# Architecture Overview

## Target
- **Repository**: notes-service
- **Path**: /workspace/triedagents-tools/runs/2026-10-28/tools/security-audit-skill/proj
- **Language**: Python 3 (stdlib only)
- **Entry point**: app/server.py

## System Description
A minimal HTTP notes API server using Python's `http.server` and `sqlite3` standard library modules. The service allows authenticated users to create, search, read, and delete their own notes and attachments.

## Components

### 1. HTTP Server (`app/server.py`)
- **Framework**: `http.server.HTTPServer` on 127.0.0.1:8090
- **Handler**: Custom `BaseHTTPRequestHandler` subclass
- **Endpoints**:
  - `GET /search?q=<term>` - Search notes by title (user-scoped)
  - `GET /note?id=<id>` - Get note by ID (user-scoped)
  - `GET /attachment?name=<name>` - Read attachment file
  - `GET /avatar?name=<name>` - Read avatar file from avatars subdirectory
  - `POST /delete?id=<id>` - Delete note by ID

### 2. Authentication
- **Mechanism**: Session token via `X-Session` header
- **Storage**: In-memory `SESSIONS` dictionary (token -> user_id)
- **Login**: Referenced but not implemented in this file (`SESSIONS` filled by `/login`)

### 3. Data Layer
- **Database**: SQLite (`notes.db` via `NOTES_DB` env var)
- **Schema** (inferred):
  - `notes` table: `id`, `title`, `body`, `owner`
- **Files**: Local filesystem (`FILES_DIR` via `NOTES_FILES` env var, default `./files`)
  - Attachments: direct under `FILES_DIR`
  - Avatars: under `FILES_DIR/avatars/`

### 4. Trust Boundaries
| Boundary | Lower-Trust Principal | Higher-Trust Resource | Control |
|----------|----------------------|----------------------|---------|
| HTTP API | Unauthenticated network caller | User notes/data | Session token check |
| HTTP API | Authenticated user (user A) | Another user's notes (user B) | `owner` column filter |
| File read | Authenticated user | Server filesystem | Path join + `startswith` check (avatars only) |
| SQL query | Authenticated user | Database | Parameterized queries (mostly) |

## Attack Surface
1. **Search endpoint** - SQL via `q` parameter
2. **Note endpoint** - SQL via `id` parameter
3. **Delete endpoint** - SQL via `id` parameter
4. **Attachment endpoint** - File read via `name` parameter
5. **Avatar endpoint** - File read via `name` parameter with path validation
6. **Session handling** - In-memory token validation

## Deployment Context
- Single-process, single-threaded HTTP server
- No TLS, no reverse proxy, no WAF
- SQLite database file on local disk
- File storage on local disk
- No rate limiting, no request size limits
- No input validation beyond type coercion (`int()`)