fix in smtp and split rs files

src/api/access_tokens.rs

@@ -0,0 +1,172 @@
+#[derive(Debug, Deserialize)]
+pub struct AccessTokenRequest {
+    kind: String,
+    slug: String,
+    password: String,
+}
+
+#[derive(Debug, Serialize)]
+pub struct AccessTokenResponse {
+    access_token: String,
+    expires_at: String,
+}
+
+pub async fn create_resource_access_token(
+    State(state): State<SharedState>,
+    Json(payload): Json<AccessTokenRequest>,
+) -> Result<Json<AccessTokenResponse>, ApiError> {
+    let kind = payload.kind.trim();
+    let slug = payload.slug.trim();
+    match kind {
+        "workspace" => {
+            let workspace = db::find_workspace(&state.db, slug)
+                .await?
+                .ok_or_else(ApiError::not_found_workspace)?;
+            if !db::verify_workspace_password(&workspace, Some(payload.password.as_str())) {
+                return Err(ApiError::unauthorized());
+            }
+        }
+        "pad" => {
+            let pad = db::find_pad(&state.db, slug)
+                .await?
+                .ok_or_else(ApiError::not_found_note)?;
+            if !db::verify_pad_password(&pad, Some(payload.password.as_str())) {
+                return Err(ApiError::unauthorized());
+            }
+        }
+        _ => return Err(ApiError::bad_request("Invalid resource kind")),
+    }
+
+    let mut bytes = [0u8; 32];
+    OsRng.fill_bytes(&mut bytes);
+    let token = hex::encode(bytes);
+    let expires_at =
+        (Utc::now() + Duration::days(state.anonymous_access_token_ttl_days)).to_rfc3339();
+    sqlx::query(queries::get(
+        state.db.kind(),
+        queries::RESOURCE_ACCESS_TOKENS_INSERT,
+    ))
+    .bind(hash_access_token(&token))
+    .bind(kind)
+    .bind(slug)
+    .bind(&expires_at)
+    .execute(state.db.pool())
+    .await?;
+    Ok(Json(AccessTokenResponse {
+        access_token: token,
+        expires_at,
+    }))
+}
+
+pub async fn verify_resource_access_token(
+    state: &SharedState,
+    kind: &str,
+    slug: &str,
+    token: Option<&str>,
+) -> Result<bool, ApiError> {
+    let Some(token) = token.map(str::trim).filter(|value| !value.is_empty()) else {
+        return Ok(false);
+    };
+    if crate::auth::resource_permission(state, kind, slug, Some(token))
+        .await
+        .map_err(|error| ApiError::forbidden(&error.message))?
+        .is_some()
+    {
+        return Ok(true);
+    }
+    let count: i64 = sqlx::query_scalar(queries::get(
+        state.db.kind(),
+        queries::RESOURCE_ACCESS_TOKENS_VALID_COUNT,
+    ))
+    .bind(hash_access_token(token))
+    .bind(kind)
+    .bind(slug)
+    .bind(Utc::now().to_rfc3339())
+    .fetch_one(state.db.pool())
+    .await?;
+    Ok(count > 0)
+}
+
+fn hash_access_token(token: &str) -> String {
+    hex::encode(Sha256::digest(token.as_bytes()))
+}
+
+pub struct ApiError {
+    status: StatusCode,
+    message: String,
+}
+
+impl ApiError {
+    fn bad_request(message: &str) -> Self {
+        Self {
+            status: StatusCode::BAD_REQUEST,
+            message: message.into(),
+        }
+    }
+    fn payload_too_large(max_bytes: usize) -> Self {
+        let max_mb = max_bytes / (1024 * 1024);
+        Self {
+            status: StatusCode::PAYLOAD_TOO_LARGE,
+            message: format!("The file may be at most {max_mb} MB"),
+        }
+    }
+    fn not_found_file() -> Self {
+        Self {
+            status: StatusCode::NOT_FOUND,
+            message: "File not found".into(),
+        }
+    }
+    fn unauthorized() -> Self {
+        Self {
+            status: StatusCode::UNAUTHORIZED,
+            message: "Invalid password".into(),
+        }
+    }
+    fn forbidden(message: &str) -> Self {
+        Self {
+            status: StatusCode::FORBIDDEN,
+            message: message.into(),
+        }
+    }
+    fn not_found_workspace() -> Self {
+        Self {
+            status: StatusCode::NOT_FOUND,
+            message: "Workspace not found".into(),
+        }
+    }
+    fn not_found_note() -> Self {
+        Self {
+            status: StatusCode::NOT_FOUND,
+            message: "Note not found".into(),
+        }
+    }
+    fn not_found_revision() -> Self {
+        Self {
+            status: StatusCode::NOT_FOUND,
+            message: "Revision not found".into(),
+        }
+    }
+    fn internal(message: &str) -> Self {
+        Self {
+            status: StatusCode::INTERNAL_SERVER_ERROR,
+            message: message.into(),
+        }
+    }
+}
+
+impl From<sqlx::Error> for ApiError {
+    fn from(error: sqlx::Error) -> Self {
+        tracing::error!(%error, "database error");
+        Self::internal("Database error")
+    }
+}
+
+impl IntoResponse for ApiError {
+    fn into_response(self) -> Response {
+        (
+            self.status,
+            Json(serde_json::json!({"error": self.message})),
+        )
+            .into_response()
+    }
+}

src/api/files.rs

@@ -0,0 +1,498 @@
+pub async fn upload_pad_file(
+    State(state): State<SharedState>,
+    headers: HeaderMap,
+    Path(slug): Path<String>,
+    mut multipart: Multipart,
+) -> Result<Json<serde_json::Value>, ApiError> {
+    let mut password: Option<String> = None;
+    let mut access_token: Option<String> = None;
+    let mut file: Option<(String, Vec<u8>)> = None;
+    while let Some(field) = multipart
+        .next_field()
+        .await
+        .map_err(|_| ApiError::bad_request("Invalid form data"))?
+    {
+        let name = field.name().unwrap_or_default().to_owned();
+        if name == "password" {
+            password = Some(
+                field
+                    .text()
+                    .await
+                    .map_err(|_| ApiError::bad_request("Invalid password"))?,
+            );
+        } else if name == "access_token" {
+            access_token = Some(
+                field
+                    .text()
+                    .await
+                    .map_err(|_| ApiError::bad_request("Invalid access token"))?,
+            );
+        } else if name == "file" {
+            let filename = field.file_name().unwrap_or("plik").to_owned();
+            let bytes = field
+                .bytes()
+                .await
+                .map_err(|_| ApiError::bad_request("Failed to read the file"))?;
+            if bytes.len() > state.upload_max_size_bytes {
+                return Err(ApiError::payload_too_large(state.upload_max_size_bytes));
+            }
+            file = Some((filename, bytes.to_vec()));
+        }
+    }
+    let pad = authorized_pad(
+        &state,
+        &slug,
+        password.as_deref(),
+        access_token.as_deref(),
+        bearer_token(&headers),
+    )
+    .await?;
+    let level = if db::verify_pad_password(&pad, password.as_deref())
+        || (pad.is_private == 0 && pad.password_hash.is_none())
+    {
+        AccessLevel::Write
+    } else {
+        combined_token_access_level(
+            &state,
+            "pad",
+            &slug,
+            access_token.as_deref(),
+            bearer_token(&headers),
+        )
+        .await?
