feat(docs): drift gate — docs frontmatter validated against real routes

Every API doc that declares frontmatter (method/path/auth/area) is now
checked by a unit test against three sources of truth:

1. Route registration: internal/router/*.go is parsed the way echo resolves
   it (group prefixes concatenate; scanner.go's parameterized groups seeded).
   Doc paths that no longer exist fail. (This is the check that would have
   caught the /api/api/admin/hash-conflicts split.)
2. Auth: frontmatter auth label must match the middleware chain
   (none|jwt|jwt+admin|device-token|optional-jwt).
3. Shapes: internal/docs/schema.go registry — example-request decoded with
   unknown fields DISALLOWED (typo guard), required-by-validate fields must
   appear (staleness guard), example-response top-level key set compared
   both directions against the marshaled handler type (or a RawMessage pin
   for hand-built map responses).

Five collections docs are the pilots with real handler shapes; notable
corrections they pin: update returns 201 (not 200), list excludes smart
collections unless include_auto=true, rule priority is 1-10 higher-wins
(docs claimed 1=highest), created_at is Go time.String() not RFC3339,
hide_finished/show_up_next toggles documented. CollectionResponse hoisted
out of GetCollections/GetBookCollections as CollectionSummary /
BookCollectionSummary so the registry can pin real types.

The gate fails on missing registry entries by design — that is the
maintenance contract. Known pre-existing (not this commit): vet copy-lock
warnings in media.go.
This commit is contained in:
John O'Keefe committed 2026-10-24 14:41:02 -04:00
1 parent 994e0f86c4
commit cc893f758e
8 files changed
+824 -168

