Janady13/missionmatch / internal/modules/opportunities/capture_handler.go

1package opportunities 2 3import ( 4 "encoding/json" 5 "errors" 6 "net/http" 7 "strings" 8 9 "github.com/go-chi/chi/v5" 10 "github.com/jackc/pgx/v5" 11 "github.com/jackc/pgx/v5/pgconn" 12 13 "github.com/missionworkforce/missionmatch/internal/platform/security" 14 "github.com/missionworkforce/missionmatch/internal/platform/tenant" 15) 16 17// CaptureRoutes mounts the tenant tracked opportunity capture surface. cmd/api mounts it under the 18// slateMATCH tool entitlement, and every route additionally requires opportunity.manage. The paths sit 19// under /opportunities/tracked because the public cache read already owns /opportunities/{noticeID}, and 20// chi cannot host two different wildcard names at one path position. 21func (h *Handler) CaptureRoutes(r chi.Router) { 22 manage := security.RequireCapability(security.CapOpportunityManage) 23 r.With(manage).Post("/opportunities/tracked", h.createTracked) 24 r.With(manage).Get("/opportunities/tracked", h.listTracked) 25 r.With(manage).Get("/opportunities/tracked/{id}", h.getTracked) 26 r.With(manage).Patch("/opportunities/tracked/{id}", h.patchTracked) 27 28 // The scope review queue. Reviewing is recruiter and above; it shapes what a requirement will say but 29 // cannot make one live. 30 review := security.RequireCapability(security.CapScopeReview) 31 r.With(review).Get("/opportunities/tracked/{id}/scope", h.listScope) 32 r.With(review).Post("/opportunities/tracked/{id}/scope/items", h.addManualScope) 33 r.With(review).Patch("/opportunities/tracked/{id}/scope/items/{item_id}", h.reviewScopeItem) 34 // SPLIT AND MERGE, the two review actions Phase 2 item 4 names that had no operations. They are POSTs 35 // rather than PATCHes because each one writes SEVERAL rows in one transaction and returns a different 36 // shape from the single item PATCH: a split returns its children, a merge returns the survivor. 37 r.With(review).Post("/opportunities/tracked/{id}/scope/items/{item_id}/split", h.splitScopeItem) 38 r.With(review).Post("/opportunities/tracked/{id}/scope/items/{item_id}/merge", h.mergeScopeItems) 39 r.With(review).Get("/opportunities/tracked/{id}/requirement-drafts", h.listDrafts) 40 // The amendment view, the read side of Section 4 item 11 and the screen Gate C names. 41 r.With(review).Get("/opportunities/tracked/{id}/amendments", h.amendmentView) 42 // GENERATION AND MANUAL COMPLETION, Phase 2 item 5. Both sit at scope.review, one tier BELOW the promotion 43 // gate, and that placement is the point: a reviewer may shape a draft all day and still cannot make it 44 // live. Only requirement.approve crosses into what the scoring engine can see. 45 r.With(review).Post("/opportunities/tracked/{id}/requirement-drafts/generate", h.generateDrafts) 46 r.With(review).Patch("/requirement-drafts/{id}", h.patchDraft) 47 48 // THE PROMOTION GATE. These two routes are the only way anything a machine derived becomes visible to 49 // the scoring engine, so they are held at requirement.approve, one tier above review. The paths are the 50 // directive's own, which collide with nothing. 51 approve := security.RequireCapability(security.CapRequirementApprove) 52 r.With(approve).Post("/requirement-drafts/{id}/approve", h.approveDraft) 53 r.With(approve).Post("/requirement-drafts/{id}/reject", h.rejectDraft) 54} 55 56func (h *Handler) listScope(w http.ResponseWriter, r *http.Request) { 57 items, err := h.svc.ListScope(r.Context(), chi.URLParam(r, "id"), strings.TrimSpace(r.URL.Query().Get("status"))) 58 if err != nil { 59 writeCaptureErr(w, err) 60 return 61 } 62 writeJSON(w, http.StatusOK, items) 63} 64 65func (h *Handler) addManualScope(w http.ResponseWriter, r *http.Request) { 66 var in ManualScopeInput 67 if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 1<<20)).Decode(&in); err != nil { 68 writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid JSON body"}) 69 return 70 } 71 out, err := h.svc.AddManualScope(r.Context(), chi.URLParam(r, "id"), in) 72 if err != nil { 73 writeCaptureErr(w, err) 74 return 75 } 76 writeJSON(w, http.StatusCreated, out) 77} 78 79func (h *Handler) reviewScopeItem(w http.ResponseWriter, r *http.Request) { 80 var in ScopeReview 81 if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 1<<20)).Decode(&in); err != nil { 82 writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid JSON body"}) 83 return 84 } 85 out, err := h.svc.ReviewScopeItem(r.Context(), chi.URLParam(r, "item_id"), in) 86 if err != nil { 87 writeCaptureErr(w, err) 88 return 89 } 90 writeJSON(w, http.StatusOK, out) 91} 92 93// amendmentView returns the version history, the amendment alerts, and the approved requirements whose 94// lineage runs back through this opportunity, which is the only part of the picture with money attached. 95func (h *Handler) amendmentView(w http.ResponseWriter, r *http.Request) { 96 out, err := h.svc.AmendmentViewFor(r.Context(), chi.URLParam(r, "id")) 97 if err != nil { 98 writeCaptureErr(w, err) 99 return 100 } 101 writeJSON(w, http.StatusOK, out) 102} 103 104// generateDrafts derives one requirement draft per accepted staffing scope item that lacks one. It is 105// idempotent, so a reviewer can press it after every batch of acceptances without producing duplicates. 106func (h *Handler) generateDrafts(w http.ResponseWriter, r *http.Request) { 107 created, skipped, err := h.svc.GenerateDrafts(r.Context(), chi.URLParam(r, "id")) 108 if err != nil { 109 writeCaptureErr(w, err) 110 return 111 } 112 writeJSON(w, http.StatusOK, map[string]any{"created": created, "skipped_existing": skipped}) 113} 114 115// patchDraft is a reviewer completing a draft by hand, which is what screen 5 exists for when the document 116// simply does not state a required field. 117func (h *Handler) patchDraft(w http.ResponseWriter, r *http.Request) { 118 var in DraftPatch 119 if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 1<<20)).Decode(&in); err != nil { 120 writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid JSON body"}) 121 return 122 } 123 out, err := h.svc.PatchDraft(r.Context(), chi.URLParam(r, "id"), in) 124 if err != nil { 125 writeCaptureErr(w, err) 126 return 127 } 128 writeJSON(w, http.StatusOK, out) 129} 130 131// splitScopeItem divides one reviewed item into several, each inheriting the parent's citation. 132func (h *Handler) splitScopeItem(w http.ResponseWriter, r *http.Request) { 133 var in struct { 134 Parts []SplitPart `json:"parts"` 135 } 136 if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 1<<20)).Decode(&in); err != nil { 137 writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid JSON body"}) 138 return 139 } 140 out, err := h.svc.SplitScopeItem(r.Context(), chi.URLParam(r, "item_id"), in.Parts) 141 if err != nil { 142 writeCaptureErr(w, err) 143 return 144 } 145 writeJSON(w, http.StatusCreated, map[string]any{"children": out}) 146} 147 148// mergeScopeItems folds other items into this one, which survives and keeps its own citation. 149func (h *Handler) mergeScopeItems(w http.ResponseWriter, r *http.Request) { 150 var in struct { 151 AbsorbIDs []string `json:"absorb_item_ids"` 152 Title string `json:"title"` 153 Description string `json:"description"` 154 ScopeType string `json:"scope_type"` 155 } 156 if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 1<<20)).Decode(&in); err != nil { 157 writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid JSON body"}) 158 return 159 } 160 out, err := h.svc.MergeScopeItems(r.Context(), chi.URLParam(r, "item_id"), in.AbsorbIDs, 161 in.Title, in.Description, in.ScopeType) 162 if err != nil { 163 writeCaptureErr(w, err) 164 return 165 } 166 writeJSON(w, http.StatusOK, out) 167} 168 169func (h *Handler) listDrafts(w http.ResponseWriter, r *http.Request) { 170 out, err := h.svc.ListDrafts(r.Context(), chi.URLParam(r, "id")) 171 if err != nil { 172 writeCaptureErr(w, err) 173 return 174 } 175 writeJSON(w, http.StatusOK, out) 176} 177 178// approveDraft is the AEDT decision endpoint. The service takes FOR UPDATE on the draft, so racing calls 179// elect one winner and the losers receive the winner's requirement with already_promoted set rather than a 180// duplicate. The approver's identity comes from the validated session, never from the request body. 181func (h *Handler) approveDraft(w http.ResponseWriter, r *http.Request) { 182 out, err := h.svc.ApproveDraft(r.Context(), chi.URLParam(r, "id")) 183 if err != nil { 184 if errors.Is(err, ErrDraftRejected) { 185 writeJSON(w, http.StatusConflict, map[string]string{"error": err.Error()}) 186 return 187 } 188 writeCaptureErr(w, err) 189 return 190 } 191 writeJSON(w, http.StatusOK, out) 192} 193 194func (h *Handler) rejectDraft(w http.ResponseWriter, r *http.Request) { 195 if err := h.svc.RejectDraft(r.Context(), chi.URLParam(r, "id")); err != nil { 196 writeCaptureErr(w, err) 197 return 198 } 199 writeJSON(w, http.StatusOK, map[string]string{"status": "rejected"}) 200} 201 202func (h *Handler) createTracked(w http.ResponseWriter, r *http.Request) { 203 var in TrackedOppInput 204 if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 1<<20)).Decode(&in); err != nil { 205 writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid JSON body"}) 206 return 207 } 208 out, err := h.svc.CreateTracked(r.Context(), in) 209 if err != nil { 210 writeCaptureErr(w, err) 211 return 212 } 213 writeJSON(w, http.StatusCreated, out) 214} 215 216func (h *Handler) listTracked(w http.ResponseWriter, r *http.Request) { 217 out, err := h.svc.ListTracked(r.Context(), strings.TrimSpace(r.URL.Query().Get("status")), intParam(r, "limit", defaultLimit)) 218 if err != nil { 219 writeCaptureErr(w, err) 220 return 221 } 222 writeJSON(w, http.StatusOK, out) 223} 224 225func (h *Handler) getTracked(w http.ResponseWriter, r *http.Request) { 226 out, err := h.svc.GetTracked(r.Context(), chi.URLParam(r, "id")) 227 if err != nil { 228 writeCaptureErr(w, err) 229 return 230 } 231 writeJSON(w, http.StatusOK, out) 232} 233 234func (h *Handler) patchTracked(w http.ResponseWriter, r *http.Request) { 235 var p TrackedOppPatch 236 if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 1<<20)).Decode(&p); err != nil { 237 writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid JSON body"}) 238 return 239 } 240 out, err := h.svc.PatchTracked(r.Context(), chi.URLParam(r, "id"), p) 241 if err != nil { 242 writeCaptureErr(w, err) 243 return 244 } 245 writeJSON(w, http.StatusOK, out) 246} 247 248// writeCaptureErr maps the capture path errors: a bad field is 400, a missing or cross org row is 404 (RLS 249// hides another tenant's row so it reads as not found), a missing pool is 503, a missing org context is 401, 250// and any integrity constraint violation (a bad reference such as an unknown capture owner) is a 400. 251func writeCaptureErr(w http.ResponseWriter, err error) { 252 var pgErr *pgconn.PgError 253 switch { 254 case errors.Is(err, ErrInvalidInput): 255 writeJSON(w, http.StatusBadRequest, map[string]string{"error": err.Error()}) 256 case errors.Is(err, pgx.ErrNoRows): 257 writeJSON(w, http.StatusNotFound, map[string]string{"error": "opportunity not found"}) 258 case errors.Is(err, ErrNoDatabase): 259 writeJSON(w, http.StatusServiceUnavailable, map[string]string{"error": "database not configured"}) 260 case errors.Is(err, tenant.ErrNoTenant): 261 writeJSON(w, http.StatusUnauthorized, map[string]string{"error": "no organization context"}) 262 case errors.As(err, &pgErr) && strings.HasPrefix(pgErr.Code, "23"): 263 writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid reference or value"}) 264 default: 265 writeJSON(w, http.StatusInternalServerError, map[string]string{"error": "internal error"}) 266 } 267} 268