Initial Mebbling hub implementation

app/api/sync/route.ts

@@ -0,0 +1,2 @@
+import { NextResponse } from "next/server"; import { requireUser } from "@/lib/auth"; import { db } from "@/lib/db"; import { externalUrl } from "@/lib/http";
+export async function POST(req:Request){try{const user=await requireUser();const f=await req.formData();const sourceId=Number(f.get('sourceId'));const source=db.prepare('SELECT s.id FROM sources s JOIN source_members sm ON sm.source_id=s.id WHERE s.id=? AND sm.user_id=?').get(sourceId,user.id);if(!source)throw 0;db.prepare("INSERT INTO sync_jobs(source_id,kind) VALUES(?, 'pull')").run(sourceId);return NextResponse.redirect(externalUrl(req,'/dashboard'));}catch{return NextResponse.redirect(externalUrl(req,'/'));}}

app/api/sync/webhook/[sourceId]/[secret]/route.ts

@@ -0,0 +1,18 @@
+import { NextResponse } from "next/server";
+import { db } from "@/lib/db";
+import { withinRateLimit } from "@/lib/rate-limit";
+import { webhookSecretMatches } from "@/lib/webhook";
+
+export async function POST(request: Request, { params }: { params: Promise<{ sourceId: string; secret: string }> }) {
+  const { sourceId, secret } = await params;
+  const id = Number(sourceId);
+  const source = db.prepare("SELECT id, webhook_secret_hash FROM sources WHERE id=?").get(id) as { id: number; webhook_secret_hash: string | null } | undefined;
+  if (!source || !webhookSecretMatches(secret, source.webhook_secret_hash)) return NextResponse.json({ error: "Not found" }, { status: 404 });
+  const forwarded = request.headers.get("x-forwarded-for")?.split(",")[0].trim() || "unknown";
+  if (!withinRateLimit(`webhook:${id}:${forwarded}`)) return NextResponse.json({ error: "Too many requests" }, { status: 429 });
+  let payload: unknown = {};
+  try { payload = await request.json(); } catch { /* Memos payload is optional; a pull reconciles source state. */ }
+  db.prepare("UPDATE sources SET last_webhook_at=CURRENT_TIMESTAMP WHERE id=?").run(id);
+  db.prepare("INSERT INTO sync_jobs(source_id,kind,payload_json) VALUES(?, 'pull', ?)").run(id, JSON.stringify(payload));
+  return NextResponse.json({ ok: true });
+}