John O'Keefe
7d5bbd1177
The plan's per-EPISODE bulk select for the admin view (§0 item 8 follow-up — trimmed in the first admin-view commit; user called it back). Admins now tick checkboxes on DOWNLOADED episode rows and delete their files in one request: - Checkbox per row, rendered ONLY for admins + downloaded episodes (nothing to delete otherwise), via the existing podcastDetail Alpine component: selection ids/count survive the list's htmx swaps (reapplied on afterSwap — same pattern as the text filter) and clear after a successful bulk delete. - Toolbar segment outside #episode-list (survives swaps): 'N selected' + 'Delete selected files' (hx-include gathers the CHECKED boxes); disabled-looking at zero selection; hx-confirm states the re-materialization contract. CSP-safe method bindings only (bulkSelectionLabel/Class) — no ternaries in Alpine expressions. - POST /feeds/:id/episodes/delete-files (admin): repeated episode-file-select keys parsed via ParseForm directly (never bound — repeated-key wire is another echo-bind gotcha); each id validated to belong to THIS feed, so a forged foreign id is refused while the real selections apply; rows reset to pending, files removed. - Tests: bulk of two real ids + one forged id → deleted:2, files gone, rows pending; non-admin 403; all prior single/feed-level pins hold.
84 lines
3.1 KiB
Go
84 lines
3.1 KiB
Go
package router
|
|
|
|
// Podcast routes (plan §8). All under /api/podcasts with the JWT
|
|
// middleware; scoping is RLS's job (D20) — handlers add no visibility
|
|
// plumbing.
|
|
|
|
import (
|
|
"bytes"
|
|
"net/http"
|
|
|
|
"bookhoard/internal/handlers"
|
|
"bookhoard/templates"
|
|
|
|
"github.com/labstack/echo/v5"
|
|
)
|
|
|
|
func registerPodcastRoutes(cfg *Config) {
|
|
g := cfg.Echo.Group("/api/podcasts", createJWTMiddleware(cfg))
|
|
|
|
// Episode-list renderer (issue #1): htmx actions answer with the
|
|
// refreshed partial directly — no event indirection to miss. The
|
|
// view assembly lives here (templates) while the action logic lives
|
|
// in the handler; this closure is the sanctioned seam.
|
|
cfg.PodcastHandler.SetEpisodeListRenderer(func(c *echo.Context, feedID string, includePolicySelect, includeOrderSelect bool) error {
|
|
user, err := getTemplateUserWithTheme(c, cfg)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
feedUUID, err := parsePodcastUUID(feedID)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
data, err := buildPodcastDetailData(c, cfg, user, feedUUID)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
var buf bytes.Buffer
|
|
render := templates.PodcastEpisodeList
|
|
if templates.HasActiveDownloads(data.Episodes) {
|
|
render = templates.PodcastEpisodeListPolling
|
|
}
|
|
if err := render(*data).Render(c.Request().Context(), &buf); err != nil {
|
|
return err
|
|
}
|
|
if includePolicySelect {
|
|
// Issue #3: out-of-band swap of the auto-download select —
|
|
// the dropdown reflects the flipped policy immediately.
|
|
if err := templates.PodcastAutoDownloadSelectOOB(data.Feed).Render(c.Request().Context(), &buf); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
if includeOrderSelect {
|
|
// §0 item 3: out-of-band swap of the order select — the
|
|
// "Reverse feed order" button flips to reverse; the
|
|
// dropdown mirrors the server state immediately.
|
|
if err := templates.PodcastOrderSelectOOB(data.Feed.ID, data.Order).Render(c.Request().Context(), &buf); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
return c.HTML(http.StatusOK, buf.String())
|
|
})
|
|
|
|
g.POST("/feeds", cfg.PodcastHandler.AddFeed)
|
|
g.GET("/feeds", cfg.PodcastHandler.ListFeeds)
|
|
g.GET("/search", cfg.PodcastHandler.Search)
|
|
|
|
// :id-scoped (RLS answers 404 for feeds outside the caller's scope).
|
|
feeds := g.Group("/feeds/:id")
|
|
feeds.GET("", cfg.PodcastHandler.GetFeed)
|
|
feeds.GET("/sequence", cfg.PodcastHandler.GetFeedSequence)
|
|
feeds.PUT("/order", cfg.PodcastHandler.SetFeedOrder)
|
|
feeds.PUT("/subscription", cfg.PodcastHandler.UpdateSubscription)
|
|
feeds.DELETE("/subscription", cfg.PodcastHandler.DeleteSubscription)
|
|
feeds.POST("/refresh", cfg.PodcastHandler.RefreshFeed)
|
|
feeds.POST("/episodes/:eid/download", cfg.PodcastHandler.DownloadEpisodes)
|
|
feeds.DELETE("", cfg.PodcastHandler.DeleteFeed) // admin-only (handler checks role)
|
|
|
|
// Admin maintenance (§0 item 8): file deletion frees the disk and
|
|
// resets rows to pending. Handler checks admin role.
|
|
feeds.POST("/delete-files", handlers.AdminMiddleware(cfg.PodcastHandler.AdminDeleteFeedFiles))
|
|
feeds.POST("/episodes/delete-files", handlers.AdminMiddleware(cfg.PodcastHandler.AdminDeleteEpisodeFilesBulk))
|
|
feeds.POST("/episodes/:eid/delete-file", handlers.AdminMiddleware(cfg.PodcastHandler.AdminDeleteEpisodeFile))
|
|
}
|