// Delete handles DELETE
func (ctl *UserController) Delete(c *models.Context) {
_, _, itemID, status, err := c.GetItemTypeAndItemID()
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
m, status, err := models.GetUser(itemID)
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
if !models.UserIsOnSite(m.ID, c.Site.ID) {
c.RespondWithErrorMessage(h.NoAuthMessage, http.StatusForbidden)
return
}
status, err = m.Delete()
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
audit.Delete(
c.Site.ID,
h.ItemTypes[h.ItemTypeUser],
itemID,
c.Auth.ProfileID,
time.Now(),
c.IP,
)
c.RespondWithOK()
}
// Update handles PUT
func (ctl *EventController) Update(c *models.Context) {
_, itemTypeID, itemID, status, err := c.GetItemTypeAndItemID()
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
// Validate inputs
m, status, err := models.GetEvent(c.Site.ID, itemID, c.Auth.ProfileID)
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
err = c.Fill(&m)
if err != nil {
c.RespondWithErrorMessage(
fmt.Sprintf("The post data is invalid: %v", err.Error()),
http.StatusBadRequest,
)
return
}
// Start Authorisation
perms := models.GetPermission(
models.MakeAuthorisationContext(
c, 0, itemTypeID, itemID),
)
if !perms.CanUpdate {
c.RespondWithErrorMessage(h.NoAuthMessage, http.StatusForbidden)
return
}
// End Authorisation
// Populate where applicable from auth and context
m.Meta.EditedByNullable = sql.NullInt64{Int64: c.Auth.ProfileID, Valid: true}
m.Meta.EditedNullable = pq.NullTime{Time: time.Now(), Valid: true}
status, err = m.Update(c.Site.ID, c.Auth.ProfileID)
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
audit.Replace(
c.Site.ID,
h.ItemTypes[h.ItemTypeEvent],
m.ID,
c.Auth.ProfileID,
time.Now(),
c.IP,
)
c.RespondWithSeeOther(
fmt.Sprintf(
"%s/%d",
h.APITypeEvent,
m.ID,
),
)
}
// Read handles GET
func (ctl *AttributeController) Read(c *models.Context) {
_, itemTypeID, itemID, status, err := c.GetItemTypeAndItemID()
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
perms := models.GetPermission(models.MakeAuthorisationContext(c, 0, itemTypeID, itemID))
if !perms.CanRead {
c.RespondWithErrorMessage(h.NoAuthMessage, http.StatusForbidden)
return
}
attributeID, status, err := models.GetAttributeID(itemTypeID, itemID, c.RouteVars["key"])
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
m, status, err := models.GetAttribute(attributeID)
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
c.RespondWithData(m)
}
// Read handles GET
func (ctl *UserController) Read(c *models.Context) {
_, itemTypeID, itemID, status, err := c.GetItemTypeAndItemID()
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
// Start Authorisation
perms := models.GetPermission(
models.MakeAuthorisationContext(
c, 0, itemTypeID, itemID),
)
if !perms.CanRead {
c.RespondWithErrorMessage(h.NoAuthMessage, http.StatusForbidden)
return
}
// End Authorisation
m, status, err := models.GetUser(itemID)
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
if !models.UserIsOnSite(m.ID, c.Site.ID) {
c.RespondWithErrorMessage(h.NoAuthMessage, http.StatusForbidden)
return
}
c.RespondWithData(m)
}
// Update handles PUT
func (ctl *ProfileController) Update(c *models.Context) {
_, itemTypeID, itemID, status, err := c.GetItemTypeAndItemID()
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
m, status, err := models.GetProfile(c.Site.ID, itemID)
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
err = c.Fill(&m)
if err != nil {
c.RespondWithErrorMessage(
fmt.Sprintf("The post data is invalid: %v", err.Error()),
http.StatusBadRequest,
)
return
}
// Start Authorisation
perms := models.GetPermission(
models.MakeAuthorisationContext(
c, 0, itemTypeID, itemID),
)
if !perms.CanUpdate {
c.RespondWithErrorMessage(h.NoAuthMessage, http.StatusForbidden)
return
}
// End Authorisation
// Populate site and user ID from goweb context
m.SiteID = c.Site.ID
status, err = m.Update()
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
