drops.rs 95.0%

230 of 242 lines run, 48 of 106 functions · run #530 on main · run missed

//! Drops in the API (oxygenhub#279): `GET`/`POST /drops` (yours; making
//! one), `GET /users/{name}/drops` (someone's public ones),
//! `GET`/`PATCH`/`DELETE /drops/{id}`. Reading a drop needs nothing but
//! its id; changing one needs `repo:write` and to be its owner (or a site
//! administrator, who may also delete it). Forking, starring and comments
//! (oxygenhub#349) need `repo:write` and an account, as on the web.

use super::{caller, not_found, ApiError};
use crate::db;
use crate::drops::{self, DropError, DropFile, NewFile};
use crate::Shared;
use axum::extract::{Path, State};
use axum::http::{HeaderMap, StatusCode};
use axum::Json;
use hub_api::{Drop, DropComment, DropEdit, DropStars, NewDrop, NewDropComment};

impl From<DropError> for ApiError {
    fn from(e: DropError) -> ApiError {
        match e {
            DropError::Bad(m) => ApiError(StatusCode::UNPROCESSABLE_ENTITY, m),
            DropError::Repo(e) => e.into(),
            DropError::Db(e) => e.into(),
        }
    }
}

/// The API's shape of a drop, with its files' content when `content`, its
/// stars (and whether `caller` starred it) and where it was forked from.
async fn shape(
    app: &Shared,
    caller: Option<&db::accounts::Account>,
    row: &db::repos::RepoRow,
    files: &[DropFile],
    content: bool,
) -> Result<Drop, ApiError> {
    let base = app.config.base_url();
    let url = drops::url_of(row);
    let starred = match caller {
        Some(a) => db::repos::starred(&app.db, a.id, row.id).await?,
        None => false,
    };
    let forked_from = match row.forked_from {
        Some(id) => db::repos::get_by_id(&app.db, id).await?.map(|f| format!("{base}{}", drops::url_of(&f))),
        None => None,
    };
    Ok(Drop {
        id: drops::id_of(row).to_string(),
        owner: row.owner.clone(),
        title: row.title.clone(),
        description: row.description.clone(),
        visibility: drops::visibility_label(row).to_string(),
        url: format!("{base}{url}"),
        clone_url: format!("{base}{url}"),
        created_ms: row.created_ms,
        updated_ms: row.updated_ms,
        files: files
            .iter()
            .map(|f| hub_api::DropFile {
                name: f.path.clone(),
                size: f.size,
                content: if content { f.text.clone() } else { None },
                raw_url: format!("{base}{url}/raw/{}/{}", row.default_bookmark, f.path),
            })
            .collect(),
        stars: db::repos::star_count(&app.db, row.id).await?,
        starred,
        forked_from,
        embed_url: format!("{base}{url}/embed"),
    })
}

async fn listed(app: &Shared, caller: Option<&db::accounts::Account>, rows: Vec<db::repos::RepoRow>) -> Result<Vec<Drop>, ApiError> {
    let mut out = Vec::with_capacity(rows.len());
    for row in rows {
        let files = drops::files(app, &row, "").await.map(|(_, f)| f).unwrap_or_default();
        out.push(shape(app, caller, &row, &files, false).await?);
    }
    Ok(out)
}

/// `GET /drops`: the caller's drops, secret ones too.
pub(super) async fn mine(State(app): State<Shared>, headers: HeaderMap) -> Result<Json<Vec<Drop>>, ApiError> {
    let c = caller(&app, &headers).await?;
    let me = c.require("repo:read")?.clone();
    let rows = db::repos::drops_of(&app.db, &me.username).await?;
    Ok(Json(listed(&app, Some(&me), rows).await?))
}

/// `GET /users/{name}/drops`: someone's public drops (all of them to
/// themselves and to site administrators).
pub(super) async fn of_user(State(app): State<Shared>, headers: HeaderMap, Path(name): Path<String>) -> Result<Json<Vec<Drop>>, ApiError> {
    let c = caller(&app, &headers).await?;
    let account = db::accounts::account_by_name(&app.db, &name).await?.ok_or_else(|| not_found("no such user"))?;
    let rows: Vec<_> =
        db::repos::drops_of(&app.db, &account.username).await?.into_iter().filter(|r| drops::listed_to(c.account.as_ref(), r)).collect();
    Ok(Json(listed(&app, c.account.as_ref(), rows).await?))
}

