gerbeur/api/routes/comments.ts

import { Router } from "@oak/oak";
import {
  APIErrorCode,
  APIException,
  type APIResponse,
  type Comment,
  isCreateCommentRequest,
  isUpdateCommentRequest,
} from "../model/interfaces.ts";
import { authMiddleware } from "../middleware/auth.ts";
import { can } from "../lib/permissions.ts";
import { parseOptionalAuth } from "../lib/auth.ts";
import { parsePagination } from "../lib/pagination.ts";
import {
  createComment,
  deleteComment,
  getCommentDumpId,
  getComments,
  updateComment,
} from "../services/comment-service.ts";
import { getCommentLikers } from "../services/comment-like-service.ts";
import { getDump } from "../services/dump-service.ts";
import {
  broadcastCommentCreated,
  broadcastCommentDeleted,
  broadcastCommentUpdated,
} from "../services/ws-service.ts";

const router = new Router({ prefix: "/api" });

// GET /api/dumps/:dumpId/comments — optional auth (to access private dump comments)
router.get("/dumps/:dumpId/comments", async (ctx) => {
  const requestingUserId = await parseOptionalAuth(ctx) ?? undefined;
  const dump = getDump(ctx.params.dumpId, requestingUserId);
  const comments = getComments(dump.id);
  const responseBody: APIResponse<Comment[]> = {
    success: true,
    data: comments,
  };
  ctx.response.body = responseBody;
});

// POST /api/dumps/:dumpId/comments — auth required
router.post("/dumps/:dumpId/comments", authMiddleware, async (ctx) => {
  const userId = ctx.state.user.userId;
  const dump = getDump(ctx.params.dumpId, userId);
  const body = await ctx.request.body.json();
  if (!isCreateCommentRequest(body)) {
    throw new APIException(
      APIErrorCode.VALIDATION_ERROR,
      400,
      "Invalid comment data",
    );
  }
  const comment = createComment(
    dump.id,
    userId,
    body.body,
    body.parentId ?? undefined,
  );
  if (!dump.isPrivate) broadcastCommentCreated(comment);
  const responseBody: APIResponse<Comment> = { success: true, data: comment };
  ctx.response.status = 201;
  ctx.response.body = responseBody;
});

// PATCH /api/comments/:commentId — auth required
router.patch("/comments/:commentId", authMiddleware, async (ctx) => {
  const userId = ctx.state.user.userId;
  const canModerate = can(ctx.state.user, "comment:moderate");
  const body = await ctx.request.body.json();
  if (!isUpdateCommentRequest(body)) {
    throw new APIException(
      APIErrorCode.VALIDATION_ERROR,
      400,
      "Invalid comment data",
    );
  }
  const { comment, isPrivate } = updateComment(
    ctx.params.commentId,
    body.body,
    userId,
    canModerate,
  );
  if (!isPrivate) broadcastCommentUpdated(comment);
  const responseBody: APIResponse<Comment> = { success: true, data: comment };
  ctx.response.body = responseBody;
});

// GET /api/comments/:commentId/likers — optional auth (to access private dump's comment likers)
router.get("/comments/:commentId/likers", async (ctx) => {
  const requestingUserId = await parseOptionalAuth(ctx) ?? undefined;
  const dumpId = getCommentDumpId(ctx.params.commentId);
  getDump(dumpId, requestingUserId); // enforces privacy, 404s if not visible
  const { page, limit } = parsePagination(ctx.request.url.searchParams);
  const { items, total } = getCommentLikers(
    ctx.params.commentId,
    page,
    limit,
  );
  ctx.response.body = {
    success: true,
    data: {
      items: items.map(({ passwordHash: _, email: _e, ...pub }) => pub),
      total,
      hasMore: page * limit < total,
    },
  };
});

// DELETE /api/comments/:commentId — auth required
router.delete("/comments/:commentId", authMiddleware, (ctx) => {
  const userId = ctx.state.user.userId;
  const canModerate = can(ctx.state.user, "comment:moderate");
  const { dumpId, isPrivate } = deleteComment(
    ctx.params.commentId,
    userId,
    canModerate,
  );
  if (!isPrivate) broadcastCommentDeleted(ctx.params.commentId, dumpId);
  const responseBody: APIResponse<null> = { success: true, data: null };
  ctx.response.body = responseBody;
});

export default router;