audit.Replace(
c.Site.ID,
h.ItemTypes[h.ItemTypeProfile],
m.ID,
c.Auth.ProfileID,
time.Now(),
c.IP,
)
c.RespondWithSeeOther(
fmt.Sprintf(
"%s/%d",
h.APITypeProfile,
m.ID,
),
)
}
// Update handles PUT
func (ctl *AttributeController) Update(c *models.Context) {
_, itemTypeID, itemID, status, err := c.GetItemTypeAndItemID()
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
key := c.RouteVars["key"]
// Exception from normal model is that we don't attempt to fetch before
// we update. We will be doing an upsert (update or insert) rather than
// a pure update. As such, the item may not exist before we update it and
// we allow that to be resolved later. This works in this case as the data
// structure is simple and we don't care about extended metadata
m := models.AttributeType{}
m.Key = key
m.Number = sql.NullFloat64{Float64: math.MaxFloat64}
err = c.Fill(&m)
if err != nil {
c.RespondWithErrorMessage(
fmt.Sprintf("The post data is invalid: %v", err.Error()),
http.StatusBadRequest,
)
return
}
perms := models.GetPermission(models.MakeAuthorisationContext(c, 0, itemTypeID, itemID))
if !perms.CanUpdate {
c.RespondWithErrorMessage(h.NoAuthMessage, http.StatusForbidden)
return
}
status, err = m.Update(itemTypeID, itemID)
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
audit.Replace(
c.Site.ID,
h.ItemTypes[h.ItemTypeAttribute],
m.ID,
c.Auth.ProfileID,
time.Now(),
c.IP,
)
c.RespondWithSeeOther(
fmt.Sprintf(
"%s/%s",
fmt.Sprintf(h.APITypeAttribute, c.RouteVars["type"], itemID),
key,
),
)
}
// Update handles PUT
func (ctl *SiteController) Update(c *models.Context) {
_, _, itemID, status, err := c.GetItemTypeAndItemID()
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
m, status, err := models.GetSite(itemID)
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
// Use the user ID to check, since the current context is a different site (the root site)
// than the site the owner profile is associated with.
owner, status, err := models.GetProfileSummary(m.ID, m.OwnedByID)
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
if owner.UserID != c.Auth.UserID {
c.RespondWithErrorMessage(
fmt.Sprintf("You must be the owner of the site to update it"),
http.StatusForbidden,
)
return
}
err = c.Fill(&m)
if err != nil {
c.RespondWithErrorMessage(
fmt.Sprintf("The post data is invalid: %v", err.Error()),
http.StatusBadRequest,
)
return
}
status, err = m.Update()
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
audit.Replace(
c.Site.ID,
h.ItemTypes[h.ItemTypeSite],
m.ID,
c.Auth.ProfileID,
time.Now(),
c.IP,
)
c.RespondWithSeeOther(fmt.Sprintf("%s/%d", h.APITypeSite, m.ID))
}
// UpdateMany handles PUT for the collection
func (ctl *AttributesController) UpdateMany(c *models.Context) {
_, itemTypeID, itemID, status, err := c.GetItemTypeAndItemID()
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
ems := []models.AttributeType{}
err = c.Fill(&ems)
if err != nil {
c.RespondWithErrorMessage(
fmt.Sprintf("The post data is invalid: %v", err.Error()),
http.StatusBadRequest,
)
return
}
for _, v := range ems {
if strings.Trim(v.Key, " ") == "" {
c.RespondWithErrorMessage(
"key must be supplied with every attribute when updating multiple attributes",
http.StatusBadRequest,
)
return
}
}
perms := models.GetPermission(models.MakeAuthorisationContext(c, 0, itemTypeID, itemID))
if !perms.CanUpdate {
c.RespondWithErrorMessage(h.NoAuthMessage, http.StatusForbidden)
return
}
status, err = models.UpdateManyAttributes(itemTypeID, itemID, ems)
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
for _, m := range ems {
audit.Replace(
c.Site.ID,
h.ItemTypes[h.ItemTypeAttribute],
m.ID,
c.Auth.ProfileID,
time.Now(),
c.IP,
)
}
c.RespondWithOK()
}
// Update handles PUT
func (ctl *UpdateOptionController) Update(c *models.Context) {
_, _, itemID, status, err := c.GetItemTypeAndItemID()
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
var exists bool