+    };
+    require_write(level)?;
+    let (original, bytes) = file.ok_or_else(|| ApiError::bad_request("No file provided"))?;
+    let safe = sanitize_filename(&original);
+    let file_token = db::pad_file_token(&state.db, pad.id).await?;
+    let mut stored = safe.clone();
+    let mut key = crate::storage::object_key("pads", pad.id, &file_token, &stored);
+    if state
+        .storage
+        .exists(&key)
+        .await
+        .map_err(|_| ApiError::internal("Failed to check file storage"))?
+    {
+        let stem = std::path::Path::new(&safe)
+            .file_stem()
+            .and_then(|v| v.to_str())
+            .unwrap_or("plik");
+        let ext = std::path::Path::new(&safe)
+            .extension()
+            .and_then(|v| v.to_str())
+            .map(|v| format!(".{v}"))
+            .unwrap_or_default();
+        stored = format!("{stem}-{}{}", db::random_suffix(6), ext);
+        key = crate::storage::object_key("pads", pad.id, &file_token, &stored);
+    }
+    let url = format!("/f/{}/{}", file_token, stored);
+    let mime = mime_guess::from_path(&stored)
+        .first_or_octet_stream()
+        .to_string();
+    let cache_control = format!("public, max-age={}", state.file_cache_max_age_seconds);
+    state
+        .storage
+        .put(&key, bytes.clone().into(), &mime, &cache_control)
+        .await
+        .map_err(|_| ApiError::internal("Failed to save the file"))?;
+    db::register_pad_file(&state.db, pad.id, &stored, &url, &mime, bytes.len() as i64).await?;
+    Ok(Json(serde_json::json!({"name": stored, "url": url})))
+}
+
+pub async fn pad_files(
+    State(state): State<SharedState>,
+    headers: HeaderMap,
+    Path(slug): Path<String>,
+    Json(payload): Json<PasswordRequest>,
+) -> Result<Json<Vec<db::NoteFile>>, ApiError> {
+    let pad = authorized_pad(
+        &state,
+        &slug,
+        payload.password.as_deref(),
+        payload.access_token.as_deref(),
+        bearer_token(&headers),
+    )
+    .await?;
+    let mut files = db::list_pad_files(&state.db, pad.id).await?;
+    for file in &mut files {
+        let attached = pad.content.contains(&file.url);
+        if attached != file.is_attached {
+            db::set_pad_file_attached(&state.db, file.id, attached).await?;
+            file.is_attached = attached;
+            file.detached_at = if attached {
+                None
+            } else {
+                Some(chrono::Utc::now().to_rfc3339())
+            };
+        }
+        file.created_at = db::normalize_timestamp(&file.created_at);
+    }
+    Ok(Json(files))
+}
+
+pub async fn delete_pad_file(
+    State(state): State<SharedState>,
+    headers: HeaderMap,
+    Path((slug, file_id)): Path<(String, i64)>,
+    Json(payload): Json<PasswordRequest>,
+) -> Result<Json<serde_json::Value>, ApiError> {
+    let pad = authorized_pad(
+        &state,
+        &slug,
+        payload.password.as_deref(),
+        payload.access_token.as_deref(),
+        bearer_token(&headers),
+    )
+    .await?;
+    if !crate::auth::is_resource_owner(&state, "pad", &pad.slug, bearer_token(&headers))
+        .await
+        .unwrap_or(false)
+    {
+        return Err(ApiError::forbidden("Only the note owner can delete files"));
+    }
+    let file = db::find_pad_file(&state.db, pad.id, file_id)
+        .await?
+        .ok_or_else(ApiError::not_found_file)?;
+    crate::storage::delete_url_file(&state.storage, "pads", pad.id, &file.url)
+        .await
+        .map_err(|_| ApiError::internal("Failed to delete the file"))?;
+    db::delete_pad_file(&state.db, pad.id, file_id).await?;
+    Ok(Json(serde_json::json!({"ok": true})))
+}
+
+pub async fn upload_note_file(
+    State(state): State<SharedState>,
+    headers: HeaderMap,
+    Path((workspace_slug, note_slug)): Path<(String, String)>,
+    mut multipart: Multipart,
+) -> Result<Json<serde_json::Value>, ApiError> {
+    let mut password: Option<String> = None;
+    let mut access_token: Option<String> = None;
+    let mut file: Option<(String, Vec<u8>)> = None;
+    while let Some(field) = multipart
+        .next_field()
+        .await
+        .map_err(|_| ApiError::bad_request("Invalid form data"))?
+    {
+        let name = field.name().unwrap_or_default().to_owned();
+        if name == "password" {
+            password = Some(
+                field
+                    .text()
+                    .await
+                    .map_err(|_| ApiError::bad_request("Invalid password"))?,
+            );
+        } else if name == "access_token" {
+            access_token = Some(
+                field
+                    .text()
+                    .await
+                    .map_err(|_| ApiError::bad_request("Invalid access token"))?,
+            );
+        } else if name == "file" {
+            let filename = field.file_name().unwrap_or("plik").to_owned();
+            let bytes = field
+                .bytes()
+                .await
+                .map_err(|_| ApiError::bad_request("Failed to read the file"))?;
+            if bytes.len() > state.upload_max_size_bytes {
+                return Err(ApiError::payload_too_large(state.upload_max_size_bytes));
+            }
+            file = Some((filename, bytes.to_vec()));
+        }
+    }
+    let (workspace, note) = authorized_note(
+        &state,
+        &workspace_slug,
+        &note_slug,
+        password.as_deref(),
+        access_token.as_deref(),
+        bearer_token(&headers),
+    )
+    .await?;
+
+    let level = if db::verify_workspace_password(&workspace, password.as_deref())
+        || (workspace.is_private == 0 && workspace.password_hash.is_none())
+    {
+        AccessLevel::Write
+    } else {
+        combined_token_access_level(
+            &state,
+            "workspace",
+            &workspace_slug,
+            access_token.as_deref(),
+            bearer_token(&headers),
+        )
+        .await?
+    };
+    require_write(level)?;
+    let (original, bytes) = file.ok_or_else(|| ApiError::bad_request("No file provided"))?;
+    let safe = sanitize_filename(&original);
+    let file_token = db::note_file_token(&state.db, note.id).await?;
+    let mut stored = safe.clone();
+    let mut key = crate::storage::object_key("notes", note.id, &file_token, &stored);
+    if state
+        .storage
+        .exists(&key)
+        .await
+        .map_err(|_| ApiError::internal("Failed to check file storage"))?
