Merge branch 'develop' into feature/grafana-dashboard

apps/server/package.json

@@ -85,10 +85,10 @@
     "jsdom": "26.1.0",
     "marked": "15.0.12",
     "mime-types": "3.0.1",
-    "multer": "2.0.0",
+    "multer": "2.0.1",
     "normalize-strings": "1.1.1",
     "ollama": "0.5.16",
-    "openai": "5.0.1",
+    "openai": "5.1.0",
     "rand-token": "1.0.1",
     "safe-compare": "1.1.4",
     "sanitize-filename": "1.6.3",

apps/server/spec/etapi/api-metrics.spec.ts

@@ -0,0 +1,48 @@
+import { Application } from "express";
+import { beforeAll, describe, expect, it } from "vitest";
+import buildApp from "../../src/app.js";
+import supertest from "supertest";
+
+let app: Application;
+let token: string;
+
+// TODO: This is an API test, not ETAPI.
+
+describe("api/metrics", () => {
+    beforeAll(async () => {
+        app = await buildApp();
+    });
+
+    it("returns Prometheus format by default", async () => {
+        const response = await supertest(app)
+            .get("/api/metrics")
+            .expect(200);
+        expect(response.headers["content-type"]).toContain("text/plain");
+        expect(response.text).toContain("trilium_info");
+        expect(response.text).toContain("trilium_notes_total");
+        expect(response.text).toContain("# HELP");
+        expect(response.text).toContain("# TYPE");
+    });
+
+    it("returns JSON when requested", async() => {
+        const response = await supertest(app)
+            .get("/api/metrics?format=json")
+            .expect(200);
+        expect(response.headers["content-type"]).toContain("application/json");
+        expect(response.body.version).toBeTruthy();
+        expect(response.body.database).toBeTruthy();
+        expect(response.body.timestamp).toBeTruthy();
+        expect(response.body.database.totalNotes).toBeTypeOf("number");
+        expect(response.body.database.activeNotes).toBeTypeOf("number");
+        expect(response.body.noteTypes).toBeTruthy();
+        expect(response.body.attachmentTypes).toBeTruthy();
+        expect(response.body.statistics).toBeTruthy();
+    });
+
+    it("returns error on invalid format", async() => {
+        const response = await supertest(app)
+            .get("/api/metrics?format=xml")
+            .expect(500);
+        expect(response.body.message).toContain("prometheus");
+    });
+});

apps/server/spec/etapi/app-info.spec.ts

@@ -0,0 +1,20 @@
+import { Application } from "express";
+import { beforeAll, describe, expect, it } from "vitest";
+import buildApp from "../../src/app.js";
+import supertest from "supertest";
+
+let app: Application;
+let token: string;
+
+describe("etapi/app-info", () => {
+    beforeAll(async () => {
+        app = await buildApp();
+    });
+
+    it("retrieves correct app info", async () => {
+        const response = await supertest(app)
+            .get("/etapi/app-info")
+            .expect(200);
+        expect(response.body.clipperProtocolVersion).toBe("1.0");
+    });
+});

apps/server/spec/etapi/attachment-content.spec.ts

@@ -0,0 +1,64 @@
+import { Application } from "express";
+import { beforeAll, describe, expect, it } from "vitest";
+import supertest from "supertest";
+import { createNote, login } from "./utils.js";
+import config from "../../src/services/config.js";
+
+let app: Application;
+let token: string;
+
+const USER = "etapi";
+let createdNoteId: string;
+let createdAttachmentId: string;
+
+describe("etapi/attachment-content", () => {
+    beforeAll(async () => {
+        config.General.noAuthentication = false;
+        const buildApp = (await (import("../../src/app.js"))).default;
+        app = await buildApp();
+        token = await login(app);
+
+        createdNoteId = await createNote(app, token);
+
+        // Create an attachment
+        const response = await supertest(app)
+            .post(`/etapi/attachments`)
+            .auth(USER, token, { "type": "basic"})
+            .send({
+                "ownerId": createdNoteId,
+                "role": "file",
+                "mime": "text/plain",
+                "title": "my attachment",
+                "content": "text"
+            });
+        createdAttachmentId = response.body.attachmentId;
+        expect(createdAttachmentId).toBeTruthy();
+    });
+
+    it("changes attachment content", async () => {
+        const text = "Changed content";
+        await supertest(app)
+            .put(`/etapi/attachments/${createdAttachmentId}/content`)
+            .auth(USER, token, { "type": "basic"})
+            .set("Content-Type", "text/plain")
+            .send(text)
+            .expect(204);
+
+        // Ensure it got changed.
+        const response = await supertest(app)
+            .get(`/etapi/attachments/${createdAttachmentId}/content`)
+            .auth(USER, token, { "type": "basic"});
+        expect(response.text).toStrictEqual(text);
+    });
+
+    it("supports binary content", async() => {
+        await supertest(app)
+            .put(`/etapi/attachments/${createdAttachmentId}/content`)
+            .auth(USER, token, { "type": "basic"})
+            .set("Content-Type", "application/octet-stream")
+            .set("Content-Transfer-Encoding", "binary")
+            .send(Buffer.from("Hello world"))
+            .expect(204);
+    });
+
+});

apps/server/spec/etapi/basic-auth.spec.ts

@@ -0,0 +1,54 @@
+import { Application } from "express";
+import { beforeAll, describe, expect, it } from "vitest";
+import supertest from "supertest";
+import { login } from "./utils.js";
+import config from "../../src/services/config.js";
+
+let app: Application;
+let token: string;
+
+const USER = "etapi";
+const URL = "/etapi/notes/root";
+
+describe("basic-auth", () => {
+    beforeAll(async () => {
+        config.General.noAuthentication = false;
+        const buildApp = (await (import("../../src/app.js"))).default;
+        app = await buildApp();
+        token = await login(app);
+    });
+
+    it("auth token works", async () => {
+        const response = await supertest(app)
+            .get(URL)
+            .auth(USER, token, { "type": "basic"})
+            .expect(200);
+    });
+
+    it("rejects wrong password", async () => {
+        const response = await supertest(app)
+            .get(URL)
+            .auth(USER, "wrong", { "type": "basic"})
+            .expect(401);
+    });
+
+    it("rejects wrong user", async () => {
+        const response = await supertest(app)
+            .get(URL)
+            .auth("wrong", token, { "type": "basic"})
+            .expect(401);
+    });
+
+    it("logs out", async () => {
+        await supertest(app)
+            .post("/etapi/auth/logout")
+            .auth(USER, token, { "type": "basic"})
+            .expect(204);
+
+        // Ensure we can't access it anymore
+        await supertest(app)
+            .get("/etapi/notes/root")
+            .auth(USER, token, { "type": "basic"})
+            .expect(401);
+    });
+});

apps/server/spec/etapi/create-backup.spec.ts

@@ -0,0 +1,26 @@
+import { Application } from "express";
+import { beforeAll, describe, expect, it } from "vitest";
+import supertest from "supertest";
+import { login } from "./utils.js";
+import config from "../../src/services/config.js";
+
+let app: Application;
+let token: string;
+
+const USER = "etapi";
+
+describe("etapi/backup", () => {
+    beforeAll(async () => {
+        config.General.noAuthentication = false;
+        const buildApp = (await (import("../../src/app.js"))).default;
+        app = await buildApp();
+        token = await login(app);
+    });
+
+    it("backup works", async () => {
+        const response = await supertest(app)
+            .put("/etapi/backup/etapi_test")
+            .auth(USER, token, { "type": "basic"})
+            .expect(204);
+    });
+});

