Janady13/missionmatch / internal/modules/recruiting/handler.go

1package recruiting 2 3import ( 4 "encoding/json" 5 "errors" 6 "net/http" 7 "sort" 8 "strconv" 9 10 "github.com/go-chi/chi/v5" 11 "github.com/google/uuid" 12 13 "github.com/missionworkforce/missionmatch/internal/platform/security" 14 "github.com/missionworkforce/missionmatch/internal/platform/tenant" 15) 16 17type Handler struct{ svc *Service } 18 19func NewHandler(svc *Service) *Handler { return &Handler{svc: svc} } 20 21// Routes mounts the client and contact surface. Reads are open to every role because a recruiter, 22// a member and a viewer all need to see who the organization works with. Writes are gated on 23// requirement.write, which the matrix grants to owner, admin and recruiter. 24func (h *Handler) Routes(r chi.Router) { 25 read := security.RequireCapability(security.CapCandidateRead) 26 write := security.RequireCapability(security.CapRequirementEdit) 27 28 r.With(read).Get("/clients", h.listClients) 29 r.With(read).Get("/clients/{clientID}", h.getClient) 30 r.With(write).Post("/clients", h.createClient) 31 r.With(write).Patch("/clients/{clientID}", h.updateClient) 32 r.With(write).Post("/clients/{clientID}/contacts", h.createContact) 33 r.With(write).Patch("/contacts/{contactID}", h.updateContact) 34 // Ownership. Claiming and releasing are ordinary recruiter actions; reassigning someone else's 35 // account is a management decision and the service gates it on admin. 36 r.With(write).Post("/clients/{clientID}/claim", h.claim) 37 r.With(write).Post("/clients/{clientID}/release", h.release) 38 r.With(write).Post("/clients/{clientID}/reassign", h.reassign) 39 40 // Requisitions. Status is not editable through PATCH: it moves clocks and writes history, so it has 41 // its own endpoint where the transition graph decides whether the move is legal. 42 r.With(read).Get("/requisitions", h.listRequisitions) 43 r.With(read).Get("/requisitions/{reqID}", h.getRequisition) 44 r.With(write).Post("/requisitions", h.createRequisition) 45 r.With(write).Patch("/requisitions/{reqID}", h.updateRequisition) 46 r.With(write).Post("/requisitions/{reqID}/status", h.changeStatus) 47 r.With(write).Post("/requisitions/{reqID}/claim", h.claimRequisition) 48 r.With(write).Post("/requisitions/{reqID}/release", h.releaseRequisition) 49 50 // The candidate pipeline. A stage move is a POST to its own endpoint rather than a PATCH field, 51 // for the same reason a requisition status is: it writes history and moves a clock, and the 52 // database validates it under a row lock. 53 r.With(read).Get("/requisitions/{reqID}/pipeline", h.pipelineBoard) 54 r.With(write).Post("/requisitions/{reqID}/applications", h.submitApplication) 55 r.With(read).Get("/applications", h.listApplications) 56 r.With(read).Get("/applications/{appID}", h.getApplication) 57 r.With(write).Post("/applications/{appID}/stage", h.moveStage) 58 // The disposition vocabulary, served rather than hardcoded in the browser, so the UI cannot offer a 59 // reason the database will refuse. 