OXYGENHUB
# 0bc95135954d oxygenhub / crates / hub / src / api / projects.rs
20.1 KiB · Rust · last changed Board views: saved views, filter bar, lanes, WIP limits, table, keys, card history (refs #361) 2 days ago source blame history raw
1 
//! Projects over the API (hub spec §8.2, §12.1): the same rules as the
2 
//! pages, through the functions they use.
3
4 
use super::{caller, forbidden, not_found, ApiError, Caller};
5 
use crate::db::projects as pdb;
6 
use crate::web::projects as wp;
7 
use crate::Shared;
8 
use axum::extract::{Path, Query, State};
9 
use axum::http::{HeaderMap, StatusCode};
10 
use axum::Json;
11 
use hub_api::{
12 
    Board, CardMove, CardsArchive, CardsArchived, CardsMove, CardsMoved, NewCard, NewProject, Project, ProjectCard, ProjectColumn,
13 
    ProjectEdit,
14 
};
15
16 
fn project_of(app: &Shared, p: &pdb::Project) -> Project {
17 
    Project {
18 
        owner: p.owner.clone(),
19 
        number: p.number,
20 
        title: p.title.clone(),
21 
        description: p.description.clone(),
22 
        public: p.public,
23 
        closed: p.closed,
24 
        updated_ms: p.updated_ms,
25 
        url: format!("{}/projects/{}/{}", app.config.base_url().trim_end_matches('/'), p.owner, p.number),
26 
    }
27 
}
28
29 
fn card_of(v: &wp::CardView) -> ProjectCard {
30 
    ProjectCard {
31 
        id: v.card.id,
32 
        kind: v.card.kind.clone(),
33 
        reference: v.reference.clone(),
34 
        title: v.title.clone(),
35 
        state: v.state.clone(),
36 
        labels: v.labels.iter().map(|l| l.name.clone()).collect(),
37 
        assignees: v.assignees.clone(),
38 
        archived_ms: v.card.archived_ms,
39 
    }
40 
}
41
42 
async fn rights(app: &Shared, c: &Caller, owner: &str) -> Result<wp::Rights, ApiError> {
43 
    wp::rights_of(app, c.account.as_ref(), owner).await?.ok_or_else(|| not_found("no such owner"))
44 
}
45
46 
/// A project the caller may see.
47 
async fn visible(app: &Shared, c: &Caller, owner: &str, number: i64) -> Result<(wp::Rights, pdb::Project), ApiError> {
48 
    let r = rights(app, c, owner).await?;
49 
    let p = pdb::get(&app.db, owner, number).await?.filter(|p| p.public || r.member).ok_or_else(|| not_found("no such project"))?;
50 
    Ok((r, p))
51 
}
52
53 
/// A project the caller may change: a write token, edit rights, and open unless `closed_ok`.
54 
async fn changeable(
55 
    app: &Shared,
56 
    headers: &HeaderMap,
57 
    owner: &str,
58 
    number: i64,
59 
    closed_ok: bool,
60 
) -> Result<(Caller, pdb::Project), ApiError> {
61 
    let c = caller(app, headers).await?;
62 
    c.require("repo:write")?;
63 
    let (r, p) = visible(app, &c, owner, number).await?;
64 
    if !r.edit {
65 
        return Err(forbidden("only the owner (or the organisation's members) may change this project"));
66 
    }
67 
    if p.closed && !closed_ok {
68 
        return Err(ApiError(StatusCode::CONFLICT, "this project is closed; reopen it to change it".into()));
69 
    }
70 
    Ok((c, p))
71 
}
72
73 
/// A column by id or by name (case-insensitive); the first when absent.
74 
async fn column(app: &Shared, project_id: i64, spec: Option<&str>) -> Result<pdb::Column, ApiError> {
75 
    let cols = pdb::columns(&app.db, project_id).await?;
76 
    let found = match spec.map(str::trim).filter(|s| !s.is_empty()) {
77 
        None => cols.into_iter().next(),
78 
        Some(s) => cols.into_iter().find(|c| c.id.to_string() == s || c.name.eq_ignore_ascii_case(s)),
79 
    };
80 
    found.ok_or_else(|| ApiError(StatusCode::BAD_REQUEST, "no such column".into()))
81 
}
82
83 
/// `GET /projects/{owner}`.