apps/server/spec/etapi/create-entities.spec.ts

@@ -0,0 +1,178 @@
+import { Application } from "express";
+import { beforeAll, describe, expect, it } from "vitest";
+import supertest from "supertest";
+import { login } from "./utils.js";
+import config from "../../src/services/config.js";
+import { randomInt } from "crypto";
+
+let app: Application;
+let token: string;
+let createdNoteId: string;
+let createdBranchId: string;
+let clonedBranchId: string;
+let createdAttributeId: string;
+let createdAttachmentId: string;
+
+const USER = "etapi";
+
+describe("etapi/create-entities", () => {
+    beforeAll(async () => {
+        config.General.noAuthentication = false;
+        const buildApp = (await (import("../../src/app.js"))).default;
+        app = await buildApp();
+        token = await login(app);
+
+        ({ createdNoteId, createdBranchId } = await createNote());
+        clonedBranchId = await createClone();
+        createdAttributeId = await createAttribute();
+        createdAttachmentId = await createAttachment();
+    });
+
+    it("returns note info", async () => {
+        const response = await supertest(app)
+            .get(`/etapi/notes/${createdNoteId}`)
+            .auth(USER, token, { "type": "basic"})
+            .send({
+                noteId: createdNoteId,
+                parentNoteId: "_hidden"
+            })
+            .expect(200);
+        expect(response.body).toMatchObject({
+            noteId: createdNoteId,
+            title: "Hello"
+        });
+        expect(new Set<string>(response.body.parentBranchIds))
+            .toStrictEqual(new Set<string>([ clonedBranchId, createdBranchId ]));
+    });
+
+    it("obtains note content", async () => {
+        await supertest(app)
+            .get(`/etapi/notes/${createdNoteId}/content`)
+            .auth(USER, token, { "type": "basic"})
+            .expect(200)
+            .expect("Hi there!");
+    });
+
+    it("obtains created branch information", async () => {
+        const response = await supertest(app)
+            .get(`/etapi/branches/${createdBranchId}`)
+            .auth(USER, token, { "type": "basic"})
+            .expect(200);
+        expect(response.body).toMatchObject({
+            branchId: createdBranchId,
+            parentNoteId: "root"
+        });
+    });
+
+    it("obtains cloned branch information", async () => {
+        const response = await supertest(app)
+            .get(`/etapi/branches/${clonedBranchId}`)
+            .auth(USER, token, { "type": "basic"})
+            .expect(200);
+        expect(response.body).toMatchObject({
+            branchId: clonedBranchId,
+            parentNoteId: "_hidden"
+        });
+    });
+
+    it("obtains attribute information", async () => {
+        const response = await supertest(app)
+            .get(`/etapi/attributes/${createdAttributeId}`)
+            .auth(USER, token, { "type": "basic"})
+            .expect(200);
+        expect(response.body.attributeId).toStrictEqual(createdAttributeId);
+    });
+
+    it("obtains attachment information", async () => {
+        const response = await supertest(app)
+            .get(`/etapi/attachments/${createdAttachmentId}`)
+            .auth(USER, token, { "type": "basic"})
+            .expect(200);
+        expect(response.body.attachmentId).toStrictEqual(createdAttachmentId);
+        expect(response.body).toMatchObject({
+            role: "file",
+            mime: "plain/text",
+            title: "my attachment"
+        });
+    });
+});
+
+async function createNote() {
+    const noteId = `forcedId${randomInt(1000)}`;
+    const response = await supertest(app)
+        .post("/etapi/create-note")
+        .auth(USER, token, { "type": "basic"})
+        .send({
+            "noteId": noteId,
+            "parentNoteId": "root",
+            "title": "Hello",
+            "type": "text",
+            "content": "Hi there!",
+            "dateCreated": "2023-08-21 23:38:51.123+0200",
+            "utcDateCreated": "2023-08-21 23:38:51.123Z"
+        })
+        .expect(201);
+    expect(response.body.note.noteId).toStrictEqual(noteId);
+    expect(response.body).toMatchObject({
+        note: {
+            noteId,
+            title: "Hello",
+            dateCreated: "2023-08-21 23:38:51.123+0200",
+            utcDateCreated: "2023-08-21 23:38:51.123Z"
+        },
+        branch: {
+            parentNoteId: "root"
+        }
+    });
+
+    return {
+        createdNoteId: response.body.note.noteId,
+        createdBranchId: response.body.branch.branchId
+    };
+}
+
+async function createClone() {
+    const response = await supertest(app)
+        .post("/etapi/branches")
+        .auth(USER, token, { "type": "basic"})
+        .send({
+            noteId: createdNoteId,
+            parentNoteId: "_hidden"
+        })
+        .expect(201);
+    expect(response.body.parentNoteId).toStrictEqual("_hidden");
+    return response.body.branchId;
+}
+
+async function createAttribute() {
+    const attributeId = `forcedId${randomInt(1000)}`;
+    const response = await supertest(app)
+        .post("/etapi/attributes")
+        .auth(USER, token, { "type": "basic"})
+        .send({
+            "attributeId": attributeId,
+            "noteId": createdNoteId,
+            "type": "label",
+            "name": "mylabel",
+            "value": "val",
+            "isInheritable": true
+        })
+        .expect(201);
+    expect(response.body.attributeId).toStrictEqual(attributeId);
+    return response.body.attributeId;
+}
+
+async function createAttachment() {
+    const response = await supertest(app)
+        .post("/etapi/attachments")
+        .auth(USER, token, { "type": "basic"})
+        .send({
+            "ownerId": createdNoteId,
+            "role": "file",
+            "mime": "plain/text",
+            "title": "my attachment",
+            "content": "my text"
+        })
+        .expect(201);
+    return response.body.attachmentId;
+}

