feat(sync): unified hourly sync cron for QRZ + LoTW

[patrickrb]

Stacked on #219 and #220 — merge those first; this diff will shrink to just the cron changes once they land.

What

Replaces the two daily LoTW-only crons with a single /api/cron/sync orchestrator that runs the full sync cycle for every eligible station, in order:

1. QRZ upload sweep — pending QSOs (NULL/'N'/'R'/'M') to each station's QRZ logbook, 250/station/run cap, failed rows retried every run
2. LoTW upload — existing per-station selection + <1h dedupe, invoked via internal fetch so lotw_upload_logs bookkeeping is unchanged
3. QRZ confirmation download — incremental via the MODSINCE cursor (stations.qrz_last_qsl_rcvd_date)
4. LoTW confirmation download — same internal-fetch pattern, now benefits from the qso_qslsince cursor added in fix(lotw): confirmations never applied - duplicate qsl_lotw_date assignment (42601) #218

Uploads run before downloads so freshly logged QSOs can confirm in the same cycle; QRZ and LoTW legs are serialized so the cross-service 'M' re-upload flags never race. Every leg is incremental and idempotent — any cadence is safe.

This is the piece that makes QRZ sync automatic: until now QRZ upload ran only on-save or manually, and QRZ confirmation download was manual-only (no cron existed at all).

Config

• vercel.json: one hourly cron (0 * * * *, Vercel Pro) replacing the two daily entries; maxDuration: 300 for the new route.
• Old /api/cron/lotw-{upload,download} routes deleted; README "Scheduled sync" updated (self-hosted: one crontab line hitting /api/cron/sync with the CRON_SECRET Bearer header).

Verification

• npm run lint / npm run typecheck / npm run build clean.
• After deploy: curl -H "Authorization: Bearer $CRON_SECRET" https://<host>/api/cron/sync returns per-station results for all four legs; without the header it returns 401.
• Fourth PR of the sync-reliability series (fix(lotw): confirmations never applied - duplicate qsl_lotw_date assignment (42601) #218, fix(qrz): rewrite auto-sync onto the API-key path, delete phantom status system #219, fix(security): require CRON_SECRET on cron + LoTW sync endpoints #220).

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
nodelog	Ready	Preview, Comment	Jul 13, 2026 5:43pm

[Copilot]

Pull request overview

This PR consolidates QRZ + LoTW synchronization into a single hourly cron orchestrator (/api/cron/sync), moving QRZ logic into a shared service layer and tightening cron authentication via a strict CRON_SECRET Bearer token.

Changes:

• Replaces the two LoTW-only daily cron routes with one hourly /api/cron/sync route (QRZ upload → LoTW upload → QRZ download → LoTW download), and updates vercel.json accordingly.
• Introduces src/lib/qrz-sync-service.ts as the single home for QRZ upload/download behavior and rewires the QRZ auto-sync + manual/bulk QRZ endpoints to use it.
• Hardens cron-mode auth for LoTW upload/download endpoints via hasValidCronSecret() and updates docs/migrations to remove legacy/phantom QRZ sync artifacts.

Reviewed changes

Copilot reviewed 22 out of 23 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
vercel.json	Removes the two daily LoTW cron entries and adds a single hourly /api/cron/sync cron with a 300s duration limit.
src/models/Station.ts	Adds station cursor field support and a helper to advance the QRZ download cursor date.
src/models/Contact.ts	Removes legacy QRZ sync fields/APIs, expands “pending QRZ upload” selection, and adds a reupload-flagging helper.
src/lib/qrz.ts	Deletes the legacy username/password QRZ logbook upload implementation (API-key path remains).
src/lib/qrz-sync-service.ts	New QRZ sync service encapsulating single-contact upload, per-station sweeps, and incremental confirmation downloads.
src/lib/qrz-auto-sync.ts	Reworks on-save QRZ auto-sync to use the new service and improves logging/behavior for serverless execution.
src/lib/lotw.ts	Removes a now-unused LoTW ADIF generation helper.
src/lib/cron-auth.ts	Adds strict cron authentication helper (Authorization: Bearer CRON_SECRET only).
src/app/api/lotw/upload/route.ts	Requires CRON_SECRET when X-Cron-Job: true is present (prevents header-only spoofing).
src/app/api/lotw/download/route.ts	Same cron-mode auth hardening as LoTW upload.
src/app/api/cron/sync/route.ts	Adds the unified sync orchestrator route coordinating QRZ + LoTW upload/download legs.
src/app/api/cron/lotw-upload/route.ts	Deletes the legacy LoTW upload cron endpoint (replaced by /api/cron/sync).
src/app/api/cron/lotw-download/route.ts	Deletes the legacy LoTW download cron endpoint (replaced by /api/cron/sync).
src/app/api/contacts/route.ts	Switches QRZ filter query param naming and runs QRZ auto-sync via after() post-response.
src/app/api/contacts/qrz-sync/route.ts	Updates bulk QRZ sync to use qrz-sync-service and adds a station cache for efficiency.
src/app/api/contacts/qrz-download/route.ts	Refactors QRZ confirmation download to use qrz-sync-service.
src/app/api/contacts/[id]/route.ts	Flags contacts for reupload on core field updates and runs auto-sync via after().
src/app/api/contacts/[id]/qrz-sync/route.ts	Updates per-contact QRZ sync to use station API key + qrz-sync-service.
src/app/admin/page.tsx	Updates admin bulk QRZ sync to use the renamed contacts filter query param.
README.md	Documents the new scheduled sync endpoint and CRON_SECRET usage (Vercel + self-hosted).
drizzle/migrations/meta/0004_snapshot.json	Adds updated schema snapshot including QRZ cursor/date and other migration state.
drizzle/migrations/meta/_journal.json	Registers the new migration in Drizzle’s journal.
drizzle/migrations/0004_drop_orphaned_qrz_sync_status_enum.sql	Drops the orphaned QRZ sync enum type tied to nonexistent legacy columns.