60 r.With(read).Get("/dispositions", h.dispositions) 61 62 // Interviews, offers and placements. All hang off an application, so a candidate considered for two 63 // roles has two of each and neither role's economics can borrow the other's. 64 r.With(read).Get("/applications/{appID}/assignment", h.getAssignment) 65 r.With(write).Post("/applications/{appID}/interviews", h.scheduleInterview) 66 r.With(write).Patch("/interviews/{ivID}", h.updateInterview) 67 r.With(write).Post("/applications/{appID}/offers", h.extendOffer) 68 r.With(write).Post("/offers/{offerID}/status", h.respondToOffer) 69 r.With(write).Post("/applications/{appID}/placement", h.createPlacement) 70 r.With(write).Post("/placements/{plID}/end", h.endPlacement) 71 r.With(read).Get("/placements", h.listPlacements) 72 73 // Recruiter activity. The log is a record: it can be added to and its notes corrected, never 74 // rewritten or deleted, which is what lets Phase 17 derive metrics from it. 75 r.With(read).Get("/activities", h.listActivities) 76 r.With(read).Get("/activities/summary", h.activitySummary) 77 r.With(write).Post("/activities", h.logActivity) 78 r.With(write).Patch("/activities/{actID}/note", h.correctActivityNote) 79 80 // Tasks. The queue is bucketed by the organization working day, not a UTC day, so an evening task 81 // due today does not read as due tomorrow. 82 r.With(read).Get("/tasks/queue", h.taskQueue) 83 r.With(read).Get("/tasks", h.listTasks) 84 r.With(write).Post("/tasks", h.createTask) 85 r.With(write).Patch("/tasks/{taskID}", h.updateTask) 86 r.With(security.RequireCapability(security.CapOrgSettings)).Post("/time-zone", h.setTimeZone) 87 88 // Analytics. Every figure is derived from rows a human created, and the time to fill keeps still 89 // open orders in the calculation rather than quietly excluding them. 90 r.With(read).Get("/analytics", h.analytics) 91 92 // Reporting and exports. The export capability is separate from reading: taking a copy out of the 93 // system is a different act from looking at it, and every export writes an audit row. 94 r.With(read).Get("/reports", h.report) 95 r.With(security.RequireCapability(security.CapExportRun)).Get("/reports/export", h.exportCSV) 96} 97 98func pathUUID(w http.ResponseWriter, r *http.Request, name, label string) (uuid.UUID, bool) { 99 id, err := uuid.Parse(chi.URLParam(r, name)) 100 if err != nil { 101 writeErr(w, http.StatusBadRequest, "invalid "+label+" id", "") 102 return uuid.UUID{}, false 103 } 104 return id, true 105} 106 107func (h *Handler) getAssignment(w http.ResponseWriter, r *http.Request) { 108 id, ok := appIDParam(w, r) 109 if !ok { 110 return 111 } 112 out, err := h.svc.GetAssignment(r.Context(), id) 113 if err != nil { 114 h.fail(w, err) 115 return 116 } 117 writeJSON(w, http.StatusOK, out) 118} 119 120func (h *Handler) scheduleInterview(w http.ResponseWriter, r *http.Request) { 121 id, ok := appIDParam(w, r) 122 if !ok { 123 return 124 } 125 var in CreateInterviewInput 126 if err := decode(w, r, &in); err != nil { 127 writeErr(w, http.StatusBadRequest, "invalid body", "") 128 return 129 } 130 out, err := h.svc.ScheduleInterview(r.Context(), id, in) 131 if err != nil { 132 h.fail(w, err) 133 return 134 } 135 writeJSON(w, http.StatusCreated, out) 136} 137 138func (h *Handler) updateInterview(w http.ResponseWriter, r *http.Request) { 139 id, ok := pathUUID(w, r, "ivID", "interview") 140 if !ok { 141 return 142 } 143 var in UpdateInterviewInput 144 if err := decode(w, r, &in); err != nil { 145 writeErr(w, http.StatusBadRequest, "invalid body", "") 146 return 147 } 148 out, err := h.svc.UpdateInterview(r.Context(), id, in) 149 if err != nil { 150 h.fail(w, err) 151 return 152 } 153 writeJSON(w, http.StatusOK, out) 154} 155 156func (h *Handler) extendOffer(w http.ResponseWriter, r *http.Request) { 157 id, ok := appIDParam(w, r) 158 if !ok { 159 return 160 } 161 var in CreateOfferInput 162 if err := decode(w, r, &in); err != nil { 163 writeErr(w, http.StatusBadRequest, "invalid body", "") 164 return 165 } 166 out, err := h.svc.ExtendOffer(r.Context(), id, in) 167 