feat(stickies): add personal sticky notes (#239)

A per-user quick-capture scratchpad opened from a header icon: a
slide-over panel of colored notes with a bold title and body, debounced
auto-save, a per-note ... menu (pin, expand to a large view, color,
delete), and drag-to-reorder. Notes are private to the user and scoped
to the company database.

Backend: Modules/Stickies (CRUD + reorder) with a pure stickyRules layer
and unit tests; the stickies collection is wired through all five schema
registration points; every query is scoped by company + userId with
content/title length caps and a per-user count cap.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: parth0025

Config/collections.js

@@ -59,6 +59,7 @@ const dbCollections = {
     WEBHOOKS: "webhooks",
     WEBHOOK_LOGS: "webhookLogs",
     RECENTVISITS: "recentVisits",
+    STICKIES: "stickies",
     API_TOKENS: "apiTokens",
     API_ACTIVITY_LOGS: "apiActivityLogs",
     EXPORT_JOBS: "exportJobs",

Config/schemaType.js

@@ -58,6 +58,7 @@ const SCHEMA_TYPE = {
     WEBHOOKS: "webhooks",
     WEBHOOK_LOGS: "webhookLogs",
     RECENTVISITS: "recentVisits",
+    STICKIES: "stickies",
     API_TOKENS: "apiTokens",
     API_ACTIVITY_LOGS: "apiActivityLogs",
     EXPORT_JOBS: "exportJobs",