apps/server/spec/etapi/delete-entities.spec.ts

@@ -0,0 +1,172 @@
+import { Application } from "express";
+import { beforeAll, beforeEach, describe, expect, it } from "vitest";
+import supertest from "supertest";
+import { login } from "./utils.js";
+import config from "../../src/services/config.js";
+import { randomInt } from "crypto";
+
+let app: Application;
+let token: string;
+let createdNoteId: string;
+let createdBranchId: string;
+
+const USER = "etapi";
+
+type EntityType = "attachments" | "attributes" | "branches" | "notes";
+
+describe("etapi/delete-entities", () => {
+    beforeAll(async () => {
+        config.General.noAuthentication = false;
+        const buildApp = (await (import("../../src/app.js"))).default;
+        app = await buildApp();
+        token = await login(app);
+    });
+
+    beforeEach(async () => {
+        ({ createdNoteId, createdBranchId } = await createNote());
+    });
+
+    it("deletes attachment", async () => {
+        const attachmentId = await createAttachment();
+        await deleteEntity("attachments", attachmentId);
+        await expectNotFound("attachments", attachmentId);
+    });
+
+    it("deletes attribute", async () => {
+        const attributeId = await createAttribute();
+        await deleteEntity("attributes", attributeId);
+        await expectNotFound("attributes", attributeId);
+    });
+
+    it("deletes cloned branch", async () => {
+        const clonedBranchId = await createClone();
+
+        await expectFound("branches", createdBranchId);
+        await expectFound("branches", clonedBranchId);
+
+        await deleteEntity("branches", createdBranchId);
+        await expectNotFound("branches", createdBranchId);
+
+        await expectFound("branches", clonedBranchId);
+        await expectFound("notes", createdNoteId);
+    });
+
+    it("deletes note with all branches", async () => {
+        const attributeId = await createAttribute();
+
+        const clonedBranchId = await createClone();
+
+        await expectFound("notes", createdNoteId);
+        await expectFound("branches", createdBranchId);
+        await expectFound("branches", clonedBranchId);
+        await expectFound("attributes", attributeId);
+        await deleteEntity("notes", createdNoteId);
+
+        await expectNotFound("branches", createdBranchId);
+        await expectNotFound("branches", clonedBranchId);
+        await expectNotFound("notes", createdNoteId);
+        await expectNotFound("attributes", attributeId);
+    });
+});
+
+async function createNote() {
+    const noteId = `forcedId${randomInt(1000)}`;
+    const response = await supertest(app)
+        .post("/etapi/create-note")
+        .auth(USER, token, { "type": "basic"})
+        .send({
+            "noteId": noteId,
+            "parentNoteId": "root",
+            "title": "Hello",
+            "type": "text",
+            "content": "Hi there!",
+            "dateCreated": "2023-08-21 23:38:51.123+0200",
+            "utcDateCreated": "2023-08-21 23:38:51.123Z"
+        })
+        .expect(201);
+    expect(response.body.note.noteId).toStrictEqual(noteId);
+
+    return {
+        createdNoteId: response.body.note.noteId,
+        createdBranchId: response.body.branch.branchId
+    };
+}
+
+async function createClone() {
+    const response = await supertest(app)
+        .post("/etapi/branches")
+        .auth(USER, token, { "type": "basic"})
+        .send({
+            noteId: createdNoteId,
+            parentNoteId: "_hidden"
+        })
+        .expect(201);
+    expect(response.body.parentNoteId).toStrictEqual("_hidden");
+    return response.body.branchId;
+}
+
+async function createAttribute() {
+    const attributeId = `forcedId${randomInt(1000)}`;
+    const response = await supertest(app)
+        .post("/etapi/attributes")
+        .auth(USER, token, { "type": "basic"})
+        .send({
+            "attributeId": attributeId,
+            "noteId": createdNoteId,
+            "type": "label",
+            "name": "mylabel",
+            "value": "val",
+            "isInheritable": true
+        })
+        .expect(201);
+    expect(response.body.attributeId).toStrictEqual(attributeId);
+    return response.body.attributeId;
+}
+
+async function createAttachment() {
+    const response = await supertest(app)
+        .post("/etapi/attachments")
+        .auth(USER, token, { "type": "basic"})
+        .send({
+            "ownerId": createdNoteId,
+            "role": "file",
+            "mime": "plain/text",
+            "title": "my attachment",
+            "content": "my text"
+        })
+        .expect(201);
+    return response.body.attachmentId;
+}
+
+async function deleteEntity(entity: EntityType, id: string) {
+    // Delete twice to test idempotency.
+    for (let i=0; i < 2; i++) {
+        await supertest(app)
+            .delete(`/etapi/${entity}/${id}`)
+            .auth(USER, token, { "type": "basic"})
+            .expect(204);
+    }
+}
+
+const MISSING_ENTITY_ERROR_CODES: Record<EntityType, string> = {
+    attachments: "ATTACHMENT_NOT_FOUND",
+    attributes: "ATTRIBUTE_NOT_FOUND",
+    branches: "BRANCH_NOT_FOUND",
+    notes: "NOTE_NOT_FOUND"
+}
+
+async function expectNotFound(entity: EntityType, id: string) {
+    const response = await supertest(app)
+            .get(`/etapi/${entity}/${id}`)
+            .auth(USER, token, { "type": "basic"})
+            .expect(404);
+
+    expect(response.body.code).toStrictEqual(MISSING_ENTITY_ERROR_CODES[entity]);
+}
+
+async function expectFound(entity: EntityType, id: string) {
+    await supertest(app)
+            .get(`/etapi/${entity}/${id}`)
+            .auth(USER, token, { "type": "basic"})
+            .expect(200);
+}

apps/server/spec/etapi/etapi-metrics.spec.ts

@@ -0,0 +1,71 @@
+import { Application } from "express";
+import { beforeAll, describe, expect, it } from "vitest";
+import supertest from "supertest";
+import { login } from "./utils.js";
+import config from "../../src/services/config.js";
+
+let app: Application;
+let token: string;
+
+const USER = "etapi";
+
+describe("etapi/metrics", () => {
+    beforeAll(async () => {
+        config.General.noAuthentication = false;
+        const buildApp = (await (import("../../src/app.js"))).default;
+        app = await buildApp();
+        token = await login(app);
+    });
+
+    it("returns Prometheus format by default", async () => {
+        const response = await supertest(app)
+            .get("/etapi/metrics")
+            .auth(USER, token, { "type": "basic"})
+            .expect(200);
+        expect(response.headers["content-type"]).toContain("text/plain");
+        expect(response.text).toContain("trilium_info");
+        expect(response.text).toContain("trilium_notes_total");
+        expect(response.text).toContain("# HELP");
+        expect(response.text).toContain("# TYPE");
+    });
+
+    it("returns JSON when requested", async() => {
+        const response = await supertest(app)
+            .get("/etapi/metrics?format=json")
+            .auth(USER, token, { "type": "basic"})
+            .expect(200);
+        expect(response.headers["content-type"]).toContain("application/json");
+        expect(response.body.version).toBeTruthy();
+        expect(response.body.database).toBeTruthy();
+        expect(response.body.timestamp).toBeTruthy();
+        expect(response.body.database.totalNotes).toBeTypeOf("number");
+        expect(response.body.database.activeNotes).toBeTypeOf("number");
+        expect(response.body.noteTypes).toBeTruthy();
+        expect(response.body.attachmentTypes).toBeTruthy();
+        expect(response.body.statistics).toBeTruthy();
+    });
+
+    it("returns Prometheus format explicitly", async () => {
+        const response = await supertest(app)
+            .get("/etapi/metrics?format=prometheus")
+            .auth(USER, token, { "type": "basic"})
+            .expect(200);
+        expect(response.headers["content-type"]).toContain("text/plain");
+        expect(response.text).toContain("trilium_info");
+        expect(response.text).toContain("trilium_notes_total");
+    });
+
+    it("returns error on invalid format", async() => {
+        const response = await supertest(app)
+            .get("/etapi/metrics?format=xml")
+            .auth(USER, token, { "type": "basic"})
+            .expect(500);
+        expect(response.body.message).toContain("prometheus");
+    });
+
+    it("should fail without authentication", async() => {
+        await supertest(app)
+            .get("/etapi/metrics")
+            .expect(401);
+    });
+});

apps/server/spec/etapi/export-note-subtree.spec.ts

@@ -0,0 +1,51 @@
+import { Application } from "express";
+import { beforeAll, describe, expect, it } from "vitest";
+import supertest from "supertest";
+import { login } from "./utils.js";
+import config from "../../src/services/config.js";
+
+let app: Application;
+let token: string;
+
+const USER = "etapi";
+
+describe("etapi/export-note-subtree", () => {
+    beforeAll(async () => {
+        config.General.noAuthentication = false;
+        const buildApp = (await (import("../../src/app.js"))).default;
+        app = await buildApp();
+        token = await login(app);
+    });
+
+    it("export works", async () => {
+        await supertest(app)
+            .get("/etapi/notes/root/export")
+            .auth(USER, token, { "type": "basic"})
+            .expect(200)
+            .expect("Content-Type", "application/zip");
+    });
+
+    it("HTML export works", async () => {
+        await supertest(app)
+            .get("/etapi/notes/root/export?format=html")
+            .auth(USER, token, { "type": "basic"})
+            .expect(200)
+            .expect("Content-Type", "application/zip");
+    });
+
+    it("Markdown export works", async () => {
+        await supertest(app)
+            .get("/etapi/notes/root/export?format=markdown")
+            .auth(USER, token, { "type": "basic"})
+            .expect(200)
+            .expect("Content-Type", "application/zip");
+    });
+
+    it("reports wrong format", async () => {
+        const response = await supertest(app)
+            .get("/etapi/notes/root/export?format=wrong")
+            .auth(USER, token, { "type": "basic"})
+            .expect(400);
+        expect(response.body.code).toStrictEqual("UNRECOGNIZED_EXPORT_FORMAT");
+    });
+});

