init

2026-08-22 02:59:16 +02:00
commit 6a5bb1d699
100 changed files with 17409 additions and 0 deletions
@@ -0,0 +1,355 @@
+package media
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"mime"
+	"net/http"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"github.com/example/sndit/backend/internal/auth"
+	"github.com/example/sndit/backend/internal/storage"
+	"github.com/google/uuid"
+)
+
+const (
+	maxUploadSize     = int64(10 << 30)
+	uploadURLDuration = 24 * time.Hour
+)
+
+type ProcessorQueue interface {
+	Enqueue(uuid.UUID)
+}
+
+type Handler struct {
+	repository *Repository
+	storage    storage.Storage
+	processor  ProcessorQueue
+	auth       *auth.Service
+}
+
+func NewHandler(repository *Repository, objectStorage storage.Storage, processor ProcessorQueue, authService *auth.Service) *Handler {
+	return &Handler{repository: repository, storage: objectStorage, processor: processor, auth: authService}
+}
+
+func (h *Handler) RegisterRoutes(mux *http.ServeMux, require func(http.Handler) http.Handler) {
+	mux.Handle("GET /api/galleries/{id}/media", require(http.HandlerFunc(h.List)))
+	mux.Handle("POST /api/galleries/{id}/uploads", require(http.HandlerFunc(h.CreateUpload)))
+	mux.Handle("POST /api/uploads/{id}/complete", require(http.HandlerFunc(h.CompleteUpload)))
+	mux.Handle("PATCH /api/media/{id}", require(http.HandlerFunc(h.Update)))
+	mux.Handle("POST /api/media/{id}/download", require(http.HandlerFunc(h.Download)))
+	mux.Handle("DELETE /api/uploads/{id}", require(http.HandlerFunc(h.Delete)))
+	mux.Handle("DELETE /api/media/{id}", require(http.HandlerFunc(h.Delete)))
+}
+
+type uploadRequest struct {
+	Filename string `json:"filename"`
+	MimeType string `json:"mimeType"`
+	FileSize int64  `json:"fileSize"`
+}
+
+type updateRequest struct {
+	SortOrder *int `json:"sortOrder"`
+}
+
+func (h *Handler) List(w http.ResponseWriter, r *http.Request) {
+	user, ok := auth.UserFromContext(r.Context())
+	if !ok {
+		writeError(w, http.StatusUnauthorized, "authentication required")
+		return
+	}
+	galleryID, err := parseID(r.PathValue("id"))
+	if err != nil {
+		writeError(w, http.StatusBadRequest, "invalid gallery id")
+		return
+	}
+	belongs, err := h.repository.GalleryBelongsToUser(r.Context(), galleryID, user.ID)
+	if err != nil || !belongs {
+		writeError(w, http.StatusNotFound, "gallery not found")
+		return
+	}
+	items, err := h.repository.ListByGallery(r.Context(), galleryID)
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, "could not load media")
+		return
+	}
+	views := make([]Public, 0, len(items))
+	for _, item := range items {
+		view, err := h.view(r.Context(), item, true)
+		if err != nil {
+			writeError(w, http.StatusInternalServerError, "could not sign media URLs")
+			return
+		}
+		views = append(views, view)
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"media": views})
+}
+
+func (h *Handler) CreateUpload(w http.ResponseWriter, r *http.Request) {
+	user, ok := auth.UserFromContext(r.Context())
+	if !ok {
+		writeError(w, http.StatusUnauthorized, "authentication required")
+		return
+	}
+	galleryID, err := parseID(r.PathValue("id"))
+	if err != nil {
+		writeError(w, http.StatusBadRequest, "invalid gallery id")
+		return
+	}
+	belongs, err := h.repository.GalleryBelongsToUser(r.Context(), galleryID, user.ID)
+	if err != nil || !belongs {
+		writeError(w, http.StatusNotFound, "gallery not found")
+		return
+	}
+	var request uploadRequest
+	if !decodeJSON(w, r, &request) {
+		return
+	}
+	filename := safeFilename(request.Filename)
+	mimeType := strings.ToLower(strings.TrimSpace(request.MimeType))
+	if mimeType == "" {
+		mimeType = mime.TypeByExtension(filepath.Ext(filename))
+	}
+	if filename == "" || len(filename) > 255 || !allowedMimeType(mimeType) {
