From 055895875a7f80e9dc463c1d60fa8958e7c86069 Mon Sep 17 00:00:00 2001 From: david raistrick <1108844+keen99@users.noreply.github.com> Date: Mon, 6 Jul 2026 19:06:52 -0400 Subject: [PATCH] Dev-only bulk delete all campaigns; deleteCollection SQL bulk + gates MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Feature: debug button to wipe all campaigns/encounters/logs in dev builds. Previously bulk delete fetched all logs per campaign, client-filtered, batchWrite — 30s+/campaign. Now SQL bulk DELETE, no fetch. Server (server/db.js, server/index.js): - deleteCollection(collPath, {where}) — SQL DELETE FROM docs WHERE parent=?, optional where-filter. Broadcasts deletions to WS subscribers. - DELETE /api/collection endpoint - Gate: ALLOW_DEV_ENDPOINTS=1 env OR createServer({allowDevEndpoints:true}) - createServer accepts allowDevEndpoints param (tests bypass env) Storage (src/storage/server.js, src/storage/firebase.js): - deleteCollection(path, whereField, whereValue) both adapters - Firebase: fetch matching + batch-delete (firestore no bulk), 500-chunk - Gate: throws if NODE_ENV not development/test - Contract-tested both backends App (src/App.js): - deleteCampaignCascade refactored (reusable, no try/catch split) - handleDeleteAllCampaigns: Promise.all per campaign, deleteCollection for encounters (no fetch), deleteCollection logs once globally, parallel - Button dev-gated (NODE_ENV), confirm modal, hidden when no campaigns Mock fixes (surfaced by new tests): - firebase firestore mock: added where() export, getDocs applies constraints (was returning all docs ignoring query constraints — pre-existing gap) Tests: - contract: deleteCollection (bulk, where-filter, empty) both backends - server-contract: live deleteCollection (bulk, where, 403 gate) - runStorageContract via makeStorage({allowDevEndpoints:true}) Safety (3 layers): - UI button hidden in prod (NODE_ENV gate) - storage method throws in prod (NODE_ENV gate) - HTTP endpoint 403 in prod (env/param gate) --- TODO.md | 9 +- scripts/dev-start.sh | 2 +- server/db.js | 21 ++++- server/index.js | 17 +++- server/tests/server-contract.test.js | 44 ++++++++- src/App.js | 131 +++++++++++++++++++-------- src/__mocks__/firebase/firestore.js | 7 +- src/storage/contract.js | 26 ++++++ src/storage/firebase.js | 21 +++++ src/storage/server.js | 13 +++ 10 files changed, 238 insertions(+), 53 deletions(-) diff --git a/TODO.md b/TODO.md index 5f31564..ea91014 100644 --- a/TODO.md +++ b/TODO.md @@ -9,10 +9,6 @@ Backlog of bugs + long-term items. Milestones live in REWORK_PLAN.md. ### dm list - keep active particpant in view (scroll) not sure good way to do this -### combat.js doesnt seem to actually exercise the add characters. there are no characters in the campaign. only in the encounter.. - -#### debug feature - button to delet all campaigns - only in dev builds - ### FEAT: player display fade transitions for inactive state @@ -22,8 +18,9 @@ not sure good way to do this - DM display keeps inactive participant visible. - Dead state does not imply inactive/disabled. - Dying/stable must not fade out or leave layout holes. -- Dead can keep skull/Dead label; create some good visual cues, no removal. -- +- Dead can keep skull/Dead label; create some good visual cues, no removal - but a cool transition to death would be nice. + + diff --git a/scripts/dev-start.sh b/scripts/dev-start.sh index 7c14975..a4d2577 100755 --- a/scripts/dev-start.sh +++ b/scripts/dev-start.sh @@ -18,7 +18,7 @@ done # backend: better-sqlite3, :4001 if ! lsof -ti :4001 >/dev/null 2>&1; then echo "starting backend :4001..." - DB_PATH=$(pwd)/data/tracker.sqlite PORT=4001 \ + DB_PATH=$(pwd)/data/tracker.sqlite PORT=4001 ALLOW_DEV_ENDPOINTS=1 \ nohup npm run server:dev > tmp/server.log 2>&1 & echo $! > tmp/server.pid else diff --git a/server/db.js b/server/db.js index 14017c4..989bdf5 100644 --- a/server/db.js +++ b/server/db.js @@ -113,6 +113,25 @@ function makeStore(db, broadcast) { return db.prepare('SELECT COUNT(*) AS n FROM docs WHERE parent = ?').get(collPath).n; } + // Bulk delete whole collection or by where-filter. No fetch. SQL knows paths. + // DEV ONLY — guarded at HTTP layer; db fn itself unguarded (server-internal trust). + function deleteCollection(collPath, { where } = {}) { + let sql = 'DELETE FROM docs WHERE parent = ?'; + const params = [collPath]; + const changed = []; + if (where) { + if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(where.field)) throw new Error(`bad where field: ${where.field}`); + if (where.op !