER_PUBLIC_URL unless you proxy it.
+  - Do not use aws s3api put-bucket-policy for public read; Garage does not support this like MinIO.
+
+Then restart the sync server (from repo root):
+
+  docker compose -f docker-compose.yml -f examples/garage/notesnook.override.yml up -d --force-recreate notesnook-server
+
+EOF