84 
pub async fn list(State(app): State<Shared>, headers: HeaderMap, Path(owner): Path<String>) -> Result<Json<Vec<Project>>, ApiError> {
85 
    let c = caller(&app, &headers).await?;
86 
    let r = rights(&app, &c, &owner).await?;
87 
    let list = pdb::of_owner(&app.db, &owner).await?;
88 
    Ok(Json(list.iter().filter(|p| p.public || r.member).map(|p| project_of(&app, p)).collect()))
89 
}
90
91 
/// `POST /projects/{owner}`.
92 
pub async fn create(
93 
    State(app): State<Shared>,
94 
    headers: HeaderMap,
95 
    Path(owner): Path<String>,
96 
    Json(body): Json<NewProject>,
97 
) -> Result<(StatusCode, Json<Project>), ApiError> {
98 
    let c = caller(&app, &headers).await?;
99 
    c.require("repo:write")?;
100 
    if !rights(&app, &c, &owner).await?.edit {
101 
        return Err(forbidden("only the owner (or the organisation's members) may create projects"));
102 
    }
103 
    let title = body.title.trim();
104 
    if title.is_empty() || title.chars().count() > 100 {
105 
        return Err(ApiError(StatusCode::BAD_REQUEST, "a project needs a title of up to 100 characters".into()));
106 
    }
107 
    let p = pdb::create(&app.db, &owner, title, body.description.trim(), !body.private).await?;
108 
    crate::db::accounts::audit(&app.db, c.account.as_ref(), "project.created", &format!("{owner}/{}", p.number), title).await.ok();
109 
    Ok((StatusCode::CREATED, Json(project_of(&app, &p))))
110 
}
111
112 
/// `GET /projects/{owner}/{n}`'s filter (#361): `q` as the board's filter
113 
/// bar takes it, or the `view` saved under that name.
114 
#[derive(serde::Deserialize, Default)]
115 
pub struct BoardFilter {
116 
    #[serde(default)]
117 
    q: Option<String>,
118 
    #[serde(default)]
119 
    view: Option<String>,
120 
}
121
122 
/// `GET /projects/{owner}/{n}`.
123 
pub async fn board(
124 
    State(app): State<Shared>,
125 
    headers: HeaderMap,
126 
    Path((owner, number)): Path<(String, i64)>,
127 
    Query(f): Query<BoardFilter>,
128 
) -> Result<Json<Board>, ApiError> {
129 
    let c = caller(&app, &headers).await?;
130 
    let (_, p) = visible(&app, &c, &owner, number).await?;
131 
    let q = match (f.q, f.view) {
132 
        (Some(q), _) => q,
133 
        (None, Some(name)) => pdb::views(&app.db, p.id)
134 
            .await?
135 
            .into_iter()
136 
            .find(|v| v.name == name)
137 
            .map(|v| v.q)
138 
            .ok_or_else(|| ApiError(StatusCode::NOT_FOUND, format!("no view {name}")))?,
139 
        (None, None) => String::new(),
140 
    };
141 
    let Json(mut b) = board_of(&app, &c, &owner, number).await?;
142 
    if !q.trim().is_empty() {
143 
        let filter = wp::CardFilter::parse(&q);
144 
        let now = crate::db::now_ms();
145 
        let (columns, _) = wp::board_columns(&app, c.account.as_ref(), &owner, &p, false).await?;
146 
        for (out, col) in b.columns.iter_mut().zip(columns.iter()) {
147 
            out.cards = col.cards.iter().filter(|card| filter.keeps(card, now)).map(card_of).collect();
148 
        }
149 
        b.filter = q.trim().to_string();
150 
    }
151 
    Ok(Json(b))
152 
}
153
154 
/// `PATCH /projects/{owner}/{n}`.
155 
pub async fn edit(
156 
    State(app): State<Shared>,
157 
    headers: HeaderMap,
158 
    Path((owner, number)): Path<(String, i64)>,
159 
    Json(body): Json<ProjectEdit>,
160 
) -> Result<Json<Project>, ApiError> {
161 
    let (c, p) = changeable(&app, &headers, &owner, number, true).await?;
162 
    // A transfer (#125) first: the other fields then apply where it went.