Modules/Stickies/controller.js

@@ -0,0 +1,177 @@
+const { SCHEMA_TYPE } = require("../../Config/schemaType");
+const { MongoDbCrudOpration } = require("../../utils/mongo-handler/mongoQueries");
+const mongoose = require("mongoose");
+const logger = require("../../Config/loggerConfig");
+const {
+    MAX_NOTES_PER_USER,
+    isObjectId,
+    validateStickyPayload,
+    validateReorder,
+} = require("./helpers/stickyRules");
+
+// Personal sticky notes — one document per note, scoped to the company
+// database AND the owning userId. Every query filters on userId, so a user
+// can only ever read or mutate their own notes. Content is stored as plain
+// text and rendered as text on the client (no HTML).
+
+// Resolve the acting user from the various shapes the clients send.
+const getUserId = (req) => {
+    const fromBody = req.body && (req.body.userId || (req.body.userData && (req.body.userData.id || req.body.userData._id)));
+    const fromQuery = req.query && req.query.uid;
+    return String(fromBody || fromQuery || '');
+};
+
+/* GET /api/v2/stickies?uid=<userId> — the user's notes, pinned first. */
+exports.listStickies = async (req, res) => {
+    try {
+        const companyId = req.headers['companyid'] || '';
+        const userId = getUserId(req);
+        if (!companyId || !userId) {
+            return res.send({ status: false, statusText: 'companyId and uid are required.' });
+        }
+
+        const stickies = await MongoDbCrudOpration(companyId, {
+            type: SCHEMA_TYPE.STICKIES,
+            data: [{ userId }, null, { sort: { isPinned: -1, sortIndex: 1, updatedAt: -1 } }],
+        }, 'find');
+
+        return res.send({ status: true, statusText: 'Stickies fetched.', data: stickies || [] });
+    } catch (error) {
+        logger.error(`ERROR in list stickies: ${error.message}`);
+        return res.send({ status: false, statusText: error.message });
+    }
+};
+
+/* POST /api/v2/stickies  body: { content?, color?, userData } */
+exports.createSticky = async (req, res) => {
+    try {
+        const companyId = req.headers['companyid'] || '';
+        const userId = getUserId(req);
+        if (!companyId || !userId) {
+            return res.send({ status: false, statusText: 'companyId and userId are required.' });
+        }
+
+        const check = validateStickyPayload(req.body || {}, { partial: false });
+        if (!check.valid) {
+            return res.send({ status: false, statusText: check.reason });
+        }
+
+        // Per-user count cap (abuse guard).
+        const count = await MongoDbCrudOpration(companyId, {
+            type: SCHEMA_TYPE.STICKIES,
+            data: [{ userId }],
+        }, 'countDocuments');
+        if (count >= MAX_NOTES_PER_USER) {
+            return res.send({ status: false, statusText: `You can keep at most ${MAX_NOTES_PER_USER} sticky notes.` });
+        }
+
+        const created = await MongoDbCrudOpration(companyId, {
+            type: SCHEMA_TYPE.STICKIES,
+            data: {
+                userId,
+                title: check.data.title,
+                content: check.data.content,
+                color: check.data.color,
+                sortIndex: 0,
+                isPinned: false,
+            },
+        }, 'save');
+
+        return res.send({ status: true, statusText: 'Sticky created.', data: created });
+    } catch (error) {
+        logger.error(`ERROR in create sticky: ${error.message}`);
+        return res.send({ status: false, statusText: error.message });
+    }
+};
+
+/* PUT /api/v2/stickies/:id  body: { content?, color?, isPinned?, userData } */
+exports.updateSticky = async (req, res) => {
+    try {
+        const companyId = req.headers['companyid'] || '';
+        const userId = getUserId(req);
+        const { id } = req.params;
+        if (!companyId || !userId || !isObjectId(id)) {
+            return res.send({ status: false, statusText: 'companyId, userId and a valid id are required.' });
+        }
+
+        const check = validateStickyPayload(req.body || {}, { partial: true });
+        if (!check.valid) {
+            return res.send({ status: false, statusText: check.reason });
+        }
+
+        const updated = await MongoDbCrudOpration(companyId, {
+            type: SCHEMA_TYPE.STICKIES,
+            data: [
+                { _id: new mongoose.Types.ObjectId(id), userId },
+                { $set: check.data },
+                { returnDocument: 'after' },
+            ],
+        }, 'findOneAndUpdate');
+
+        if (!updated) {
+            return res.send({ status: false, statusText: 'Sticky not found.' });
+        }
+        return res.send({ status: true, statusText: 'Sticky updated.', data: updated });
+    } catch (error) {
+        logger.error(`ERROR in update sticky: ${error.message}`);
+        return res.send({ status: false, statusText: error.message });
+    }
+};
+
+/* DELETE /api/v2/stickies/:id?uid=<userId> */
+exports.deleteSticky = async (req, res) => {
+    try {
+        const companyId = req.headers['companyid'] || '';
+        const userId = getUserId(req);
+        const { id } = req.params;
+        if (!companyId || !userId || !isObjectId(id)) {
+            return res.send({ status: false, statusText: 'companyId, userId and a valid id are required.' });
+        }
+
+        const deleted = await MongoDbCrudOpration(companyId, {
+            type: SCHEMA_TYPE.STICKIES,
+            data: [{ _id: new mongoose.Types.ObjectId(id), userId }],
+        }, 'findOneAndDelete');
+
+        if (!deleted) {
+            return res.send({ status: false, statusText: 'Sticky not found.' });
+        }
+        return res.send({ status: true, statusText: 'Sticky deleted.', data: { _id: id } });
+    } catch (error) {
+        logger.error(`ERROR in delete sticky: ${error.message}`);
+        return res.send({ status: false, statusText: error.message });
+    }
+};
+
+/* PUT /api/v2/stickies/reorder  body: { ids: [..], userData } */
+exports.reorderStickies = async (req, res) => {
+    try {
+        const companyId = req.headers['companyid'] || '';
+        const userId = getUserId(req);
+        if (!companyId || !userId) {
+            return res.send({ status: false, statusText: 'companyId and userId are required.' });
+        }
+
+        const check = validateReorder(req.body && req.body.ids);
+        if (!check.valid) {
+            return res.send({ status: false, statusText: check.reason });
+        }
+
+        // Each note is updated only when it belongs to the user (userId in
+        // the filter), so a forged id for someone else's note is a no-op.
+        for (let index = 0; index < check.ids.length; index += 1) {
+            await MongoDbCrudOpration(companyId, {
+                type: SCHEMA_TYPE.STICKIES,
+                data: [
+                    { _id: new mongoose.Types.ObjectId(check.ids[index]), userId },
+                    { $set: { sortIndex: index } },
+                ],
+            }, 'updateOne');
+        }
+
+        return res.send({ status: true, statusText: 'Stickies reordered.' });
+    } catch (error) {
+        logger.error(`ERROR in reorder stickies: ${error.message}`);
+        return res.send({ status: false, statusText: error.message });
+    }
+};