+    {
+        let stem = std::path::Path::new(&safe)
+            .file_stem()
+            .and_then(|v| v.to_str())
+            .unwrap_or("plik");
+        let ext = std::path::Path::new(&safe)
+            .extension()
+            .and_then(|v| v.to_str())
+            .map(|v| format!(".{v}"))
+            .unwrap_or_default();
+        stored = format!("{stem}-{}{}", db::random_suffix(6), ext);
+        key = crate::storage::object_key("notes", note.id, &file_token, &stored);
+    }
+    let url = format!("/f/{}/{}", file_token, stored);
+    let mime = mime_guess::from_path(&stored)
+        .first_or_octet_stream()
+        .to_string();
+    let cache_control = format!("public, max-age={}", state.file_cache_max_age_seconds);
+    state
+        .storage
+        .put(&key, bytes.clone().into(), &mime, &cache_control)
+        .await
+        .map_err(|_| ApiError::internal("Failed to save the file"))?;
+    db::register_note_file(&state.db, note.id, &stored, &url, &mime, bytes.len() as i64).await?;
+    Ok(Json(serde_json::json!({"name": stored, "url": url})))
+}
+
+pub async fn delete_note(
+    State(state): State<SharedState>,
+    headers: HeaderMap,
+    Path((workspace_slug, note_slug)): Path<(String, String)>,
+    Json(payload): Json<PasswordRequest>,
+) -> Result<Json<serde_json::Value>, ApiError> {
+    let (workspace, note) = authorized_note(
+        &state,
+        &workspace_slug,
+        &note_slug,
+        payload.password.as_deref(),
+        payload.access_token.as_deref(),
+        bearer_token(&headers),
+    )
+    .await?;
+
+    let level = if db::verify_workspace_password(&workspace, payload.password.as_deref())
+        || (workspace.is_private == 0 && workspace.password_hash.is_none())
+    {
+        AccessLevel::Write
+    } else {
+        combined_token_access_level(
+            &state,
+            "workspace",
+            &workspace_slug,
+            payload.access_token.as_deref(),
+            bearer_token(&headers),
+        )
+        .await?
+    };
+    require_write(level)?;
+    if note.protected {
+        return Err(ApiError::bad_request(
+            "This note is protected and cannot be deleted",
+        ));
+    }
+    for file in db::list_note_files(&state.db, note.id).await? {
+        crate::storage::delete_url_file(&state.storage, "notes", note.id, &file.url)
+            .await
+            .map_err(|_| ApiError::internal("Failed to delete note files"))?;
+    }
+    db::delete_note(&state.db, note.id).await?;
+    Ok(Json(serde_json::json!({"ok": true})))
+}
+
+pub async fn note_files(
+    State(state): State<SharedState>,
+    headers: HeaderMap,
+    Path((workspace_slug, note_slug)): Path<(String, String)>,
+    Json(payload): Json<PasswordRequest>,
+) -> Result<Json<Vec<db::NoteFile>>, ApiError> {
+    let (_workspace, note) = authorized_note(
+        &state,
+        &workspace_slug,
+        &note_slug,
+        payload.password.as_deref(),
+        payload.access_token.as_deref(),
+        bearer_token(&headers),
+    )
+    .await?;
+    let mut files = db::list_note_files(&state.db, note.id).await?;
+    for file in &mut files {
+        let attached = note.content.contains(&file.url);
+        if attached != file.is_attached {
+            db::set_note_file_attached(&state.db, file.id, attached).await?;
+            file.is_attached = attached;
+            file.detached_at = if attached {
+                None
+            } else {
+                Some(chrono::Utc::now().to_rfc3339())
+            };
+        }
+        file.created_at = db::normalize_timestamp(&file.created_at);
+    }
+    Ok(Json(files))
+}
+
+pub async fn delete_note_file(
+    State(state): State<SharedState>,
+    headers: HeaderMap,
+    Path((workspace_slug, note_slug, file_id)): Path<(String, String, i64)>,
+    Json(payload): Json<PasswordRequest>,
+) -> Result<Json<serde_json::Value>, ApiError> {
+    let (workspace, note) = authorized_note(
+        &state,
+        &workspace_slug,
+        &note_slug,
+        payload.password.as_deref(),
+        payload.access_token.as_deref(),
+        bearer_token(&headers),
+    )
+    .await?;
+    let workspace_owner = crate::auth::is_resource_owner(
+        &state,
+        "workspace",
+        &workspace.slug,
+        bearer_token(&headers),
+    )
+    .await
+    .unwrap_or(false);
+    let note_owner = crate::auth::optional_user(&state, &headers)
+        .await
+        .ok()
+        .flatten()
+        .and_then(|user| {
+            note.created_by
+                .as_deref()
+                .map(|creator| creator == user.nickname)
+        })
+        .unwrap_or(false);
+    if !workspace_owner && !note_owner {
+        return Err(ApiError::forbidden(
+            "Only the note owner or workspace owner can delete files",
+        ));
+    }
+    let file = db::find_note_file(&state.db, note.id, file_id)
+        .await?
+        .ok_or_else(ApiError::not_found_file)?;
+    crate::storage::delete_url_file(&state.storage, "notes", note.id, &file.url)
+        .await
+        .map_err(|_| ApiError::internal("Failed to delete the file"))?;
+    db::delete_note_file(&state.db, note.id, file_id).await?;
+    Ok(Json(serde_json::json!({"ok": true})))
+}
+
+pub async fn download_file(
+    State(state): State<SharedState>,
+    Path((token, filename)): Path<(String, String)>,
+) -> Result<Response, ApiError> {
+    serve_token_file(&state, &token, &filename).await
+}
+
+pub async fn download_legacy_file(
+    State(state): State<SharedState>,
+    Path((directory, filename)): Path<(String, String)>,
+) -> Result<Response, ApiError> {
+    let Some((id_part, token)) = directory.split_once('_') else {
+        return Err(ApiError::not_found_file());
+    };
+    let id: i64 = id_part.parse().map_err(|_| ApiError::not_found_file())?;
+    let owner = db::find_file_owner(&state.db, token)
+        .await?
+        .ok_or_else(ApiError::not_found_file)?;
+    if owner.id != id {
+        return Err(ApiError::not_found_file());
+    }
+    serve_token_file(&state, token, &filename).await
+}
+
+async fn serve_token_file(
+    state: &SharedState,
+    token: &str,
+    filename: &str,
+) -> Result<Response, ApiError> {
+    let safe = sanitize_filename(filename);
+    if safe != filename {
+        return Err(ApiError::not_found_file());
+    }
+    let owner = db::find_file_owner(&state.db, token)
+        .await?