/// `POST /drops`.
pub(super) async fn create(
    State(app): State<Shared>,
    headers: HeaderMap,
    Json(body): Json<NewDrop>,
) -> Result<(StatusCode, Json<Drop>), ApiError> {
    let c = caller(&app, &headers).await?;
    let me = c.require("repo:write")?.clone();
    let files: Vec<NewFile> = body.files.into_iter().map(|f| NewFile { name: f.name, content: f.content }).collect();
    let row = drops::create(&app, &me, &body.title, &body.description, body.secret, &files).await?;
    let (_, files) = drops::files(&app, &row, "").await?;
    Ok((StatusCode::CREATED, Json(shape(&app, Some(&me), &row, &files, true).await?)))
}

async fn row_of(app: &Shared, id: &str) -> Result<db::repos::RepoRow, ApiError> {
    if !crate::repos::names::valid_drop_id(id) {
        return Err(not_found("no such drop"));
    }
    db::repos::drop_by_id(&app.db, id).await?.ok_or_else(|| not_found("no such drop"))
}

/// `GET /drops/{id}`: anyone with the id, its files' content included.
pub(super) async fn view(State(app): State<Shared>, headers: HeaderMap, Path(id): Path<String>) -> Result<Json<Drop>, ApiError> {
    let c = caller(&app, &headers).await?;
    let row = row_of(&app, &id).await?;
    if c.account.as_ref().is_some_and(|a| a.blocked()) {
        return Err(not_found("no such drop"));
    }
    let (_, files) = drops::files(&app, &row, "").await?;
    Ok(Json(shape(&app, c.account.as_ref(), &row, &files, true).await?))
}

/// The drop, when the caller may change it (its owner) or, `deleting`,
/// delete it (its owner or a site administrator); else 403.
async fn writable(
    app: &Shared,
    headers: &HeaderMap,
    id: &str,
    deleting: bool,
) -> Result<(db::accounts::Account, db::repos::RepoRow), ApiError> {
    let c = caller(app, headers).await?;
    let me = c.require("repo:write")?.clone();
    let row = row_of(app, id).await?;
    let may = if deleting { drops::may_delete(Some(&me), &row) } else { drops::may_edit(Some(&me), &row) };
    if !may {
        return Err(super::forbidden(if deleting {
            "only the drop's owner or a site administrator may delete it"
        } else {
            "only the drop's owner may change it"
        }));
    }
    Ok((me, row))
}

/// `PATCH /drops/{id}`.
pub(super) async fn edit(
    State(app): State<Shared>,
    headers: HeaderMap,
    Path(id): Path<String>,
    Json(body): Json<DropEdit>,
) -> Result<Json<Drop>, ApiError> {
    let (me, row) = writable(&app, &headers, &id, false).await?;
    let mut seen = Vec::new();
    let mut files = Vec::with_capacity(body.files.len());
    for f in body.files {
        let name = drops::check_name(&f.name).map_err(|m| ApiError(StatusCode::UNPROCESSABLE_ENTITY, m))?;
        if seen.contains(&name) {
            return Err(ApiError(StatusCode::UNPROCESSABLE_ENTITY, format!("{name} is named twice.")));
        }
        seen.push(name.clone());
        files.push(oxy_core::repo::FileEdit { path: name, content: f.content.map(|c| c.replace("\r\n", "\n").into_bytes()) });
    }
    let update = drops::Update {
        title: body.title.unwrap_or_else(|| row.title.clone()),
        description: body.description.unwrap_or_else(|| row.description.clone()),
        secret: body.secret.unwrap_or(row.visibility() != hub_api::Visibility::Public),
        files,
        message: body.message.unwrap_or_default(),
    };
    drops::update(&app, &me, &row, update).await?;
    let row = db::repos::get_by_id(&app.db, row.id).await?.ok_or_else(|| not_found("no such drop"))?;
    let (_, files) = drops::files(&app, &row, "").await?;
    Ok(Json(shape(&app, Some(&me), &row, &files, true).await?))
}