Modules/Stickies/helpers/stickyRules.js

@@ -0,0 +1,89 @@
+// Pure validation/normalization rules for sticky notes — NO I/O, so the
+// jest suite can import this file directly without dragging in mongoose,
+// controllers, or any module that trips the Babel parser on legacy files.
+
+const STICKY_COLORS = ['yellow', 'green', 'blue', 'pink', 'orange', 'purple', 'gray'];
+const DEFAULT_COLOR = 'yellow';
+const MAX_TITLE_LENGTH = 200;
+const MAX_CONTENT_LENGTH = 2000;
+const MAX_NOTES_PER_USER = 200;
+const OBJECT_ID_PATTERN = /^[0-9a-fA-F]{24}$/;
+
+const isObjectId = (value) => OBJECT_ID_PATTERN.test(String(value || ''));
+
+// Notes are plain text rendered as text (never HTML) on the client, so we
+// only bound the length and coerce to a string here — no markup stripping.
+const normalizeContent = (content) => String(content == null ? '' : content);
+
+const normalizeColor = (color) => (STICKY_COLORS.includes(String(color)) ? String(color) : DEFAULT_COLOR);
+
+// Validate a create/update payload. `partial: true` (update) only checks the
+// fields that are present; create requires the note to be within limits.
+const validateStickyPayload = (payload = {}, { partial = false } = {}) => {
+    const out = {};
+
+    if (!partial || payload.title !== undefined) {
+        const title = normalizeContent(payload.title);
+        if (title.length > MAX_TITLE_LENGTH) {
+            return { valid: false, reason: `Title exceeds ${MAX_TITLE_LENGTH} characters.` };
+        }
+        out.title = title;
+    }
+
+    if (!partial || payload.content !== undefined) {
+        const content = normalizeContent(payload.content);
+        if (content.length > MAX_CONTENT_LENGTH) {
+            return { valid: false, reason: `Content exceeds ${MAX_CONTENT_LENGTH} characters.` };
+        }
+        out.content = content;
+    }
+
+    if (!partial || payload.color !== undefined) {
+        out.color = normalizeColor(payload.color);
+    }
+
+    if (payload.isPinned !== undefined) {
+        out.isPinned = Boolean(payload.isPinned);
+    }
+
+    if (payload.sortIndex !== undefined) {
+        const n = Number(payload.sortIndex);
+        if (!Number.isFinite(n)) {
+            return { valid: false, reason: 'sortIndex must be a number.' };
+        }
+        out.sortIndex = n;
+    }
+
+    if (partial && Object.keys(out).length === 0) {
+        return { valid: false, reason: 'No valid fields to update.' };
+    }
+
+    return { valid: true, data: out };
+};
+
+// Validate a reorder request: an array of sticky ids in their new order.
+const validateReorder = (ids) => {
+    if (!Array.isArray(ids) || !ids.length) {
+        return { valid: false, reason: 'ids must be a non-empty array.' };
+    }
+    if (ids.length > MAX_NOTES_PER_USER) {
+        return { valid: false, reason: 'Too many ids.' };
+    }
+    if (!ids.every(isObjectId)) {
+        return { valid: false, reason: 'Every id must be a valid ObjectId.' };
+    }
+    return { valid: true, ids: ids.map(String) };
+};
+
+module.exports = {
+    STICKY_COLORS,
+    DEFAULT_COLOR,
+    MAX_TITLE_LENGTH,
+    MAX_CONTENT_LENGTH,
+    MAX_NOTES_PER_USER,
+    isObjectId,
+    normalizeContent,
+    normalizeColor,
+    validateStickyPayload,
+    validateReorder,
+};

Modules/Stickies/init.js

@@ -0,0 +1,5 @@
+const routes = require('./routes');
+
+exports.init = (app) => {
+    routes.init(app);
+}

Modules/Stickies/routes.js

@@ -0,0 +1,9 @@
+const ctrl = require('./controller');
+
+exports.init = (app) => {
+    app.get('/api/v2/stickies', ctrl.listStickies);
+    app.post('/api/v2/stickies', ctrl.createSticky);
+    app.put('/api/v2/stickies/reorder', ctrl.reorderStickies);
+    app.put('/api/v2/stickies/:id', ctrl.updateSticky);
+    app.delete('/api/v2/stickies/:id', ctrl.deleteSticky);
+}