+        .ok_or_else(ApiError::not_found_file)?;
+    let kind = match owner.kind {
+        db::FileOwnerKind::Pad => "pads",
+        db::FileOwnerKind::Note => "notes",
+    };
+    let key = crate::storage::object_key(kind, owner.id, token, &safe);
+    let legacy_key = crate::storage::legacy_key(owner.id, token, &safe);
+    let bytes = state
+        .storage
+        .get_local_with_legacy(&key, &legacy_key)
+        .await
+        .map_err(|_| ApiError::not_found_file())?;
+    let mime = mime_guess::from_path(&safe).first_or_octet_stream();
+    let mut response = bytes.into_response();
+    response.headers_mut().insert(
+        header::CONTENT_TYPE,
+        HeaderValue::from_str(mime.as_ref())
+            .unwrap_or_else(|_| HeaderValue::from_static("application/octet-stream")),
+    );
+    response.headers_mut().insert(
+        header::X_CONTENT_TYPE_OPTIONS,
+        HeaderValue::from_static("nosniff"),
+    );
+    response.headers_mut().insert(
+        HeaderName::from_static("x-robots-tag"),
+        HeaderValue::from_static("noindex, nofollow, noarchive, nosnippet"),
+    );
+    response.headers_mut().insert(
+        header::REFERRER_POLICY,
+        HeaderValue::from_static("no-referrer"),
+    );
+    response.headers_mut().insert(
+        header::CACHE_CONTROL,
+        HeaderValue::from_str(&format!(
+            "public, max-age={}",
+            state.file_cache_max_age_seconds
+        ))
+        .expect("valid file cache-control header"),
+    );
+    Ok(response)
+}
+
+fn bearer_token(headers: &HeaderMap) -> Option<&str> {
+    headers
+        .get(header::AUTHORIZATION)
+        .and_then(|value| value.to_str().ok())
+        .and_then(|value| value.strip_prefix("Bearer "))
+        .map(str::trim)
+        .filter(|value| !value.is_empty())
+}
+
+fn sanitize_filename(value: &str) -> String {
+    let name = std::path::Path::new(value)
+        .file_name()
+        .and_then(|v| v.to_str())
+        .unwrap_or("plik");
+    let clean: String = name
+        .chars()
+        .map(|c| {
+            if c.is_ascii_alphanumeric() || matches!(c, '.' | '-' | '_') {
+                c
+            } else {
+                '_'
+            }
+        })
+        .collect();
+    if clean.is_empty() || clean == "." || clean == ".." {
+        "plik".into()
+    } else {
+        clean.chars().take(160).collect()
+    }
+}
+

src/api/mod.rs

@@ -0,0 +1,27 @@
+use axum::{
+    Json,
+    extract::{Multipart, Path, State},
+    http::{HeaderMap, HeaderName, HeaderValue, StatusCode, header},
+    response::{IntoResponse, Response},
+};
+use chrono::{Duration, Utc};
+use rand_core::{OsRng, RngCore};
+use serde::{Deserialize, Serialize};
+use sha2::{Digest, Sha256};
+use slug::slugify;
+
+use crate::{
+    db, queries,
+    state::{NoteUpdate, RoomEvent, SharedState},
+};
+
+const MAX_NAME_LENGTH: usize = 80;
+const MIN_PASSWORD_LENGTH: usize = 8;
+const MAX_PASSWORD_LENGTH: usize = 128;
+const MIN_WORKSPACE_SLUG_LENGTH: usize = 6;
+
+
+include!("workspace_notes.rs");
+include!("pads_public.rs");
+include!("files.rs");
+include!("access_tokens.rs");

src/api/pads_public.rs

@@ -0,0 +1,381 @@
+#[derive(Debug, Deserialize)]
+pub struct CreatePadRequest {
+    name: String,
+    #[serde(default)]
+    password: Option<String>,
+}
+
+#[derive(Debug, Serialize)]
+pub struct CreatePadResponse {
+    slug: String,
+    url: String,
+}
+
+#[derive(Debug, Serialize)]
+pub struct PadInfo {
+    slug: String,
+    title: String,
+    protected: bool,
+    allow_public_task_updates: bool,
+    created_at: String,
+    updated_at: String,
+    can_delete_files: bool,
+    global_color: Option<String>,
+    note_color: Option<String>,
+}
+
+pub async fn create_pad(
+    State(state): State<SharedState>,
+    headers: HeaderMap,
+    Json(payload): Json<CreatePadRequest>,
+) -> Result<(StatusCode, Json<CreatePadResponse>), ApiError> {
+    let title = validate_name(&payload.name, "Note name")?;
+    let password = validate_password(payload.password.as_deref())?;
+    let base = slugify(title);
+    if base.is_empty() {
+        return Err(ApiError::bad_request(
+            "The name cannot be converted into a valid address",
+        ));
+    }
+    let slug = unique_pad_slug(&state, &base).await?;
+    let pad = db::create_pad(&state.db, &slug, title, password).await?;
+    if let Some(user) = crate::auth::optional_user(&state, &headers)
+        .await
+        .map_err(|e| ApiError::forbidden(&e.message))?
+    {
+        sqlx::query(queries::get(state.db.kind(), queries::USER_ATTACH_PAD))
+            .bind(user.id)
+            .bind(&pad.slug)
+            .execute(state.db.pool())
+            .await?;
+    }
+    Ok((
+        StatusCode::CREATED,
+        Json(CreatePadResponse {
+            url: format!("/p/{slug}"),
+            slug,
+        }),
+    ))
+}
+
+pub async fn pad_info(
+    State(state): State<SharedState>,
+    headers: HeaderMap,
+    Path(slug): Path<String>,
+) -> Result<Json<PadInfo>, ApiError> {
+    let pad = db::find_pad(&state.db, &slug)
+        .await?
+        .ok_or_else(ApiError::not_found_note)?;
+    ensure_private_resource_access(
+        &state,
+        "pad",
+        &pad.slug,
+        pad.is_private,
+        bearer_token(&headers),
+    )
+    .await?;
+    let (global_color, note_color) = editor_colors(&state, &headers, "pad", &slug).await?;
+    Ok(Json(PadInfo {
+        slug: pad.slug,
+        title: pad.title,
+        protected: pad.password_hash.is_some(),
+        allow_public_task_updates: db::pad_public_task_updates(&state.db, pad.id).await?,
+        created_at: db::normalize_timestamp(&pad.created_at),
+        updated_at: db::normalize_timestamp(&pad.updated_at),
+        can_delete_files: crate::auth::is_resource_owner(
+            &state,
+            "pad",
+            &slug,
+            bearer_token(&headers),
+        )
+        .await
+        .unwrap_or(false),
+        global_color,
+        note_color,
+    }))
+}
+
+pub async fn pad_editor_color(
+    State(state): State<SharedState>,
+    headers: HeaderMap,
+    Path(slug): Path<String>,
+) -> Result<Json<serde_json::Value>, ApiError> {
+    let (global_color, note_color) = editor_colors(&state, &headers, "pad", &slug).await?;
+    Ok(Json(
+        serde_json::json!({"global_color": global_color, "note_color": note_color}),
+    ))
+}
+
+pub async fn note_editor_color(
+    State(state): State<SharedState>,
+    headers: HeaderMap,
+    Path((workspace_slug, note_slug)): Path<(String, String)>,
+) -> Result<Json<serde_json::Value>, ApiError> {
+    let (global_color, note_color) = editor_colors(
+        &state,
+        &headers,
+        "note",
+        &format!("{}/{}", workspace_slug, note_slug),
+    )
+    .await?;
+    Ok(Json(
+        serde_json::json!({"global_color": global_color, "note_color": note_color}),
+    ))
+}
+
+pub async fn set_pad_editor_color(
+    State(state): State<SharedState>,
+    headers: HeaderMap,
+    Path(slug): Path<String>,
+    Json(payload): Json<EditorColorRequest>,
+) -> Result<Json<serde_json::Value>, ApiError> {
+    save_editor_color(&state, &headers, "pad", &slug, payload.color.as_deref()).await
+}
+
+pub async fn set_note_editor_color(
+    State(state): State<SharedState>,
+    headers: HeaderMap,
+    Path((workspace_slug, note_slug)): Path<(String, String)>,
+    Json(payload): Json<EditorColorRequest>,
+) -> Result<Json<serde_json::Value>, ApiError> {
+    save_editor_color(
+        &state,
+        &headers,
+        "note",
+        &format!("{}/{}", workspace_slug, note_slug),
+        payload.color.as_deref(),
+    )
+    .await
+}
+
+pub async fn publish_pad_page(
+    State(state): State<SharedState>,
+    headers: HeaderMap,
+    Path(slug): Path<String>,
+    Json(payload): Json<PublishRequest>,
+) -> Result<Json<PublishResponse>, ApiError> {
+    let pad = authorized_pad(
+        &state,
+        &slug,
+        payload.password.as_deref(),
+        payload.access_token.as_deref(),
+        bearer_token(&headers),
+    )
+    .await?;
+    let level = if db::verify_pad_password(&pad, payload.password.as_deref())
+        || (pad.is_private == 0 && pad.password_hash.is_none())
+    {
+        AccessLevel::Write
+    } else {
+        combined_token_access_level(
+            &state,
+            "pad",
+            &slug,
+            payload.access_token.as_deref(),
+            bearer_token(&headers),
+        )
+        .await?