== '==') throw new Error(`unsupported where op: ${where.op}`); + sql += ` AND json_extract(data, '$.${where.field}') = ?`; + params.push(where.value); + } + // collect paths+parents for broadcast before delete + const rows = db.prepare('SELECT path, parent FROM docs WHERE parent = ?' + (where ? ` AND json_extract(data, '$.${where.field}') = ?` : '')).all(...params); + const info = db.prepare(sql).run(...params); + if (broadcast) rows.forEach(r => broadcast({ path: r.path, parent: r.parent, deleted: true })); + return info.changes; + } + function batchWrite(ops) { const run = db.transaction((items) => { const changed = []; @@ -151,7 +170,7 @@ function makeStore(db, broadcast) { return result; } - return { getDoc, setDoc, updateDoc, deleteDoc, getCollection, countCollection, batchWrite, transactionalUndo }; + return { getDoc, setDoc, updateDoc, deleteDoc, getCollection, countCollection, deleteCollection, batchWrite, transactionalUndo }; } module.exports = { openDb, parentOf, makeStore }; diff --git a/server/index.js b/server/index.js index f37d285..cb9c8c7 100644 --- a/server/index.js +++ b/server/index.js @@ -11,7 +11,7 @@ const crypto = require('crypto'); const { WebSocketServer } = require('ws'); const { openDb, makeStore } = require('./db'); -function createServer({ dbPath, port, corsOrigin } = {}) { +function createServer({ dbPath, port, corsOrigin, allowDevEndpoints = false } = {}) { const db = openDb(dbPath || './data/tracker.sqlite'); const app = express(); app.use(cors({ origin: corsOrigin || '*' })); @@ -103,6 +103,21 @@ function createServer({ dbPath, port, corsOrigin } = {}) { res.json({ ok: true }); }); + // DELETE /api/collection?path=...&whereField=...&whereValue=... + // Bulk delete whole collection or filtered. No fetch. SQL DELETE. + // DEV ONLY: requires ALLOW_DEV_ENDPOINTS=1 env on server. + app.delete('/api/collection', (req, res) => { + if (!allowDevEndpoints && process.env.ALLOW_DEV_ENDPOINTS !== '1') { + return res.status(403).json({ error: 'bulk delete disabled (dev only)' }); + } + const { path: p, whereField, whereOp, whereValue } = req.query; + if (!p) return res.status(400).json({ error: 'path required' }); + const opts = {}; + if (whereField) opts.where = { field: whereField, op: whereOp || '==', value: whereValue }; + const deleted = store.deleteCollection(p, opts); + res.json({ ok: true, deleted }); + }); + // POST /api/collection body: { path, data } (addDoc: auto-id under collection) app.post('/api/collection', (req, res) => { const { path: collPath, data } = req.body || {}; diff --git a/server/tests/server-contract.test.js b/server/tests/server-contract.test.js index 6a9cac0..1e323c9 100644 --- a/server/tests/server-contract.test.js +++ b/server/tests/server-contract.test.js @@ -16,9 +16,9 @@ const { runStorageContract } = require('../../src/storage/contract'); // Factory: fresh backend (unique sqlite file) + storage pointed at it. // Disposing the storage closes the backend so each test is fully isolated. -async function makeStorage() { +async function makeStorage({ allowDevEndpoints = false } = {}) { const dbPath = path.join(os.tmpdir(), `ws-contract-${Date.now()}-${Math.random().toString(36).slice(2)}.sqlite`); - const handle = createServer({ dbPath, port: 0 }); + const handle = createServer({ dbPath, port: 0, allowDevEndpoints }); await new Promise((resolve, reject) => { handle.server.on('error', reject); handle.server.listen(0, resolve); @@ -31,7 +31,7 @@ async function makeStorage() { return