05/18/2026 Catchup - linksync project work and TicTacToe evaluations on different coding LLMs with OpenCode.

LinkSyncServer/api/endpoints/collections.py

@@ -1,29 +1,40 @@
 """
-LinkSyncServer - Collection CRUD Endpoints
+LinkSyncServer - Collection CRUD Endpoints with SQLAlchemy
 """
 
-from fastapi import APIRouter, Depends, HTTPException, status
+from fastapi import APIRouter, Depends, HTTPException, status, Query, Request
 from sqlalchemy.orm import Session
+from sqlalchemy import func, and_, or_, exists
 from typing import List, Optional
 import uuid
+import logging
+
+from models.base import Base, Bookmark, Collection, AuditLog, get_engine, sessionmaker
+from pydantic import BaseModel, Field
+import os
 
 router = APIRouter(prefix="/api/collections", tags=["Collections"])
 
+# Logging
+logger = logging.getLogger(__name__)
+
 
 class CollectionCreate(BaseModel):
-    name: str
-    description: Optional[str] = None
-    query_type: str  # "static" or "dynamic"
-    query_expression: Optional[dict] = None
-    is_public: bool = False
+    name: str = Field(..., description="Collection name")
+    description: Optional[str] = Field(None, max_length=1024, description="Collection description")
+    query_type: str = Field(default="static", description="Static or dynamic collection")
+    query_expression: Optional[dict] = Field(None, description="Query expression for dynamic collections")
+    is_public: bool = Field(default=False, description="Is collection public")
+    tags: Optional[List[str]] = Field(default_factory=list, description="Collection tags")
 
 
 class CollectionUpdate(BaseModel):
-    name: Optional[str] = None
-    description: Optional[str] = None
-    query_type: Optional[str] = None
-    query_expression: Optional[dict] = None
+    name: Optional[str] = Field(None, max_length=255)
+    description: Optional[str] = Field(None, max_length=1024)
+    query_type: Optional[str] = Field(None)
+    query_expression: Optional[dict] = Field(None)
     is_public: Optional[bool] = None
+    tags: Optional[List[str]] = Field(None)
 
 
 class CollectionResponse(BaseModel):
@@ -35,135 +46,188 @@ class CollectionResponse(BaseModel):
     is_public: bool
     created_at: str
     updated_at: str
+    tags: List[str]
 
 
-def mock_create_collection(data: CollectionCreate) -> CollectionResponse:
-    """Create collection (mock implementation)."""
-    return {
-        "id": str(uuid.uuid4()),
-        "name": data.name,
-        "description": data.description,
-        "query_type": data.query_type,
-        "query_expression": data.query_expression,
-        "is_public": data.is_public,
-        "created_at": "2026-05-11T00:00:00Z",
-        "updated_at": "2026-05-11T00:00:00Z"
-    }
+def get_db():
+    """Get database session."""
+    db_session = sessionmaker(get_engine())()
+    return db_session
 
 
-def mock_get_collections() -> List[CollectionResponse]:
-    """Get all collections (mock implementation)."""
-    return [
-        {
-            "id": str(uuid.uuid4()),
-            "name": "Work Links",
-            "description": "Links for work use",
-            "query_type": "dynamic",
-            "query_expression": {"operation": "OR", "operands": [{"operation": "TERM", "value": "work"}]},
-            "is_public": False,
-            "created_at": "2026-05-11T00:00:00Z",
-            "updated_at": "2026-05-11T00:00:00Z"
-        }
-    ]
+def get_current_user(request: Request):
+    """Get current authenticated user."""
+    SECRET_KEY = os.environ.get("SECRET_KEY")
+    
+    auth_header = request.headers.get("Authorization") or request.headers.get("authorization")
+    
+    if auth_header and auth_header.startswith("Bearer "):
+        token = auth_header[7:]
+        try:
+            import jwt
+            payload = jwt.decode(token, SECRET_KEY, algorithms=["HS256"])
+            return {"username": payload.get("sub"), "id": payload.get("sub")}
+        except Exception:
+            pass
+
+    return {"username": "guest"}
 
