feat(gists): allow authors to correct a gist within a 60s edit window (#215)

* feat(gists): allow authors to correct a gist within a 60s edit window

* fix(contracts): pin Cargo.lock to fix CI build break

soroban-env-host 22.1.3 declares ed25519-dalek as ">=2.0.0" with no
upper bound. Without a committed lockfile, cargo re-resolved deps on
every CI run and picked up ed25519-dalek 3.0.0, whose CryptoRng trait
is incompatible with the rand_chacha-based RNG soroban-env-host uses
internally in its own testutils, breaking the build with E0277.

Pin ed25519-dalek to 2.2.0 (still satisfies the >=2.0.0 constraint)
and commit Cargo.lock so builds are reproducible instead of drifting
with upstream releases.

Author: xJeffx23

Backend/README.md

@@ -176,6 +176,26 @@ Content-Type: application/json
 5. Persist the record in Postgres
 6. Return the created gist
 
+### Correct a Gist
+
+```
+PATCH /gists/{id}
+Content-Type: application/json
+```
+
+```json
+{
+  "content": "Great street food here tonight (fixed typo)",
+  "author": "GXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
+}
+```
+
+Lets an author fix a typo shortly after posting — but only shortly after:
+
+- **60-second edit window.** Measured from the gist's `created_at`. Once elapsed, the endpoint returns `410 Gone` and the content is permanent.
+- **Author-gated.** `author` must match the gist's stored author exactly, or the endpoint returns `403 Forbidden`. Gists posted without an author (fully anonymous) can never be edited — there's no identity to verify against.
+- **Lineage preserved.** The prior IPFS CID is kept in `previous_cid` and the new content is re-pinned to IPFS, producing a fresh `content_hash`. Nothing is deleted — the edit is an append, not an overwrite of history.
+
 ---
 
 ## Database Model
@@ -195,6 +215,8 @@ Table: `gists`
 | `author_address` | `text` | Nullable — anonymous posts allowed |
 | `tx_hash` | `text` | Stellar transaction hash |
 | `created_at` | `timestamptz` | |
+| `previous_cid` | `text` | Nullable — IPFS CID this gist replaced, set on edit |
+| `edited_at` | `timestamptz` | Nullable — set on edit |
 
 ---
 

Backend/src/database/migrations/AddLineageColumn.ts

@@ -0,0 +1,33 @@
+import { MigrationInterface, QueryRunner } from 'typeorm';
+
+export class AddLineageColumn1700000000002 implements MigrationInterface {
+  name = 'AddLineageColumn1700000000002';
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    // Author identity — required to authorize future edits to a gist.
+    // Nullable: gists posted without an author remain permanently anonymous
+    // and therefore uneditable (no identity to verify a PATCH against).
+    await queryRunner.query(`
+      ALTER TABLE "gists"
+        ADD COLUMN IF NOT EXISTS "author" VARCHAR(80)
+    `);
+
+    // Lineage — the content_hash (IPFS CID) that was replaced by the
+    // current content_hash, plus when that replacement happened.
+    await queryRunner.query(`
+      ALTER TABLE "gists"
+        ADD COLUMN IF NOT EXISTS "previous_cid" VARCHAR(100)
+    `);
+
+    await queryRunner.query(`
+      ALTER TABLE "gists"
+        ADD COLUMN IF NOT EXISTS "edited_at" TIMESTAMPTZ
+    `);
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`ALTER TABLE "gists" DROP COLUMN IF EXISTS "edited_at"`);
+    await queryRunner.query(`ALTER TABLE "gists" DROP COLUMN IF EXISTS "previous_cid"`);
+    await queryRunner.query(`ALTER TABLE "gists" DROP COLUMN IF EXISTS "author"`);
+  }
+}

Backend/src/gists/dto/update-gist.dto.ts

@@ -0,0 +1,21 @@
+import { ApiProperty } from '@nestjs/swagger';
+import { IsString, MaxLength } from 'class-validator';
+
+export class UpdateGistDto {
+  @ApiProperty({
+    description: 'Corrected gist content (max 280 characters)',
+    example: 'Great coffee spot here! (typo fixed)',
+    maxLength: 280,
+  })
+  @IsString()
+  @MaxLength(280)
+  content: string;
+
+  @ApiProperty({
+    description: "Stellar address of the gist's original author; must match the stored author",
+    example: 'GABC...XYZ',
+  })
+  @IsString()
+  @MaxLength(80)
+  author: string;
+}

Backend/src/gists/entities/gist.entity.ts

@@ -22,6 +22,15 @@ export class Gist {
   @Column({ type: 'varchar', length: 80, nullable: true })
   tx_hash: string | null;
 
+  @Column({ type: 'varchar', length: 80, nullable: true })
+  author: string | null;
+
+  @Column({ type: 'varchar', length: 100, nullable: true })
+  previous_cid: string | null;
+
+  @Column({ type: 'timestamptz', nullable: true })
+  edited_at: Date | null;
+
   /**
    * PostGIS geography(Point, 4326) column.
    * TypeORM has no native geography type — the real column is created
@@ -33,4 +42,8 @@ export class Gist {
 