m, status, err := models.GetUpdateOptionByUpdateType(c.Auth.ProfileID, itemID)
if err != nil && status != http.StatusNotFound {
c.RespondWithErrorDetail(err, status)
return
}
if status == http.StatusOK {
exists = true
}
err = c.Fill(&m)
if err != nil {
c.RespondWithErrorMessage(
fmt.Sprintf("The post data is invalid: %v", err.Error()),
http.StatusBadRequest,
)
return
}
// Profile ID cannot be changed
m.UpdateTypeID = itemID
m.ProfileID = c.Auth.ProfileID
if exists {
// Update
status, err = m.Update()
} else {
// Create
status, err = m.Insert()
}
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
// Respond
c.RespondWithSeeOther(
fmt.Sprintf(
h.APITypeUpdateOptionType,
m.UpdateTypeID,
),
)
}
// Delete handles DELETE
func (ctl *CommentController) Delete(c *models.Context) {
_, itemTypeID, itemID, status, err := c.GetItemTypeAndItemID()
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
// Start Authorisation
perms := models.GetPermission(
models.MakeAuthorisationContext(
c, 0, itemTypeID, itemID),
)
if !perms.CanDelete {
c.RespondWithErrorMessage(h.NoAuthMessage, http.StatusForbidden)
return
}
// End Authorisation
// Partially instantiated type for Id passing
m, status, err := models.GetCommentSummary(c.Site.ID, itemID)
if err != nil {
if status == http.StatusNotFound {
c.RespondWithOK()
return
}
c.RespondWithErrorDetail(err, status)
return
}
// Delete resource
status, err = m.Delete(c.Site.ID)
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
audit.Delete(
c.Site.ID,
h.ItemTypes[h.ItemTypeComment],
m.ID,
c.Auth.ProfileID,
time.Now(),
c.IP,
)
c.RespondWithOK()
}
// Read handles GET
func (ctl *CommentContextController) Read(c *models.Context) {
_, itemTypeID, itemID, status, err := c.GetItemTypeAndItemID()
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
// Start Authorisation
perms := models.GetPermission(
models.MakeAuthorisationContext(
c, 0, itemTypeID, itemID),
)
if !perms.CanRead {
c.RespondWithErrorMessage(h.NoAuthMessage, http.StatusForbidden)
return
}
// End Authorisation
limit, _, status, err := h.GetLimitAndOffset(c.Request.URL.Query())
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
m, status, err := models.GetCommentSummary(c.Site.ID, itemID)
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
link, status, err := m.GetPageLink(limit, c.Auth.ProfileID)
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
pageURL, err := url.Parse(link.Href)
if err != nil {
c.RespondWithErrorMessage(err.Error(), http.StatusInternalServerError)
return
}
queryString := pageURL.Query()
queryString.Add("comment_id", strconv.FormatInt(m.ID, 10))
pageURL.RawQuery = queryString.Encode()
c.RespondWithLocation(pageURL.String())
}
// Delete handles DELETE
func (ctl *HuddleController) Delete(c *models.Context) {
_, itemTypeID, itemID, status, err := c.GetItemTypeAndItemID()
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
// Start Authorisation
perms := models.GetPermission(
models.MakeAuthorisationContext(
c, 0, itemTypeID, itemID),
)
if !perms.CanDelete {
c.RespondWithErrorMessage(h.NoAuthMessage, http.StatusForbidden)
return
}
// End Authorisation
m, status, err := models.GetHuddle(c.Site.ID, c.Auth.ProfileID, itemID)
if err != nil {
if status == http.StatusNotFound {
c.RespondWithOK()
return
}
c.RespondWithErrorDetail(err, status)
return
}
status, err = m.Delete(c.Site.ID, c.Auth.ProfileID)
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
audit.Delete(
c.Site.ID,
h.ItemTypes[h.ItemTypeHuddle],
m.ID,
c.Auth.ProfileID,
time.Now(),
c.IP,
)
c.RespondWithOK()
}
// Read handles GET
func (ctl *SiteCheckController) Read(c *models.Context) {
_, _, itemID, status, err := c.GetItemTypeAndItemID()
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
m, status, err := models.GetSite(itemID)
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
// Use the user ID to check, since the current context is a different site (the root site)
// than the site the owner profile is associated with.