 
-def mock_get_collection(collection_id: str) -> CollectionResponse | None:
-    """Get collection by ID (mock implementation)."""
-    if collection_id == "mock-id":
-        return {
-            "id": "mock-id",
-            "name": "Work Links",
-            "description": "Links for work use",
-            "query_type": "dynamic",
-            "query_expression": {"operation": "OR", "operands": [{"operation": "TERM", "value": "work"}]},
-            "is_public": False,
-            "created_at": "2026-05-11T00:00:00Z",
-            "updated_at": "2026-05-11T00:00:00Z"
-        }
-    return None
-
-
-def mock_update_collection(collection_id: str, data: CollectionUpdate) -> CollectionResponse | None:
-    """Update collection."""
-    return mock_get_collection(collection_id)
-
-
-def mock_delete_collection(collection_id: str) -> bool:
-    """Delete collection."""
-    return True
-
-
-def mock_execute_query(query_expression: dict) -> List[dict]:
-    """Execute query against bookmarks (mock implementation)."""
-    return [
-        {
-            "id": str(uuid.uuid4()),
-            "url": "https://example.com/work",
-            "title": "Work Example",
-            "description": "An example",
-            "notes": "",
-            "tags": ["work"],
-            "favicon_url": None,
-            "path": "/Work",
-            "created_at": "2026-05-11T00:00:00Z",
-            "updated_at": "2026-05-11T00:00:00Z",
-            "visit_count": 0,
-            "is_bookmarked": False,
-            "source_set_id": None
-        }
-    ]
-
-
-@router.get("/", response_model=List[CollectionResponse])
-async def list_collections():
-    """List all collections."""
-    return mock_get_collections()
-
-
-@router.get("/{collection_id}", response_model=CollectionResponse)
-async def get_collection(collection_id: str):
-    """Get collection by ID."""
-    collection = mock_get_collection(collection_id)
-    if not collection:
-        raise HTTPException(status_code=404, detail="Collection not found")
-    return collection
-
-
-@router.post("/", response_model=CollectionResponse, status_code=status.HTTP_201_CREATED)
-async def create_collection(data: CollectionCreate):
-    """Create new collection."""
-    collection = mock_create_collection(data)
-    return collection
-
-
-@router.put("/{collection_id}", response_model=CollectionResponse)
-async def update_collection(
-    collection_id: str,
-    data: CollectionUpdate
-):
-    """Update collection."""
-    collection = mock_update_collection(collection_id, data)
-    if not collection:
-        raise HTTPException(status_code=404, detail="Collection not found")
-    return collection
-
-
-@router.delete("/{collection_id}", response_model=dict)
-async def delete_collection(collection_id: str):
-    """Delete collection."""
-    success = mock_delete_collection(collection_id)
-    if not success:
-        raise HTTPException(status_code=404, detail="Collection not found")
-    return {"message": "Collection deleted successfully"}
-
-
-@router.post("/{collection_id}/refresh", response_model=dict)
-async def refresh_collection(collection_id: str):
-    """Refresh dynamic collection (re-evaluate query)."""
-    return {"message": "Collection refreshed successfully"}
-
-
-@router.post("/execute", response_model=List[dict])
-async def execute_query(query_expression: dict):
-    """Execute query and return result set."""
-    return mock_execute_query(query_expression)
+class CollectionManager:
+    """Collection management helper."""
+    
+    @staticmethod
+    def get_collection(collection_id: str) -> Optional[Collection]:
+        """Get collection by ID."""
+        db = get_db()
+        try:
+            collection = db.query(Collection).filter(Collection.id == collection_id).first()
+            return collection
+        except Exception:
+            return None
+    
+    @staticmethod
+    def create_collection(data: CollectionCreate, request: Request) -> Collection:
+        """Create new collection."""
+        db = get_db()
+        
+        collection = Collection(
+            name=data.name,
+            description=data.description,
+            query_type=data.query_type,
+            query_expression=data.query_expression,
+            is_public=data.is_public,
+            tags=TagCollection(tags=data.tags or []),
+        )
+        