+    };
+    require_write(level)?;
+    let token = db::publish_pad(&state.db, pad.id).await?;
+    db::set_pad_public_task_updates(&state.db, pad.id, payload.allow_task_updates).await?;
+    Ok(Json(PublishResponse {
+        url: format!("/s/{token}"),
+    }))
+}
+
+pub async fn publish_note_page(
+    State(state): State<SharedState>,
+    headers: HeaderMap,
+    Path((workspace_slug, note_slug)): Path<(String, String)>,
+    Json(payload): Json<PublishRequest>,
+) -> Result<Json<PublishResponse>, ApiError> {
+    let (workspace, note) = authorized_note(
+        &state,
+        &workspace_slug,
+        &note_slug,
+        payload.password.as_deref(),
+        payload.access_token.as_deref(),
+        bearer_token(&headers),
+    )
+    .await?;
+    let level = if db::verify_workspace_password(&workspace, payload.password.as_deref())
+        || (workspace.is_private == 0 && workspace.password_hash.is_none())
+    {
+        AccessLevel::Write
+    } else {
+        combined_token_access_level(
+            &state,
+            "workspace",
+            &workspace_slug,
+            payload.access_token.as_deref(),
+            bearer_token(&headers),
+        )
+        .await?
+    };
+    require_write(level)?;
+    let token = db::publish_note(&state.db, note.id).await?;
+    db::set_note_public_task_updates(&state.db, note.id, payload.allow_task_updates).await?;
+    Ok(Json(PublishResponse {
+        url: format!("/s/{token}"),
+    }))
+}
+
+pub async fn public_page(
+    State(state): State<SharedState>,
+    Path(token): Path<String>,
+) -> Result<Json<PublicPageResponse>, ApiError> {
+    let page = db::find_published_page(&state.db, &token)
+        .await?
+        .ok_or_else(ApiError::not_found_note)?;
+    Ok(Json(PublicPageResponse {
+        title: page.title,
+        content: page.content,
+        updated_at: db::normalize_timestamp(&page.updated_at),
+        allow_task_updates: page.allow_task_updates,
+    }))
+}
+
+pub async fn update_public_task(
+    State(state): State<SharedState>,
+    Path(token): Path<String>,
+    Json(payload): Json<PublicTaskUpdateRequest>,
+) -> Result<Json<PublicPageResponse>, ApiError> {
+    let current = db::find_published_page(&state.db, &token)
+        .await?
+        .ok_or_else(ApiError::not_found_note)?;
+    if !current.allow_task_updates {
+        return Err(ApiError::forbidden(
+            "Task updates are disabled for this page",
+        ));
+    }
+    let page = db::update_public_task(&state.db, &token, payload.source_line, payload.checked)
+        .await?
+        .ok_or_else(ApiError::not_found_note)?;
+    Ok(Json(PublicPageResponse {
+        title: page.title,
+        content: page.content,
+        updated_at: db::normalize_timestamp(&page.updated_at),
+        allow_task_updates: page.allow_task_updates,
+    }))
+}
+
+pub async fn pad_history(
+    State(state): State<SharedState>,
+    headers: HeaderMap,
+    Path(slug): Path<String>,
+    Json(payload): Json<PasswordRequest>,
+) -> Result<Json<Vec<db::Revision>>, ApiError> {
+    let pad = authorized_pad(
+        &state,
+        &slug,
+        payload.password.as_deref(),
+        payload.access_token.as_deref(),
+        bearer_token(&headers),
+    )
+    .await?;
+    let revisions = db::list_pad_revisions(&state.db, pad.id)
+        .await?
+        .into_iter()
+        .map(|mut revision| {
+            revision.created_at = db::normalize_timestamp(&revision.created_at);
+            revision
+        })
+        .collect();
+    Ok(Json(revisions))
+}
+
+pub async fn pad_restore(
+    State(state): State<SharedState>,
+    headers: HeaderMap,
+    Path(slug): Path<String>,
+    Json(payload): Json<RestoreRequest>,
+) -> Result<Json<serde_json::Value>, ApiError> {
+    let pad = authorized_pad(
+        &state,
+        &slug,
+        payload.password.as_deref(),
+        payload.access_token.as_deref(),
+        bearer_token(&headers),
+    )
+    .await?;
+    let level = if db::verify_pad_password(&pad, payload.password.as_deref())
+        || (pad.is_private == 0 && pad.password_hash.is_none())
+    {
+        AccessLevel::Write
+    } else {
+        combined_token_access_level(
+            &state,
+            "pad",
+            &slug,
+            payload.access_token.as_deref(),
+            bearer_token(&headers),
+        )
+        .await?
+    };
+    require_write(level)?;
+    let content: Option<String> = sqlx::query_scalar(queries::get(state.db.kind(), queries::Q029))
+        .bind(payload.revision_id)
+        .bind(pad.id)
+        .fetch_optional(state.db.pool())
+        .await?;
+    let content = content.ok_or_else(ApiError::not_found_revision)?;
+    let owner_map: Option<String> =
+        sqlx::query_scalar(queries::get(state.db.kind(), queries::Q030))
+            .bind(payload.revision_id)
+            .bind(pad.id)
+            .fetch_optional(state.db.pool())
+            .await?;
+    let owner_map = owner_map.unwrap_or_else(|| "[]".into());
+    let (revision_id, updated_at) =
+        db::save_pad_revision(&state.db, pad.id, &content, Some("restore"), &owner_map).await?;
+    let update = NoteUpdate {
+        content,
+        revision_id,
+        updated_at,
+        author: Some("restore".into()),
+        owner_map,
+    };
+    let _ = state
+        .pad_channel(&slug)
+        .await
+        .send(RoomEvent::Document(update));
+    Ok(Json(serde_json::json!({"ok": true})))
+}
+
+async fn authorized_pad(
+    state: &SharedState,
+    slug: &str,
+    password: Option<&str>,
+    access_token: Option<&str>,
+    bearer: Option<&str>,
+) -> Result<db::Pad, ApiError> {
+    let pad = db::find_pad(&state.db, slug)
+        .await?