/// `DELETE /drops/{id}`.
pub(super) async fn delete(State(app): State<Shared>, headers: HeaderMap, Path(id): Path<String>) -> Result<StatusCode, ApiError> {
    let (me, row) = writable(&app, &headers, &id, true).await?;
    drops::delete(&app, &me, &row).await?;
    Ok(StatusCode::NO_CONTENT)
}

/// The drop and the signed-in caller, with `repo:write`, for forking,
/// starring and commenting: anyone who may read the drop (its id) may.
async fn reader(app: &Shared, headers: &HeaderMap, id: &str) -> Result<(db::accounts::Account, db::repos::RepoRow), ApiError> {
    let c = caller(app, headers).await?;
    let me = c.require("repo:write")?.clone();
    if me.blocked() {
        return Err(not_found("no such drop"));
    }
    Ok((me, row_of(app, id).await?))
}

/// `POST /drops/{id}/fork` (oxygenhub#349): a new drop of the caller's
/// whose history starts from this one, as the page's FORK.
pub(super) async fn fork(
    State(app): State<Shared>,
    headers: HeaderMap,
    Path(id): Path<String>,
) -> Result<(StatusCode, Json<Drop>), ApiError> {
    let (me, row) = reader(&app, &headers, &id).await?;
    let made = drops::fork(&app, &me, &row).await?;
    let (_, files) = drops::files(&app, &made, "").await?;
    Ok((StatusCode::CREATED, Json(shape(&app, Some(&me), &made, &files, true).await?)))
}

/// `PUT /drops/{id}/star` stars the drop, `DELETE` takes the star back;
/// either is the same however often it is asked.
async fn set_star(app: &Shared, headers: &HeaderMap, id: &str, want: bool) -> Result<Json<DropStars>, ApiError> {
    let (me, row) = reader(app, headers, id).await?;
    if db::repos::starred(&app.db, me.id, row.id).await? != want {
        db::repos::toggle_star(&app.db, me.id, row.id).await?;
    }
    Ok(Json(DropStars { stars: db::repos::star_count(&app.db, row.id).await?, starred: want }))
}

pub(super) async fn star(State(app): State<Shared>, headers: HeaderMap, Path(id): Path<String>) -> Result<Json<DropStars>, ApiError> {
    set_star(&app, &headers, &id, true).await
}

pub(super) async fn unstar(State(app): State<Shared>, headers: HeaderMap, Path(id): Path<String>) -> Result<Json<DropStars>, ApiError> {
    set_star(&app, &headers, &id, false).await
}

fn comment_of(c: db::repos::DropComment) -> DropComment {
    DropComment { id: c.id, author: c.author, body: c.body, created_ms: c.created_ms }
}

/// `GET /drops/{id}/comments`: oldest first, to anyone with the id.
pub(super) async fn comments(
    State(app): State<Shared>,
    headers: HeaderMap,
    Path(id): Path<String>,
) -> Result<Json<Vec<DropComment>>, ApiError> {
    let c = caller(&app, &headers).await?;
    if c.account.as_ref().is_some_and(|a| a.blocked()) {
        return Err(not_found("no such drop"));
    }
    let row = row_of(&app, &id).await?;
    Ok(Json(db::repos::drop_comments(&app.db, row.id).await?.into_iter().map(comment_of).collect()))
}

/// `POST /drops/{id}/comments`: the drop's owner is told.
pub(super) async fn add_comment(
    State(app): State<Shared>,
    headers: HeaderMap,
    Path(id): Path<String>,
    Json(body): Json<NewDropComment>,
) -> Result<(StatusCode, Json<DropComment>), ApiError> {
    let (me, row) = reader(&app, &headers, &id).await?;
    let n = drops::add_comment(&app, &me, &row, &body.body).await?;
    let c = db::repos::drop_comment(&app.db, row.id, n).await?.ok_or_else(|| not_found("no such comment"))?;
    Ok((StatusCode::CREATED, Json(comment_of(c))))
}