+        db.add(collection)
+        db.commit()
+        db.refresh(collection)
+        
+        # Create audit log
+        user = get_current_user(request)
+        try:
+            audit = AuditLog(
+                action="create",
+                entity_type="Collection",
+                entity_id=collection.id,
+                old_value=None,
+                new_value=collection.dict(),
+                user_id=user.get("id")
+            )
+            db.add(audit)
+            db.commit()
+        except Exception:
+            pass
+        
+        return collection
+    
+    @staticmethod
+    def update_collection(collection_id: str, data: CollectionUpdate, request: Request) -> Optional[Collection]:
+        """Update collection."""
+        db = get_db()
+        
+        collection = db.query(Collection).filter(Collection.id == collection_id).first()
+        
+        if not collection:
+            return None
+        
+        # Update fields
+        for field_name, value in data.dict().items():
+            if value is not None:
+                if hasattr(collection, field_name):
+                    setattr(collection, field_name, value)
+                elif field_name == "tags":
+                    if isinstance(value, list):
+                        collection.tags.add(*value)
+                    else:
+                        collection.tags.update(str(value))
+        
+        db.commit()
+        db.refresh(collection)
+        
+        # Create audit log
+        user = get_current_user(request)
+        try:
+            audit = AuditLog(
+                action="update",
+                entity_type="Collection",
+                entity_id=collection_id,
+                old_value=collection.dict(),
+                new_value=collection.dict(),
+                user_id=user.get("id")
+            )
+            db.add(audit)
+            db.commit()
+        except Exception:
+            pass
+        
+        return collection
+    
+    @staticmethod
+    def delete_collection(collection_id: str, request: Request) -> dict:
+        """Delete collection."""
+        db = get_db()
+        
+        collection = db.query(Collection).filter(Collection.id == collection_id).first()
+        
+        if not collection:
+            raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Collection not found")
+        
+        db.delete(collection)
+        db.commit()
+        
+        # Create audit log
+        user = get_current_user(request)
+        try:
+            audit = AuditLog(
+                action="delete",
+                entity_type="Collection",
+                entity_id=collection_id,
+                old_value=collection.dict(),
+                new_value=None,
+                user_id=user.get("id")
+            )
+            db.add(audit)
+            db.commit()
+        except Exception:
+            pass
+        
+        return {"message": "Collection deleted successfully", "deleted_id": collection_id}
+    
+    @staticmethod
+    def get_collection_tags(collection_id: str) -> List[str]:
+        """Get collection tags."""
+        db = get_db()
+        
+        collection = db.query(Collection).filter(Collection.id == collection_id).first()
+        
+        if not collection:
+            return []
+        
+        return list(collection.tags)
+    
+    @staticmethod
+    def get_collection_bookmarks(collection_id: str, limit: int = 50, offset: int = 0) -> List[Bookmark]:
+        """
+        Get bookmarks for collection (static or dynamic).
+        
+        For dynamic collections with query expression:
+        Use query executor to parse and filter bookmarks
+        """
+        db = get_db()
+        
+        collection = db.query(Collection).filter(Collection.id == collection_id).first()
+        
+        if not collection:
+            return []
+        
+        if collection.query_type == "static":
+            # Static collection: get all bookmarks
+            bookmarks = db.query(Bookmark).filter(Bookmark.collection_id == collection_id).limit(limit).offset(offset).all()
+        else:
+            # Dynamic collection: query expression
+            # TODO: Use query executor to parse expression (executor module)
+            bookmarks = db.query(Bookmark).limit(limit).offset(offset).all()
+        
+        return bookmarks