owner, status, err := models.GetProfileSummary(m.ID, m.OwnedByID)
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
if owner.UserID != c.Auth.UserID {
c.RespondWithErrorMessage(
fmt.Sprintf("You must be the owner of the site to view its status"),
http.StatusForbidden,
)
return
}
siteHealth, status, err := models.CheckSiteHealth(m)
if err != nil {
c.RespondWithErrorMessage(
fmt.Sprintf("Error checking site status: %s", err.Error()),
status,
)
return
}
glog.Infof("Got site health: %+v\n", siteHealth)
c.RespondWithData(siteHealth)
}
// Read handles GET
func (ctl *UpdateOptionController) Read(c *models.Context) {
if c.Auth.ProfileID < 1 {
c.RespondWithErrorMessage(h.NoAuthMessage, http.StatusForbidden)
return
}
_, _, itemID, status, err := c.GetItemTypeAndItemID()
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
m, status, err := models.GetUpdateOptionByUpdateType(c.Auth.ProfileID, itemID)
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
c.RespondWithData(m)
}
// ReadMany handles GET for a collection
func (ctl *AttributesController) ReadMany(c *models.Context) {
_, itemTypeID, itemID, status, err := c.GetItemTypeAndItemID()
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
perms := models.GetPermission(models.MakeAuthorisationContext(c, 0, itemTypeID, itemID))
if !perms.CanRead {
c.RespondWithErrorMessage(h.NoAuthMessage, http.StatusForbidden)
return
}
// Fetch query string args if any exist
limit, offset, status, err := h.GetLimitAndOffset(c.Request.URL.Query())
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
ems, total, pages, status, err := models.GetAttributes(itemTypeID, itemID, limit, offset)
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
// Construct the response
m := models.AttributesType{}
m.Attributes = h.ConstructArray(
ems,
fmt.Sprintf(h.APITypeAttribute, c.RouteVars["type"], 0),
total,
limit,
offset,
pages,
c.Request.URL,
)
c.RespondWithData(m)
}
// Read handles GET
func (ctl *CommentController) Read(c *models.Context) {
_, itemTypeID, itemID, status, err := c.GetItemTypeAndItemID()
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
// Start Authorisation
perms := models.GetPermission(
models.MakeAuthorisationContext(
c, 0, itemTypeID, itemID),
)
if !perms.CanRead {
c.RespondWithErrorMessage(h.NoAuthMessage, http.StatusForbidden)
return
}
// End Authorisation
limit, _, status, err := h.GetLimitAndOffset(c.Request.URL.Query())
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
m, status, err := models.GetComment(c.Site.ID, itemID, c.Auth.ProfileID, limit)
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
m.Meta.Permissions = perms
if c.Auth.ProfileID > 0 {
go models.MarkAsRead(m.ItemTypeID, m.ItemID, c.Auth.ProfileID, m.Meta.Created)
}
c.RespondWithData(m)
}
// Delete handles DELETE
func (ctl *AttributeController) Delete(c *models.Context) {
_, itemTypeID, itemID, status, err := c.GetItemTypeAndItemID()
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
key := c.RouteVars["key"]
m := models.AttributeType{}
m.Key = key
attributeID, status, err := models.GetAttributeID(itemTypeID, itemID, m.Key)
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
m.ID = attributeID
status, err = m.Delete()
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
audit.Delete(
c.Site.ID,
h.ItemTypes[h.ItemTypeAttribute],
m.ID,
c.Auth.ProfileID,
time.Now(),
c.IP,
)
c.RespondWithOK()
}
// Read handles GET
func (ctl *ProfileController) Read(c *models.Context) {
_, itemTypeID, itemID, status, err := c.GetItemTypeAndItemID()
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
// Start Authorisation
perms := models.GetPermission(
models.MakeAuthorisationContext(
c, 0, itemTypeID, itemID),
)
if c.Site.ID == 1 {
if c.Auth.ProfileID != itemID {
perms.CanRead = false
}
}
if !perms.CanRead {
c.RespondWithErrorMessage(h.NoAuthMessage, http.StatusForbidden)