/// `DELETE /drops/{id}/comments/{n}`: its author, the drop's owner or a
/// site administrator.
pub(super) async fn delete_comment(
    State(app): State<Shared>,
    headers: HeaderMap,
    Path((id, n)): Path<(String, i64)>,
) -> Result<StatusCode, ApiError> {
    let (me, row) = reader(&app, &headers, &id).await?;
    let c = db::repos::drop_comment(&app.db, row.id, n).await?.ok_or_else(|| not_found("no such comment"))?;
    if !drops::may_delete_comment(Some(&me), &row, &c) {
        return Err(super::forbidden("only the comment's author, the drop's owner or a site administrator may delete it"));
    }
    db::repos::delete_drop_comment(&app.db, row.id, n).await?;
    Ok(StatusCode::NO_CONTENT)
}

`/`	Search
`g` `c`	Code
`g` `h`	History
`g` `b`	Bookmarks
`g` `t`	Trust
`y`	Permalink to this state (files and trees)
`?`	This sheet

1		//! Drops in the API (oxygenhub#279): `GET`/`POST /drops` (yours; making
2		//! one), `GET /users/{name}/drops` (someone's public ones),
3		//! `GET`/`PATCH`/`DELETE /drops/{id}`. Reading a drop needs nothing but
4		//! its id; changing one needs `repo:write` and to be its owner (or a site
5		//! administrator, who may also delete it). Forking, starring and comments
6		//! (oxygenhub#349) need `repo:write` and an account, as on the web.
7
8		use super::{caller, not_found, ApiError};
9		use crate::db;
10		use crate::drops::{self, DropError, DropFile, NewFile};
11		use crate::Shared;
12		use axum::extract::{Path, State};
13		use axum::http::{HeaderMap, StatusCode};
14		use axum::Json;
15		use hub_api::{Drop, DropComment, DropEdit, DropStars, NewDrop, NewDropComment};
16
17		impl From<DropError> for ApiError {
18	2×	fn from(e: DropError) -> ApiError {
19	2×	match e {
20	2×	DropError::Bad(m) => ApiError(StatusCode::UNPROCESSABLE_ENTITY, m),
21	0×	DropError::Repo(e) => e.into(),
22	0×	DropError::Db(e) => e.into(),
23		}
24	2×	}
25		}
26
27		/// The API's shape of a drop, with its files' content when `content`, its
28		/// stars (and whether `caller` starred it) and where it was forked from.
29	14×	async fn shape(
30	14×	app: &Shared,
31	14×	caller: Option<&db::accounts::Account>,
32	14×	row: &db::repos::RepoRow,
33	14×	files: &[DropFile],
34	14×	content: bool,
35	14×	) -> Result<Drop, ApiError> {
36	14×	let base = app.config.base_url();
37	14×	let url = drops::url_of(row);
38	14×	let starred = match caller {
39	11×	Some(a) => db::repos::starred(&app.db, a.id, row.id).await?,
40	3×	None => false,
41		};
42	14×	let forked_from = match row.forked_from {
43	1×	Some(id) => db::repos::get_by_id(&app.db, id).await?.map(\|f\| format!("{base}{}", drops::url_of(&f))),
44	13×	None => None,
45		};
46		Ok(Drop {
47	14×	id: drops::id_of(row).to_string(),
48	14×	owner: row.owner.clone(),
49	14×	title: row.title.clone(),
50	14×	description: row.description.clone(),
51	14×	visibility: drops::visibility_label(row).to_string(),
52	14×	url: format!("{base}{url}"),
53	14×	clone_url: format!("{base}{url}"),
54	14×	created_ms: row.created_ms,
55	14×	updated_ms: row.updated_ms,
56	14×	files: files
57	14×	.iter()
58	14×	.map(\|f\| hub_api::DropFile {
59	22×	name: f.path.clone(),
60	22×	size: f.size,
61	22×	content: if content { f.text.clone() } else { None },
62	22×	raw_url: format!("{base}{url}/raw/{}/{}", row.default_bookmark, f.path),
63	22×	})
64	14×	.collect(),
65	14×	stars: db::repos::star_count(&app.db, row.id).await?,