No files matched your search

@@ -1,27 +1,28 @@
---
method: DELETE
path: /api/collections/:id
auth: jwt
area: collections
---
<!-- source: internal/handlers/collections.go:464 CollectionHandler.DeleteCollection -->
# Delete Collection
Delete a collection. Books are NOT deleted.
Deletes a collection. Membership rows go with it; the books themselves are
untouched.
**Endpoint**: `DELETE /api/collections/{id}`
**Auth**: Required
**Content-Type**: `application/json`
Success is **204 No Content** — there is no response body. (htmx requests
receive a small HTML redirect snippet instead; that behavior is web-internal.)
## Path Parameters
## Example request
| Parameter | Type | Required | Description |
| --------- | ------------- | -------- | --------------- |
| id | string (UUID) | Yes | Collection UUID |
```text
DELETE /api/collections/550e8400-e29b-41d4-a716-446655440000
```
## Response (204 No Content)
## Errors
Collection deleted successfully. No response body.
## Error Responses
| Code | Description |
| ---- | ----------------------- |
| 401 | Authentication required |
| 404 | Collection not found |
| 500 | Internal server error |
## Try It Out
| Status | Body | When |
| ------ | ---- | ---- |
| 400 | `{"error": "invalid collection id"}` | malformed id |
| 500 | `{"error": "..."}` | unexpected server error |
@@ -1,54 +1,74 @@
---
method: GET
path: /api/collections/:id
auth: jwt
area: collections
---
<!-- source: internal/handlers/collections.go:243 CollectionHandler.GetCollection -->
# Get Collection
Get single collection with all books.
Returns one collection with its books and, for smart collections, the
computed Up Next entries.
**Endpoint**: `GET /api/collections/{id}`
**Auth**: Required
**Content-Type**: `application/json`
## Example request
## Path Parameters
```text
GET /api/collections/550e8400-e29b-41d4-a716-446655440000
```
| Parameter | Type | Required | Description |
| --------- | ------------- | -------- | --------------- |
| id | string (UUID) | Yes | Collection UUID |
## Example response
## Query Parameters
| Parameter | Type | Required | Description |
| ------------- | ------- | -------- | ----------------------------------------- |
| include_books | boolean | No | Include books in response (default: true) |
| limit | integer | No | Number of books to return (default: 50) |
| offset | integer | No | Number of books to skip (default: 0) |
## Response (200 OK)
```json
```json example-response
{
"id": "550e8400-e29b-41d4-a716-446655440000",
"name": "Science Fiction",
"description": "My sci-fi collection",
"color": "#FF5733",
"icon": "🚀",
"books": [
{
"media_item_id": "660e8400-e29b-41d4-a716-446655440000",
"title": "Foundation",
"author": "Isaac Asimov",
"cover_image_path": "/covers/foundation.jpg"
}
],
"auto_assign_rules": [],
"view_settings": {},
"created_at": "2026-02-01T10:00:00Z"
"user_id": "8f14e45f-ceea-467f-a429-0b21bfc0b1a2",
"name": "To Read",
"description": "Books I want to read soon",
"color": "#00FF00",
"icon": "📖",
"auto_assign_rules": null,
"view_settings": { "kobo": { "view_mode": "grid" } },
"books": [],
"book_count": 0,
"is_smart": false,
"up_next": [],
"created_at": "2026-10-24 13:57:01.81234 +0000 UTC"
}
```
## Error Responses
`created_at` uses Go's `time.String()` format, not RFC3339. `books` and
`up_next` are book-card arrays; `up_next` items carry
`id`, `title`, `author`, `cover`, `format`, `progress`.
| Code | Description |
| ---- | ----------------------- |
| 401 | Authentication required |
| 404 | Collection not found |
| 500 | Internal server error |
## Query parameters
## Try It Out
| Param | Type | Notes |
| ----- | ---- | ----- |
| library_id | uuid | optional; scopes items/counts to one library (invalid values are rejected with 400) |
## Response fields
| Field | Type | Notes |
| ----- | ---- | ----- |
| id | string (uuid) | |
| user_id | string (uuid) | owner |
| name | string | |
| description | string | |
| color | string | |
| icon | string | |
| auto_assign_rules | array \| null | |
| view_settings | object | |
| books | array | book cards in this collection |
| book_count | number | length of `books` |
| is_smart | boolean | |
| up_next | array | smart collections only: computed next-up entries |
| created_at | string | |
## Errors
| Status | Body | When |
| ------ | ---- | ---- |
| 400 | `{"error": "invalid collection id"}` / `{"error": "invalid library_id"}` | malformed id(s) |
| 404 | `{"error": "collection not found"}` | no such collection |
| 500 | `{"error": "..."}` | unexpected server error |
@@ -1,57 +1,77 @@
---
method: GET
path: /api/collections
auth: jwt
area: collections
---
<!-- source: internal/handlers/collections.go:153 CollectionHandler.GetCollections -->
# List Collections
Get all collections for the authenticated user.
Lists the signed-in user's collections with live book counts. Smart
(rule-driven) collections are **excluded by default** so legacy readers never
see stale membership — pass `include_auto=true` to include them.
**Endpoint**: `GET /api/collections`
**Auth**: Required
**Content-Type**: `application/json`
## Example request
## Query Parameters
```text
GET /api/collections?include_auto=true&sort_by=name
```
| Parameter | Type | Required | Description |
| --------- | ------- | -------- | --------------------------------------------- |
| limit | integer | No | Number of collections to return (default: 50) |
| offset | integer | No | Number of collections to skip (default: 0) |
## Example response
## Response (200 OK)
```json