return
}
// End Authorisation
m, status, err := models.GetProfile(c.Site.ID, itemID)
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
m.Meta.Permissions = perms
if c.Auth.ProfileID > 0 {
// Get watcher status
watcherID, sendEmail, sendSms, ignored, status, err := models.GetWatcherAndIgnoreStatus(
h.ItemTypes[h.ItemTypeProfile], m.ID, c.Auth.ProfileID,
)
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
if ignored {
m.Meta.Flags.Ignored = true
}
if watcherID > 0 {
m.Meta.Flags.Watched = true
m.Meta.Flags.SendEmail = sendEmail
m.Meta.Flags.SendSMS = sendSms
}
if c.Auth.ProfileID == m.ID {
// Get counts of things
m.GetUnreadHuddleCount()
}
if perms.IsOwner {
user, status, err := models.GetUser(c.Auth.UserID)
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
m.Email = user.Email
}
}
c.RespondWithData(m)
}
// Read handles GET
func (ctl *EventController) Read(c *models.Context) {
_, itemTypeID, itemID, status, err := c.GetItemTypeAndItemID()
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
// Start Authorisation
perms := models.GetPermission(
models.MakeAuthorisationContext(
c, 0, itemTypeID, itemID),
)
if !perms.CanRead {
c.RespondWithErrorMessage(h.NoAuthMessage, http.StatusForbidden)
return
}
// End Authorisation
// Read Event
m, status, err := models.GetEvent(c.Site.ID, itemID, c.Auth.ProfileID)
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
// Get Comments
m.Comments, status, err = models.GetComments(
c.Site.ID,
h.ItemTypeEvent,
m.ID,
c.Request.URL,
c.Auth.ProfileID,
m.Meta.Created,
)
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
m.Meta.Permissions = perms
// Mark as read (to the last comment on this page if applicable)
if c.Auth.ProfileID > 0 {
read := m.Meta.Created
switch m.Comments.Items.(type) {
case []models.CommentSummaryType:
comments := m.Comments.Items.([]models.CommentSummaryType)
if len(comments) > 0 {
read = comments[len(comments)-1].Meta.Created
if m.Comments.Page >= m.Comments.Pages {
read = time.Now()
}
}
default:
}
go models.MarkAsRead(h.ItemTypes[h.ItemTypeEvent], m.ID, c.Auth.ProfileID, read)
// Get watcher status
watcherID, sendEmail, sendSms, ignored, status, err := models.GetWatcherAndIgnoreStatus(
h.ItemTypes[h.ItemTypeEvent], m.ID, c.Auth.ProfileID,
)
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
if ignored {
m.Meta.Flags.Ignored = true
}
if watcherID > 0 {
m.Meta.Flags.Watched = true
m.Meta.Flags.SendEmail = sendEmail
m.Meta.Flags.SendSMS = sendSms
}
}
go models.IncrementViewCount(h.ItemTypes[h.ItemTypeEvent], m.ID)
c.RespondWithData(m)
}
// Patch handles PATCH
func (ctl *EventController) Patch(c *models.Context) {
_, itemTypeID, itemID, status, err := c.GetItemTypeAndItemID()
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
patches := []h.PatchType{}
err = c.Fill(&patches)
if err != nil {
c.RespondWithErrorMessage(
fmt.Sprintf("The post data is invalid: %v", err.Error()),
http.StatusBadRequest,
)
return
}
status, err = h.TestPatch(patches)
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
// Start Authorisation
ac := models.MakeAuthorisationContext(c, 0, itemTypeID, itemID)
perms := models.GetPermission(ac)
if !perms.CanUpdate {
c.RespondWithErrorMessage(h.NoAuthMessage, http.StatusForbidden)
return
}
// All patches are 'replace'
for _, patch := range patches {
status, err := patch.ScanRawValue()
if !patch.Bool.Valid {
c.RespondWithErrorDetail(err, status)
return
}
switch patch.Path {
case "/meta/flags/sticky":
// Only super users' can sticky and unsticky
if !perms.IsModerator {
c.RespondWithErrorMessage(h.NoAuthMessage, http.StatusForbidden)
return
}
if !patch.Bool.Valid {
c.RespondWithErrorMessage("/meta/flags/sticky requires a bool value", http.StatusBadRequest)
return
}
case "/meta/flags/open":
// Only super users' and item owners can open and close
if !(perms.IsModerator || perms.IsOwner) {