+        .ok_or_else(ApiError::not_found_note)?;
+    let token_level = combined_token_access_level(state, "pad", slug, access_token, bearer).await?;
+    if pad.is_private != 0 && token_level == AccessLevel::None {
+        return Err(ApiError::forbidden("This note is private."));
+    }
+    if pad.password_hash.is_some()
+        && !db::verify_pad_password(&pad, password)
+        && token_level == AccessLevel::None
+    {
+        return Err(ApiError::unauthorized());
+    }
+    Ok(pad)
+}
+
+async fn unique_pad_slug(state: &SharedState, base: &str) -> Result<String, ApiError> {
+    if db::find_pad(&state.db, base).await?.is_none() {
+        return Ok(base.to_owned());
+    }
+    for _ in 0..8 {
+        let candidate = format!("{base}-{}", db::random_suffix(6));
+        if db::find_pad(&state.db, &candidate).await?.is_none() {
+            return Ok(candidate);
+        }
+    }
+    Err(ApiError::internal("Failed to create a unique address"))
+}
+

src/api/workspace_notes.rs

@@ -0,0 +1,714 @@
+#[derive(Debug, Serialize)]
+pub struct PublishResponse {
+    url: String,
+}
+
+#[derive(Debug, Serialize)]
+pub struct PublicPageResponse {
+    title: String,
+    content: String,
+    updated_at: String,
+    allow_task_updates: bool,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct CreateWorkspaceRequest {
+    name: String,
+    #[serde(default)]
+    password: Option<String>,
+}
+
+#[derive(Debug, Serialize)]
+pub struct CreateWorkspaceResponse {
+    slug: String,
+    url: String,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct PasswordRequest {
+    #[serde(default)]
+    password: Option<String>,
+    #[serde(default)]
+    access_token: Option<String>,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct PublishRequest {
+    #[serde(default)]
+    password: Option<String>,
+    #[serde(default)]
+    access_token: Option<String>,
+    #[serde(default)]
+    allow_task_updates: bool,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct PublicTaskUpdateRequest {
+    source_line: usize,
+    checked: bool,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct CreateNoteRequest {
+    name: String,
+    #[serde(default)]
+    password: Option<String>,
+    #[serde(default)]
+    access_token: Option<String>,
+    #[serde(default)]
+    protect: bool,
+    #[serde(default)]
+    created_by: Option<String>,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct RestoreRequest {
+    #[serde(default)]
+    password: Option<String>,
+    #[serde(default)]
+    access_token: Option<String>,
+    revision_id: i64,
+}
+
+#[derive(Debug, Serialize)]
+pub struct WorkspaceInfo {
+    slug: String,
+    title: String,
+    protected: bool,
+    created_at: String,
+    updated_at: String,
+}
+
+#[derive(Debug, Serialize)]
+pub struct WorkspaceOpenResponse {
+    workspace: WorkspaceInfo,
+    notes: Vec<NoteListItem>,
+}
+
+#[derive(Debug, Serialize)]
+pub struct NoteListItem {
+    slug: String,
+    title: String,
+    created_at: String,
+    updated_at: String,
+    url: String,
+    protected: bool,
+    created_by: Option<String>,
+}
+
+#[derive(Debug, Serialize)]
+pub struct NoteInfo {
+    workspace_slug: String,
+    workspace_title: String,
+    slug: String,
+    title: String,
+    protected: bool,
+    note_protected: bool,
+    allow_public_task_updates: bool,
+    created_at: String,
+    updated_at: String,
+    can_delete_files: bool,
+    global_color: Option<String>,
+    note_color: Option<String>,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct EditorColorRequest {
+    color: Option<String>,
+}
+
+pub async fn create_workspace(
+    State(state): State<SharedState>,
+    headers: HeaderMap,
+    Json(payload): Json<CreateWorkspaceRequest>,
+) -> Result<(StatusCode, Json<CreateWorkspaceResponse>), ApiError> {
+    let title = validate_name(&payload.name, "Workspace name")?;
+    let password = validate_password(payload.password.as_deref())?;
+    let slug = unique_workspace_slug(&state, title).await?;
+
+    let workspace = db::create_workspace(&state.db, &slug, title, password).await?;
+    if let Some(user) = crate::auth::optional_user(&state, &headers)
+        .await
+        .map_err(|e| ApiError::forbidden(&e.message))?
+    {
+        sqlx::query(queries::get(
+            state.db.kind(),
+            queries::USER_ATTACH_WORKSPACE,
+        ))
+        .bind(user.id)
+        .bind(&workspace.slug)
+        .execute(state.db.pool())
+        .await?;
+    }
+
+    Ok((
+        StatusCode::CREATED,
+        Json(CreateWorkspaceResponse {
+            url: format!("/w/{slug}"),
+            slug,
+        }),
+    ))
+}
+
+pub async fn workspace_info(
+    State(state): State<SharedState>,
+    headers: HeaderMap,
+    Path(workspace_slug): Path<String>,
+) -> Result<Json<WorkspaceInfo>, ApiError> {
+    let workspace = db::find_workspace(&state.db, &workspace_slug)
+        .await?
+        .ok_or_else(ApiError::not_found_workspace)?;
+    ensure_private_resource_access(
+        &state,
+        "workspace",
+        &workspace.slug,
+        workspace.is_private,
+        bearer_token(&headers),
+    )
+    .await?;
+    Ok(Json(workspace_info_from(&workspace)))
+}
+
+pub async fn open_workspace(
+    State(state): State<SharedState>,
+    headers: HeaderMap,
+    Path(workspace_slug): Path<String>,
+    Json(payload): Json<PasswordRequest>,
+) -> Result<Json<WorkspaceOpenResponse>, ApiError> {
+    let workspace = authorized_workspace(
+        &state,
+        &workspace_slug,
+        payload.password.as_deref(),
+        payload.access_token.as_deref(),
+        bearer_token(&headers),
+    )
+    .await?;
+    let notes = db::list_notes(&state.db, workspace.id)
+        .await?
+        .into_iter()
+        .map(|note| NoteListItem {
+            url: format!("/w/{}/n/{}", workspace.slug, note.slug),
+            slug: note.slug,
+            title: note.title,
+            created_at: db::normalize_timestamp(&note.created_at),
+            updated_at: db::normalize_timestamp(&note.updated_at),
+            protected: note.protected,
+            created_by: note.created_by,
+        })
+        .collect();
+
+    Ok(Json(WorkspaceOpenResponse {
+        workspace: workspace_info_from(&workspace),
+        notes,
+    }))
+}
+
+pub async fn create_note(
+    State(state): State<SharedState>,
+    headers: HeaderMap,
+    Path(workspace_slug): Path<String>,
+    Json(payload): Json<CreateNoteRequest>,
+) -> Result<(StatusCode, Json<NoteListItem>), ApiError> {
+    let workspace = authorized_workspace(
+        &state,
+        &workspace_slug,
+        payload.password.as_deref(),
+        payload.access_token.as_deref(),
+        bearer_token(&headers),
+    )
+    .await?;
+    let level = if db::verify_workspace_password(&workspace, payload.password.as_deref())
+        || (workspace.is_private == 0 && workspace.password_hash.is_none())
+    {
+        AccessLevel::Write
+    } else {
+        combined_token_access_level(
+            &state,
+            "workspace",
+            &workspace_slug,
+            payload.access_token.as_deref(),
+            bearer_token(&headers),
+        )
+        .await?