storage; } -runStorageContract('server (live backend)', makeStorage); +runStorageContract('server (live backend)', () => makeStorage({ allowDevEndpoints: true })); describe('server-side query constraints', () => { let storage; @@ -75,3 +75,41 @@ describe('server-side query constraints', () => { expect(res).toEqual({ count: 5 }); }); }); + +describe('DELETE /api/collection (bulk delete)', () => { + let storage; + beforeEach(async () => { + storage = await makeStorage({ allowDevEndpoints: true }); + }); + afterEach((done) => storage.dispose(done)); + + test('deletes all docs in collection, no fetch', async () => { + for (let i = 0; i < 3; i++) await storage.addDoc('logs', { type: 'x', n: i }); + const res = await storage._api('DELETE', '/api/collection', { path: 'logs' }); + expect(res.ok).toBe(true); + expect(res.deleted).toBe(3); + const after = await storage._api('GET', '/api/collection/count', { path: 'logs' }); + expect(after.count).toBe(0); + }); + + test('honors whereField filter', async () => { + await storage.addDoc('logs', { type: 'keep', n: 1 }); + await storage.addDoc('logs', { type: 'drop', n: 2 }); + await storage.addDoc('logs', { type: 'drop', n: 3 }); + const res = await storage._api('DELETE', '/api/collection', + { path: 'logs', whereField: 'type', whereValue: 'drop' }); + expect(res.deleted).toBe(2); + const after = await storage._api('GET', '/api/collection/count', { path: 'logs' }); + expect(after.count).toBe(1); + }); + + test('403 when ALLOW_DEV_ENDPOINTS not set', async () => { + const gated = await makeStorage({ allowDevEndpoints: false }); + let errMsg = null; + try { + await gated._api('DELETE', '/api/collection', { path: 'logs' }); + } catch (e) { errMsg = e.message; } + expect(errMsg).toMatch(/403/); + await new Promise((resolve) => gated.dispose(resolve)); + }); +}); diff --git a/src/App.js b/src/App.js index 0693bf6..f871e2d 100644 --- a/src/App.js +++ b/src/App.js @@ -2313,50 +2313,81 @@ function AdminView({ userId }) { if (!db || !itemToDelete) return; const campaignId = itemToDelete.id; + await deleteCampaignCascade(campaignId); - try { - const encountersPath = getPath.encounters(campaignId); - const encounters = await storage.getCollection(encountersPath); - const deleteOps = encounters.map(e => { - const id = e.id || e.path?.split('/').pop(); - return { type: 'delete', path: `${encountersPath}/${id}` }; - }); - - // cascade: delete logs for every encounter in this campaign - const allLogs = await storage.getCollection(getPath.logs()); - const encPaths = new Set(encounters.map(e => `${encountersPath}/${e.id || e.path?.split('/').pop()}`)); - const encIds = new Set(encounters.map(e => e.id || e.path?.split('/').pop())); - const logOps = allLogs - .filter(l => - (l.encounterId && encIds.has(l.encounterId)) || - (l.encounterPath && [...encPaths].some(p => l.encounterPath.includes(p))) - ) - .map(l => ({ - type: 'delete', - path: `${getPath.logs()}/${l.id || l.path?.split('/').pop()}`, - })); - - if (deleteOps.length > 0 || logOps.length > 0) { - await storage.batchWrite([...deleteOps, ...logOps]); - } - - await storage.deleteDoc(getPath.campaign(campaignId)); - - if (selectedCampaignId === campaignId) { - setSelectedCampaignId(null); - } - - const activeDisplay = await storage.getDoc(getPath.activeDisplay()); - - if (activeDisplay && activeDisplay.activeCampaignId === campaignId) { - await storage.updateDoc(getPath.activeDisplay(), { activeCampaignId: null, activeEncounterId: null }); - } - } catch (err) { - console.error("Error deleting campaign:", err); - showToast("Failed to delete campaign. Please try again."); } + if (selectedCampaignId === campaignId) { + setSelectedCampaignId(null); + } setShowDeleteConfirm(false); setItemToDelete(null); + showToast('Campaign deleted.'); + }; + + // Cascade delete: encounters + logs + display + campaign doc. + const deleteCampaignCascade = async (campaignId) => { + const encountersPath = getPath.encounters(campaignId); + const encounters = await