66	14×	starred,
67	14×	forked_from,
68	14×	embed_url: format!("{base}{url}/embed"),
69		})
70	14×	}
71
72	5×	async fn listed(app: &Shared, caller: Option<&db::accounts::Account>, rows: Vec<db::repos::RepoRow>) -> Result<Vec<Drop>, ApiError> {
73	5×	let mut out = Vec::with_capacity(rows.len());
74	5×	for row in rows {
75	5×	let files = drops::files(app, &row, "").await.map(\|(_, f)\| f).unwrap_or_default();
76	5×	out.push(shape(app, caller, &row, &files, false).await?);
77		}
78	5×	Ok(out)
79	5×	}
80
81		/// `GET /drops`: the caller's drops, secret ones too.
82	2×	pub(super) async fn mine(State(app): State<Shared>, headers: HeaderMap) -> Result<Json<Vec<Drop>>, ApiError> {
83	2×	let c = caller(&app, &headers).await?;
84	2×	let me = c.require("repo:read")?.clone();
85	2×	let rows = db::repos::drops_of(&app.db, &me.username).await?;
86	2×	Ok(Json(listed(&app, Some(&me), rows).await?))
87	2×	}
88
89		/// `GET /users/{name}/drops`: someone's public drops (all of them to
90		/// themselves and to site administrators).
91	3×	pub(super) async fn of_user(State(app): State<Shared>, headers: HeaderMap, Path(name): Path<String>) -> Result<Json<Vec<Drop>>, ApiError> {
92	3×	let c = caller(&app, &headers).await?;
93	3×	let account = db::accounts::account_by_name(&app.db, &name).await?.ok_or_else(\|\| not_found("no such user"))?;
94	3×	let rows: Vec<_> =
95	5×	db::repos::drops_of(&app.db, &account.username).await?.into_iter().filter(\|r\| drops::listed_to(c.account.as_ref(), r)).collect();
96	3×	Ok(Json(listed(&app, c.account.as_ref(), rows).await?))
97	3×	}
98
99		/// `POST /drops`.
100	3×	pub(super) async fn create(
101	3×	State(app): State<Shared>,
102	3×	headers: HeaderMap,
103	3×	Json(body): Json<NewDrop>,
104	3×	) -> Result<(StatusCode, Json<Drop>), ApiError> {
105	3×	let c = caller(&app, &headers).await?;
106	3×	let me = c.require("repo:write")?.clone();
107	4×	let files: Vec<NewFile> = body.files.into_iter().map(\|f\| NewFile { name: f.name, content: f.content }).collect();
108	3×	let row = drops::create(&app, &me, &body.title, &body.description, body.secret, &files).await?;
109	3×	let (_, files) = drops::files(&app, &row, "").await?;
110	3×	Ok((StatusCode::CREATED, Json(shape(&app, Some(&me), &row, &files, true).await?)))
111	3×	}
112
113	25×	async fn row_of(app: &Shared, id: &str) -> Result<db::repos::RepoRow, ApiError> {
114	25×	if !crate::repos::names::valid_drop_id(id) {
115	0×	return Err(not_found("no such drop"));
116	25×	}
117	25×	db::repos::drop_by_id(&app.db, id).await?.ok_or_else(\|\| not_found("no such drop"))
118	25×	}
119
120		/// `GET /drops/{id}`: anyone with the id, its files' content included.
121	6×	pub(super) async fn view(State(app): State<Shared>, headers: HeaderMap, Path(id): Path<String>) -> Result<Json<Drop>, ApiError> {
122	6×	let c = caller(&app, &headers).await?;
123	6×	let row = row_of(&app, &id).await?;
124	4×	if c.account.as_ref().is_some_and(\|a\| a.blocked()) {
125	0×	return Err(not_found("no such drop"));
126	4×	}
127	4×	let (_, files) = drops::files(&app, &row, "").await?;
128	4×	Ok(Json(shape(&app, c.account.as_ref(), &row, &files, true).await?))
129	6×	}
130
131		/// The drop, when the caller may change it (its owner) or, `deleting`,
132		/// delete it (its owner or a site administrator); else 403.
133	7×	async fn writable(
134	7×	app: &Shared,