if err != nil { 168 h.fail(w, err) 169 return 170 } 171 writeJSON(w, http.StatusCreated, out) 172} 173 174func (h *Handler) respondToOffer(w http.ResponseWriter, r *http.Request) { 175 id, ok := pathUUID(w, r, "offerID", "offer") 176 if !ok { 177 return 178 } 179 var in OfferStatusInput 180 if err := decode(w, r, &in); err != nil { 181 writeErr(w, http.StatusBadRequest, "invalid body", "") 182 return 183 } 184 out, err := h.svc.RespondToOffer(r.Context(), id, in) 185 if err != nil { 186 h.fail(w, err) 187 return 188 } 189 writeJSON(w, http.StatusOK, out) 190} 191 192func (h *Handler) createPlacement(w http.ResponseWriter, r *http.Request) { 193 id, ok := appIDParam(w, r) 194 if !ok { 195 return 196 } 197 var in CreatePlacementInput 198 if err := decode(w, r, &in); err != nil { 199 writeErr(w, http.StatusBadRequest, "invalid body", "") 200 return 201 } 202 out, err := h.svc.CreatePlacement(r.Context(), id, in) 203 if err != nil { 204 h.fail(w, err) 205 return 206 } 207 writeJSON(w, http.StatusCreated, out) 208} 209 210func (h *Handler) endPlacement(w http.ResponseWriter, r *http.Request) { 211 id, ok := pathUUID(w, r, "plID", "placement") 212 if !ok { 213 return 214 } 215 var in EndPlacementInput 216 if err := decode(w, r, &in); err != nil { 217 writeErr(w, http.StatusBadRequest, "invalid body", "") 218 return 219 } 220 out, err := h.svc.EndPlacement(r.Context(), id, in) 221 if err != nil { 222 h.fail(w, err) 223 return 224 } 225 writeJSON(w, http.StatusOK, out) 226} 227 228func (h *Handler) listPlacements(w http.ResponseWriter, r *http.Request) { 229 q := r.URL.Query() 230 limit, _ := strconv.Atoi(q.Get("limit")) 231 offset, _ := strconv.Atoi(q.Get("offset")) 232 out, err := h.svc.ListPlacements(r.Context(), q.Get("status"), limit, offset) 233 if err != nil { 234 h.fail(w, err) 235 return 236 } 237 writeJSON(w, http.StatusOK, out) 238} 239 240func appIDParam(w http.ResponseWriter, r *http.Request) (uuid.UUID, bool) { 241 id, err := uuid.Parse(chi.URLParam(r, "appID")) 242 if err != nil { 243 writeErr(w, http.StatusBadRequest, "invalid application id", "") 244 return uuid.UUID{}, false 245 } 246 return id, true 247} 248 249func (h *Handler) pipelineBoard(w http.ResponseWriter, r *http.Request) { 250 id, ok := reqIDParam(w, r) 251 if !ok { 252 return 253 } 254 out, err := h.svc.Board(r.Context(), id) 255 if err != nil { 256 h.fail(w, err) 257 return 258 } 259 writeJSON(w, http.StatusOK, out) 260} 261 262func (h *Handler) submitApplication(w http.ResponseWriter, r *http.Request) { 263 id, ok := reqIDParam(w, r) 264 if !ok { 265 return 266 } 267 var in CreateApplicationInput 268 if err := decode(w, r, &in); err != nil { 269 writeErr(w, http.StatusBadRequest, "invalid body", "") 270 return 271 } 272 out, err := h.svc.Submit(r.Context(), id, in) 273 if err != nil { 274 h.fail(w, err) 275 return 276 } 277 writeJSON(w, http.StatusCreated, out) 278} 279 280func (h *Handler) listApplications(w http.ResponseWriter, r *http.Request) { 281 q := r.URL.Query() 282 limit, _ := strconv.Atoi(q.Get("limit")) 283 offset, _ := strconv.Atoi(q.Get("offset")) 284 out, err := h.svc.ListApplications(r.Context(), q.Get("candidate_id"), q.Get("stage"), limit, offset) 285 if err != nil { 286 h.fail(w, err) 287 return 288 } 289 writeJSON(w, http.StatusOK, out) 290} 291 292func (h *Handler) getApplication(w http.ResponseWriter, r *http.Request) { 293 id, ok := appIDParam(w, r) 294 if !ok { 295 return 296 } 297 out, err := h.svc.GetApplication(r.Context(), id) 298 if err != nil { 299 h.fail(w, err) 300 return 301 } 302 