+		writeError(w, http.StatusBadRequest, "unsupported media file")
+		return
+	}
+	if request.FileSize <= 0 || request.FileSize > maxUploadSize {
+		writeError(w, http.StatusBadRequest, "file size must be between 1 byte and 10 GB")
+		return
+	}
+	mediaID := uuid.New()
+	storageKey := fmt.Sprintf("galleries/%s/%s/original/%s", galleryID, mediaID, filename)
+	item, err := h.repository.Create(r.Context(), galleryID, mediaID, filename, mimeType, request.FileSize, storageKey)
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, "could not create upload")
+		return
+	}
+	uploadURL, err := h.storage.CreateUploadURL(r.Context(), storageKey, mimeType, uploadURLDuration)
+	if err != nil {
+		_, _ = h.repository.Delete(r.Context(), user.ID, mediaID)
+		writeError(w, http.StatusInternalServerError, "could not create upload URL")
+		return
+	}
+	writeJSON(w, http.StatusCreated, map[string]any{
+		"uploadId":  mediaID.String(),
+		"uploadUrl": uploadURL,
+		"media":     publicFromRecord(item),
+	})
+}
+
+func (h *Handler) CompleteUpload(w http.ResponseWriter, r *http.Request) {
+	user, ok := auth.UserFromContext(r.Context())
+	if !ok {
+		writeError(w, http.StatusUnauthorized, "authentication required")
+		return
+	}
+	mediaID, err := parseID(r.PathValue("id"))
+	if err != nil {
+		writeError(w, http.StatusBadRequest, "invalid media id")
+		return
+	}
+	item, err := h.repository.GetForUser(r.Context(), user.ID, mediaID)
+	if err != nil {
+		writeError(w, http.StatusNotFound, "media not found")
+		return
+	}
+	info, err := h.storage.Stat(r.Context(), item.StorageKey)
+	if err != nil {
+		writeError(w, http.StatusBadRequest, "uploaded object is not available yet")
+		return
+	}
+	item, err = h.repository.Complete(r.Context(), user.ID, mediaID, info.Size)
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, "could not complete upload")
+		return
+	}
+	h.processor.Enqueue(item.ID)
+	writeJSON(w, http.StatusOK, map[string]any{"media": publicFromRecord(item)})
+}
+
+func (h *Handler) Update(w http.ResponseWriter, r *http.Request) {
+	user, ok := auth.UserFromContext(r.Context())
+	if !ok {
+		writeError(w, http.StatusUnauthorized, "authentication required")
+		return
+	}
+	mediaID, err := parseID(r.PathValue("id"))
+	if err != nil {
+		writeError(w, http.StatusBadRequest, "invalid media id")
+		return
+	}
+	var request updateRequest
+	if !decodeJSON(w, r, &request) {
+		return
+	}
+	if request.SortOrder == nil || *request.SortOrder < 0 {
+		writeError(w, http.StatusBadRequest, "sort order must be zero or greater")
+		return
+	}
+	if err := h.repository.UpdateSortOrder(r.Context(), user.ID, mediaID, *request.SortOrder); err != nil {
+		writeError(w, http.StatusNotFound, "media not found")
+		return
+	}
+	item, _ := h.repository.GetForUser(r.Context(), user.ID, mediaID)
+	view, err := h.view(r.Context(), item, true)
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, "could not sign media URL")
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"media": view})
+}
+
+func (h *Handler) Delete(w http.ResponseWriter, r *http.Request) {
+	user, ok := auth.UserFromContext(r.Context())
+	if !ok {
+		writeError(w, http.StatusUnauthorized, "authentication required")
+		return
+	}
+	mediaID, err := parseID(r.PathValue("id"))
+	if err != nil {
+		writeError(w, http.StatusBadRequest, "invalid media id")
+		return
+	}
+	item, err := h.repository.Delete(r.Context(), user.ID, mediaID)
+	if err != nil {
+		writeError(w, http.StatusNotFound, "media not found")
+		return
+	}
+	for _, key := range []string{item.StorageKey, item.PreviewKey, item.ThumbnailKey} {
+		if key != "" && key != item.ExternalURL {
+			_ = h.storage.Delete(r.Context(), key)
+		}
+	}
+	w.WriteHeader(http.StatusNoContent)
+}
+