apps/server/spec/etapi/get-date-notes.spec.ts

@@ -0,0 +1,103 @@
+import { beforeAll, describe, expect, it } from "vitest";
+import config from "../../src/services/config.js";
+import { login } from "./utils.js";
+import { Application } from "express";
+import supertest from "supertest";
+import date_notes from "../../src/services/date_notes.js";
+import cls from "../../src/services/cls.js";
+
+let app: Application;
+let token: string;
+
+const USER = "etapi";
+
+describe("etapi/get-date-notes", () => {
+    beforeAll(async () => {
+        config.General.noAuthentication = false;
+        const buildApp = (await (import("../../src/app.js"))).default;
+        app = await buildApp();
+        token = await login(app);
+    });
+
+    it("obtains inbox", async () => {
+        await supertest(app)
+            .get("/etapi/inbox/2022-01-01")
+            .auth(USER, token, { "type": "basic"})
+            .expect(200);
+    });
+
+    describe("days", () => {
+        it("obtains day from calendar", async () => {
+            await supertest(app)
+                .get("/etapi/calendar/days/2022-01-01")
+                .auth(USER, token, { "type": "basic"})
+                .expect(200);
+        });
+
+        it("detects invalid date", async () => {
+            const response = await supertest(app)
+                .get("/etapi/calendar/days/2022-1")
+                .auth(USER, token, { "type": "basic"})
+                .expect(400);
+            expect(response.body.code).toStrictEqual("DATE_INVALID");
+        });
+    });
+
+    describe("weeks", () => {
+        beforeAll(() => {
+            cls.init(() => {
+                const rootCalendarNote = date_notes.getRootCalendarNote();
+                rootCalendarNote.setLabel("enableWeekNote");
+            });
+        });
+
+        it("obtains week calendar", async () => {
+            await supertest(app)
+                .get("/etapi/calendar/weeks/2022-W01")
+                .auth(USER, token, { "type": "basic"})
+                .expect(200);
+        });
+
+        it("detects invalid date", async () => {
+            const response = await supertest(app)
+                .get("/etapi/calendar/weeks/2022-1")
+                .auth(USER, token, { "type": "basic"})
+                .expect(400);
+            expect(response.body.code).toStrictEqual("WEEK_INVALID");
+        });
+    });
+
+    describe("months", () => {
+        it("obtains month calendar", async () => {
+            await supertest(app)
+                .get("/etapi/calendar/months/2022-01")
+                .auth(USER, token, { "type": "basic"})
+                .expect(200);
+        });
+
+        it("detects invalid month", async () => {
+            const response = await supertest(app)
+                .get("/etapi/calendar/months/2022-1")
+                .auth(USER, token, { "type": "basic"})
+                .expect(400);
+            expect(response.body.code).toStrictEqual("MONTH_INVALID");
+        });
+    });
+
+    describe("years", () => {
+        it("obtains year calendar", async () => {
+            await supertest(app)
+                .get("/etapi/calendar/years/2022")
+                .auth(USER, token, { "type": "basic"})
+                .expect(200);
+        });
+
+        it("detects invalid year", async () => {
+            const response = await supertest(app)
+                .get("/etapi/calendar/years/202")
+                .auth(USER, token, { "type": "basic"})
+                .expect(400);
+            expect(response.body.code).toStrictEqual("YEAR_INVALID");
+        });
+    });
+});

apps/server/spec/etapi/get-inherited-attribute-cloned.spec.ts

@@ -0,0 +1,98 @@
+import { Application } from "express";
+import { beforeAll, describe, expect, it } from "vitest";
+import supertest from "supertest";
+import { createNote, login } from "./utils.js";
+import config from "../../src/services/config.js";
+
+let app: Application;
+let token: string;
+
+let parentNoteId: string;
+
+describe("etapi/get-inherited-attribute-cloned", () => {
+    beforeAll(async () => {
+        config.General.noAuthentication = false;
+        const buildApp = (await (import("../../src/app.js"))).default;
+        app = await buildApp();
+        token = await login(app);
+
+        parentNoteId = await createNote(app, token);
+    });
+
+    it("gets inherited attribute", async () => {
+        // Create an inheritable attribute on the parent note.
+        let response = await supertest(app)
+            .post("/etapi/attributes")
+            .auth("etapi", token, { "type": "basic"})
+            .send({
+                "noteId": parentNoteId,
+                "type": "label",
+                "name": "mylabel",
+                "value": "val",
+                "isInheritable": true,
+                "position": 10
+            })
+            .expect(201);
+        const parentAttributeId = response.body.attributeId;
+        expect(parentAttributeId).toBeTruthy();
+
+        // Create a subnote.
+        response = await supertest(app)
+            .post("/etapi/create-note")
+            .auth("etapi", token, { "type": "basic"})
+            .send({
+                "parentNoteId": parentNoteId,
+                "title": "Hello",
+                "type": "text",
+                "content": "Hi there!"
+            })
+            .expect(201);
+        const childNoteId = response.body.note.noteId;
+
+        // Create child attribute
+        response = await supertest(app)
+            .post("/etapi/attributes")
+            .auth("etapi", token, { "type": "basic"})
+            .send({
+                "noteId": childNoteId,
+                "type": "label",
+                "name": "mylabel",
+                "value": "val",
+                "isInheritable": false,
+                "position": 10
+            })
+            .expect(201);
+        const childAttributeId = response.body.attributeId;
+        expect(parentAttributeId).toBeTruthy();
+
+        // Clone child to parent
+        response = await supertest(app)
+            .post("/etapi/branches")
+            .auth("etapi", token, { "type": "basic"})
+            .send({
+                noteId: childNoteId,
+                parentNoteId: parentNoteId
+            })
+            .expect(200);
+        parentNoteId = response.body.parentNoteId;
+
+        // Check attribute IDs
+        response = await supertest(app)
+            .get(`/etapi/notes/${childNoteId}`)
+            .auth("etapi", token, { "type": "basic"})
+            .expect(200);
+        expect(response.body.noteId).toStrictEqual(childNoteId);
+        expect(response.body.attributes).toHaveLength(2);
+        expect(hasAttribute(response.body.attributes, parentAttributeId));
+        expect(hasAttribute(response.body.attributes, childAttributeId));
+    });
+
+    function hasAttribute(list: object[], attributeId: string) {
+        for (let i = 0; i < list.length; i++) {
+                if (list[i]["attributeId"] === attributeId) {
+                return true;
+            }
+        }
+        return false;
+    }
+});