LinkSyncServer/api/endpoints/links.py

@@ -1,36 +1,46 @@
 """
-LinkSyncServer - Link CRUD Endpoints
+LinkSyncServer - Link CRUD Endpoints with SQLAlchemy
 """
 
-from fastapi import APIRouter, Depends, HTTPException, status
-from sqlalchemy.orm import Session
+from fastapi import APIRouter, Depends, HTTPException, status, Query, Request
+from sqlalchemy.orm import Session, sessionmaker
+from sqlalchemy import func, or_
 from typing import List, Optional
 import uuid
+import logging
+import hashlib
+
+from models.base import Base, Bookmark, User, AuditLog, get_engine, create_engine
+from pydantic import BaseModel, Field
+import os
 
 router = APIRouter(prefix="/api/links", tags=["Links"])
 
+# Logging
+logger = logging.getLogger(__name__)
+
 
 class BookmarkCreate(BaseModel):
-    url: str
-    title: str
-    description: Optional[str] = None
-    notes: Optional[str] = None
-    tags: Optional[List[str]] = None
-    favicon_url: Optional[str] = None
-    path: Optional[str] = None
-    visit_count: int = 0
-    is_bookmarked: bool = False
+    url: str = Field(..., description="Bookmark URL")
+    title: str = Field(..., min_length=1, max_length=255, description="Bookmark title")
+    description: Optional[str] = Field(None, max_length=500, description="Optional description")
+    notes: Optional[str] = Field(None, max_length=2000, description="Optional notes")
+    tags: Optional[List[str]] = Field(default_factory=list, description="List of tag names")
+    favicon_url: Optional[str] = Field(None, max_length=512, description="Favicon URL")
+    path: Optional[str] = Field(None, max_length=512, description="Folder path")
+    visit_count: int = Field(ge=0, description="Visit counter")
+    is_bookmarked: bool = Field(default=False, description="Bookmark flag")
 
 
 class BookmarkUpdate(BaseModel):
-    url: Optional[str] = None
-    title: Optional[str] = None
-    description: Optional[str] = None
-    notes: Optional[str] = None
-    tags: Optional[List[str]] = None
-    favicon_url: Optional[str] = None
-    path: Optional[str] = None
-    visit_count: Optional[int] = None
+    url: Optional[str] = Field(None, description="New URL")
+    title: Optional[str] = Field(None, min_length=1, max_length=255)
+    description: Optional[str] = Field(None, max_length=500)
+    notes: Optional[str] = Field(None, max_length=2000)
+    tags: Optional[List[str]] = Field(None)
+    favicon_url: Optional[str] = Field(None, max_length=512)
+    path: Optional[str] = Field(None, max_length=512)
+    visit_count: Optional[int] = Field(None, ge=0)
     is_bookmarked: Optional[bool] = None
 
 
@@ -48,128 +58,301 @@ class BookmarkResponse(BaseModel):
     visit_count: int
     is_bookmarked: bool
     source_set_id: Optional[str]
+    user_id: Optional[str]
 
 
-def get_db():
+def get_db_session():
     """Get database session."""
-    from models.base import get_engine
-    db = get_engine()
-    return db
+    try:
+        return sessionmaker(get_engine())()
+    except Exception:
+        return None
 
 
-def mock_create_bookmark(data: BookmarkCreate) -> dict:
-    """Create bookmark (mock implementation for demo)."""
-    bookmark = {
-        "id": str(uuid.uuid4()),
-        "url": data.url,
-        "title": data.title,
-        "description": data.description,
-        "notes": data.notes,
-        "tags": data.tags or [],
-        "favicon_url": data.favicon_url,
-        "path": data.path,
-        "created_at": "2026-05-11T00:00:00Z",
-        "updated_at": "2026-05-11T00:00:00Z",
-        "visit_count": data.visit_count,
-        "is_bookmarked": data.is_bookmarked,
-        "source_set_id": None
-    }
-    return bookmark
+def get_current_user(request: Request):
+    """Get current authenticated user."""
+    SECRET_KEY = os.environ.get("SECRET_KEY")
+    
+    auth_header = request.headers.get("Authorization") or request.headers.get("authorization")
+    
+    if auth_header and auth_header.startswith("Bearer "):
+        token = auth_header[7:]
+        try:
+            import jwt
+            payload = jwt.decode(token, SECRET_KEY, algorithms=["HS256"])
+            return {"username": payload.get("sub"), "id": payload.get("sub")}
+        except Exception:
+            pass
 
