sync app filled in

apps/server/internal/httpserver/sync_handlers.go

@@ -2,6 +2,7 @@ package httpserver
 
 import (
 	"encoding/json"
+	"errors"
 	"net/http"
 	"os"
 
@@ -53,16 +54,31 @@ func (s *Server) handleSyncDelta(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	result, err := s.syncService.ApplyDelta(r.Context(), req.SnapshotID, sync.Delta{Changes: req.ClientDelta})
+	principal, ok := requirePrincipal(r)
+	if !ok {
+		writeJSON(w, http.StatusUnauthorized, map[string]string{"error": "authentication required"})
+		return
+	}
+
+	result, err := s.syncService.ApplyDelta(r.Context(), req.SnapshotID, principal.UserID, sync.Delta{Changes: req.ClientDelta})
 	if err != nil {
+		if errors.Is(err, sync.ErrForbidden) {
+			writeJSON(w, http.StatusForbidden, map[string]string{"error": "forbidden"})
+			return
+		}
+		if errors.Is(err, sync.ErrInvalidPath) || errors.Is(err, sync.ErrInvalidHash) || errors.Is(err, sync.ErrContentRequired) || errors.Is(err, sync.ErrHashMismatch) || errors.Is(err, sync.ErrContentNotFound) {
+			writeJSON(w, http.StatusBadRequest, map[string]string{"error": err.Error()})
+			return
+		}
 		s.logger.Error("sync delta failed", "error", err)
 		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": "failed to apply delta"})
 		return
 	}
 
 	writeJSON(w, http.StatusOK, sync.DeltaResponse{
-		ServerDelta: result.ServerDelta,
-		Conflicts:   result.Conflicts,
+		ServerDelta:   result.ServerDelta,
+		Conflicts:     result.Conflicts,
+		NewSnapshotID: result.NewSnapshotID,
 	})
 }
 
@@ -78,8 +94,22 @@ func (s *Server) handleSyncResolve(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	snapshot, err := s.syncService.ResolveConflicts(r.Context(), req.SnapshotID, req.Resolutions)
+	principal, ok := requirePrincipal(r)
+	if !ok {
+		writeJSON(w, http.StatusUnauthorized, map[string]string{"error": "authentication required"})
+		return
+	}
+
+	snapshot, err := s.syncService.ResolveConflicts(r.Context(), req.SnapshotID, principal.UserID, req.Resolutions)
 	if err != nil {
+		if errors.Is(err, sync.ErrForbidden) {
+			writeJSON(w, http.StatusForbidden, map[string]string{"error": "forbidden"})
+			return
+		}
+		if errors.Is(err, sync.ErrInvalidPath) || errors.Is(err, sync.ErrInvalidHash) || errors.Is(err, sync.ErrContentRequired) || errors.Is(err, sync.ErrHashMismatch) || errors.Is(err, sync.ErrContentNotFound) {
+			writeJSON(w, http.StatusBadRequest, map[string]string{"error": err.Error()})
+			return
+		}
 		s.logger.Error("sync resolve failed", "error", err)
 		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": "failed to resolve conflicts"})
 		return
@@ -99,6 +129,10 @@ func (s *Server) handleContentFetch(w http.ResponseWriter, r *http.Request) {
 
 	content, err := s.syncService.GetContent(hash)
 	if err != nil {
+		if errors.Is(err, sync.ErrInvalidHash) {
+			writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid content hash"})
+			return
+		}
 		if os.IsNotExist(err) {
 			writeJSON(w, http.StatusNotFound, map[string]string{"error": "content not found"})
 			return