writeJSON(w, http.StatusOK, out) 303} 304 305func (h *Handler) moveStage(w http.ResponseWriter, r *http.Request) { 306 id, ok := appIDParam(w, r) 307 if !ok { 308 return 309 } 310 var in MoveStageInput 311 if err := decode(w, r, &in); err != nil { 312 writeErr(w, http.StatusBadRequest, "invalid body", "") 313 return 314 } 315 out, err := h.svc.MoveStage(r.Context(), id, in) 316 if err != nil { 317 h.fail(w, err) 318 return 319 } 320 writeJSON(w, http.StatusOK, out) 321} 322 323// dispositions serves the closed reason vocabulary with the outcome each code belongs to, so the form 324// can offer only the codes valid for the outcome being recorded. 325func (h *Handler) dispositions(w http.ResponseWriter, r *http.Request) { 326 type item struct { 327 Code string `json:"code"` 328 Outcome string `json:"outcome"` 329 Label string `json:"label"` 330 } 331 out := make([]item, 0, len(dispositionCodes)) 332 for code, outcome := range dispositionCodes { 333 out = append(out, item{Code: code, Outcome: outcome, Label: dispositionLabel(code)}) 334 } 335 sort.Slice(out, func(i, j int) bool { 336 if out[i].Outcome != out[j].Outcome { 337 return out[i].Outcome < out[j].Outcome 338 } 339 return out[i].Code < out[j].Code 340 }) 341 writeJSON(w, http.StatusOK, map[string]any{"dispositions": out, "stages": ladderView()}) 342} 343 344// reqID parses the path parameter, writing the 400 itself so each handler stays two lines. 345func reqIDParam(w http.ResponseWriter, r *http.Request) (uuid.UUID, bool) { 346 id, err := uuid.Parse(chi.URLParam(r, "reqID")) 347 if err != nil { 348 writeErr(w, http.StatusBadRequest, "invalid requisition id", "") 349 return uuid.UUID{}, false 350 } 351 return id, true 352} 353 354func (h *Handler) listRequisitions(w http.ResponseWriter, r *http.Request) { 355 q := r.URL.Query() 356 limit, _ := strconv.Atoi(q.Get("limit")) 357 offset, _ := strconv.Atoi(q.Get("offset")) 358 out, err := h.svc.ListRequisitions(r.Context(), 359 q.Get("client_id"), q.Get("status"), q.Get("owner"), q.Get("q"), limit, offset) 360 if err != nil { 361 h.fail(w, err) 362 return 363 } 364 writeJSON(w, http.StatusOK, out) 365} 366 367func (h *Handler) getRequisition(w http.ResponseWriter, r *http.Request) { 368 id, ok := reqIDParam(w, r) 369 if !ok { 370 return 371 } 372 out, err := h.svc.GetRequisition(r.Context(), id) 373 if err != nil { 374 h.fail(w, err) 375 return 376 } 377 writeJSON(w, http.StatusOK, out) 378} 379 380func (h *Handler) createRequisition(w http.ResponseWriter, r *http.Request) { 381 var in CreateRequisitionInput 382 if err := decode(w, r, &in); err != nil { 383 writeErr(w, http.StatusBadRequest, "invalid body", "") 384 return 385 } 386 out, err := h.svc.CreateRequisition(r.Context(), in) 387 if err != nil { 388 h.fail(w, err) 389 return 390 } 391 writeJSON(w, http.StatusCreated, out) 392} 393 394func (h *Handler) updateRequisition(w http.ResponseWriter, r *http.Request) { 395 id, ok := reqIDParam(w, r) 396 if !ok { 397 return 398 } 399 var in UpdateRequisitionInput 400 if err := decode(w, r, &in); err != nil { 401 writeErr(w, http.StatusBadRequest, "invalid body", "") 402 return 403 } 404 out, err := h.svc.UpdateRequisition(r.Context(), id, in) 405 if err != nil { 406 h.fail(w, err) 407 return 408 } 409 writeJSON(w, http.StatusOK, out) 410} 411 412func (h *Handler) changeStatus(w http.ResponseWriter, r *http.Request) { 413 id, ok := reqIDParam(w, r) 414 if !ok { 415 return 416 } 417 var in ChangeStatusInput 418 if err := decode(w, r, &in); err != nil { 419 writeErr(w, http.StatusBadRequest, "invalid body", "") 420 