-
-def mock_get_bookmarks() -> List[dict]:
-    """Get all bookmarks (mock implementation)."""
-    return [
-        {
-            "id": str(uuid.uuid4()),
-            "url": "https://example.com",
-            "title": "Example",
-            "description": "An example website",
-            "notes": "",
-            "tags": ["example", "demo"],
-            "favicon_url": None,
-            "path": "/Home",
-            "created_at": "2026-05-11T00:00:00Z",
-            "updated_at": "2026-05-11T00:00:00Z",
-            "visit_count": 0,
-            "is_bookmarked": False,
-            "source_set_id": None
-        }
-    ]
-
-
-def mock_get_bookmark(bookmark_id: str) -> dict | None:
-    """Get single bookmark by ID."""
-    # Mock implementation
-    if bookmark_id == "mock-id":
-        return {
-            "id": "mock-id",
-            "url": "https://example.com",
-            "title": "Example",
-            "description": "An example website",
-            "notes": "",
-            "tags": ["example", "demo"],
-            "favicon_url": None,
-            "path": "/Home",
-            "created_at": "2026-05-11T00:00:00Z",
-            "updated_at": "2026-05-11T00:00:00Z",
-            "visit_count": 0,
-            "is_bookmarked": False,
-            "source_set_id": None
-        }
-    return None
-
-
-def mock_update_bookmark(bookmark_id: str, data: BookmarkUpdate) -> dict | None:
-    """Update bookmark."""
-    # Mock implementation
-    return mock_get_bookmark(bookmark_id)
-
-
-def mock_delete_bookmark(bookmark_id: str) -> bool:
-    """Delete bookmark."""
-    return True
+    return {"username": "guest"}
 
 
 @router.get("/", response_model=List[BookmarkResponse])
-async def list_bookmarks(limit: int = 20, offset: int = 0):
-    """List all bookmarks."""
-    bookmarks = mock_get_bookmarks()
-    return bookmarks[offset:offset + limit]
+async def list_bookmarks(
+    limit: int = Query(20, le=100, ge=1, description="Number of results per page"),
+    offset: int = Query(0, ge=0, description="Offset for pagination"),
+    search: Optional[str] = Query(None, description="Search query"),
+    tags_filter: Optional[List[str]] = Query(None, description="Filter by tags"),
+    path_filter: Optional[str] = Query(None, description="Filter by folder path")
+):
+    """List all bookmarks with optional filters."""
+    db = get_db_session()
+    if not db:
+        return []
+    
+    query = Bookmark.query
+    
+    # Search filter
+    if search:
+        query = query.filter((Bookmark.title.contains(search)) | 
+                            (Bookmark.description.contains(search)) | 
+                            (Bookmark.url.contains(search)))
+    
+    # Tag filter
+    if tags_filter:
+        or_clause = or_(*[Bookmark.tags.contains(tag) for tag in tags_filter])
+        query = query.filter(or_clause)
+    
+    # Path filter
+    if path_filter:
+        query = query.filter(Bookmark.path.contains(path_filter))
+    
+    bookmarks = query.limit(limit).offset(offset).all()
+    return bookmarks
 
 
 @router.get("/{bookmark_id}", response_model=BookmarkResponse)
 async def get_bookmark(bookmark_id: str):
     """Get bookmark by ID."""
-    bookmark = mock_get_bookmark(bookmark_id)
+    db = get_db_session()
+    
+    if not db:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Bookmark not found")
+    
+    bookmark = db.query(Bookmark).filter(Bookmark.id == bookmark_id).first()
+    
     if not bookmark:
-        raise HTTPException(status_code=404, detail="Bookmark not found")
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Bookmark not found")
+    
     return bookmark
 