c.RespondWithErrorMessage(h.NoAuthMessage, http.StatusForbidden)
return
}
if !patch.Bool.Valid {
c.RespondWithErrorMessage("/meta/flags/open requires a bool value", http.StatusBadRequest)
return
}
case "/meta/flags/deleted":
// Only super users' can undelete, but super users' and owners can delete
if !patch.Bool.Valid {
c.RespondWithErrorMessage("/meta/flags/deleted requires a bool value", http.StatusBadRequest)
return
}
if (patch.Bool.Bool == false && !(perms.IsModerator || perms.IsOwner)) || !perms.IsModerator {
c.RespondWithErrorMessage(h.NoAuthMessage, http.StatusForbidden)
return
}
case "/meta/flags/moderated":
if !perms.IsModerator {
c.RespondWithErrorMessage(h.NoAuthMessage, http.StatusForbidden)
return
}
default:
c.RespondWithErrorMessage("Invalid patch operation path", http.StatusBadRequest)
return
}
}
// End Authorisation
m, status, err := models.GetEvent(c.Site.ID, itemID, c.Auth.ProfileID)
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
status, err = m.Patch(ac, patches)
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
audit.Update(
c.Site.ID,
h.ItemTypes[h.ItemTypeEvent],
m.ID,
c.Auth.ProfileID,
time.Now(),
c.IP,
)
c.RespondWithOK()
}
// Read handles GET
func (ctl *LastCommentController) Read(c *models.Context) {
itemType, itemTypeID, itemID, status, err := c.GetItemTypeAndItemID()
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
perms := models.GetPermission(models.MakeAuthorisationContext(c, 0, itemTypeID, itemID))
if !perms.CanRead {
c.RespondWithErrorMessage(h.NoAuthMessage, http.StatusForbidden)
return
}
parsed := c.Request.URL
query := parsed.Query()
limit, _, status, err := h.GetLimitAndOffset(query)
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
query.Del("limit")
if limit != h.DefaultQueryLimit {
query.Set("limit", strconv.FormatInt(limit, 10))
}
lastComment, status, err := models.GetLastComment(itemTypeID, itemID)
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
location := fmt.Sprintf(
"%s/%d",
h.ItemTypesToAPIItem[itemType],
itemID,
)
parsed.Path = location
// Construct location of the last comment on the item.
if lastComment.Valid {
_, _, offset, _, err := models.GetPageNumber(
lastComment.ID,
limit,
c.Auth.ProfileID,
)
if err != nil {
query.Del("offset")
if offset != h.DefaultQueryOffset {
query.Set("offset", strconv.FormatInt(offset, 10))
}
query.Del("comment_id")
query.Set("comment_id", strconv.FormatInt(lastComment.ID, 10))
parsed.RawQuery = query.Encode()
c.RespondWithLocation(parsed.String())
return
}
}
parsed.RawQuery = query.Encode()
c.RespondWithLocation(parsed.String())
}
// Delete handles DELETE
func (ctl *WatcherController) Delete(c *models.Context) {
_, _, itemID, status, err := c.GetItemTypeAndItemID()
if itemID != 0 {
m, status, err := models.GetWatcher(itemID, c.Site.ID)
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
// Check ownership
if c.Auth.ProfileID != m.ProfileID {
c.RespondWithErrorMessage(h.NoAuthMessage, http.StatusForbidden)
return
}
// Delete resource
status, err = m.Delete()
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
c.RespondWithOK()
}
// Fill from query string
m := models.WatcherType{}
itemID, itemType, status, err := h.GetItemAndItemType(c.Request.URL.Query())
if _, exists := h.ItemTypes[itemType]; !exists {
c.RespondWithErrorMessage(
fmt.Sprintf("Watcher could not be deleted: Item type not found"),
http.StatusBadRequest,
)
return
}
m.ItemTypeID = h.ItemTypes[itemType]
m.ID, _, _, _, status, err = models.GetWatcherAndIgnoreStatus(
m.ItemTypeID,
itemID,
c.Auth.ProfileID,
)
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
// Get watcher item to delete it
m, status, err = models.GetWatcher(m.ID, c.Site.ID)
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
// Delete resource
status, err = m.Delete()
if err != nil {
c.RespondWithErrorDetail(err, status)
return
}
c.RespondWithOK()
}