163 
    let (owner, number) = match body.owner.as_deref().map(str::trim).filter(|to| !to.is_empty() && *to != owner) {
164 
        Some(to) => match wp::rights_of(&app, c.account.as_ref(), to).await? {
165 
            Some(r) if r.edit => {
166 
                let moved = pdb::transfer(&app.db, p.id, to).await?;
167 
                let detail = format!("{owner}/{number} to {to}/{}", moved.number);
168 
                crate::db::accounts::audit(&app.db, c.account.as_ref(), "project.transferred", &detail, &p.title).await.ok();
169 
                (moved.owner, moved.number)
170 
            }
171 
            _ => return Err(ApiError(StatusCode::FORBIDDEN, format!("you cannot make projects under {to}"))),
172 
        },
173 
        None => (owner, number),
174 
    };
175 
    let p = pdb::get(&app.db, &owner, number).await?.unwrap_or(p);
176 
    let title = body.title.as_deref().map(str::trim).filter(|t| !t.is_empty()).unwrap_or(&p.title).chars().take(100).collect::<String>();
177 
    pdb::set(
178 
        &app.db,
179 
        p.id,
180 
        &title,
181 
        body.description.as_deref().map(str::trim).unwrap_or(&p.description),
182 
        body.private.map(|x| !x).unwrap_or(p.public),
183 
        body.closed.unwrap_or(p.closed),
184 
    )
185 
    .await?;
186 
    let fresh = pdb::get(&app.db, &owner, number).await?.unwrap_or(p);
187 
    Ok(Json(project_of(&app, &fresh)))
188 
}
189
190 
/// A board's columns as `GET /projects/{owner}/{n}` gives them, for the
191 
/// column calls to answer with (#366).
192 
async fn board_of(app: &Shared, c: &Caller, owner: &str, number: i64) -> Result<Json<Board>, ApiError> {
193 
    let (_, p) = visible(app, c, owner, number).await?;
194 
    let (columns, _) = wp::board_columns(app, c.account.as_ref(), owner, &p, false).await?;
195 
    Ok(Json(Board {
196 
        project: project_of(app, &p),
197 
        columns: columns
198 
            .iter()
199 
            .map(|col| ProjectColumn {
200 
                id: col.column.id,
201 
                name: col.column.name.clone(),
202 
                cards: col.cards.iter().map(card_of).collect(),
203 
                wip_limit: col.column.wip_limit,
204 
            })
205 
            .collect(),
206 
        views: pdb::views(&app.db, p.id)
207 
            .await?
208 
            .into_iter()
209 
            .map(|v| hub_api::ProjectView { name: v.name, layout: v.layout, q: v.q, lane: v.lane, sort: v.sort })
210 
            .collect(),
211 
        filter: String::new(),
212 
    }))
213 
}
214
215 
/// A column's name: trimmed, 1 to 40 characters, as the board page has it.
216 
fn column_name(name: &str) -> Result<&str, ApiError> {
217 
    let name = name.trim();
218 
    if name.is_empty() || name.chars().count() > 40 {
219 
        return Err(ApiError(StatusCode::BAD_REQUEST, "a column has a name of 1 to 40 characters".into()));
220 
    }
221 
    Ok(name)
222 
}
223
224 
/// `POST /projects/{owner}/{n}/columns` (#366): add a column at the right;
225 
/// answers the board.
226 
pub async fn add_column(
227 
    State(app): State<Shared>,
228 
    headers: HeaderMap,
229 
    Path((owner, number)): Path<(String, i64)>,
230 
    Json(body): Json<hub_api::NewColumn>,
231 
) -> Result<Json<Board>, ApiError> {
232 
    let (c, p) = changeable(&app, &headers, &owner, number, false).await?;
233 
    let name = column_name(&body.name)?;
234 
    if pdb::columns(&app.db, p.id).await?.iter().any(|col| col.name.eq_ignore_ascii_case(name)) {
235 
        return Err(ApiError(StatusCode::CONFLICT, format!("the board has a column {name} already")));
236 
    }
237 
    pdb::add_column(&app.db, p.id, name).await?;
238 
    board_of(&app, &c, &owner, number).await
239 
}
240
241 
/// `PATCH /projects/{owner}/{n}/columns/{column}` (#366): rename or move a
242 
/// column named by id or name; answers the board.