 
 @router.post("/", response_model=BookmarkResponse, status_code=status.HTTP_201_CREATED)
-async def create_bookmark(data: BookmarkCreate):
+async def create_bookmark(data: BookmarkCreate, request: Request):
     """Create new bookmark."""
-    bookmark = mock_create_bookmark(data)
+    db = get_db_session()
+    
+    if not db:
+        raise HTTPException(status_code=status.HTTP_500_INTERNAL_SERVER_ERROR, detail="Database unavailable")
+    
+    bookmark = Bookmark(
+        url=data.url,
+        title=data.title,
+        description=data.description,
+        notes=data.notes,
+        tags=data.tags or [],
+        favicon_url=data.favicon_url,
+        path=data.path,
+        visit_count=data.visit_count,
+        is_bookmarked=data.is_bookmarked
+    )
+    
+    bookmark_id = f"{data.url[:20]}-{uuid.uuid4()[:8]}"
+    bookmark = db.add(bookmark)
+    db.commit()
+    db.refresh(bookmark)
+    
+    # Get user for audit log
+    user = get_current_user(request)
+    
+    # Create audit log (optional)
+    try:
+        audit = AuditLog(
+            action="create",
+            entity_type="Bookmark",
+            entity_id=bookmark_id,
+            old_value=None,
+            new_value=bookmark.dict(),
+            user_id=user.get("id")
+        )
+        db.add(audit)
+        db.commit()
+    except Exception:
+        pass
+
     return bookmark
 
 
 @router.put("/{bookmark_id}", response_model=BookmarkResponse)
 async def update_bookmark(
     bookmark_id: str,
-    data: BookmarkUpdate
+    data: BookmarkUpdate,
+    request: Request
 ):
     """Update bookmark."""
-    bookmark = mock_update_bookmark(bookmark_id, data)
+    db = get_db_session()
+    
+    if not db:
+        raise HTTPException(status_code=status.HTTP_500_INTERNAL_SERVER_ERROR, detail="Database unavailable")
+    
+    bookmark = db.query(Bookmark).filter(Bookmark.id == bookmark_id).first()
+    
     if not bookmark:
-        raise HTTPException(status_code=404, detail="Bookmark not found")
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Bookmark not found")
+    
+    # Update fields
+    for field_name, value in data.dict().items():
+        if value is not None:
+            setattr(bookmark, field_name, value)
+    
+    db.commit()
+    db.refresh(bookmark)
+    
+    # Get user for audit log
+    user = get_current_user(request)
+    
+    # Create audit log
+    try:
+        old_data = Bookmark(id=bookmark_id, url=bookmark.url, title=bookmark.title).dict()
+        audit = AuditLog(
+            action="update",
+            entity_type="Bookmark",
+            entity_id=bookmark_id,
+            old_value=old_data,
+            new_value=bookmark.dict(),
+            user_id=user.get("id")
+        )
+        db.add(audit)
+        db.commit()
+    except Exception:
+        pass
+
     return bookmark
 
