Janady13/missionmatch / internal/modules/collab/handler.go

1package collab 2 3import ( 4 "encoding/json" 5 "errors" 6 "net/http" 7 8 "github.com/go-chi/chi/v5" 9 "github.com/google/uuid" 10 11 "github.com/missionworkforce/missionmatch/internal/platform/security" 12 "github.com/missionworkforce/missionmatch/internal/platform/tenant" 13) 14 15// Handler serves the who is on this surface. 16// 17// THE CAPABILITY CHOICE. Reads are gated on candidate.read, the tier every role holds, because a viewer 18// seeing that Dana is already on a candidate is exactly the collision this prevents and there is no reason to 19// withhold it from them. Writes are gated on candidate.write, the tier that runs a desk, because claiming 20// work you cannot do is not a thing anyone needs. Neither adds a capability to the frozen matrix: the two 21// existing tiers already describe this authority correctly, and inventing work.claim would have meant 22// touching the exhaustively tested matrix to say something it already says. 23type Handler struct{ svc *Service } 24 25func NewHandler(svc *Service) *Handler { return &Handler{svc: svc} } 26 27func (h *Handler) Routes(r chi.Router) { 28 read := security.RequireCapability(security.CapCandidateRead) 29 write := security.RequireCapability(security.CapCandidateWrite) 30 31 r.With(read).Get("/work/mine", h.mine) 32 r.With(read).Get("/work/{entityType}/{entityID}", h.get) 33 // A touch WRITES a presence row, so it is a POST, but it is gated at the READ tier: looking at a record 34 // you are allowed to read is not a privileged act, and requiring the write tier would blind every viewer 35 // on the floor to the fact that they are looking at the same person. 36 r.With(read).Post("/work/{entityType}/{entityID}/touch", h.touch) 37 r.With(write).Post("/work/{entityType}/{entityID}/claim", h.claim) 38 r.With(write).Delete("/work/{entityType}/{entityID}/claim", h.release) 39} 40 41func (h *Handler) params(w http.ResponseWriter, r *http.Request) (string, uuid.UUID, bool) { 42 t := chi.URLParam(r, "entityType") 43 if !ValidEntityType(t) { 44 // 404 rather than 422: an unknown type is an unknown route, and this keeps the surface consistent 45 // with the rest of the API where a thing you may not reach is indistinguishable from absent. 46 writeErr(w, http.StatusNotFound, "no such record type, expected one of: "+typeList()) 47 return "", uuid.Nil, false 48 } 49 id, err := uuid.Parse(chi.URLParam(r, "entityID")) 50 if err != nil { 51 writeErr(w, http.StatusBadRequest, "that is not a record identifier") 52 return "", uuid.Nil, false 53 } 54 return t, id, true 55} 56 57func (h *Handler) get(w http.ResponseWriter, r *http.Request) { 58 t, id, ok := h.params(w, r) 59 if !ok { 60 return 61 } 62 a, err := h.svc.GetActivity(r.Context(), t, id) 63 if err != nil { 64 h.fail(w, err) 65 return 66 } 67 writeJSON(w, http.StatusOK, a) 68} 69 70func (h *Handler) touch(w http.ResponseWriter, r *http.Request) { 71 t, id, ok := h.params(w, r) 72 if !ok { 73 return 74 } 75 a, err := h.svc.Touch(r.Context(), t, id) 76 if err != nil { 77 h.fail(w, err) 78 return 79 } 80 writeJSON(w, http.StatusOK, a) 81} 82 83func (h *Handler) claim(w http.ResponseWriter, r *http.Request) { 84 t, id, ok := h.params(w, r) 85 if !ok { 86 return 87 } 88 var in ClaimInput 89 if r.Body != nil { 90 // An empty body is a valid claim with the defaults, so a decode failure on an absent body is not an 91 // error. A malformed body is. 92 if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 4<<10)).Decode(&in); err != nil && !errors.Is(err, http.ErrBodyReadAfterClose) { 93 in = ClaimInput{} 94 } 95 } 96 a, err := h.svc.TakeClaim(r.Context(), t, id, in, clientIP(r), r.UserAgent()) 97 if err != nil { 98 h.fail(w, err) 99 return 100 } 101 writeJSON(w, http.StatusOK, a) 102} 103 104func (h *Handler) release(w http.ResponseWriter, r *http.Request) { 105 t, id, ok := h.params(w, r) 106 if !ok { 107 return 108 } 109 a, err := h.svc.ReleaseClaim(r.Context(), t, id, clientIP(r), r.UserAgent()) 110 if err != nil { 111 h.fail(w, err) 112 return 113 } 114 writeJSON(w, http.StatusOK, a) 115} 116 117func (h *Handler) mine(w http.ResponseWriter, r *http.Request) { 118 cs, err := h.svc.MyClaims(r.Context()) 119 if err != nil { 120 h.fail(w, err) 121 return 122 } 123 writeJSON(w, http.StatusOK, map[string]any{"claims": cs, "count": len(cs)}) 124} 125 126func (h *Handler) fail(w http.ResponseWriter, err error) { 127 switch { 128 case errors.Is(err, ErrUnknownType): 129 writeErr(w, http.StatusNotFound, "no such record type") 130 case errors.Is(err, ErrNotFound): 131 writeErr(w, http.StatusNotFound, "no such record") 132 case errors.Is(err, ErrClaimedByOther): 133 // 409, and the message names the alternative. A recruiter who genuinely needs the record can take it 134 // explicitly, which is audited, rather than being stuck. 135 writeErr(w, http.StatusConflict, 136 "somebody else is already working this record, take it over explicitly if you need it") 137 case errors.Is(err, ErrNotYours): 138 writeErr(w, http.StatusForbidden, "that claim belongs to somebody else, a manager can release it") 139 case errors.Is(err, ErrNoDatabase): 140 writeErr(w, http.StatusServiceUnavailable, "unavailable") 141 case errors.Is(err, tenant.ErrNoTenant): 142 writeErr(w, http.StatusForbidden, "forbidden") 143 default: 144 writeErr(w, http.StatusInternalServerError, "could not read who is working this record") 145 } 146} 147 148func clientIP(r *http.Request) string { return r.Header.Get("X-Forwarded-For") } 149 150func writeJSON(w http.ResponseWriter, code int, v any) { 151 w.Header().Set("Content-Type", "application/json") 152 w.WriteHeader(code) 153 _ = json.NewEncoder(w).Encode(v) 154} 155 156func writeErr(w http.ResponseWriter, code int, msg string) { 157 writeJSON(w, code, map[string]string{"error": msg}) 158} 159