|
14 | 14 | POST /api/sessions – add a session to activity [host] |
15 | 15 | GET /api/tags – list all tags |
16 | 16 | POST /api/activity-tags – add tags to an activity [host] |
| 17 | + GET /api/activities/:id/comments – list comments for an activity |
| 18 | + POST /api/activities/:id/comments – post a comment [auth] |
| 19 | + DELETE /api/comments/:id – delete a comment [owner|host] |
17 | 20 |
|
18 | 21 | Security model |
19 | 22 | * ALL user PII (username, email, display name, role) is encrypted with a |
@@ -361,6 +364,22 @@ def _is_basic_auth_valid(req, env) -> bool: |
361 | 364 | "CREATE INDEX IF NOT EXISTS idx_sa_session ON session_attendance(session_id)", |
362 | 365 | "CREATE INDEX IF NOT EXISTS idx_sa_user ON session_attendance(user_id)", |
363 | 366 | "CREATE INDEX IF NOT EXISTS idx_at_activity ON activity_tags(activity_id)", |
| 367 | + # Comments |
| 368 | + """CREATE TABLE IF NOT EXISTS comments ( |
| 369 | + id TEXT PRIMARY KEY, |
| 370 | + activity_id TEXT NOT NULL, |
| 371 | + user_id TEXT NOT NULL, |
| 372 | + body TEXT NOT NULL, |
| 373 | + parent_id TEXT, |
| 374 | + created_at TEXT NOT NULL DEFAULT (datetime('now')), |
| 375 | + updated_at TEXT, |
| 376 | + FOREIGN KEY (activity_id) REFERENCES activities(id), |
| 377 | + FOREIGN KEY (user_id) REFERENCES users(id), |
| 378 | + FOREIGN KEY (parent_id) REFERENCES comments(id) |
| 379 | + )""", |
| 380 | + "CREATE INDEX IF NOT EXISTS idx_comments_activity ON comments(activity_id)", |
| 381 | + "CREATE INDEX IF NOT EXISTS idx_comments_parent ON comments(parent_id)", |
| 382 | + "CREATE INDEX IF NOT EXISTS idx_comments_user ON comments(user_id)", |
364 | 383 | ] |
365 | 384 |
|
366 | 385 |
|
@@ -1203,6 +1222,106 @@ async def _dispatch(request, env): |
1203 | 1222 | return await serve_static(path, env) |
1204 | 1223 |
|
1205 | 1224 |
|
| 1225 | + |
| 1226 | +# --------------------------------------------------------------------------- |
| 1227 | +# Comments API |
| 1228 | +# --------------------------------------------------------------------------- |
| 1229 | + |
| 1230 | +async def api_get_comments(req, env, activity_id: str, enc_key: str): |
| 1231 | + """GET /api/activities/:id/comments — list comments for an activity.""" |
| 1232 | + # Check activity exists |
| 1233 | + act = await env.DB.prepare( |
| 1234 | + "SELECT id FROM activities WHERE id = ?" |
| 1235 | + ).bind(activity_id).first() |
| 1236 | + if not act: |
| 1237 | + return err("Activity not found", 404) |
| 1238 | + |
| 1239 | + rows = await env.DB.prepare( |
| 1240 | + "SELECT c.id, c.body, c.parent_id, c.created_at, c.updated_at, " |
| 1241 | + "c.user_id, u.name AS author_name " |
| 1242 | + "FROM comments c " |
| 1243 | + "JOIN users u ON u.id = c.user_id " |
| 1244 | + "WHERE c.activity_id = ? " |
| 1245 | + "ORDER BY c.created_at ASC" |
| 1246 | + ).bind(activity_id).all() |
| 1247 | + |
| 1248 | + comments = [] |
| 1249 | + for r in (rows.results or []): |
| 1250 | + comments.append({ |
| 1251 | + "id": r["id"], |
| 1252 | + "body": decrypt(r["body"], enc_key), |
| 1253 | + "parent_id": r["parent_id"], |
