Establishes the patterns every later backend issue copies: the actor parameter, centralized role checks, and the version-guard/409 sync protocol. The service layer is the seam both REST handlers and future agent tools call, so permissions live here, not in handlers. - service/gardens.go: Service methods take (ctx, actorID, args). requireGardenRole(ctx, actor, gardenID, min) is THE authorization point — owner is implicit via owner_id now; #16 extends it to consult garden_shares. A user with no role gets ErrNotFound (existence masked), not ErrForbidden. Create/Get/List/Update/Delete with input validation (name required, 0 dims default to 10 m on create / rejected on update, negatives always rejected, unit metric|imperial, 100 m cap). - store/gardens.go: version-guarded UPDATE ... WHERE id=? AND version=? RETURNING; a no-match re-reads to return (current row, ErrVersionConflict) vs ErrNotFound. ListGardensForOwner returns a non-nil slice. - api/gardens.go: GET,POST /gardens and GET,PATCH,DELETE /gardens/:id behind requireAuth. writeVersionConflict documents the 409 envelope ({error:{code,message}, current:{...}}) — the contract for every mutable resource. writeResourceError maps ErrNotFound/Forbidden/ InvalidInput/VersionConflict; parseIDParam guards path ids. Tests: service (defaults, validation, owned-only list, version conflict returns current + retry, cross-user ErrNotFound, delete) and api (full CRUD flow, 409 envelope shape, cross-user 404, auth required, create validation). Verified against the running binary: create stores imperial 122x244 cm and list returns it. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi
133 lines
4.3 KiB
Go
133 lines
4.3 KiB
Go
package store
|
|
|
|
import (
|
|
"context"
|
|
"database/sql"
|
|
"errors"
|
|
"fmt"
|
|
|
|
"gitea.stevedudenhoeffer.com/steve/pansy/internal/domain"
|
|
)
|
|
|
|
// gardenColumns lists the gardens columns in the fixed order scanGarden expects.
|
|
const gardenColumns = `id, owner_id, name, width_cm, height_cm, unit_pref, notes, version, created_at, updated_at`
|
|
|
|
func scanGarden(s scanner) (*domain.Garden, error) {
|
|
var g domain.Garden
|
|
if err := s.Scan(
|
|
&g.ID, &g.OwnerID, &g.Name, &g.WidthCM, &g.HeightCM,
|
|
&g.UnitPref, &g.Notes, &g.Version, &g.CreatedAt, &g.UpdatedAt,
|
|
); err != nil {
|
|
return nil, err
|
|
}
|
|
return &g, nil
|
|
}
|
|
|
|
// CreateGarden inserts a garden (owner_id, name, dimensions, unit, notes already
|
|
// set and validated by the service) and returns the stored row.
|
|
func (d *DB) CreateGarden(ctx context.Context, g *domain.Garden) (*domain.Garden, error) {
|
|
res, err := d.sql.ExecContext(ctx,
|
|
`INSERT INTO gardens (owner_id, name, width_cm, height_cm, unit_pref, notes)
|
|
VALUES (?, ?, ?, ?, ?, ?)`,
|
|
g.OwnerID, g.Name, g.WidthCM, g.HeightCM, g.UnitPref, g.Notes,
|
|
)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("store: insert garden: %w", err)
|
|
}
|
|
id, err := res.LastInsertId()
|
|
if err != nil {
|
|
return nil, fmt.Errorf("store: garden insert id: %w", err)
|
|
}
|
|
return d.GetGarden(ctx, id)
|
|
}
|
|
|
|
// GetGarden returns the garden with the given id, or domain.ErrNotFound.