return 421 } 422 out, err := h.svc.ChangeStatus(r.Context(), id, in) 423 if err != nil { 424 h.fail(w, err) 425 return 426 } 427 writeJSON(w, http.StatusOK, out) 428} 429 430func (h *Handler) claimRequisition(w http.ResponseWriter, r *http.Request) { 431 id, ok := reqIDParam(w, r) 432 if !ok { 433 return 434 } 435 out, err := h.svc.ClaimRequisition(r.Context(), id) 436 if err != nil { 437 h.fail(w, err) 438 return 439 } 440 writeJSON(w, http.StatusOK, out) 441} 442 443func (h *Handler) releaseRequisition(w http.ResponseWriter, r *http.Request) { 444 id, ok := reqIDParam(w, r) 445 if !ok { 446 return 447 } 448 out, err := h.svc.ReleaseRequisition(r.Context(), id) 449 if err != nil { 450 h.fail(w, err) 451 return 452 } 453 writeJSON(w, http.StatusOK, out) 454} 455 456const maxBody = 1 << 20 457 458func decode(w http.ResponseWriter, r *http.Request, v any) error { 459 dec := json.NewDecoder(http.MaxBytesReader(w, r.Body, maxBody)) 460 dec.DisallowUnknownFields() 461 return dec.Decode(v) 462} 463 464func (h *Handler) listClients(w http.ResponseWriter, r *http.Request) { 465 q := r.URL.Query() 466 limit, _ := strconv.Atoi(q.Get("limit")) 467 offset, _ := strconv.Atoi(q.Get("offset")) 468 out, err := h.svc.ListClients(r.Context(), q.Get("status"), q.Get("q"), q.Get("owner"), limit, offset) 469 if err != nil { 470 h.fail(w, err) 471 return 472 } 473 writeJSON(w, http.StatusOK, out) 474} 475 476func (h *Handler) getClient(w http.ResponseWriter, r *http.Request) { 477 id, err := uuid.Parse(chi.URLParam(r, "clientID")) 478 if err != nil { 479 writeErr(w, http.StatusBadRequest, "invalid client id", "") 480 return 481 } 482 out, err := h.svc.GetClient(r.Context(), id) 483 if err != nil { 484 h.fail(w, err) 485 return 486 } 487 writeJSON(w, http.StatusOK, out) 488} 489 490func (h *Handler) createClient(w http.ResponseWriter, r *http.Request) { 491 var in CreateClientInput 492 if err := decode(w, r, &in); err != nil { 493 writeErr(w, http.StatusBadRequest, "invalid body", "") 494 return 495 } 496 out, err := h.svc.CreateClient(r.Context(), in) 497 if err != nil { 498 h.fail(w, err) 499 return 500 } 501 writeJSON(w, http.StatusCreated, out) 502} 503 504func (h *Handler) updateClient(w http.ResponseWriter, r *http.Request) { 505 id, err := uuid.Parse(chi.URLParam(r, "clientID")) 506 if err != nil { 507 writeErr(w, http.StatusBadRequest, "invalid client id", "") 508 return 509 } 510 var in UpdateClientInput 511 if err := decode(w, r, &in); err != nil { 512 writeErr(w, http.StatusBadRequest, "invalid body", "") 513 return 514 } 515 out, err := h.svc.UpdateClient(r.Context(), id, in) 516 if err != nil { 517 h.fail(w, err) 518 return 519 } 520 writeJSON(w, http.StatusOK, out) 521} 522 523func (h *Handler) createContact(w http.ResponseWriter, r *http.Request) { 524 id, err := uuid.Parse(chi.URLParam(r, "clientID")) 525 if err != nil { 526 writeErr(w, http.StatusBadRequest, "invalid client id", "") 527 return 528 } 529 var in CreateContactInput 530 if err := decode(w, r, &in); err != nil { 531 writeErr(w, http.StatusBadRequest, "invalid body", "") 532 return 533 } 534 out, err := h.svc.CreateContact(r.Context(), id, in) 535 if err != nil { 536 h.fail(w, err) 537 return 538 } 539 writeJSON(w, http.StatusCreated, out) 540} 541 542func (h *Handler) updateContact(w http.ResponseWriter, r *http.Request) { 543 id, err := uuid.Parse(chi.URLParam(r, "contactID")) 544 if err != nil { 545 writeErr(w, http.StatusBadRequest, "invalid contact id", "") 546 return 547 } 548 var in UpdateContactInput 549 if err := decode(w, r, &in); err != nil { 550 writeErr(w, http.StatusBadRequest, "invalid body", "") 551 return 552 } 553 out, err := h.svc.UpdateContact(r.Context(), id, in) 554 if err != nil { 555 h.fail(w, err) 556 return 557 } 558 writeJSON(w, http.StatusOK, out) 559} 560 561// fail maps a domain error onto a status and, where the error names a field, returns that field so the 562// UI can mark the offending input rather than showing one sentence at the top of a form. 563// 564// 409 is used for two genuinely different situations and they are distinguished by message: a duplicate 565// value the caller can fix by changing input, and a concurrent edit the caller fixes by reloading. 566func (h *Handler) fail(w http.ResponseWriter, err error) { 567 var dup *DuplicateError 568 var val *ValidationError 569 var notOwner *ErrNotOwner 570 switch { 571 case errors.As(err, &notOwner): 572 // 409 rather than 403: this is not a permissions failure, it is an account someone else holds. 573 // The owner is named so the caller knows who to talk to. 574 writeErrOwner(w, notOwner) 575 case errors.As(err, &dup): 576 // A person is not "in use". The generic phrasing fits a name or an identifier and reads badly for 577 // anything else, so the one case that is a human gets its own sentence. 578 if dup.Field == "candidate" { 579 writeErr(w, http.StatusConflict, "that candidate is already on this job order", "candidate_id") 580 return 581 } 582 writeErr(w, http.StatusConflict, "that "+dup.Field+" is already in use", dup.Field) 583 case errors.As(err, &val): 584 writeErr(w, http.StatusUnprocessableEntity, val.Message, val.Field) 585 case errors.Is(err, ErrConflict): 586 writeErr(w, http.StatusConflict, "the record was changed by someone else, reload and try again", "") 587 case errors.Is(err, ErrNotFound): 588 writeErr(w, http.StatusNotFound, "not found", "") 589 case errors.Is(err, tenant.ErrNoTenant): 590 writeErr(w, http.StatusForbidden, "no tenant context", "") 591 case errors.Is(err, ErrNoDatabase): 592 writeErr(w, http.StatusServiceUnavailable, "database unavailable", "") 593 default: 594 // A wrapped database error can carry table and column names, so it never reaches the caller. 595 writeErr(w, http.StatusInternalServerError, "internal error", "") 596 } 597} 598 599func (h *Handler) claim(w http.ResponseWriter, r *http.Request) { 600 id, err := uuid.Parse(chi.URLParam(r, "clientID")) 601 if err != nil { 602 writeErr(w, http.StatusBadRequest, "invalid client id", "") 603 return 604 } 605 out, err := h.svc.Claim(r.Context(), id) 606 if err != nil { 607 h.fail(w, err) 608 return 609 } 610 writeJSON(w, http.StatusOK, out) 611} 612 613func (h *Handler) release(w http.ResponseWriter, r *http.Request) { 614 id, err := uuid.Parse(chi.URLParam(r, "clientID")) 615 if err != nil { 616 writeErr(w, http.StatusBadRequest, "invalid client id", "") 617 return 618 } 619 out, err := h.svc.Release(r.Context(), id) 620 if err != nil { 621 h.fail(w, err) 622 return 623 } 624 writeJSON(w, http.StatusOK, out) 625} 626 627func (h *Handler) reassign(w http.ResponseWriter, r *http.Request) { 628 id, err := uuid.Parse(chi.URLParam(r, "clientID")) 629 if err != nil { 630 writeErr(w, http.StatusBadRequest, "invalid client id", "") 631 return 632 } 633 var in struct { 634 OwnerUserID string `json:"owner_user_id"` 635 } 636 if err := decode(w, r, &in); err != nil { 637 writeErr(w, http.StatusBadRequest, "invalid body", "") 638 return 639 } 640 to, err := uuid.Parse(in.OwnerUserID) 641 if err != nil { 642 writeErr(w, http.StatusUnprocessableEntity, "owner_user_id must be a