| 1254 | + "created_at": r["created_at"], |
| 1255 | + "updated_at": r["updated_at"], |
| 1256 | + "user_id": r["user_id"], |
| 1257 | + "author": decrypt(r["author_name"], enc_key), |
| 1258 | + }) |
| 1259 | + return ok(comments) |
| 1260 | + |
| 1261 | + |
| 1262 | +async def api_post_comment(req, env, activity_id: str, user, enc_key: str): |
| 1263 | + """POST /api/activities/:id/comments — post a comment (auth required).""" |
| 1264 | + if not user: |
| 1265 | + return err("Authentication required", 401) |
| 1266 | + |
| 1267 | + # Check activity exists |
| 1268 | + act = await env.DB.prepare( |
| 1269 | + "SELECT id FROM activities WHERE id = ?" |
| 1270 | + ).bind(activity_id).first() |
| 1271 | + if not act: |
| 1272 | + return err("Activity not found", 404) |
| 1273 | + |
| 1274 | + body, parse_err = await parse_json_object(req) |
| 1275 | + if parse_err: |
| 1276 | + return parse_err |
| 1277 | + |
| 1278 | + text = (body.get("body") or "").strip() |
| 1279 | + if not text: |
| 1280 | + return err("Comment body is required") |
| 1281 | + if len(text) > 2000: |
| 1282 | + return err("Comment must be 2000 characters or fewer") |
| 1283 | + |
| 1284 | + parent_id = body.get("parent_id") or None |
| 1285 | + if parent_id: |
| 1286 | + parent = await env.DB.prepare( |
| 1287 | + "SELECT id FROM comments WHERE id = ? AND activity_id = ?" |
| 1288 | + ).bind(parent_id, activity_id).first() |
| 1289 | + if not parent: |
| 1290 | + return err("Parent comment not found", 404) |
| 1291 | + |
| 1292 | + cid = new_id() |
| 1293 | + await env.DB.prepare( |
| 1294 | + "INSERT INTO comments (id, activity_id, user_id, body, parent_id) " |
| 1295 | + "VALUES (?, ?, ?, ?, ?)" |
| 1296 | + ).bind(cid, activity_id, user["id"], encrypt(text, enc_key), parent_id).run() |
| 1297 | + |
| 1298 | + return ok({"id": cid, "body": text, "parent_id": parent_id, |
| 1299 | + "user_id": user["id"], "activity_id": activity_id}, "Comment posted") |
| 1300 | + |
| 1301 | + |
| 1302 | +async def api_delete_comment(req, env, comment_id: str, user): |
| 1303 | + """DELETE /api/comments/:id — delete own comment (or host deletes any).""" |
| 1304 | + if not user: |
| 1305 | + return err("Authentication required", 401) |
| 1306 | + |
| 1307 | + comment = await env.DB.prepare( |
| 1308 | + "SELECT c.id, c.user_id, a.host_id " |
| 1309 | + "FROM comments c JOIN activities a ON a.id = c.activity_id " |
| 1310 | + "WHERE c.id = ?" |
| 1311 | + ).bind(comment_id).first() |
| 1312 | + if not comment: |
| 1313 | + return err("Comment not found", 404) |
| 1314 | + |
| 1315 | + is_owner = comment["user_id"] == user["id"] |
| 1316 | + is_host = comment["host_id"] == user["id"] |
| 1317 | + |
| 1318 | + if not (is_owner or is_host): |
| 1319 | + return err("Permission denied", 403) |
| 1320 | + |
| 1321 | + await env.DB.prepare("DELETE FROM comments WHERE id = ?").bind(comment_id).run() |
| 1322 | + return ok(msg="Comment deleted") |
| 1323 | + |
| 1324 | + |
1206 | 1325 | async def on_fetch(request, env): |
1207 | 1326 | try: |
1208 | 1327 | return await _dispatch(request, env) |
|
0 commit comments