apps/server/spec/etapi/get-inherited-attribute.spec.ts

@@ -0,0 +1,60 @@
+import { Application } from "express";
+import { beforeAll, describe, expect, it } from "vitest";
+import supertest from "supertest";
+import { createNote, login } from "./utils.js";
+import config from "../../src/services/config.js";
+
+let app: Application;
+let token: string;
+
+let parentNoteId: string;
+
+describe("etapi/get-inherited-attribute", () => {
+    beforeAll(async () => {
+        config.General.noAuthentication = false;
+        const buildApp = (await (import("../../src/app.js"))).default;
+        app = await buildApp();
+        token = await login(app);
+
+        parentNoteId = await createNote(app, token);
+    });
+
+    it("gets inherited attribute", async () => {
+        // Create an inheritable attribute on the parent note.
+        let response = await supertest(app)
+            .post("/etapi/attributes")
+            .auth("etapi", token, { "type": "basic"})
+            .send({
+                "noteId": parentNoteId,
+                "type": "label",
+                "name": "mylabel",
+                "value": "val",
+                "isInheritable": true
+            })
+            .expect(201);
+        const createdAttributeId = response.body.attributeId;
+        expect(createdAttributeId).toBeTruthy();
+
+        // Create a subnote.
+        response = await supertest(app)
+            .post("/etapi/create-note")
+            .auth("etapi", token, { "type": "basic"})
+            .send({
+                "parentNoteId": parentNoteId,
+                "title": "Hello",
+                "type": "text",
+                "content": "Hi there!"
+            })
+            .expect(201);
+        const createdNoteId = response.body.note.noteId;
+
+        // Check the attribute is inherited.
+        response = await supertest(app)
+            .get(`/etapi/notes/${createdNoteId}`)
+            .auth("etapi", token, { "type": "basic"})
+            .expect(200);
+        expect(response.body.noteId).toStrictEqual(createdNoteId);
+        expect(response.body.attributes).toHaveLength(1);
+        expect(response.body.attributes[0].attributeId === createdAttributeId);
+    });
+});

apps/server/spec/etapi/import-zip.spec.ts

@@ -0,0 +1,34 @@
+import { Application } from "express";
+import { beforeAll, describe, expect, it } from "vitest";
+import supertest from "supertest";
+import { login } from "./utils.js";
+import config from "../../src/services/config.js";
+import { readFileSync } from "fs";
+import { join } from "path";
+
+let app: Application;
+let token: string;
+
+const USER = "etapi";
+
+describe("etapi/import", () => {
+    beforeAll(async () => {
+        config.General.noAuthentication = false;
+        const buildApp = (await (import("../../src/app.js"))).default;
+        app = await buildApp();
+        token = await login(app);
+    });
+
+    it("demo zip can be imported", async () => {
+        const buffer = readFileSync(join(__dirname, "../../src/assets/db/demo.zip"));
+        const response = await supertest(app)
+            .post("/etapi/notes/root/import")
+            .auth(USER, token, { "type": "basic"})
+            .set("Content-Type", "application/octet-stream")
+            .set("Content-Transfer-Encoding", "binary")
+            .send(buffer)
+            .expect(201);
+        expect(response.body.note.title).toStrictEqual("Journal");
+        expect(response.body.branch.parentNoteId).toStrictEqual("root");
+    });
+});

apps/server/spec/etapi/no-token.spec.ts

@@ -0,0 +1,54 @@
+import { Application } from "express";
+import { beforeAll, describe, expect, it } from "vitest";
+import supertest from "supertest";
+import { login } from "./utils.js";
+import config from "../../src/services/config.js";
+import type TestAgent from "supertest/lib/agent.js";
+
+let app: Application;
+
+const USER = "etapi";
+
+const routes = [
+    "GET /etapi/notes?search=aaa",
+    "GET /etapi/notes/root",
+    "PATCH /etapi/notes/root",
+    "DELETE /etapi/notes/root",
+    "GET /etapi/branches/root",
+    "PATCH /etapi/branches/root",
+    "DELETE /etapi/branches/root",
+    "GET /etapi/attributes/000",
+    "PATCH /etapi/attributes/000",
+    "DELETE /etapi/attributes/000",
+    "GET /etapi/inbox/2022-02-22",
+    "GET /etapi/calendar/days/2022-02-22",
+    "GET /etapi/calendar/weeks/2022-02-22",
+    "GET /etapi/calendar/months/2022-02",
+    "GET /etapi/calendar/years/2022",
+    "POST /etapi/create-note",
+    "GET /etapi/app-info",
+]
+
+describe("no-token", () => {
+    beforeAll(async () => {
+        config.General.noAuthentication = false;
+        const buildApp = (await (import("../../src/app.js"))).default;
+        app = await buildApp();
+    });
+
+    for (const route of routes) {
+        const [ method, url ] = route.split(" ", 2);
+
+        it(`rejects access to ${method} ${url}`, () => {
+            (supertest(app)[method.toLowerCase()](url) as TestAgent)
+                .auth(USER, "fakeauth", { "type": "basic"})
+                .expect(401)
+        });
+    }
+
+    it("responds with 404 even without token", () => {
+        supertest(app)
+            .get("/etapi/zzzzzz")
+            .expect(404);
+    });
+});

apps/server/spec/etapi/note-content.spec.ts

@@ -0,0 +1,72 @@
+import { Application } from "express";
+import { beforeAll, describe, expect, it } from "vitest";
+import supertest from "supertest";
+import { createNote, login } from "./utils.js";
+import config from "../../src/services/config.js";
+
+let app: Application;
+let token: string;
+
+const USER = "etapi";
+let createdNoteId: string;
+
+describe("etapi/note-content", () => {
+    beforeAll(async () => {
+        config.General.noAuthentication = false;
+        const buildApp = (await (import("../../src/app.js"))).default;
+        app = await buildApp();
+        token = await login(app);
+
+        createdNoteId = await createNote(app, token);
+    });
+
+    it("get content", async () => {
+        const response = await getContentResponse();
+        expect(response.text).toStrictEqual("Hi there!");
+    });
+
+    it("put note content", async () => {
+        const text = "Changed content";
+        await supertest(app)
+            .put(`/etapi/notes/${createdNoteId}/content`)
+            .auth(USER, token, { "type": "basic"})
+            .set("Content-Type", "text/plain")
+            .send(text)
+            .expect(204);
+
+        const response = await getContentResponse();
+        expect(response.text).toStrictEqual(text);
+    });
+
+    it("put note content binary", async () => {
+        // First, create a binary note
+        const response = await supertest(app)
+            .post("/etapi/create-note")
+            .auth("etapi", token, { "type": "basic"})
+            .send({
+                "parentNoteId": "root",
+                "title": "Hello",
+                "mime": "image/png",
+                "type": "image",
+                "content": ""
+            })
+            .expect(201);
+        const createdNoteId = response.body.note.noteId;
+
+        // Put binary content
+        await supertest(app)
+            .put(`/etapi/notes/${createdNoteId}/content`)
+            .auth(USER, token, { "type": "basic"})
+            .set("Content-Type", "application/octet-stream")
+            .set("Content-Transfer-Encoding", "binary")
+            .send(Buffer.from("Hello world"))
+            .expect(204);
+    });
+
+    function getContentResponse() {
+        return supertest(app)
+            .get(`/etapi/notes/${createdNoteId}/content`)
+            .auth(USER, token, { "type": "basic"})
+            .expect(200);
+    }
+});