```json example-response
{
"collections": [
{
"id": "550e8400-e29b-41d4-a716-446655440000",
"name": "Science Fiction",
"description": "My sci-fi collection",
"color": "#FF5733",
"icon": "🚀",
"auto_assign_rules": [
{
"field": "genre",
"operator": "equals",
"value": "Science Fiction",
"priority": 1,
"enabled": true
}
],
"view_settings": {
"kobo": {
"view_mode": "grid",
"sort_order": "name",
"items_per_page": 24
}
},
"created_at": "2026-02-01T10:00:00Z"
"name": "To Read",
"description": "Books I want to read soon",
"color": "#00FF00",
"icon": "📖",
"auto_assign_rules": null,
"created_at": "2026-10-24 13:57:01.81234 +0000 UTC",
"book_count": 12,
"is_smart": false
}
],
"total": 1
}
```
## Error Responses
`created_at` uses Go's `time.String()` format, not RFC3339.
| Code | Description |
| ---- | ----------------------- |
| 401 | Authentication required |
| 500 | Internal server error |
## Query parameters
## Try It Out
| Param | Type | Default | Notes |
| ----- | ---- | ------- | ----- |
| include_auto | boolean | `false` | include smart collections |
| sort_by | string | — | `name` sorts alphabetically; otherwise service order |
| library_id | uuid | — | scopes book counts to one library (smart collections only) |
## Response fields
| Field | Type | Notes |
| ----- | ---- | ----- |
| collections | array | `CollectionSummary` objects, see below |
| total | number | length of `collections` |
### Collection item
| Field | Type | Notes |
| ----- | ---- | ----- |
| id | string (uuid) | |
| name | string | |
| description | string | |
| color | string | |
| icon | string | |
| auto_assign_rules | array \| null | raw rules JSON; non-null implies smart |
| created_at | string | Go `time.String()` format |
| book_count | number | live count; respects `library_id` for smart collections |
| is_smart | boolean | |
## Errors
| Status | Body | When |
| ------ | ---- | ---- |
| 500 | `{"error": "..."}` | unexpected server error |
@@ -1,63 +1,70 @@
---
method: PUT
path: /api/collections/:id
auth: jwt
area: collections
---
<!-- source: internal/handlers/collections.go:399 CollectionHandler.UpdateCollection -->
# Update Collection
Update collection details.
Updates name/metadata, replaces the rule set, and merges view settings.
Note the quirk: **the success status is 201**, not 200 (historical).
**Endpoint**: `PUT /api/collections/{id}`
**Auth**: Required
**Content-Type**: `application/json`
The playlist toggles `hide_finished` / `show_up_next` are accepted as
top-level single-element arrays (an htmx form artifact — the LAST value wins)
and are merged into `view_settings` server-side. JSON clients may prefer to
set `view_settings.hide_finished` / `view_settings.show_up_next` directly.
## Path Parameters
## Example request
| Parameter | Type | Required | Description |
| --------- | ------------- | -------- | --------------- |
| id | string (UUID) | Yes | Collection UUID |
## Request Body
All fields are optional. Include only fields you want to update.
| Field | Type | Required | Description |
| ----------------- | ------ | -------- | ----------------------------------------------- |
| name | string | No | Collection name (max 255 chars) |
| description | string | No | Collection description |
| color | string | No | Hex color code (e.g., "#FF5733") |
| icon | string | No | Emoji icon (e.g., "🚀", "📖") |
| auto_assign_rules | array | No | Array of rule objects (replaces existing rules) |
| view_settings | object | No | Per-device display preferences |
### Example Request
```json
```json example-request
{
"name": "Sci-Fi Favorites",
"name": "To Read (2026)",
"description": "Updated description",
"color": "#7aa2f7",
"icon": "🌟"
"color": "#33CCFF",
"icon": "📚",
"auto_assign_rules": [],
"view_settings": { "hide_finished": true },
"hide_finished": ["true"],
"show_up_next": ["true"]
}
```
## Response (200 OK)
## Example response
```json
```json example-response
{
"id": "550e8400-e29b-41d4-a716-446655440000",
"name": "Sci-Fi Favorites",
"user_id": "8f14e45f-ceea-467f-a429-0b21bfc0b1a2",
"name": "To Read (2026)",
"description": "Updated description",
"color": "#7aa2f7",
"icon": "🌟",
"auto_assign_rules": [],
"view_settings": {},
"created_at": "2026-02-01T10:00:00Z"
"color": "#33CCFF",
"icon": "📚",
"auto_assign_rules": null,
"view_settings": { "hide_finished": true, "show_up_next": true },
"created_at": "2026-10-24 13:57:01.81234 +0000 UTC"
}
```
## Error Responses
`created_at` uses Go's `time.String()` format, not RFC3339.
| Code | Description |
| ---- | ----------------------------------- |
| 400 | Invalid request (validation failed) |
| 401 | Authentication required |
| 404 | Collection not found |
| 500 | Internal server error |
## Request fields
## Try It Out
| Field | Type | Required | Notes |
| ----- | ---- | -------- | ----- |
| name | string | yes | |
| description | string | no | |
| color | string | no | |
| icon | string | no | |
| auto_assign_rules | array | no | replaces the whole rule set (rule object shape: see Create Collection) |
| view_settings | object | no | merged into stored settings |
| hide_finished | array | no | single-element string array `["true"]`/`["false"]`; merged into view_settings |
| show_up_next | array | no | same shape as `hide_finished` |
## Errors
| Status | Body | When |
| ------ | ---- | ---- |
| 400 | `{"error": "invalid collection id"}` / `{"error": "invalid request"}` | malformed id or body |
| 500 | `{"error": "..."}` | unexpected server error |