user id", "owner_user_id") 643 return 644 } 645 out, err := h.svc.Reassign(r.Context(), id, to) 646 if err != nil { 647 h.fail(w, err) 648 return 649 } 650 writeJSON(w, http.StatusOK, out) 651} 652 653func writeJSON(w http.ResponseWriter, code int, v any) { 654 w.Header().Set("Content-Type", "application/json") 655 w.WriteHeader(code) 656 _ = json.NewEncoder(w).Encode(v) 657} 658 659func writeErr(w http.ResponseWriter, code int, msg, field string) { 660 body := map[string]string{"error": msg} 661 if field != "" { 662 body["field"] = field 663 } 664 writeJSON(w, code, body) 665} 666 667// writeErrOwner returns the holder alongside the message so the UI can offer to contact them or, for an 668// admin, to reassign. 669func writeErrOwner(w http.ResponseWriter, e *ErrNotOwner) { 670 writeJSON(w, http.StatusConflict, map[string]string{ 671 "error": e.Error(), 672 "field": "owner_user_id", 673 "owner_user_id": e.OwnerUserID, 674 "owner_name": e.OwnerName, 675 }) 676} 677 678// --------------------------------------------------------------------------- 679// Recruiter activity 680// --------------------------------------------------------------------------- 681 682func (h *Handler) logActivity(w http.ResponseWriter, r *http.Request) { 683 var in LogActivityInput 684 if err := decode(w, r, &in); err != nil { 685 writeErr(w, http.StatusBadRequest, "invalid body", "") 686 return 687 } 688 out, err := h.svc.LogActivity(r.Context(), in) 689 if err != nil { 690 h.fail(w, err) 691 return 692 } 693 writeJSON(w, http.StatusCreated, out) 694} 695 696func (h *Handler) listActivities(w http.ResponseWriter, r *http.Request) { 697 q := r.URL.Query() 698 limit, _ := strconv.Atoi(q.Get("limit")) 699 offset, _ := strconv.Atoi(q.Get("offset")) 700 out, err := h.svc.ListActivities(r.Context(), ActivityFilter{ 701 Actor: q.Get("actor"), 702 CandidateID: q.Get("candidate_id"), 703 RequisitionID: q.Get("requisition_id"), 704 ApplicationID: q.Get("application_id"), 705 Kind: q.Get("kind"), 706 Since: q.Get("since"), 707 // Captured rows are opt in. A recruiter's own log means what they did, and mixing in everything 708 // the platform recorded on their behalf would drown it. 709 IncludeCaptured: q.Get("include_captured") == "true", 710 }, limit, offset) 711 if err != nil { 712 h.fail(w, err) 713 return 714 } 715 writeJSON(w, http.StatusOK, out) 716} 717 718func (h *Handler) correctActivityNote(w http.ResponseWriter, r *http.Request) { 719 var in CorrectNoteInput 720 if err := decode(w, r, &in); err != nil { 721 writeErr(w, http.StatusBadRequest, "invalid body", "") 722 return 723 } 724 out, err := h.svc.CorrectActivityNote(r.Context(), chi.URLParam(r, "actID"), in.Body) 725 if err != nil { 726 h.fail(w, err) 727 return 728 } 729 writeJSON(w, http.StatusOK, out) 730} 731 732func (h *Handler) activitySummary(w http.ResponseWriter, r *http.Request) { 733 out, err := h.svc.ActivitySummary(r.Context(), r.URL.Query().Get("since")) 734 if err != nil { 735 h.fail(w, err) 736 return 737 } 738 writeJSON(w, http.StatusOK, out) 739} 740 741// --------------------------------------------------------------------------- 742// Tasks 743// --------------------------------------------------------------------------- 744 745func (h *Handler) taskQueue(w http.ResponseWriter, r *http.Request) { 746 q := r.URL.Query() 747 out, err := h.svc.TaskQueueView(r.Context(), q.Get("assignee"), q.Get("include_closed") == "true") 748 if err != nil { 749 h.fail(w, err) 750 return 751 } 752 writeJSON(w, http.StatusOK, out) 753} 754 755func (h *Handler) listTasks(w