apps/server/spec/etapi/other.spec.ts

@@ -0,0 +1,26 @@
+import { Application } from "express";
+import { beforeAll, describe, expect, it } from "vitest";
+import supertest from "supertest";
+import { login } from "./utils.js";
+import config from "../../src/services/config.js";
+
+let app: Application;
+let token: string;
+
+const USER = "etapi";
+
+describe("etapi/refresh-note-ordering/root", () => {
+    beforeAll(async () => {
+        config.General.noAuthentication = false;
+        const buildApp = (await (import("../../src/app.js"))).default;
+        app = await buildApp();
+        token = await login(app);
+    });
+
+    it("refreshes note ordering", async () => {
+        await supertest(app)
+            .post("/etapi/refresh-note-ordering/root")
+            .auth(USER, token, { "type": "basic"})
+            .expect(204);
+    });
+});

apps/server/spec/etapi/patch-attachment.spec.ts

@@ -0,0 +1,78 @@
+import { Application } from "express";
+import { beforeAll, describe, expect, it } from "vitest";
+import supertest from "supertest";
+import { createNote, login } from "./utils.js";
+import config from "../../src/services/config.js";
+
+let app: Application;
+let token: string;
+
+const USER = "etapi";
+let createdNoteId: string;
+let createdAttachmentId: string;
+
+describe("etapi/attachment-content", () => {
+    beforeAll(async () => {
+        config.General.noAuthentication = false;
+        const buildApp = (await (import("../../src/app.js"))).default;
+        app = await buildApp();
+        token = await login(app);
+
+        createdNoteId = await createNote(app, token);
+
+        // Create an attachment
+        const response = await supertest(app)
+            .post(`/etapi/attachments`)
+            .auth(USER, token, { "type": "basic"})
+            .send({
+                "ownerId": createdNoteId,
+                "role": "file",
+                "mime": "text/plain",
+                "title": "my attachment",
+                "content": "text"
+            });
+        createdAttachmentId = response.body.attachmentId;
+        expect(createdAttachmentId).toBeTruthy();
+    });
+
+    it("changes title and position", async () => {
+        const state = {
+            title: "CHANGED",
+            position: 999
+        }
+        await supertest(app)
+            .patch(`/etapi/attachments/${createdAttachmentId}`)
+            .auth(USER, token, { "type": "basic"})
+            .send(state)
+            .expect(200);
+
+        // Ensure it got changed.
+        const response = await supertest(app)
+            .get(`/etapi/attachments/${createdAttachmentId}`)
+            .auth(USER, token, { "type": "basic"});
+        expect(response.body).toMatchObject(state);
+    });
+
+    it("forbids changing owner", async () => {
+        const response = await supertest(app)
+            .patch(`/etapi/attachments/${createdAttachmentId}`)
+            .auth(USER, token, { "type": "basic"})
+            .send({
+                ownerId: "root"
+            })
+            .expect(400);
+        expect(response.body.code).toStrictEqual("PROPERTY_NOT_ALLOWED");
+    });
+
+    it("handles validation error", async () => {
+        const response = await supertest(app)
+            .patch(`/etapi/attachments/${createdAttachmentId}`)
+            .auth(USER, token, { "type": "basic"})
+            .send({
+                title: null
+            })
+            .expect(400);
+        expect(response.body.code).toStrictEqual("PROPERTY_VALIDATION_ERROR");
+    });
+
+});

apps/server/spec/etapi/patch-attribute.spec.ts

@@ -0,0 +1,77 @@
+import { Application } from "express";
+import { beforeAll, describe, expect, it } from "vitest";
+import supertest from "supertest";
+import { createNote, login } from "./utils.js";
+import config from "../../src/services/config.js";
+
+let app: Application;
+let token: string;
+
+const USER = "etapi";
+let createdNoteId: string;
+let createdAttributeId: string;
+
+describe("etapi/patch-attribute", () => {
+    beforeAll(async () => {
+        config.General.noAuthentication = false;
+        const buildApp = (await (import("../../src/app.js"))).default;
+        app = await buildApp();
+        token = await login(app);
+
+        createdNoteId = await createNote(app, token);
+
+        // Create an attribute
+        const response = await supertest(app)
+            .post(`/etapi/attributes`)
+            .auth(USER, token, { "type": "basic"})
+            .send({
+                "noteId": createdNoteId,
+                "type": "label",
+                "name": "mylabel",
+                "value": "val",
+                "isInheritable": true
+            });
+        createdAttributeId = response.body.attributeId;
+        expect(createdAttributeId).toBeTruthy();
+    });
+
+    it("changes name and value", async () => {
+        const state = {
+            value: "CHANGED"
+        };
+        await supertest(app)
+            .patch(`/etapi/attributes/${createdAttributeId}`)
+            .auth(USER, token, { "type": "basic"})
+            .send(state)
+            .expect(200);
+
+        // Ensure it got changed.
+        const response = await supertest(app)
+            .get(`/etapi/attributes/${createdAttributeId}`)
+            .auth(USER, token, { "type": "basic"});
+        expect(response.body).toMatchObject(state);
+    });
+
+    it("forbids setting disallowed property", async () => {
+        const response = await supertest(app)
+            .patch(`/etapi/attributes/${createdAttributeId}`)
+            .auth(USER, token, { "type": "basic"})
+            .send({
+                noteId: "root"
+            })
+            .expect(400);
+        expect(response.body.code).toStrictEqual("PROPERTY_NOT_ALLOWED");
+    });
+
+    it("forbids setting wrong data type", async () => {
+        const response = await supertest(app)
+            .patch(`/etapi/attributes/${createdAttributeId}`)
+            .auth(USER, token, { "type": "basic"})
+            .send({
+                value: null
+            })
+            .expect(400);
+        expect(response.body.code).toStrictEqual("PROPERTY_VALIDATION_ERROR");
+    });
+
+});

apps/server/spec/etapi/patch-branch.spec.ts

@@ -0,0 +1,77 @@
+import { Application } from "express";
+import { beforeAll, describe, expect, it } from "vitest";
+import supertest from "supertest";
+import { createNote, login } from "./utils.js";
+import config from "../../src/services/config.js";
+
+let app: Application;
+let token: string;
+
+const USER = "etapi";
+let createdBranchId: string;
+
+describe("etapi/attachment-content", () => {
+    beforeAll(async () => {
+        config.General.noAuthentication = false;
+        const buildApp = (await (import("../../src/app.js"))).default;
+        app = await buildApp();
+        token = await login(app);
+
+        // Create a note and a branch.
+        const response = await supertest(app)
+            .post("/etapi/create-note")
+            .auth("etapi", token, { "type": "basic"})
+            .send({
+                "parentNoteId": "root",
+                "title": "Hello",
+                "type": "text",
+                "content": "",
+            })
+            .expect(201);
+
+        createdBranchId = response.body.branch.branchId;
+    });
+
+    it("can patch branch info", async () => {
+        const state = {
+            prefix: "pref",
+            notePosition: 666,
+            isExpanded: true
+        };
+
+        await supertest(app)
+            .patch(`/etapi/branches/${createdBranchId}`)
+            .auth("etapi", token, { "type": "basic"})
+            .send(state)
+            .expect(200);
+
+        const response = await supertest(app)
+            .get(`/etapi/branches/${createdBranchId}`)
+            .auth("etapi", token, { "type": "basic"})
+            .expect(200);
+        expect(response.body).toMatchObject(state);
+    });
+
+    it("rejects not allowed property", async () => {
+        const response = await supertest(app)
+            .patch(`/etapi/branches/${createdBranchId}`)
+            .auth("etapi", token, { "type": "basic"})
+            .send({
+                parentNoteId: "root"
+            })
+            .expect(400);
+        expect(response.body.code).toStrictEqual("PROPERTY_NOT_ALLOWED");
+    });
+
+    it("rejects invalid property value", async () => {
+        const response = await supertest(app)
+            .patch(`/etapi/branches/${createdBranchId}`)
+            .auth("etapi", token, { "type": "basic"})
+            .send({
+                prefix: 123
+            })
+            .expect(400);
+        expect(response.body.code).toStrictEqual("PROPERTY_VALIDATION_ERROR");
+    });
+
+});