   @CreateDateColumn({ type: 'timestamptz' })
   created_at: Date;
+
+  // Not persisted columns — populated by ST_X/ST_Y in raw SELECT queries.
+  lat?: number;
+  lon?: number;
 }

Backend/src/gists/gist.repository.spec.ts

@@ -49,6 +49,18 @@ describeIntegration('GistRepository (integration)', () => {
       expect(Number(gist.lon)).toBeCloseTo(7.4951, 3);
       expect(gist.created_at).toBeDefined();
     });
+
+    it('should persist the author', async () => {
+      const gist = await repository.create({
+        content: 'authored gist',
+        lat: 9.0579,
+        lon: 7.4951,
+        content_hash: 'mock_test_cid',
+        author: 'GABC...XYZ',
+      });
+
+      expect(gist.author).toBe('GABC...XYZ');
+    });
   });
 
   describe('findNearby', () => {
@@ -143,4 +155,40 @@ describeIntegration('GistRepository (integration)', () => {
       expect(result).toBeNull();
     });
   });
+
+  describe('update', () => {
+    it('should update content and record CID lineage', async () => {
+      const created = await repository.create({
+        content: 'before edit',
+        lat: 9.0579,
+        lon: 7.4951,
+        content_hash: 'cid_before',
+        author: 'GABC...XYZ',
+      });
+
+      const editedAt = new Date();
+      const updated = await repository.update(created.id, {
+        content: 'after edit',
+        content_hash: 'cid_after',
+        previous_cid: 'cid_before',
+        edited_at: editedAt,
+      });
+
+      expect(updated).not.toBeNull();
+      expect(updated!.content).toBe('after edit');
+      expect(updated!.content_hash).toBe('cid_after');
+      expect(updated!.previous_cid).toBe('cid_before');
+      expect(updated!.edited_at).toBeDefined();
+    });
+
+    it('should return null for a non-existent ID', async () => {
+      const result = await repository.update('00000000-0000-0000-0000-000000000000', {
+        content: 'no-op',
+        content_hash: 'cid',
+        previous_cid: null,
+        edited_at: new Date(),
+      });
+      expect(result).toBeNull();
+    });
+  });
 });

Backend/src/gists/gist.repository.ts

@@ -20,6 +20,14 @@ export interface CreateGistData {
   content_hash?: string;
   stellar_gist_id?: string;
   tx_hash?: string;
+  author?: string;
+}
+
+export interface UpdateGistData {
+  content: string;
+  content_hash: string;
+  previous_cid: string | null;
+  edited_at: Date;
 }
 
 export interface UpsertEventData {
@@ -44,26 +52,27 @@ export class GistRepository {
       content_hash = null,
       stellar_gist_id = null,
       tx_hash = null,
+      author = null,
     } = data;
 
     const result = await this.dataSource.query<Gist[]>(
       `
       INSERT INTO gists (
         content, location, location_cell,
-        content_hash, stellar_gist_id, tx_hash
+        content_hash, stellar_gist_id, tx_hash, author
       )
       VALUES (
         $1,
         ST_SetSRID(ST_MakePoint($2, $3), 4326)::geography,
-        $4, $5, $6, $7
+        $4, $5, $6, $7, $8
       )
       RETURNING
         id, content, location_cell, content_hash,
-        stellar_gist_id, tx_hash, created_at,
+        stellar_gist_id, tx_hash, author, previous_cid, edited_at, created_at,
         ST_X(location::geometry) AS lon,
         ST_Y(location::geometry) AS lat
       `,
-      [content, lon, lat, location_cell, content_hash, stellar_gist_id, tx_hash],
+      [content, lon, lat, location_cell, content_hash, stellar_gist_id, tx_hash, author],
     );
 
     return result[0];
@@ -119,7 +128,7 @@ export class GistRepository {
       `
       SELECT
         id, content, location_cell, content_hash,
-        stellar_gist_id, tx_hash, created_at,
+        stellar_gist_id, tx_hash, author, previous_cid, edited_at, created_at,
         ST_X(location::geometry) AS lon,
         ST_Y(location::geometry) AS lat
       FROM gists
@@ -131,6 +140,28 @@ export class GistRepository {
     return rows[0] ?? null;
   }
 
+  async update(id: string, data: UpdateGistData): Promise<Gist | null> {
+    const { content, content_hash, previous_cid, edited_at } = data;
+
+    const rows = await this.dataSource.query<Gist[]>(
+      `
+      UPDATE gists
+      SET content = $2,
+          content_hash = $3,
+          previous_cid = $4,
+          edited_at = $5
+      WHERE id = $1
+      RETURNING
+        id, content, location_cell, content_hash,
+        stellar_gist_id, tx_hash, author, previous_cid, edited_at, created_at,
+        ST_X(location::geometry) AS lon,
+        ST_Y(location::geometry) AS lat
+      `,
+      [id, content, content_hash, previous_cid, edited_at],
+    );
+    return rows[0] ?? null;
+  }
+
   async findByStellarGistId(stellarGistId: string): Promise<Gist | null> {
     const rows = await this.dataSource.query<Gist[]>(
       `