+    };
+    require_write(level)?;
+    let title = validate_name(&payload.name, "Note name")?;
+    let base = slugify(title);
+    if base.is_empty() {
+        return Err(ApiError::bad_request(
+            "The name cannot be converted into a valid address",
+        ));
+    }
+
+    let slug = unique_note_slug(&state, workspace.id, &base).await?;
+    let created_by = payload
+        .created_by
+        .as_deref()
+        .map(str::trim)
+        .filter(|v| !v.is_empty())
+        .map(|v| v.chars().take(40).collect::<String>());
+    let note = db::create_note(
+        &state.db,
+        workspace.id,
+        &slug,
+        title,
+        payload.protect,
+        created_by.as_deref(),
+    )
+    .await?;
+    Ok((
+        StatusCode::CREATED,
+        Json(NoteListItem {
+            url: format!("/w/{workspace_slug}/n/{slug}"),
+            slug: note.slug,
+            title: note.title,
+            created_at: db::normalize_timestamp(&note.created_at),
+            updated_at: db::normalize_timestamp(&note.updated_at),
+            protected: note.protected,
+            created_by: note.created_by,
+        }),
+    ))
+}
+
+fn clean_editor_color(value: Option<&str>) -> Result<Option<String>, ApiError> {
+    let Some(value) = value else {
+        return Ok(None);
+    };
+    let value = value.trim();
+    if value.len() == 7
+        && value.starts_with('#')
+        && value[1..].chars().all(|c| c.is_ascii_hexdigit())
+    {
+        Ok(Some(value.to_ascii_lowercase()))
+    } else {
+        Err(ApiError::bad_request("Invalid editor color"))
+    }
+}
+
+async fn editor_colors(
+    state: &SharedState,
+    headers: &HeaderMap,
+    kind: &str,
+    slug: &str,
+) -> Result<(Option<String>, Option<String>), ApiError> {
+    let Some(user) = crate::auth::optional_user(state, headers)
+        .await
+        .map_err(|e| ApiError::forbidden(&e.message))?
+    else {
+        return Ok((None, None));
+    };
+    let global: Option<String> = sqlx::query_scalar(queries::get(
+        state.db.kind(),
+        queries::AUTH_EDITOR_COLOR_BY_USER,
+    ))
+    .bind(user.id)
+    .fetch_one(state.db.pool())
+    .await?;
+    let note: Option<String> = sqlx::query_scalar(queries::get(
+        state.db.kind(),
+        queries::RESOURCE_COLOR_BY_USER,
+    ))
+    .bind(user.id)
+    .bind(kind)
+    .bind(slug)
+    .fetch_optional(state.db.pool())
+    .await?;
+    Ok((global, note))
+}
+
+async fn save_editor_color(
+    state: &SharedState,
+    headers: &HeaderMap,
+    kind: &str,
+    slug: &str,
+    color: Option<&str>,
+) -> Result<Json<serde_json::Value>, ApiError> {
+    let user = crate::auth::optional_user(state, headers)
+        .await
+        .map_err(|e| ApiError::forbidden(&e.message))?
+        .ok_or_else(|| ApiError::forbidden("Log in to save note colors"))?;
+    let color = clean_editor_color(color)?;
+    let mut tx = state.db.pool().begin().await?;
+    sqlx::query(queries::get(
+        state.db.kind(),
+        queries::RESOURCE_COLOR_DELETE,
+    ))
+    .bind(user.id)
+    .bind(kind)
+    .bind(slug)
+    .execute(&mut *tx)
+    .await?;
+    if let Some(value) = color.as_deref() {
+        sqlx::query(queries::get(
+            state.db.kind(),
+            queries::RESOURCE_COLOR_INSERT,
+        ))
+        .bind(user.id)
+        .bind(kind)
+        .bind(slug)
+        .bind(value)
+        .execute(&mut *tx)
+        .await?;
+    }
+    tx.commit().await?;
+    Ok(Json(serde_json::json!({"color": color})))
+}
+
+pub async fn note_info(
+    State(state): State<SharedState>,
+    headers: HeaderMap,
+    Path((workspace_slug, note_slug)): Path<(String, String)>,
+) -> Result<Json<NoteInfo>, ApiError> {
+    let workspace = db::find_workspace(&state.db, &workspace_slug)
+        .await?
+        .ok_or_else(ApiError::not_found_workspace)?;
+    ensure_private_resource_access(
+        &state,
+        "workspace",
+        &workspace.slug,
+        workspace.is_private,
+        bearer_token(&headers),
+    )
+    .await?;
+    let note = db::find_note(&state.db, workspace.id, &note_slug)
+        .await?
+        .ok_or_else(ApiError::not_found_note)?;
+    let color_slug = format!("{}/{}", workspace_slug, note_slug);
+    let (global_color, note_color) = editor_colors(&state, &headers, "note", &color_slug).await?;
+
+    Ok(Json(NoteInfo {
+        workspace_slug: workspace.slug,
+        workspace_title: workspace.title,
+        slug: note.slug,
+        title: note.title,
+        protected: workspace.password_hash.is_some(),
+        note_protected: note.protected,
+        allow_public_task_updates: db::note_public_task_updates(&state.db, note.id).await?,
+        created_at: db::normalize_timestamp(&note.created_at),
+        updated_at: db::normalize_timestamp(&note.updated_at),
+        can_delete_files: {
+            let workspace_owner = crate::auth::is_resource_owner(
+                &state,
+                "workspace",
+                &workspace_slug,
+                bearer_token(&headers),
+            )
+            .await
+            .unwrap_or(false);
+            let note_owner = crate::auth::optional_user(&state, &headers)
+                .await
+                .ok()
+                .flatten()
+                .and_then(|user| {
+                    note.created_by
+                        .as_deref()
+                        .map(|creator| creator == user.nickname)
+                })
+                .unwrap_or(false);
+            workspace_owner || note_owner
+        },
+        global_color,
+        note_color,
+    }))
+}
+
+pub async fn history(
+    State(state): State<SharedState>,
+    headers: HeaderMap,
+    Path((workspace_slug, note_slug)): Path<(String, String)>,
+    Json(payload): Json<PasswordRequest>,
+) -> Result<Json<Vec<db::Revision>>, ApiError> {
+    let (workspace, note) = authorized_note(
+        &state,
+        &workspace_slug,
+        &note_slug,
+        payload.password.as_deref(),
+        payload.access_token.as_deref(),
+        bearer_token(&headers),
+    )
+    .await?;
+    let _ = workspace;
+    let revisions = db::list_revisions(&state.db, note.id)
+        .await?
+        .into_iter()
+        .map(|mut revision| {
+            revision.created_at = db::normalize_timestamp(&revision.created_at);
+            revision
+        })
+        .collect();
+    Ok(Json(revisions))
+}
+
+pub async fn restore(
+    State(state): State<SharedState>,
+    headers: HeaderMap,
+    Path((workspace_slug, note_slug)): Path<(String, String)>,
+    Json(payload): Json<RestoreRequest>,
+) -> Result<Json<serde_json::Value>, ApiError> {
+    let (workspace, note) = authorized_note(
+        &state,
+        &workspace_slug,
+        &note_slug,
+        payload.password.as_deref(),
+        payload.access_token.as_deref(),
+        bearer_token(&headers),
+    )
+    .await?;
+    let level = if db::verify_workspace_password(&workspace, payload.password.as_deref())
+        || (workspace.is_private == 0 && workspace.password_hash.is_none())
+    {
+        AccessLevel::Write
+    } else {
+        combined_token_access_level(
+            &state,
+            "workspace",
+            &workspace_slug,
+            payload.access_token.as_deref(),
+            bearer_token(&headers),
+        )
+        .await?