apps/server/spec/etapi/patch-note.spec.ts

@@ -0,0 +1,89 @@
+import { Application } from "express";
+import { beforeAll, describe, expect, it } from "vitest";
+import supertest from "supertest";
+import { login } from "./utils.js";
+import config from "../../src/services/config.js";
+
+let app: Application;
+let token: string;
+
+const USER = "etapi";
+let createdNoteId: string;
+
+describe("etapi/patch-note", () => {
+    beforeAll(async () => {
+        config.General.noAuthentication = false;
+        const buildApp = (await (import("../../src/app.js"))).default;
+        app = await buildApp();
+        token = await login(app);
+
+        const response = await supertest(app)
+            .post("/etapi/create-note")
+            .auth("etapi", token, { "type": "basic"})
+            .send({
+                "parentNoteId": "root",
+                "title": "Hello",
+                "type": "code",
+                "mime": "application/json",
+                "content": "{}"
+            })
+            .expect(201);
+
+        const createdNoteId = response.body.note.noteId as string;
+        expect(createdNoteId).toBeTruthy();
+    });
+
+    it("obtains correct note information", async () => {
+        await expectNoteToMatch({
+            title: "Hello",
+            type: "code",
+            mime: "application/json"
+        });
+    });
+
+    it("patches type, mime and creation dates", async () => {
+        const changes = {
+            "title": "Wassup",
+            "type": "html",
+            "mime": "text/html",
+            "dateCreated": "2023-08-21 23:38:51.123+0200",
+            "utcDateCreated": "2023-08-21 23:38:51.123Z"
+        };
+        await supertest(app)
+            .patch(`/etapi/notes/${createdNoteId}`)
+            .auth("etapi", token, { "type": "basic"})
+            .send(changes)
+            .expect(200);
+        await expectNoteToMatch(changes);
+    });
+
+    it("refuses setting protection", async () => {
+        const response = await supertest(app)
+            .patch(`/etapi/notes/${createdNoteId}`)
+            .auth("etapi", token, { "type": "basic"})
+            .send({
+                isProtected: true
+            })
+            .expect(400);
+        expect(response.body.code).toStrictEqual("PROPERTY_NOT_ALLOWED");
+    });
+
+    it("refuses incorrect type", async () => {
+        const response = await supertest(app)
+            .patch(`/etapi/notes/${createdNoteId}`)
+            .auth("etapi", token, { "type": "basic"})
+            .send({
+                title: true
+            })
+            .expect(400);
+        expect(response.body.code).toStrictEqual("PROPERTY_VALIDATION_ERROR");
+    });
+
+    async function expectNoteToMatch(state: object) {
+        const response = await supertest(app)
+            .get(`/etapi/notes/${createdNoteId}`)
+            .auth("etapi", token, { "type": "basic"})
+            .expect(200);
+        expect(response.body).toMatchObject(state);
+    }
+});

apps/server/spec/etapi/post-revision.spec.ts

@@ -0,0 +1,29 @@
+import { Application } from "express";
+import { beforeAll, describe, expect, it } from "vitest";
+import supertest from "supertest";
+import { createNote, login } from "./utils.js";
+import config from "../../src/services/config.js";
+
+let app: Application;
+let token: string;
+
+const USER = "etapi";
+let createdNoteId: string;
+
+describe("etapi/post-revision", () => {
+    beforeAll(async () => {
+        config.General.noAuthentication = false;
+        const buildApp = (await (import("../../src/app.js"))).default;
+        app = await buildApp();
+        token = await login(app);
+        createdNoteId = await createNote(app, token);
+    });
+
+    it("posts note revision", async () => {
+        await supertest(app)
+            .post(`/etapi/notes/${createdNoteId}/revision`)
+            .auth(USER, token, { "type": "basic"})
+            .send("Changed content")
+            .expect(204);
+    });
+});

apps/server/spec/etapi/search.spec.ts

@@ -0,0 +1,40 @@
+import { Application } from "express";
+import { beforeAll, describe, expect, it } from "vitest";
+import supertest from "supertest";
+import { createNote, login } from "./utils.js";
+import config from "../../src/services/config.js";
+import { randomUUID } from "crypto";
+
+let app: Application;
+let token: string;
+
+const USER = "etapi";
+let content: string;
+
+describe("etapi/search", () => {
+    beforeAll(async () => {
+        config.General.noAuthentication = false;
+        const buildApp = (await (import("../../src/app.js"))).default;
+        app = await buildApp();
+        token = await login(app);
+
+        content = randomUUID();
+        await createNote(app, token, content);
+    });
+
+    it("finds by content", async () => {
+        const response = await supertest(app)
+            .get(`/etapi/notes?search=${content}&debug=true`)
+            .auth(USER, token, { "type": "basic"})
+            .expect(200);
+        expect(response.body.results).toHaveLength(1);
+    });
+
+    it("does not find by content when fast search is on", async () => {
+        const response = await supertest(app)
+            .get(`/etapi/notes?search=${content}&debug=true&fastSearch=true`)
+            .auth(USER, token, { "type": "basic"})
+            .expect(200);
+        expect(response.body.results).toHaveLength(0);
+    });
+});

apps/server/spec/etapi/utils.ts

@@ -0,0 +1,33 @@
+import type { Application } from "express";
+import supertest from "supertest";
+import { expect } from "vitest";
+
+export async function login(app: Application) {
+    // Obtain auth token.
+    const response = await supertest(app)
+        .post("/etapi/auth/login")
+        .send({
+            "password": "demo1234"
+        })
+        .expect(201);
+    const token = response.body.authToken;
+    expect(token).toBeTruthy();
+    return token;
+}
+
+export async function createNote(app: Application, token: string, content?: string) {
+    const response = await supertest(app)
+        .post("/etapi/create-note")
+        .auth("etapi", token, { "type": "basic"})
+        .send({
+            "parentNoteId": "root",
+            "title": "Hello",
+            "type": "text",
+            "content": content ?? "Hi there!",
+        })
+        .expect(201);
+
+    const noteId = response.body.note.noteId as string;
+    expect(noteId).toStrictEqual(noteId);
+    return noteId;
+}

apps/server/spec/setup.ts

@@ -3,6 +3,13 @@ import i18next from "i18next";
 import { join } from "path";
 import dayjs from "dayjs";
 