 
 @router.delete("/{bookmark_id}", response_model=dict)
-async def delete_bookmark(bookmark_id: str):
+async def delete_bookmark(bookmark_id: str, request: Request):
     """Delete bookmark."""
-    success = mock_delete_bookmark(bookmark_id)
-    if not success:
-        raise HTTPException(status_code=404, detail="Bookmark not found")
-    return {"message": "Bookmark deleted successfully"}
+    db = get_db_session()
+    
+    if not db:
+        raise HTTPException(status_code=status.HTTP_500_INTERNAL_SERVER_ERROR, detail="Database unavailable")
+    
+    bookmark = db.query(Bookmark).filter(Bookmark.id == bookmark_id).first()
+    
+    if not bookmark:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Bookmark not found")
+    
+    db.delete(bookmark)
+    db.commit()
+    
+    # Get user for audit log
+    user = get_current_user(request)
+    
+    # Create audit log
+    try:
+        audit = AuditLog(
+            action="delete",
+            entity_type="Bookmark",
+            entity_id=bookmark_id,
+            old_value=bookmark.dict(),
+            new_value=None,
+            user_id=user.get("id")
+        )
+        db.add(audit)
+        db.commit()
+    except Exception:
+        pass
+
+    return {"message": "Bookmark deleted successfully", "deleted_id": bookmark_id}
+
+
+@router.post("/{bookmark_id}/tags")
+async def add_tags(bookmark_id: str, tags: List[str], request: Request):
+    """Add tags to bookmark."""
+    db = get_db_session()
+    
+    if not db:
+        raise HTTPException(status_code=status.HTTP_500_INTERNAL_SERVER_ERROR, detail="Database unavailable")
+    
+    bookmark = db.query(Bookmark).filter(Bookmark.id == bookmark_id).first()
+    
+    if not bookmark:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Bookmark not found")
+    
+    for tag in tags:
+        if tag.lower() not in [t.lower() for t in bookmark.tags]:
+            bookmark.tags.append(tag)
+    
+    db.commit()
+    db.refresh(bookmark)
+    
+    return bookmark
+
+
+@router.delete("/{bookmark_id}/tags")
+async def remove_tags(bookmark_id: str, tags_to_remove: List[str], request: Request):
+    """Remove tags from bookmark."""
+    db = get_db_session()
+    
+    if not db:
+        raise HTTPException(status_code=status.HTTP_500_INTERNAL_SERVER_ERROR, detail="Database unavailable")
+    
+    bookmark = db.query(Bookmark).filter(Bookmark.id == bookmark_id).first()
+    
+    if not bookmark:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Bookmark not found")
+    
+    bookmark.tags = [t for t in bookmark.tags if t.lower() not in [tag.lower() for tag in tags_to_remove]]
+    
+    db.commit()
+    db.refresh(bookmark)
+    
+    return bookmark
+
+
+@router.get("/{bookmark_id}/stats")
+async def get_bookmark_stats(bookmark_id: str, request: Request):
+    """Get bookmark statistics."""
+    db = get_db_session()
+    
+    if not db:
+        return {}
+    
+    bookmark = db.query(Bookmark).filter(Bookmark.id == bookmark_id).first()
+    
+    if not bookmark:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Bookmark not found")
+    
+    # Get visit count
+    visits = db.query("SELECT COUNT(*) FROM visits WHERE bookmark_id = :bookmark_id")
+    visit_count = visits.execute({"bookmark_id": bookmark_id})
+    
+    return {
+        "bookmark_id": bookmark_id,
+        "visit_count": visit_count[0][0],
+        "last_visited": visits.execute({"bookmark_id": bookmark_id})
+    }
+
+
+# Audit log helper (optional)
+def create_audit_log(action: str, entity_type: str, entity_id: str, old_value: dict, new_value: dict):
+    """Create audit log entry."""
+    db = get_db_session()
+    
+    if not db:
+        return
+    
+    try:
+        audit = AuditLog(
+            action=action,
+            entity_type=entity_type,
+            entity_id=entity_id,
+            old_value=old_value,
+            new_value=new_value,
+            ip_address=request.client.host if hasattr(request, 'client') and hasattr(request.client, 'host') else None
+        )
+        db.add(audit)
+        db.commit()
+    except Exception:
+        pass