243 
pub async fn edit_column(
244 
    State(app): State<Shared>,
245 
    headers: HeaderMap,
246 
    Path((owner, number, spec)): Path<(String, i64, String)>,
247 
    Json(body): Json<hub_api::ColumnEdit>,
248 
) -> Result<Json<Board>, ApiError> {
249 
    let (c, p) = changeable(&app, &headers, &owner, number, false).await?;
250 
    let col = named_column(&app, p.id, &spec).await?;
251 
    if body.name.is_none() && body.position.is_none() {
252 
        return Err(ApiError(StatusCode::BAD_REQUEST, "say what to change: name or position".into()));
253 
    }
254 
    if let Some(name) = body.name.as_deref() {
255 
        let name = column_name(name)?;
256 
        let others = pdb::columns(&app.db, p.id).await?;
257 
        if others.iter().any(|o| o.id != col.id && o.name.eq_ignore_ascii_case(name)) {
258 
            return Err(ApiError(StatusCode::CONFLICT, format!("the board has a column {name} already")));
259 
        }
260 
        pdb::rename_column(&app.db, p.id, col.id, name).await?;
261 
    }
262 
    if let Some(pos) = body.position {
263 
        pdb::place_column(&app.db, p.id, col.id, pos).await?;
264 
    }
265 
    board_of(&app, &c, &owner, number).await
266 
}
267
268 
/// `DELETE /projects/{owner}/{n}/columns/{column}` (#366): its cards go to
269 
/// the first remaining column; a board keeps at least one. Answers the board.
270 
pub async fn remove_column(
271 
    State(app): State<Shared>,
272 
    headers: HeaderMap,
273 
    Path((owner, number, spec)): Path<(String, i64, String)>,
274 
) -> Result<Json<Board>, ApiError> {
275 
    let (c, p) = changeable(&app, &headers, &owner, number, false).await?;
276 
    let col = named_column(&app, p.id, &spec).await?;
277 
    if !pdb::remove_column(&app.db, p.id, col.id).await? {
278 
        return Err(ApiError(StatusCode::CONFLICT, "a board keeps at least one column".into()));
279 
    }
280 
    board_of(&app, &c, &owner, number).await
281 
}
282
283 
/// A column named by id or name, or 404.
284 
async fn named_column(app: &Shared, project_id: i64, spec: &str) -> Result<pdb::Column, ApiError> {
285 
    let cols = pdb::columns(&app.db, project_id).await?;
286 
    cols.into_iter()
287 
        .find(|c| c.id.to_string() == spec.trim() || c.name.eq_ignore_ascii_case(spec.trim()))
288 
        .ok_or_else(|| ApiError(StatusCode::NOT_FOUND, format!("no column {spec}")))
289 
}
290
291 
/// `GET /projects/{owner}/{n}/cards`: the cards by column, as the board
292 
/// has them.
293 
#[derive(serde::Deserialize, Default)]
294 
pub struct CardsQuery {
295 
    /// The archived cards instead (#293).
296 
    #[serde(default)]
297 
    archived: bool,
298 
}
299
300 
/// `GET /projects/{owner}/{n}/cards`, `?archived=true` for the archived ones.
301 
pub async fn cards(
302 
    State(app): State<Shared>,
303 
    headers: HeaderMap,
304 
    Path((owner, number)): Path<(String, i64)>,
305 
    Query(q): Query<CardsQuery>,
306 
) -> Result<Json<Vec<ProjectColumn>>, ApiError> {
307 
    if !q.archived {
308 
        return Ok(Json(board(State(app), headers, Path((owner, number)), Query(BoardFilter::default())).await?.0.columns));
309 
    }
310 
    let c = caller(&app, &headers).await?;
311 
    let (_, p) = visible(&app, &c, &owner, number).await?;
312 
    let (columns, _) = wp::board_columns(&app, c.account.as_ref(), &owner, &p, true).await?;
313 
    Ok(Json(
314 
        columns
315 
            .iter()
316 
            .map(|col| ProjectColumn {
317 
                id: col.column.id,
318 
                name: col.column.name.clone(),
319 
                cards: col.cards.iter().map(card_of).collect(),
320 
                wip_limit: col.column.wip_limit,
321 
            })
322 
            .collect(),
323 
    ))
324 
}
325
326 
/// `POST /projects/{owner}/{n}/cards`.
327 
pub async fn add_card(
328 
    State(app): State<Shared>,
329 
    headers: HeaderMap,
330 
    Path((owner, number)): Path<(String, i64)>,
331 
    Json(body): Json<NewCard>,
332 
) -> Result<(StatusCode, Json<ProjectCard>), ApiError> {
333 
    let (c, p) = changeable(&app, &headers, &owner, number, false).await?;
334 
    let col = column(&app, p.id, body.column.as_deref()).await?;
335 
    let actor = c.account.as_ref().map(|a| a.username.clone()).unwrap_or_default();
336 
    let card = match wp::add_card(&app, c.account.as_ref(), &owner, p.id, col.id, &body.reference, "", &body.note, &actor).await? {
337 
        Ok(card) => card,
338 
        Err(why) => return Err(ApiError(StatusCode::BAD_REQUEST, why)),
339 
    };
340 
    // Answer with the card as the board shows it.