+    };
+    require_write(level)?;
+    let content: Option<String> = sqlx::query_scalar(queries::get(state.db.kind(), queries::Q028))
+        .bind(payload.revision_id)
+        .bind(note.id)
+        .fetch_optional(state.db.pool())
+        .await?;
+    let content = content.ok_or_else(ApiError::not_found_revision)?;
+    let (revision_id, updated_at) = db::save_revision(
+        &state.db,
+        note.id,
+        workspace.id,
+        &content,
+        Some("restore"),
+        "[]",
+    )
+    .await?;
+    let update = NoteUpdate {
+        content,
+        revision_id,
+        updated_at,
+        author: Some("restore".into()),
+        owner_map: "[]".into(),
+    };
+    let _ = state
+        .note_channel(&workspace_slug, &note_slug)
+        .await
+        .send(RoomEvent::Document(update));
+    Ok(Json(serde_json::json!({"ok": true})))
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord)]
+pub enum AccessLevel {
+    None,
+    Read,
+    Write,
+}
+
+fn permission_level(permission: Option<&str>) -> AccessLevel {
+    match permission {
+        Some("rw") => AccessLevel::Write,
+        Some("ro") => AccessLevel::Read,
+        _ => AccessLevel::None,
+    }
+}
+
+async fn anonymous_access_token_valid(
+    state: &SharedState,
+    kind: &str,
+    slug: &str,
+    token: Option<&str>,
+) -> Result<bool, ApiError> {
+    let Some(token) = token.map(str::trim).filter(|value| !value.is_empty()) else {
+        return Ok(false);
+    };
+    let count: i64 = sqlx::query_scalar(queries::get(
+        state.db.kind(),
+        queries::RESOURCE_ACCESS_TOKENS_VALID_COUNT,
+    ))
+    .bind(hash_access_token(token))
+    .bind(kind)
+    .bind(slug)
+    .bind(Utc::now().to_rfc3339())
+    .fetch_one(state.db.pool())
+    .await?;
+    Ok(count > 0)
+}
+
+async fn token_access_level(
+    state: &SharedState,
+    kind: &str,
+    slug: &str,
+    token: Option<&str>,
+) -> Result<AccessLevel, ApiError> {
+    let permission = crate::auth::resource_permission(state, kind, slug, token)
+        .await
+        .map_err(|error| ApiError::forbidden(&error.message))?;
+    let level = permission_level(permission.as_deref());
+    if level != AccessLevel::None {
+        return Ok(level);
+    }
+    if anonymous_access_token_valid(state, kind, slug, token).await? {
+        // A server-issued token created after a correct resource password
+        // retains the historical read/write semantics of password access.
+        return Ok(AccessLevel::Write);
+    }
+    Ok(AccessLevel::None)
+}
+
+async fn combined_token_access_level(
+    state: &SharedState,
+    kind: &str,
+    slug: &str,
+    access_token: Option<&str>,
+    bearer: Option<&str>,
+) -> Result<AccessLevel, ApiError> {
+    Ok(std::cmp::max(
+        token_access_level(state, kind, slug, access_token).await?,
+        token_access_level(state, kind, slug, bearer).await?,
+    ))
+}
+
+fn require_write(level: AccessLevel) -> Result<(), ApiError> {
+    if level >= AccessLevel::Write {
+        Ok(())
+    } else {
+        Err(ApiError::forbidden("Read-only access."))
+    }
+}
+
+async fn ensure_private_resource_access(
+    state: &SharedState,
+    kind: &str,
+    slug: &str,
+    is_private: i64,
+    token: Option<&str>,
+) -> Result<(), ApiError> {
+    if is_private == 0 {
+        return Ok(());
+    }
+    if verify_resource_access_token(state, kind, slug, token).await? {
+        return Ok(());
+    }
+    Err(ApiError::forbidden("This resource is private."))
+}
+
+pub async fn authorized_workspace(
+    state: &SharedState,
+    slug: &str,
+    password: Option<&str>,
+    access_token: Option<&str>,
+    bearer: Option<&str>,
+) -> Result<db::Workspace, ApiError> {
+    let workspace = db::find_workspace(&state.db, slug)
+        .await?
+        .ok_or_else(ApiError::not_found_workspace)?;
+    let token_level =
+        combined_token_access_level(state, "workspace", slug, access_token, bearer).await?;
+    if workspace.is_private != 0 && token_level == AccessLevel::None {
+        return Err(ApiError::forbidden("This workspace is private."));
+    }
+    if workspace.password_hash.is_some()
+        && !db::verify_workspace_password(&workspace, password)
+        && token_level == AccessLevel::None
+    {
+        return Err(ApiError::unauthorized());
+    }
+    Ok(workspace)
+}
+
+async fn authorized_note(
+    state: &SharedState,
+    workspace_slug: &str,
+    note_slug: &str,
+    password: Option<&str>,
+    access_token: Option<&str>,
+    bearer: Option<&str>,
+) -> Result<(db::Workspace, db::Note), ApiError> {
+    let workspace =
+        authorized_workspace(state, workspace_slug, password, access_token, bearer).await?;
+    let note = db::find_note(&state.db, workspace.id, note_slug)
+        .await?
+        .ok_or_else(ApiError::not_found_note)?;
+    Ok((workspace, note))
+}
+
+fn workspace_info_from(workspace: &db::Workspace) -> WorkspaceInfo {
+    WorkspaceInfo {
+        slug: workspace.slug.clone(),
+        title: workspace.title.clone(),
+        protected: workspace.password_hash.is_some(),
+        created_at: db::normalize_timestamp(&workspace.created_at),
+        updated_at: db::normalize_timestamp(&workspace.updated_at),
+    }
+}
+
+fn validate_name<'a>(value: &'a str, field: &str) -> Result<&'a str, ApiError> {
+    let value = value.trim();
+    if value.is_empty() || value.chars().count() > MAX_NAME_LENGTH {
+        return Err(ApiError::bad_request(&format!(
+            "{field} must contain between 1 and {MAX_NAME_LENGTH} characters"
+        )));
+    }
+    Ok(value)
+}
+
+fn validate_password(password: Option<&str>) -> Result<Option<&str>, ApiError> {
+    let Some(password) = password.map(str::trim).filter(|value| !value.is_empty()) else {
+        return Ok(None);
+    };
+    let length = password.chars().count();
+    if !(MIN_PASSWORD_LENGTH..=MAX_PASSWORD_LENGTH).contains(&length) {
+        return Err(ApiError::bad_request(
+            "Password must contain between 8 and 128 characters",
+        ));
+    }
+    Ok(Some(password))
+}
+
+async fn unique_workspace_slug(state: &SharedState, title: &str) -> Result<String, ApiError> {
+    let base = slugify(title);
+    if base.is_empty() {
+        return Err(ApiError::bad_request(
+            "The name cannot be converted into a valid address",
+        ));
+    }
+
+    let needs_suffix = base.chars().count() < MIN_WORKSPACE_SLUG_LENGTH
+        || db::find_workspace(&state.db, &base).await?.is_some();
+    if !needs_suffix {
+        return Ok(base);
+    }
+
+    for _ in 0..8 {
+        let candidate = format!("{base}-{}", db::random_suffix(8));
+        if db::find_workspace(&state.db, &candidate).await?.is_none() {
+            return Ok(candidate);
+        }
+    }
+    Err(ApiError::internal("Failed to create a unique address"))
+}
+
+async fn unique_note_slug(
+    state: &SharedState,
+    workspace_id: i64,
+    base: &str,
+) -> Result<String, ApiError> {
+    if db::find_note(&state.db, workspace_id, base)
+        .await?
+        .is_none()
+    {
+        return Ok(base.to_owned());
+    }
+    for _ in 0..8 {
+        let candidate = format!("{base}-{}", db::random_suffix(6));
+        if db::find_note(&state.db, workspace_id, &candidate)
+            .await?
+            .is_none()
+        {
+            return Ok(candidate);
+        }
+    }
+    Err(ApiError::internal("Failed to create a unique address"))
+}
+