LinkSyncServer/api/endpoints/tags.py

@@ -0,0 +1,188 @@
+"""
+LinkSyncServer - Tag Management Endpoints
+"""
+
+from fastapi import APIRouter, Depends, HTTPException, status, Query
+from sqlalchemy.orm import Session
+from typing import List, Optional
+import logging
+import uuid
+
+from models.base import Base, Tag, Bookmark, get_engine
+from pydantic import BaseModel, Field
+
+router = APIRouter(prefix="/api/tags", tags=["Tags"])
+
+
+class TagCreate(BaseModel):
+    name: str = Field(..., min_length=1, max_length=50)
+    color: Optional[str] = Field(None, max_length=7)
+
+
+class TagUpdate(BaseModel):
+    name: Optional[str] = Field(None)
+    color: Optional[str] = Field(None)
+
+
+class TagResponse(BaseModel):
+    id: str
+    name: str
+    color: Optional[str]
+    created_at: str
+    updated_at: str
+
+
+def get_db_session():
+    """Get database session."""
+    try:
+        return Session(get_engine())
+    except Exception:
+        return None
+
+
+def get_current_user(request):
+    """Get current authenticated user."""
+    SECRET_KEY = None
+    
+    try:
+        auth_header = request.headers.get("Authorization") or request.headers.get("authorization")
+        
+        if auth_header and auth_header.startswith("Bearer "):
+            token = auth_header[7:]
+            import jwt
+            payload = jwt.decode(token, SECRET_KEY, algorithms=["HS256"])
+            return {"username": payload.get("sub"), "id": payload.get("sub")}
+        elif not auth_header:
+            return {"username": "guest"}
+    except:
+        pass
+    
+    return {"username": "guest"}
+
+
+@router.get("/", response_model=List[TagResponse])
+async def list_tags(page: int = Query(1, ge=1), per_page: int = Query(50, ge=1, le=200)):
+    """List tags with pagination."""
+    db = get_db_session()
+    
+    if not db:
+        return []
+    
+    count = db.query(Tag).count()
+    tags = db.query(Tag).order_by(Tag.name).offset((page - 1) * per_page).limit(per_page).all()
+    
+    return tags
+
+
+@router.get("/count", response_model=dict)
+async def tag_count():
+    """Get total tag count."""
+    db = get_db_session()
+    
+    if not db:
+        return {"count": 0}
+    
+    return {"count": db.query(Tag).count()}
+
+
+@router.get("/{tag_id}", response_model=TagResponse)
+async def get_tag(tag_id: str):
+    """Get tag by ID."""
+    db = get_db_session()
+    
+    if not db:
+        raise HTTPException(status_code=404, detail="Tag not found")
+    
+    tag = db.query(Tag).filter(Tag.id == tag_id).first()
+    
+    if not tag:
+        raise HTTPException(status_code=404, detail="Tag not found")
+    
+    return tag
+
+
+@router.get("/{tag_id}/links")
+async def get_tag_links(tag_id: str, limit: int = Query(50, ge=1), offset: int = Query(0, ge=0)):
+    """Get links for tag.""""
+    db = get_db_session()
+    
+    if not db:
+        return []
+    
+    tag = db.query(Tag).filter(Tag.id == tag_id).first()
+    
+    if not tag:
+        raise HTTPException(status_code=404, detail="Tag not found")
+    
+    links = db.query(Bookmark).join(Tag).filter(Tag.id == tag_id).limit(limit).offset(offset).all()
+    
+    return links
+
+
+@router.post("/", response_model=TagResponse, status_code=201)
+async def create_tag(data: TagCreate, request):
+    """Create new tag."""
+    db = get_db_session()
+    
+    if not db:
+        raise HTTPException(status_code=500, detail="Database unavailable")
+    
+    tag = Tag(
+        id=f"tag-{uuid.uuid4()[:8]}",
+        name=data.name,
+        color=data.color
+    )
+    
+    db.add(tag)
+    db.commit()
+    db.refresh(tag)
+    
+    return tag
+
+
+@router.put("/{tag_id}", response_model=TagResponse)
+async def update_tag(tag_id: str, data: TagUpdate):
+    """Update tag."""
+    db = get_db_session()
+    
+    if not db:
+        raise HTTPException(status_code=500, detail="Database unavailable")
+    
+    tag = db.query(Tag).filter(Tag.id == tag_id).first()
+    
+    if not tag:
+        raise HTTPException(status_code=404, detail="Tag not found")
+    
+    for field_name in ["name", "color"]:
+        if field_name in data.dict() and data.dict()[field_name] is not None:
+            setattr(tag, field_name, data.dict()[field_name])
+    
+    db.commit()
+    db.refresh(tag)
+    
+    return tag
+
+
+@router.delete("/{tag_id}", response_model=dict)
+async def delete_tag(tag_id: str):
+    """Delete tag (and remove from all links)."""
+    db = get_db_session()
+    
+    if not db:
+        raise HTTPException(status_code=500, detail="Database unavailable")
+    
+    tag = db.query(Tag).filter(Tag.id == tag_id).first()
+    
+    if not tag:
+        raise HTTPException(status_code=404, detail="Tag not found")
+    
+    # Remove tag from all bookmarks
+    bookmarks = db.query(Bookmark).filter(Bookmark.tags.contains(tag.name)).all()
+    
+    for bookmark in bookmarks:
+        bookmark.tags = [t for t in bookmark.tags if t[0] != tag_id]
+    
+    db.delete(tag)
+    db.commit()
+    
+    return {"message": f"Tag '{tag.name}' deleted and removed from all links"}