341 
    let (columns, _) = wp::board_columns(&app, c.account.as_ref(), &owner, &p, false).await?;
342 
    let view = columns
343 
        .iter()
344 
        .flat_map(|col| col.cards.iter())
345 
        .find(|v| v.card.id == card.id)
346 
        .map(card_of)
347 
        .ok_or_else(|| not_found("no such card"))?;
348 
    Ok((StatusCode::CREATED, Json(view)))
349 
}
350
351 
/// `PATCH /projects/{owner}/{n}/cards/{id}`: move to another column.
352 
pub async fn move_card(
353 
    State(app): State<Shared>,
354 
    headers: HeaderMap,
355 
    Path((owner, number, id)): Path<(String, i64, i64)>,
356 
    Json(body): Json<CardMove>,
357 
) -> Result<StatusCode, ApiError> {
358 
    let (_, p) = changeable(&app, &headers, &owner, number, false).await?;
359 
    let col = column(&app, p.id, Some(&body.column)).await?;
360 
    if !pdb::cards(&app.db, p.id).await?.iter().any(|c| c.id == id) {
361 
        return Err(not_found("no such card"));
362 
    }
363 
    pdb::move_card(&app.db, p.id, id, col.id).await?;
364 
    Ok(StatusCode::NO_CONTENT)
365 
}
366
367 
/// Whether `card` is the one `name` names: its id, or its issue or
368 
/// proposal as `12`, `#12`, `name#12` or `owner/name#12`.
369 
fn names_card(name: &str, card: &ProjectCard) -> bool {
370 
    let name = name.trim();
371 
    if name.is_empty() {
372 
        return false;
373 
    }
374 
    if name.parse::<i64>().is_ok_and(|id| id == card.id) {
375 
        return true;
376 
    }
377 
    let Some((_, number)) = card.reference.rsplit_once('#') else { return false };
378 
    match name.rsplit_once('#') {
379 
        None => name == number,
380 
        Some(("", n)) => n == number,
381 
        Some((repo, n)) => n == number && (card.reference == format!("{repo}#{n}") || card.reference.ends_with(&format!("/{repo}#{n}"))),
382 
    }
383 
}
384
385 
/// `POST /projects/{owner}/{n}/cards/move` (#289): a column's cards to
386 
/// another at once, with exceptions and a state filter; one audit entry.
387 
pub async fn move_cards(
388 
    State(app): State<Shared>,
389 
    headers: HeaderMap,
390 
    Path((owner, number)): Path<(String, i64)>,
391 
    Json(body): Json<CardsMove>,
392 
) -> Result<Json<CardsMoved>, ApiError> {
393 
    let (c, p) = changeable(&app, &headers, &owner, number, false).await?;
394 
    let from = column(&app, p.id, Some(&body.from)).await?;
395 
    let to = column(&app, p.id, Some(&body.column)).await?;
396 
    if from.id == to.id {
397 
        return Err(ApiError(StatusCode::BAD_REQUEST, "the cards are in that column already".into()));
398 
    }
399 
    let (columns, _) = wp::board_columns(&app, c.account.as_ref(), &owner, &p, false).await?;
400 
    let cards: Vec<ProjectCard> =
401 
        columns.iter().filter(|col| col.column.id == from.id).flat_map(|col| col.cards.iter().map(card_of)).collect();
402 
    let states: Vec<String> = body.state.iter().map(|s| s.trim().to_ascii_lowercase()).filter(|s| !s.is_empty()).collect();
403 
    let (moved, kept): (Vec<ProjectCard>, Vec<ProjectCard>) = cards.into_iter().partition(|card| {
404 
        !body.except.iter().any(|e| names_card(e, card)) && (states.is_empty() || states.iter().any(|s| card.state.eq_ignore_ascii_case(s)))
405 
    });
406 
    if !body.dry_run && !moved.is_empty() {
407 
        let ids: Vec<i64> = moved.iter().map(|c| c.id).collect();
408 
        pdb::move_cards(&app.db, p.id, &ids, to.id).await?;
409 
        let detail = format!("{} card(s) from {} to {}", moved.len(), from.name, to.name);
410 
        crate::db::accounts::audit(&app.db, c.account.as_ref(), "project.cards_moved", &format!("{owner}/{number}"), &detail).await.ok();
411 
    }
412 
    Ok(Json(CardsMoved { moved, kept, dry_run: body.dry_run }))
413 
}
414
415 
/// `POST /projects/{owner}/{n}/cards/archive` (#293): a column's cards off
416 
/// the board at once, kept, with #289's exceptions and state filter and an
417 
/// age; one audit entry.