Backend/src/gists/gists.controller.spec.ts

@@ -7,6 +7,7 @@ import { GistsController } from './gists.controller';
 import { GistsService } from './gists.service';
 import { CreateGistDto } from './dto/create-gist.dto';
 import { QueryGistsDto } from './dto/query-gists.dto';
+import { UpdateGistDto } from './dto/update-gist.dto';
 import { Gist } from './entities/gist.entity';
 import { PaginatedResponse } from '../common/utils/pagination.helper';
 describe('GistsController', () => {
@@ -19,6 +20,7 @@ describe('GistsController', () => {
       createBatch: jest.fn(),
       findNearby: jest.fn(),
       findOne: jest.fn(),
+      update: jest.fn(),
     };
 
     const module: TestingModule = await Test.createTestingModule({
@@ -60,6 +62,9 @@ describe('GistsController', () => {
       content_hash: 'abc123hash',
       stellar_gist_id: null,
       tx_hash: null,
+      author: null,
+      previous_cid: null,
+      edited_at: null,
       location: 'POINT(7.4951 9.0579)',
       created_at: new Date('2026-03-25T04:34:31.334Z'),
       ...overrides,
@@ -213,4 +218,47 @@ describe('GistsController', () => {
       await expect(controller.findOne(id)).rejects.toThrow('Gist not found');
     });
   });
+
+  describe('update()', () => {
+    it('should call gistsService.update with the id and DTO', async () => {
+      const id = '123e4567-e89b-12d3-a456-426614174000';
+      const dto: UpdateGistDto = { content: 'Fixed typo', author: 'GABC...XYZ' };
+      const result = createMockGist({ id, content: dto.content, author: dto.author });
+
+      jest.spyOn(service, 'update').mockResolvedValueOnce(result);
+
+      const response = await controller.update(id, dto);
+
+      expect(service.update).toHaveBeenCalledWith(id, dto);
+      expect(response).toEqual(result);
+    });
+
+    it('should propagate a 410 Gone error when the edit window has closed', async () => {
+      const id = '123e4567-e89b-12d3-a456-426614174000';
+      const dto: UpdateGistDto = { content: 'Fixed typo', author: 'GABC...XYZ' };
+      const error = Object.assign(new Error('Edit window has closed for this gist'), {
+        status: 410,
+      });
+
+      jest.spyOn(service, 'update').mockRejectedValueOnce(error);
+
+      await expect(controller.update(id, dto)).rejects.toThrow(
+        'Edit window has closed for this gist',
+      );
+    });
+
+    it('should propagate a forbidden error when the author does not match', async () => {
+      const id = '123e4567-e89b-12d3-a456-426614174000';
+      const dto: UpdateGistDto = { content: 'Fixed typo', author: 'GIMPOSTOR' };
+      const error = Object.assign(new Error('Only the original author may edit this gist'), {
+        status: 403,
+      });
+
+      jest.spyOn(service, 'update').mockRejectedValueOnce(error);
+
+      await expect(controller.update(id, dto)).rejects.toThrow(
+        'Only the original author may edit this gist',
+      );
+    });
+  });
 });

Backend/src/gists/gists.controller.ts

@@ -4,16 +4,18 @@ import {
   Controller,
   Get,
   Post,
+  Patch,
   Body,
   Param,
   Query,
   ParseArrayPipe,
 } from '@nestjs/common';
 import { Throttle, SkipThrottle } from '@nestjs/throttler';
-import { ApiBody, ApiOperation, ApiTags, ApiParam } from '@nestjs/swagger';
+import { ApiBody, ApiOperation, ApiTags, ApiParam, ApiResponse } from '@nestjs/swagger';
 import { GistsService } from './gists.service';
 import { CreateGistDto } from './dto/create-gist.dto';
 import { QueryGistsDto } from './dto/query-gists.dto';
+import { UpdateGistDto } from './dto/update-gist.dto';
 
 const MAX_GISTS_PER_BATCH = 10;
 
@@ -70,4 +72,16 @@ export class GistsController {
   findOne(@Param('id') id: string) {
     return this.gistsService.findOne(id);
   }
+
+  @Patch(':id')
+  @Throttle({ default: { limit: 10, ttl: 60000 } })
+  @ApiOperation({
+    summary: 'Correct a gist within its 60s edit window (same author only)',
+  })
+  @ApiParam({ name: 'id', description: 'Gist UUID' })
+  @ApiResponse({ status: 403, description: 'Caller is not the original author' })
+  @ApiResponse({ status: 410, description: 'Edit window has closed' })
+  update(@Param('id') id: string, @Body() dto: UpdateGistDto) {
+    return this.gistsService.update(id, dto);
+  }
 }