Janady13/missionmatch / internal/modules/opportunities/document_handler.go

1package opportunities 2 3import ( 4 "encoding/json" 5 "errors" 6 "io" 7 "net/http" 8 9 "github.com/go-chi/chi/v5" 10 "github.com/google/uuid" 11 12 "github.com/missionworkforce/missionmatch/internal/platform/security" 13 "github.com/missionworkforce/missionmatch/internal/platform/tenant" 14) 15 16// The document intake HTTP surface, directive Section 6 screen 3. 17// 18// Gated on opportunity.manage rather than a read capability, because attaching a customer's solicitation 19// package to an opportunity is a write to tenant data and should state that authority rather than inherit it. 20// 21// EVERY FAILURE MODE HERE RETURNS A REASON A HUMAN CAN ACT ON. "Upload failed" is the message that produces 22// a support ticket; "this file is 81 MB and the cap is 64 MB" is the message that produces a smaller file. 23 24type DocumentHandler struct{ svc *DocumentService } 25 26func NewDocumentHandler(svc *DocumentService) *DocumentHandler { return &DocumentHandler{svc: svc} } 27 28func (h *DocumentHandler) Routes(r chi.Router) { 29 write := security.RequireCapability(security.CapOpportunityManage) 30 read := security.RequireCapability(security.CapCandidateRead) 31 r.With(write).Post("/opportunities/{id}/documents", h.upload) 32 r.With(read).Get("/opportunities/{id}/documents", h.list) 33} 34 35// maxRequestBytes bounds what the server will READ, which is a different control from the size cap on the 36// document itself. Without it a caller can stream forever and the cap is only reached after the bytes are 37// already in memory, which is a denial of service with extra steps. 38const maxRequestBytes = MaxDocumentBytes + (1 << 20) 39 40func (h *DocumentHandler) upload(w http.ResponseWriter, r *http.Request) { 41 oppID := chi.URLParam(r, "id") 42 43 if err := r.ParseMultipartForm(8 << 20); err != nil { 44 writeDocErr(w, http.StatusBadRequest, "this endpoint takes a multipart form with a file field: "+err.Error()) 45 return 46 } 47 file, header, err := r.FormFile("file") 48 if err != nil { 49 writeDocErr(w, http.StatusBadRequest, "no file field in the form") 50 return 51 } 52 defer file.Close() 53 54 // LimitReader with ONE byte of headroom, so exceeding the cap is DETECTED rather than silently truncated 55 // into a corrupt document that hashes differently every time. 56 body, err := io.ReadAll(io.LimitReader(file, maxRequestBytes+1)) 57 if err != nil { 58 writeDocErr(w, http.StatusBadRequest, "could not read the uploaded file: "+err.Error()) 59 return 60 } 61 if len(body) > maxRequestBytes { 62 writeDocErr(w, http.StatusRequestEntityTooLarge, "the upload exceeds the request cap") 63 return 64 } 65 66 p, _ := tenant.UserFromContext(r.Context()) 67 uid, uerr := uuid.Parse(p.UserID) 68 if uerr != nil { 69 writeDocErr(w, http.StatusUnauthorized, "no validated user on this request") 70 return 71 } 72 doc, err := h.svc.Upload(r.Context(), uid, UploadInput{ 73 OpportunityID: oppID, 74 DocumentType: r.FormValue("document_type"), 75 FileName: header.Filename, 76 MediaType: header.Header.Get("Content-Type"), 77 Bytes: body, 78 }) 79 if err != nil { 80 writeDocErr(w, statusForDocumentError(err), err.Error()) 81 return 82 } 83 writeDocJSON(w, http.StatusCreated, doc) 84} 85 86func (h *DocumentHandler) list(w http.ResponseWriter, r *http.Request) { 87 docs, err := h.svc.List(r.Context(), chi.URLParam(r, "id")) 88 if err != nil { 89 writeDocErr(w, statusForDocumentError(err), err.Error()) 90 return 91 } 92 writeDocJSON(w, http.StatusOK, map[string]any{"documents": docs}) 93} 94 95// statusForDocumentError maps a sentinel to a status. Mapping on typed values rather than on message text 96// means renaming an error message never silently changes an HTTP contract. 97func statusForDocumentError(err error) int { 98 switch { 99 case errors.Is(err, ErrDocumentTooLarge): 100 return http.StatusRequestEntityTooLarge 101 case errors.Is(err, ErrMediaTypeRefused): 102 return http.StatusUnsupportedMediaType 103 case errors.Is(err, ErrDuplicateDocument): 104 return http.StatusConflict 105 case errors.Is(err, ErrDocumentEmpty), errors.Is(err, ErrDocumentTypeInvalid): 106 return http.StatusBadRequest 107 case errors.Is(err, ErrOpportunityUnknown): 108 // 404 rather than 403: an opportunity belonging to another tenant must be indistinguishable from one 109 // that does not exist, or the error code itself becomes a cross tenant existence oracle. 110 return http.StatusNotFound 111 case errors.Is(err, ErrNoDatabase): 112 return http.StatusServiceUnavailable 113 default: 114 return http.StatusInternalServerError 115 } 116} 117 118func writeDocJSON(w http.ResponseWriter, code int, v any) { 119 w.Header().Set("Content-Type", "application/json") 120 w.WriteHeader(code) 121 _ = json.NewEncoder(w).Encode(v) 122} 123 124func writeDocErr(w http.ResponseWriter, code int, msg string) { 125 writeDocJSON(w, code, map[string]string{"error": msg}) 126} 127