135	7×	headers: &HeaderMap,
136	7×	id: &str,
137	7×	deleting: bool,
138	7×	) -> Result<(db::accounts::Account, db::repos::RepoRow), ApiError> {
139	7×	let c = caller(app, headers).await?;
140	7×	let me = c.require("repo:write")?.clone();
141	7×	let row = row_of(app, id).await?;
142	7×	let may = if deleting { drops::may_delete(Some(&me), &row) } else { drops::may_edit(Some(&me), &row) };
143	7×	if !may {
144	3×	return Err(super::forbidden(if deleting {
145	1×	"only the drop's owner or a site administrator may delete it"
146		} else {
147	2×	"only the drop's owner may change it"
148		}));
149	4×	}
150	4×	Ok((me, row))
151	7×	}
152
153		/// `PATCH /drops/{id}`.
154	4×	pub(super) async fn edit(
155	4×	State(app): State<Shared>,
156	4×	headers: HeaderMap,
157	4×	Path(id): Path<String>,
158	4×	Json(body): Json<DropEdit>,
159	4×	) -> Result<Json<Drop>, ApiError> {
160	4×	let (me, row) = writable(&app, &headers, &id, false).await?;
161	2×	let mut seen = Vec::new();
162	2×	let mut files = Vec::with_capacity(body.files.len());
163	2×	for f in body.files {
164	2×	let name = drops::check_name(&f.name).map_err(\|m\| ApiError(StatusCode::UNPROCESSABLE_ENTITY, m))?;
165	2×	if seen.contains(&name) {
166	0×	return Err(ApiError(StatusCode::UNPROCESSABLE_ENTITY, format!("{name} is named twice.")));
167	2×	}
168	2×	seen.push(name.clone());
169	2×	files.push(oxy_core::repo::FileEdit { path: name, content: f.content.map(\|c\| c.replace("\r\n", "\n").into_bytes()) });
170		}
171	2×	let update = drops::Update {
172	2×	title: body.title.unwrap_or_else(\|\| row.title.clone()),
173	2×	description: body.description.unwrap_or_else(\|\| row.description.clone()),
174	2×	secret: body.secret.unwrap_or(row.visibility() != hub_api::Visibility::Public),
175	2×	files,
176	2×	message: body.message.unwrap_or_default(),
177		};
178	2×	drops::update(&app, &me, &row, update).await?;
179	1×	let row = db::repos::get_by_id(&app.db, row.id).await?.ok_or_else(\|\| not_found("no such drop"))?;
180	1×	let (_, files) = drops::files(&app, &row, "").await?;
181	1×	Ok(Json(shape(&app, Some(&me), &row, &files, true).await?))
182	4×	}
183
184		/// `DELETE /drops/{id}`.
185	3×	pub(super) async fn delete(State(app): State<Shared>, headers: HeaderMap, Path(id): Path<String>) -> Result<StatusCode, ApiError> {
186	3×	let (me, row) = writable(&app, &headers, &id, true).await?;
187	2×	drops::delete(&app, &me, &row).await?;
188	2×	Ok(StatusCode::NO_CONTENT)
189	3×	}
190
191		/// The drop and the signed-in caller, with `repo:write`, for forking,
192		/// starring and commenting: anyone who may read the drop (its id) may.
193	12×	async fn reader(app: &Shared, headers: &HeaderMap, id: &str) -> Result<(db::accounts::Account, db::repos::RepoRow), ApiError> {
194	12×	let c = caller(app, headers).await?;
195	12×	let me = c.require("repo:write")?.clone();
196	11×	if me.blocked() {
197	0×	return Err(not_found("no such drop"));
198	11×	}
199	11×	Ok((me, row_of(app, id).await?))
200	12×	}
201
202		/// `POST /drops/{id}/fork` (oxygenhub#349): a new drop of the caller's
203		/// whose history starts from this one, as the page's FORK.
204	2×	pub(super) async fn fork(
205	2×	State(app): State<Shared>,
206	2×	headers: HeaderMap,
207	2×	Path(id): Path<String>,
208	2×	) -> Result<(StatusCode, Json<Drop>), ApiError> {
209	2×	let (me, row) = reader(&app, &headers, &id).await?;