+func (h *Handler) Download(w http.ResponseWriter, r *http.Request) {
+	user, ok := auth.UserFromContext(r.Context())
+	if !ok {
+		writeError(w, http.StatusUnauthorized, "authentication required")
+		return
+	}
+	mediaID, err := parseID(r.PathValue("id"))
+	if err != nil {
+		writeError(w, http.StatusBadRequest, "invalid media id")
+		return
+	}
+	item, err := h.repository.GetForUser(r.Context(), user.ID, mediaID)
+	if err != nil || item.ProcessingStatus != StatusReady {
+		writeError(w, http.StatusNotFound, "media not found")
+		return
+	}
+	url := item.ExternalURL
+	if url == "" {
+		url, err = h.storage.CreateDownloadURL(r.Context(), item.StorageKey, time.Hour)
+		if err != nil {
+			writeError(w, http.StatusInternalServerError, "could not create download")
+			return
+		}
+	}
+	_ = h.repository.RecordDownload(r.Context(), item.GalleryID, &item.ID, user.ID.String())
+	writeJSON(w, http.StatusOK, map[string]string{"url": url})
+}
+
+func (h *Handler) view(ctx context.Context, item Record, includeOriginal bool) (Public, error) {
+	view := publicFromRecord(item)
+	if item.ProcessingStatus != StatusReady {
+		return view, nil
+	}
+	if item.ExternalURL != "" {
+		view.ThumbnailURL = item.ExternalURL
+		view.PreviewURL = item.ExternalURL
+		if includeOriginal {
+			view.OriginalURL = item.ExternalURL
+		}
+		return view, nil
+	}
+	previewKey := item.PreviewKey
+	if previewKey == "" {
+		previewKey = item.StorageKey
+	}
+	thumbnailKey := item.ThumbnailKey
+	if thumbnailKey == "" {
+		thumbnailKey = previewKey
+	}
+	var err error
+	view.ThumbnailURL, err = h.storage.CreateDownloadURL(ctx, thumbnailKey, time.Hour)
+	if err != nil {
+		return Public{}, err
+	}
+	view.PreviewURL, err = h.storage.CreateDownloadURL(ctx, previewKey, time.Hour)
+	if err != nil {
+		return Public{}, err
+	}
+	if includeOriginal {
+		view.OriginalURL, err = h.storage.CreateDownloadURL(ctx, item.StorageKey, time.Hour)
+		if err != nil {
+			return Public{}, err
+		}
+	}
+	return view, nil
+}
+
+func publicFromRecord(item Record) Public {
+	return Public{
+		ID:               item.ID,
+		OriginalFilename: item.OriginalFilename,
+		MimeType:         item.MimeType,
+		FileSize:         item.FileSize,
+		ProcessingStatus: item.ProcessingStatus,
+		Width:            item.Width,
+		Height:           item.Height,
+		DurationSeconds:  item.DurationSeconds,
+		SortOrder:        item.SortOrder,
+	}
+}
+
+func allowedMimeType(value string) bool {
+	switch value {
+	case "image/jpeg", "image/png", "image/webp", "image/heic", "image/heif", "video/mp4", "video/quicktime", "video/webm":
+		return true
+	default:
+		return false
+	}
+}
+
+func safeFilename(value string) string {
+	value = strings.ReplaceAll(value, "\\", "/")
+	value = filepath.Base(value)
+	if value == "." || value == ".." {
+		return ""
+	}
+	return strings.TrimSpace(value)
+}
+
+func parseID(value string) (uuid.UUID, error) {
+	return uuid.Parse(value)
+}
+
+func decodeJSON(w http.ResponseWriter, r *http.Request, target any) bool {
+	if !strings.HasPrefix(r.Header.Get("Content-Type"), "application/json") {
+		writeError(w, http.StatusUnsupportedMediaType, "content type must be application/json")
+		return false
+	}
+	decoder := json.NewDecoder(http.MaxBytesReader(w, r.Body, 1<<20))
+	decoder.DisallowUnknownFields()
+	if err := decoder.Decode(target); err != nil {
+		writeError(w, http.StatusBadRequest, "invalid JSON body")
+		return false
+	}
+	return true
+}
+
+func writeError(w http.ResponseWriter, status int, message string) {
+	writeJSON(w, status, map[string]string{"error": message})
+}
+
+func writeJSON(w http.ResponseWriter, status int, value any) {
+	w.Header().Set("Content-Type", "application/json; charset=utf-8")
+	w.WriteHeader(status)
+	_ = json.NewEncoder(w).Encode(value)
+}