418 
pub async fn archive_cards(
419 
    State(app): State<Shared>,
420 
    headers: HeaderMap,
421 
    Path((owner, number)): Path<(String, i64)>,
422 
    Json(body): Json<CardsArchive>,
423 
) -> Result<Json<CardsArchived>, ApiError> {
424 
    let (c, p) = changeable(&app, &headers, &owner, number, false).await?;
425 
    let from = column(&app, p.id, Some(&body.from)).await?;
426 
    if body.older_days.is_some_and(|d| !(0..=3650).contains(&d)) {
427 
        return Err(ApiError(StatusCode::BAD_REQUEST, "older_days is 0 to 3650".into()));
428 
    }
429 
    let (columns, _) = wp::board_columns(&app, c.account.as_ref(), &owner, &p, false).await?;
430 
    let now = crate::db::now_ms();
431 
    let states: Vec<String> = body.state.iter().map(|s| s.trim().to_ascii_lowercase()).filter(|s| !s.is_empty()).collect();
432 
    let (archived, kept): (Vec<&wp::CardView>, Vec<&wp::CardView>) =
433 
        columns.iter().filter(|col| col.column.id == from.id).flat_map(|col| col.cards.iter()).partition(|v| {
434 
            let card = card_of(v);
435 
            !body.except.iter().any(|e| names_card(e, &card))
436 
                && (states.is_empty() || states.iter().any(|s| card.state.eq_ignore_ascii_case(s)))
437 
                && body.older_days.is_none_or(|d| pdb::older_than(&v.card, d, now))
438 
        });
439 
    if !body.dry_run && !archived.is_empty() {
440 
        let ids: Vec<i64> = archived.iter().map(|v| v.card.id).collect();
441 
        pdb::archive_cards(&app.db, p.id, &ids).await?;
442 
        let detail = format!("{} card(s) of {}", ids.len(), from.name);
443 
        crate::db::accounts::audit(&app.db, c.account.as_ref(), "project.cards_archived", &format!("{owner}/{number}"), &detail).await.ok();
444 
    }
445 
    let stamp = |v: &wp::CardView| ProjectCard { archived_ms: (!body.dry_run).then_some(now), ..card_of(v) };
446 
    Ok(Json(CardsArchived {
447 
        archived: archived.into_iter().map(stamp).collect(),
448 
        kept: kept.into_iter().map(card_of).collect(),
449 
        dry_run: body.dry_run,
450 
    }))
451 
}
452
453 
/// `POST /projects/{owner}/{n}/cards/{id}/restore` (#293): an archived
454 
/// card back on the board, at the end of its column.
455 
pub async fn restore_card(
456 
    State(app): State<Shared>,
457 
    headers: HeaderMap,
458 
    Path((owner, number, id)): Path<(String, i64, i64)>,
459 
) -> Result<StatusCode, ApiError> {
460 
    let (_, p) = changeable(&app, &headers, &owner, number, false).await?;
461 
    if !pdb::cards(&app.db, p.id).await?.iter().any(|c| c.id == id && c.archived_ms.is_some()) {
462 
        return Err(not_found("no such archived card"));
463 
    }
464 
    pdb::restore_card(&app.db, p.id, id).await?;
465 
    Ok(StatusCode::NO_CONTENT)
466 
}
467
468 
/// `DELETE /projects/{owner}/{n}/cards/{id}`.
469 
pub async fn remove_card(
470 
    State(app): State<Shared>,
471 
    headers: HeaderMap,
472 
    Path((owner, number, id)): Path<(String, i64, i64)>,
473 
) -> Result<StatusCode, ApiError> {
474 
    let (_, p) = changeable(&app, &headers, &owner, number, false).await?;
475 
    if !pdb::cards(&app.db, p.id).await?.iter().any(|c| c.id == id) {
476 
        return Err(not_found("no such card"));
477 
    }
478 
    pdb::remove_card(&app.db, p.id, id).await?;
479 
    Ok(StatusCode::NO_CONTENT)
480 
}