+// Initialize environment variables.
+process.env.TRILIUM_DATA_DIR = join(__dirname, "db");
+process.env.TRILIUM_RESOURCE_DIR = join(__dirname, "../src");
+process.env.TRILIUM_INTEGRATION_TEST = "memory";
+process.env.TRILIUM_ENV = "dev";
+process.env.TRILIUM_PUBLIC_SERVER = "http://localhost:4200";
+
 beforeAll(async () => {
     // Initialize the translations manually to avoid any side effects.
     const Backend = (await import("i18next-fs-backend")).default;

apps/server/src/assets/views/share/page.ejs

@@ -13,6 +13,7 @@
     <link rel="shortcut icon" href="../favicon.ico">
     <% } %>
     <script src="<%= appPath %>/share.js" type="module"></script>
+    <link href="<%= assetPath %>/src/share.css" rel="stylesheet">
     <% if (!note.isLabelTruthy("shareOmitDefaultCss")) { %>
         <link href="<%= assetPath %>/stylesheets/share.css" rel="stylesheet">
     <% } %>

apps/server/src/etapi/backup.ts

@@ -4,10 +4,10 @@ import eu from "./etapi_utils.js";
 import backupService from "../services/backup.js";
 
 function register(router: Router) {
-    eu.route(router, "put", "/etapi/backup/:backupName", async (req, res, next) => {
-        await backupService.backupNow(req.params.backupName);
-
-        res.sendStatus(204);
+    eu.route(router, "put", "/etapi/backup/:backupName", (req, res, next) => {
+        backupService.backupNow(req.params.backupName)
+            .then(() => res.sendStatus(204))
+            .catch(() => res.sendStatus(500));
     });
 }
 

apps/server/src/etapi/etapi_utils.ts

@@ -6,7 +6,7 @@ import etapiTokenService from "../services/etapi_tokens.js";
 import config from "../services/config.js";
 import type { NextFunction, Request, RequestHandler, Response, Router } from "express";
 import type { ValidatorMap } from "./etapi-interface.js";
-import type { ApiRequestHandler } from "../routes/route_api.js";
+import type { ApiRequestHandler, SyncRouteRequestHandler } from "../routes/route_api.js";
 const GENERIC_CODE = "GENERIC";
 
 type HttpMethod = "all" | "get" | "post" | "put" | "delete" | "patch" | "options" | "head";
@@ -73,11 +73,11 @@ function processRequest(req: Request, res: Response, routeHandler: ApiRequestHan
     }
 }
 
-function route(router: Router, method: HttpMethod, path: string, routeHandler: ApiRequestHandler) {
+function route(router: Router, method: HttpMethod, path: string, routeHandler: SyncRouteRequestHandler) {
     router[method](path, checkEtapiAuth, (req: Request, res: Response, next: NextFunction) => processRequest(req, res, routeHandler, next, method, path));
 }
 
-function NOT_AUTHENTICATED_ROUTE(router: Router, method: HttpMethod, path: string, middleware: RequestHandler[], routeHandler: RequestHandler) {
+function NOT_AUTHENTICATED_ROUTE(router: Router, method: HttpMethod, path: string, middleware: RequestHandler[], routeHandler: SyncRouteRequestHandler) {
     router[method](path, ...middleware, (req: Request, res: Response, next: NextFunction) => processRequest(req, res, routeHandler, next, method, path));
 }
 

apps/server/src/etapi/special_notes.ts

@@ -15,46 +15,46 @@ function isValidDate(date: string) {
 }
 
 function register(router: Router) {
-    eu.route(router, "get", "/etapi/inbox/:date", async (req, res, next) => {
+    eu.route(router, "get", "/etapi/inbox/:date", (req, res, next) => {
         const { date } = req.params;
 
         if (!isValidDate(date)) {
             throw getDateInvalidError(date);
         }
-        const note = await specialNotesService.getInboxNote(date);
+        const note = specialNotesService.getInboxNote(date);
         res.json(mappers.mapNoteToPojo(note));
     });
 
-    eu.route(router, "get", "/etapi/calendar/days/:date", async (req, res, next) => {
+    eu.route(router, "get", "/etapi/calendar/days/:date", (req, res, next) => {
         const { date } = req.params;
 
         if (!isValidDate(date)) {
             throw getDateInvalidError(date);
         }
 
-        const note = await dateNotesService.getDayNote(date);
+        const note = dateNotesService.getDayNote(date);
         res.json(mappers.mapNoteToPojo(note));
     });
 
-    eu.route(router, "get", "/etapi/calendar/week-first-day/:date", async (req, res, next) => {
+    eu.route(router, "get", "/etapi/calendar/week-first-day/:date", (req, res, next) => {
         const { date } = req.params;
 
         if (!isValidDate(date)) {
             throw getDateInvalidError(date);
         }
 
-        const note = await dateNotesService.getWeekFirstDayNote(date);
+        const note = dateNotesService.getWeekFirstDayNote(date);
         res.json(mappers.mapNoteToPojo(note));
     });
 
-    eu.route(router, "get", "/etapi/calendar/weeks/:week", async (req, res, next) => {
+    eu.route(router, "get", "/etapi/calendar/weeks/:week", (req, res, next) => {
         const { week } = req.params;
 
         if (!/[0-9]{4}-W[0-9]{2}/.test(week)) {
             throw getWeekInvalidError(week);
         }
 
-        const note = await dateNotesService.getWeekNote(week);
+        const note = dateNotesService.getWeekNote(week);
 
         if (!note) {
             throw getWeekNotFoundError(week);
@@ -63,14 +63,14 @@ function register(router: Router) {
         res.json(mappers.mapNoteToPojo(note));
     });
 
-    eu.route(router, "get", "/etapi/calendar/months/:month", async (req, res, next) => {
+    eu.route(router, "get", "/etapi/calendar/months/:month", (req, res, next) => {
         const { month } = req.params;
 
         if (!/[0-9]{4}-[0-9]{2}/.test(month)) {
             throw getMonthInvalidError(month);
         }
 
-        const note = await dateNotesService.getMonthNote(month);
+        const note = dateNotesService.getMonthNote(month);
         res.json(mappers.mapNoteToPojo(note));
     });
 

apps/server/src/services/html_sanitizer.ts

@@ -1,5 +1,5 @@
 import sanitizeHtml from "sanitize-html";
-import sanitizeUrl from "@braintree/sanitize-url";
+import { sanitizeUrl } from "@braintree/sanitize-url";
 import optionService from "./options.js";
 
 // Be consistent with `ALLOWED_PROTOCOLS` in `src\public\app\services\link.js`
@@ -190,6 +190,6 @@ function sanitize(dirtyHtml: string) {
 export default {
     sanitize,
     sanitizeUrl: (url: string) => {
-        return sanitizeUrl.sanitizeUrl(url).trim();
+        return sanitizeUrl(url).trim();
     }
 };

apps/server/src/services/special_notes.ts

@@ -9,6 +9,7 @@ import searchService from "./search/services/search.js";
 import SearchContext from "./search/search_context.js";
 import hiddenSubtree from "./hidden_subtree.js";
 import { t } from "i18next";
+import { BNote } from "./backend_script_entrypoint.js";
 const { LBTPL_NOTE_LAUNCHER, LBTPL_CUSTOM_WIDGET, LBTPL_SPACER, LBTPL_SCRIPT } = hiddenSubtree;
 
 function getInboxNote(date: string) {
@@ -17,7 +18,7 @@ function getInboxNote(date: string) {
         throw new Error("Unable to find workspace note");
     }
 
-    let inbox;
+    let inbox: BNote;
 
     if (!workspaceNote.isRoot()) {
         inbox = workspaceNote.searchNoteInSubtree("#workspaceInbox");

apps/server/vite.config.mts

@@ -10,7 +10,7 @@ export default defineConfig(() => ({
     globals: true,
     setupFiles: ["./spec/setup.ts"],
     environment: "node",
-    include: ['{src,tests}/**/*.{test,spec}.{js,mjs,cjs,ts,mts,cts,jsx,tsx}'],
+    include: ['{src,spec}/**/*.{test,spec}.{js,mjs,cjs,ts,mts,cts,jsx,tsx}'],
     reporters: ['default'],
     coverage: {
       reportsDirectory: './test-output/vitest/coverage',