Handlers

// PostHandler serves the post endpoints. It reads the request, asks
// services.PostService, and writes the answer; it runs no query of its
// own, so everything a route does is also available to a job or a test.
type PostHandler struct {
    DB *gorm.DB
}

// service is the post service over this handler's database.
func (h *PostHandler) service() *services.PostService {
    return &services.PostService{DB: h.DB}
}

// ctx is the request's context with the caller on it, which the service
// scopes owned rows by. The organization the multitenant plugin resolved and
// the cancellation when the client goes away travel with it.
func (h *PostHandler) ctx(c *gin.Context) context.Context {
    return authz.WithActor(c.Request.Context(), authz.ActorOf(c))
}

// fail answers an error from the service: a version conflict with the version
// the record is at, a missing row with 404, a broken rule with 422 and its
// message, and anything else as an opaque 500 that is logged.
func (h *PostHandler) fail(c *gin.Context, err error, fallback string) {
    var conflict *concurrency.ErrConflict
    switch {
    case errors.As(err, &conflict):
        concurrency.WriteConflict(c, conflict.Current)
    case errors.Is(err, gorm.ErrRecordNotFound):
        c.JSON(http.StatusNotFound, gin.H{
            "error": gin.H{"code": "NOT_FOUND", "message": "Post not found"},
        })
    default:
        respond.WriteError(c, err, fallback)
    }
}

m.Staff.GET("/posts", middleware.RequireRole("ADMIN", "perm:posts.view"), h.List)
m.Staff.GET("/posts/export", middleware.RequireRole("ADMIN", "perm:posts.view"), h.Export)
m.Staff.GET("/posts/:id", middleware.RequireRole("ADMIN", "perm:posts.view"), h.GetByID)
m.Staff.POST("/posts", middleware.RequireRole("ADMIN", "perm:posts.create"), h.Create)
m.Staff.PUT("/posts/:id", middleware.RequireRole("ADMIN", "perm:posts.edit"), h.Update)
m.Staff.PATCH("/posts/:id", middleware.RequireRole("ADMIN", "perm:posts.edit"), h.Patch)
m.Staff.DELETE("/posts/:id", middleware.RequireRole("ADMIN", "perm:posts.delete"), h.Delete)
m.Staff.POST("/posts/bulk", middleware.RequireRole("ADMIN", "perm:posts.delete"), h.Bulk)

// CreatePostRequest is the JSON body accepted by POST /posts.
type CreatePostRequest struct {
    Title     string `json:"title" binding:"required"`
    Body      string `json:"body"`
    Published bool   `json:"published"`
}

func (h *PostHandler) Create(c *gin.Context) {
    var req CreatePostRequest
    if err := c.ShouldBindJSON(&req); err != nil {
        c.JSON(http.StatusUnprocessableEntity, gin.H{
            "error": gin.H{"code": "VALIDATION_ERROR", "message": err.Error()},
        })
        return
    }

    item := models.Post{
        Title:     req.Title,
        Body:      req.Body,
        Published: req.Published,
    }

    if err := h.service().Create(h.ctx(c), &item); err != nil {
        h.fail(c, err, "Failed to create post")
        return
    }

    events.Emitted(c, "posts", "Post", "created", item.ID, item.Title, "", nil, item)

    c.JSON(http.StatusCreated, gin.H{
        "data":    item,
        "message": "Post created successfully",
    })
}

func (h *PostHandler) List(c *gin.Context) {
    res, err := h.service().List(h.ctx(c), paginate.Bind(c), c.Query("archived"))
    if err != nil {
        h.fail(c, err, "Failed to fetch posts")
        return
    }
    c.JSON(http.StatusOK, res) // { data, meta }
}

func (h *PostHandler) GetByID(c *gin.Context) {
    item, err := h.service().GetByID(h.ctx(c), c.Param("id"))
    if err != nil {
        h.fail(c, err, "Failed to load post")
        return
    }

    // The version to send back as If-Match when saving.
    c.Header("ETag", concurrency.Tag(item.Version))
    c.JSON(http.StatusOK, gin.H{"data": item})
}

// UpdatePostRequest is the JSON body accepted by PUT /posts/:id.
// Every field is optional: only what the client sends is applied.
type UpdatePostRequest struct {
    Title     string `json:"title"`
    Body      string `json:"body"`
    Published *bool  `json:"published"`
}

func (h *PostHandler) Update(c *gin.Context) {
    var req UpdatePostRequest
    if err := c.ShouldBindJSON(&req); err != nil {
        c.JSON(http.StatusUnprocessableEntity, gin.H{
            "error": gin.H{"code": "VALIDATION_ERROR", "message": err.Error()},
        })
        return
    }

    updates := map[string]interface{}{}
    if req.Title != "" {
        updates["title"] = req.Title
    }
    if req.Body != "" {
        updates["body"] = req.Body
    }
    if req.Published != nil {
        updates["published"] = *req.Published
    }

    item, err := h.service().Update(h.ctx(c), c.Param("id"), updates, concurrency.FromRequest(c))
    if err != nil {
        h.fail(c, err, "Failed to update post") // 409 on a stale If-Match
        return
    }

    c.Header("ETag", concurrency.Tag(item.Version))
    c.JSON(http.StatusOK, gin.H{
        "data":    item,
        "message": "Post updated successfully",
    })
}

func (h *PostHandler) Delete(c *gin.Context) {
    item, err := h.service().Delete(h.ctx(c), c.Param("id"))
    if err != nil {
        h.fail(c, err, "Failed to delete post")
        return
    }

    events.Emitted(c, "posts", "Post", "deleted", item.ID, item.Title, "", item, nil)
    c.JSON(http.StatusOK, gin.H{"message": "Post deleted successfully"})
}