210	1×	let made = drops::fork(&app, &me, &row).await?;
211	1×	let (_, files) = drops::files(&app, &made, "").await?;
212	1×	Ok((StatusCode::CREATED, Json(shape(&app, Some(&me), &made, &files, true).await?)))
213	2×	}
214
215		/// `PUT /drops/{id}/star` stars the drop, `DELETE` takes the star back;
216		/// either is the same however often it is asked.
217	4×	async fn set_star(app: &Shared, headers: &HeaderMap, id: &str, want: bool) -> Result<Json<DropStars>, ApiError> {
218	4×	let (me, row) = reader(app, headers, id).await?;
219	4×	if db::repos::starred(&app.db, me.id, row.id).await? != want {
220	3×	db::repos::toggle_star(&app.db, me.id, row.id).await?;
221	1×	}
222	4×	Ok(Json(DropStars { stars: db::repos::star_count(&app.db, row.id).await?, starred: want }))
223	4×	}
224
225	3×	pub(super) async fn star(State(app): State<Shared>, headers: HeaderMap, Path(id): Path<String>) -> Result<Json<DropStars>, ApiError> {
226	3×	set_star(&app, &headers, &id, true).await
227	3×	}
228
229	1×	pub(super) async fn unstar(State(app): State<Shared>, headers: HeaderMap, Path(id): Path<String>) -> Result<Json<DropStars>, ApiError> {
230	1×	set_star(&app, &headers, &id, false).await
231	1×	}
232
233	4×	fn comment_of(c: db::repos::DropComment) -> DropComment {
234	4×	DropComment { id: c.id, author: c.author, body: c.body, created_ms: c.created_ms }
235	4×	}
236
237		/// `GET /drops/{id}/comments`: oldest first, to anyone with the id.
238	1×	pub(super) async fn comments(
239	1×	State(app): State<Shared>,
240	1×	headers: HeaderMap,
241	1×	Path(id): Path<String>,
242	1×	) -> Result<Json<Vec<DropComment>>, ApiError> {
243	1×	let c = caller(&app, &headers).await?;
244	1×	if c.account.as_ref().is_some_and(\|a\| a.blocked()) {
245	0×	return Err(not_found("no such drop"));
246	1×	}
247	1×	let row = row_of(&app, &id).await?;
248	1×	Ok(Json(db::repos::drop_comments(&app.db, row.id).await?.into_iter().map(comment_of).collect()))
249	1×	}
250
251		/// `POST /drops/{id}/comments`: the drop's owner is told.
252	3×	pub(super) async fn add_comment(
253	3×	State(app): State<Shared>,
254	3×	headers: HeaderMap,
255	3×	Path(id): Path<String>,
256	3×	Json(body): Json<NewDropComment>,
257	3×	) -> Result<(StatusCode, Json<DropComment>), ApiError> {
258	3×	let (me, row) = reader(&app, &headers, &id).await?;
259	3×	let n = drops::add_comment(&app, &me, &row, &body.body).await?;
260	2×	let c = db::repos::drop_comment(&app.db, row.id, n).await?.ok_or_else(\|\| not_found("no such comment"))?;
261	2×	Ok((StatusCode::CREATED, Json(comment_of(c))))
262	3×	}
263
264		/// `DELETE /drops/{id}/comments/{n}`: its author, the drop's owner or a
265		/// site administrator.
266	3×	pub(super) async fn delete_comment(
267	3×	State(app): State<Shared>,
268	3×	headers: HeaderMap,
269	3×	Path((id, n)): Path<(String, i64)>,
270	3×	) -> Result<StatusCode, ApiError> {
271	3×	let (me, row) = reader(&app, &headers, &id).await?;
272	3×	let c = db::repos::drop_comment(&app.db, row.id, n).await?.ok_or_else(\|\| not_found("no such comment"))?;
273	2×	if !drops::may_delete_comment(Some(&me), &row, &c) {
274	1×	return Err(super::forbidden("only the comment's author, the drop's owner or a site administrator may delete it"));
275	1×	}
276	1×	db::repos::delete_drop_comment(&app.db, row.id, n).await?;
277	1×	Ok(StatusCode::NO_CONTENT)
278	3×	}

Coverage / crates/hub/src/api/drops.rs 95.0%

Keyboard