storage.getCollection(encountersPath); + const deleteOps = encounters.map(e => { + const id = e.id || e.path?.split('/').pop(); + return { type: 'delete', path: `${encountersPath}/${id}` }; + }); + + const allLogs = await storage.getCollection(getPath.logs()); + const encPaths = new Set(encounters.map(e => `${encountersPath}/${e.id || e.path?.split('/').pop()}`)); + const encIds = new Set(encounters.map(e => e.id || e.path?.split('/').pop())); + const logOps = allLogs + .filter(l => + (l.encounterId && encIds.has(l.encounterId)) || + (l.encounterPath && [...encPaths].some(p => l.encounterPath.includes(p))) + ) + .map(l => ({ + type: 'delete', + path: `${getPath.logs()}/${l.id || l.path?.split('/').pop()}`, + })); + + if (deleteOps.length > 0 || logOps.length > 0) { + await storage.batchWrite([...deleteOps, ...logOps]); + } + + await storage.deleteDoc(getPath.campaign(campaignId)); + + const activeDisplay = await storage.getDoc(getPath.activeDisplay()); + if (activeDisplay && activeDisplay.activeCampaignId === campaignId) { + await storage.updateDoc(getPath.activeDisplay(), { activeCampaignId: null, activeEncounterId: null }); + } + }; + + // Dev-only: wipe all campaigns + encounters + logs. Irreversible. + // Uses deleteCollection (SQL bulk DELETE, no fetch). Parallel per campaign. + const [showDeleteAllConfirm, setShowDeleteAllConfirm] = useState(false); + const handleDeleteAllCampaigns = async () => { + if (!db) return; + try { + const all = await storage.getCollection(getPath.campaigns()); + await Promise.all(all.map(async (c) => { + const cid = c.id || c.path?.split('/').pop(); + // bulk-delete all encounters under this campaign (SQL DELETE, no fetch) + if (storage.deleteCollection) { + await storage.deleteCollection(getPath.encounters(cid)); + } + await storage.deleteDoc(getPath.campaign(cid)); + })); + // nuke all logs in one shot (orphans acceptable in dev; logs span campaigns) + if (storage.deleteCollection) { + await storage.deleteCollection(getPath.logs()); + } + const activeDisplay = await storage.getDoc(getPath.activeDisplay()); + if (activeDisplay && activeDisplay.activeCampaignId) { + await storage.updateDoc(getPath.activeDisplay(), { activeCampaignId: null, activeEncounterId: null }); + } + setSelectedCampaignId(null); + setShowDeleteAllConfirm(false); + showToast(`Deleted ${all.length} campaign(s).`); + } catch (err) { + console.error('Error deleting all campaigns:', err); + showToast('Failed to delete all campaigns.'); + } }; const selectedCampaign = campaignsWithDetails.find(c => c.id === selectedCampaignId); @@ -2495,6 +2526,26 @@ function AdminView({ userId }) { title="Delete Campaign?" message={`Are you sure you want to delete the campaign "${itemToDelete?.name}" and all its encounters? This action cannot be undone.`} /> + + {process.env.NODE_ENV === 'development' && campaignsWithDetails.length > 0 && ( +
+ +
+ )} + + setShowDeleteAllConfirm(false)} + onConfirm={handleDeleteAllCampaigns} + title="Delete ALL Campaigns?" + message="DEV ONLY: This permanently deletes EVERY campaign, all encounters, and all logs. Cannot be undone. Are you absolutely sure?" + /> ); } diff --git a/src/__mocks__/firebase/firestore.js b/src/__mocks__/firebase/firestore.js index 3426666..9ba0654 100644 --- a/src/__mocks__/firebase/firestore.js +++ b/src/__mocks__/firebase/firestore.js @@ -13,6 +13,7 @@ export function doc(db, path, extra) { } export function collection(db, path) { return ref(path); } export function query(refOrColl, ...constraints) { return { ref: refOrColl, constraints }; } +export function where(field, op, value) { return { __type: 'where', field, op, value }; } export function orderBy(field, dir) { return { __type: 'orderBy', field, dir }; } export function limit(n) { return { __type: 'limit', n }; } @@ -67,7 +68,9 @@ export async function getDoc(docRef) { } export async function getDocs(collRefOrQuery) { const collPath = collRefOrQuery.ref ? collRefOrQuery.ref.path : collRefOrQuery.path; - const docs = MOCK_DB.collection(collPath); + let docs = MOCK_DB.collection(collPath); + const constraints = collRefOrQuery.constraints || []; + docs = applyConstraints(docs, constraints); return { docs: docs.map(d => ({ id: d.id, data: () => d.data, ref: { path: `${collPath}/${d.id}` } })) }; } @@ -118,6 +121,8 @@ function applyConstraints(docs, constraints) { }); } else if (c.