http.ResponseWriter, r *http.Request) { 756 q := r.URL.Query() 757 limit, _ := strconv.Atoi(q.Get("limit")) 758 offset, _ := strconv.Atoi(q.Get("offset")) 759 out, err := h.svc.ListTasks(r.Context(), q.Get("candidate_id"), q.Get("requisition_id"), 760 q.Get("application_id"), limit, offset) 761 if err != nil { 762 h.fail(w, err) 763 return 764 } 765 writeJSON(w, http.StatusOK, out) 766} 767 768func (h *Handler) createTask(w http.ResponseWriter, r *http.Request) { 769 var in CreateTaskInput 770 if err := decode(w, r, &in); err != nil { 771 writeErr(w, http.StatusBadRequest, "invalid body", "") 772 return 773 } 774 out, err := h.svc.CreateTask(r.Context(), in) 775 if err != nil { 776 h.fail(w, err) 777 return 778 } 779 writeJSON(w, http.StatusCreated, out) 780} 781 782func (h *Handler) updateTask(w http.ResponseWriter, r *http.Request) { 783 id, ok := pathUUID(w, r, "taskID", "task") 784 if !ok { 785 return 786 } 787 var in UpdateTaskInput 788 if err := decode(w, r, &in); err != nil { 789 writeErr(w, http.StatusBadRequest, "invalid body", "") 790 return 791 } 792 out, err := h.svc.UpdateTask(r.Context(), id, in) 793 if err != nil { 794 h.fail(w, err) 795 return 796 } 797 writeJSON(w, http.StatusOK, out) 798} 799 800// setTimeZone is gated on org settings rather than requirement.write. It changes what "today" means for 801// every count in the product, so it is an owner decision and not a recruiter one. 802func (h *Handler) setTimeZone(w http.ResponseWriter, r *http.Request) { 803 var in struct { 804 TimeZone string `json:"time_zone"` 805 } 806 if err := decode(w, r, &in); err != nil { 807 writeErr(w, http.StatusBadRequest, "invalid body", "") 808 return 809 } 810 tz, err := h.svc.SetTimeZone(r.Context(), in.TimeZone) 811 if err != nil { 812 h.fail(w, err) 813 return 814 } 815 writeJSON(w, http.StatusOK, map[string]string{"time_zone": tz}) 816} 817 818func (h *Handler) analytics(w http.ResponseWriter, r *http.Request) { 819 out, err := h.svc.Analytics(r.Context(), r.URL.Query().Get("since")) 820 if err != nil { 821 h.fail(w, err) 822 return 823 } 824 writeJSON(w, http.StatusOK, out) 825} 826 827func (h *Handler) report(w http.ResponseWriter, r *http.Request) { 828 q := r.URL.Query() 829 out, err := h.svc.Report(r.Context(), Period(q.Get("period")), q.Get("since")) 830 if err != nil { 831 h.fail(w, err) 832 return 833 } 834 writeJSON(w, http.StatusOK, out) 835} 836 837// exportCSV streams a report as a downloadable file. 838// 839// Gated on export.run, which is a distinct capability from reading the same data on screen: taking a 840// copy out of the system is a different act from looking at it, and the audit trail treats it that way. 841func (h *Handler) exportCSV(w http.ResponseWriter, r *http.Request) { 842 q := r.URL.Query() 843 body, filename, err := h.svc.Export(r.Context(), ExportKind(q.Get("kind")), 844 Period(q.Get("period")), q.Get("since")) 845 if err != nil { 846 h.fail(w, err) 847 return 848 } 849 w.Header().Set("Content-Type", "text/csv; charset=utf-8") 850 // The filename is generated, never taken from input, so there is nothing to inject into the header. 851 w.Header().Set("Content-Disposition", `attachment; filename="`+filename+`"`) 852 // A downloaded report is a snapshot of a moving system. Caching it would show a stale file that looks 853 // current, and an intermediary caching tenant data is worse than that. 854 w.Header().Set("Cache-Control", "no-store") 855 w.Header().Set("X-Content-Type-Options", "nosniff") 856 w.WriteHeader(http.StatusOK) 857 _, _ = w.Write([]byte(body)) 858} 859