|
|
func (d *DB) GetGarden(ctx context.Context, id int64) (*domain.Garden, error) {
|
|
g, err := scanGarden(d.sql.QueryRowContext(ctx,
|
|
`SELECT `+gardenColumns+` FROM gardens WHERE id = ?`, id))
|
|
if errors.Is(err, sql.ErrNoRows) {
|
|
return nil, domain.ErrNotFound
|
|
}
|
|
if err != nil {
|
|
return nil, fmt.Errorf("store: get garden: %w", err)
|
|
}
|
|
return g, nil
|
|
}
|
|
|
|
// ListGardensForOwner returns the gardens owned by ownerID, newest first. The
|
|
// slice is always non-nil (an empty list, not null). Shared-with-me gardens are
|
|
// added in #16.
|
|
func (d *DB) ListGardensForOwner(ctx context.Context, ownerID int64) ([]domain.Garden, error) {
|
|
rows, err := d.sql.QueryContext(ctx,
|
|
`SELECT `+gardenColumns+` FROM gardens WHERE owner_id = ? ORDER BY created_at DESC, id DESC`,
|
|
ownerID,
|
|
)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("store: list gardens: %w", err)
|
|
}
|
|
defer rows.Close()
|
|
|
|
gardens := []domain.Garden{}
|
|
for rows.Next() {
|
|
g, err := scanGarden(rows)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("store: scan garden: %w", err)
|
|
}
|
|
gardens = append(gardens, *g)
|
|
}
|
|
if err := rows.Err(); err != nil {
|
|
return nil, fmt.Errorf("store: iterate gardens: %w", err)
|
|
}
|
|
return gardens, nil
|
|
}
|
|
|
|
// UpdateGarden applies a version-guarded update (optimistic concurrency): the row
|
|
// is written only if its stored version matches g.Version, and version is
|
|
// incremented on success. It returns:
|
|
// - the updated row, on success;
|
|
// - (current row, domain.ErrVersionConflict) when the version didn't match, so
|
|
// the caller can hand the fresh row back to the client to rebase;
|
|
// - (nil, domain.ErrNotFound) if the row no longer exists.
|
|
//
|
|
// This is the sync contract every mutable resource in pansy follows.
|
|
func (d *DB) UpdateGarden(ctx context.Context, g *domain.Garden) (*domain.Garden, error) {
|
|
updated, err := scanGarden(d.sql.QueryRowContext(ctx,
|
|
`UPDATE gardens
|
|
SET name = ?, width_cm = ?, height_cm = ?, unit_pref = ?, notes = ?,
|
|
version = version + 1,
|
|
updated_at = strftime('%Y-%m-%dT%H:%M:%SZ', 'now')
|
|
WHERE id = ? AND version = ?
|
|
RETURNING `+gardenColumns,
|
|
g.Name, g.WidthCM, g.HeightCM, g.UnitPref, g.Notes, g.ID, g.Version,
|
|
))
|
|
if errors.Is(err, sql.ErrNoRows) {
|
|
// No row matched: distinguish "gone" from "stale version".
|
|
current, gerr := d.GetGarden(ctx, g.ID)
|
|
if gerr != nil {
|
|
return nil, gerr // ErrNotFound (or a real error)
|
|
}
|
|
return current, domain.ErrVersionConflict
|
|
}
|
|
if err != nil {
|
|
return nil, fmt.Errorf("store: update garden: %w", err)
|
|
}
|
|
return updated, nil
|
|
}
|
|
|
|
// DeleteGarden removes a garden (and, via ON DELETE CASCADE, its objects/shares).
|
|
// Returns domain.ErrNotFound if no row was deleted.
|
|
func (d *DB) DeleteGarden(ctx context.Context, id int64) error {
|
|
res, err := d.sql.ExecContext(ctx, `DELETE FROM gardens WHERE id = ?`, id)
|
|
if err != nil {
|
|
return fmt.Errorf("store: delete garden: %w", err)
|
|
}
|
|
n, err := res.RowsAffected()
|
|
if err != nil {
|
|
return fmt.Errorf("store: garden delete rows: %w", err)
|
|
}
|
|
if n == 0 {
|
|
return domain.ErrNotFound
|
|
}
|
|
return nil
|
|
}
|