__type === 'limit') { out = out.slice(0, c.n); + } else if (c.__type === 'where') { + out = out.filter(d => d.data[c.field] === c.value); } } return out; diff --git a/src/storage/contract.js b/src/storage/contract.js index 0407740..d320223 100644 --- a/src/storage/contract.js +++ b/src/storage/contract.js @@ -209,6 +209,32 @@ function runStorageContract(name, factory) { }); }); + describe('deleteCollection', () => { + test('deletes all docs in collection', async () => { + await storage.addDoc('logs', { type: 'a' }); + await storage.addDoc('logs', { type: 'b' }); + const deleted = await storage.deleteCollection('logs'); + expect(deleted).toBe(2); + const remaining = await storage.getCollection('logs'); + expect(remaining).toHaveLength(0); + }); + + test('honors whereField filter', async () => { + await storage.addDoc('logs', { type: 'keep', n: 1 }); + await storage.addDoc('logs', { type: 'drop', n: 2 }); + await storage.addDoc('logs', { type: 'drop', n: 3 }); + const deleted = await storage.deleteCollection('logs', 'type', 'drop'); + expect(deleted).toBe(2); + const remaining = await storage.getCollection('logs'); + expect(remaining).toHaveLength(1); + }); + + test('empty collection returns 0', async () => { + const deleted = await storage.deleteCollection('logs'); + expect(deleted).toBe(0); + }); + }); + describe('subscribeDoc', () => { test('fires cb immediately with current value', async () => { await storage.setDoc('campaigns/a', { name: 'Alpha' }); diff --git a/src/storage/firebase.js b/src/storage/firebase.js index 4315224..939863b 100644 --- a/src/storage/firebase.js +++ b/src/storage/firebase.js @@ -130,6 +130,27 @@ export function createFirebaseStorage() { await batch.commit(); }, + // Bulk delete collection (optionally where-filtered). Firestore has no + // single bulk-by-path op: fetch matching docs, batch-delete in chunks + // of 500 (firestore batch limit). DEV ONLY. + async deleteCollection(path, whereField, whereValue) { + if (process.env.NODE_ENV !== 'development' && process.env.NODE_ENV !== 'test') { + throw new Error('deleteCollection: dev only'); + } + let q = collection(db, path); + if (whereField) q = query(q, where(whereField, '==', whereValue)); + const snap = await getDocsReal(q); + const docs = snap.docs; + let count = 0; + for (let i = 0; i < docs.length; i += 500) { + const batch = writeBatch(db); + for (const d of docs.slice(i, i + 500)) batch.delete(d.ref); + await batch.commit(); + count += Math.min(500, docs.length - i); + } + return count; + }, + // Transactional undo via batch (atomic in firestore). Apply updates + // flip undone flag in single commit. async undo({ logPath, undo, redo = false }) { diff --git a/src/storage/server.js b/src/storage/server.js index 2ca28bb..4708f11 100644 --- a/src/storage/server.js +++ b/src/storage/server.js @@ -204,6 +204,19 @@ function createServerStorage({ baseUrl, realtimeUrl } = {}) { await api('DELETE', '/api/doc', { path: p }); }, + // Bulk delete collection (optionally where-filtered). No fetch. SQL DELETE. + // DEV ONLY. Method ships in prod build but throws if not dev. + async deleteCollection(rawCollPath, whereField, whereValue) { + if (process.env.NODE_ENV !== 'development' && process.env.NODE_ENV !== 'test') { + throw new Error('deleteCollection: dev only'); + } + const p = norm(rawCollPath); + const query = { path: p }; + if (whereField) { query.whereField = whereField; query.whereValue = whereValue; } + const res = await api('DELETE', '/api/collection', query); + return res.deleted; + }, + async addDoc(rawCollPath, data) { const p = norm(rawCollPath); const res = await api('POST', '/api/collection', null, { path: p, data });