various: simplify code; work on security and performance

Signed-off-by: NotAShelf <raf@notashelf.dev>
Change-Id: I9a5114addcab5fbff430ab2b919b83466a6a6964

crates/pinakes-server/src/routes/social.rs

@@ -0,0 +1,199 @@
+use axum::Json;
+use axum::extract::{Extension, Path, Query, State};
+use serde::Deserialize;
+use uuid::Uuid;
+
+use crate::auth::resolve_user_id;
+use crate::dto::*;
+use crate::error::ApiError;
+use crate::state::AppState;
+
+use pinakes_core::model::{MediaId, Pagination};
+
+#[derive(Deserialize)]
+pub struct ShareLinkQuery {
+    pub password: Option<String>,
+}
+
+// ===== Ratings =====
+
+pub async fn rate_media(
+    State(state): State<AppState>,
+    Extension(username): Extension<String>,
+    Path(id): Path<Uuid>,
+    Json(req): Json<CreateRatingRequest>,
+) -> Result<Json<RatingResponse>, ApiError> {
+    if req.stars < 1 || req.stars > 5 {
+        return Err(ApiError(
+            pinakes_core::error::PinakesError::InvalidOperation(
+                "stars must be between 1 and 5".into(),
+            ),
+        ));
+    }
+    let user_id = resolve_user_id(&state.storage, &username).await?;
+    let rating = state
+        .storage
+        .rate_media(user_id, MediaId(id), req.stars, req.review_text.as_deref())
+        .await?;
+    Ok(Json(RatingResponse::from(rating)))
+}
+
+pub async fn get_media_ratings(
+    State(state): State<AppState>,
+    Path(id): Path<Uuid>,
+) -> Result<Json<Vec<RatingResponse>>, ApiError> {
+    let ratings = state.storage.get_media_ratings(MediaId(id)).await?;
+    Ok(Json(
+        ratings.into_iter().map(RatingResponse::from).collect(),
+    ))
+}
+
+// ===== Comments =====
+
+pub async fn add_comment(
+    State(state): State<AppState>,
+    Extension(username): Extension<String>,
+    Path(id): Path<Uuid>,
+    Json(req): Json<CreateCommentRequest>,
+) -> Result<Json<CommentResponse>, ApiError> {
+    let char_count = req.text.chars().count();
+    if char_count == 0 || char_count > 10_000 {
+        return Err(ApiError(
+            pinakes_core::error::PinakesError::InvalidOperation(
+                "comment text must be 1-10000 characters".into(),
+            ),
+        ));
+    }
+    let user_id = resolve_user_id(&state.storage, &username).await?;
+    let comment = state
+        .storage
+        .add_comment(user_id, MediaId(id), &req.text, req.parent_id)
+        .await?;
+    Ok(Json(CommentResponse::from(comment)))
+}
+
+pub async fn get_media_comments(
+    State(state): State<AppState>,
+    Path(id): Path<Uuid>,
+) -> Result<Json<Vec<CommentResponse>>, ApiError> {
+    let comments = state.storage.get_media_comments(MediaId(id)).await?;
+    Ok(Json(
+        comments.into_iter().map(CommentResponse::from).collect(),
+    ))
+}
+
+// ===== Favorites =====
+
+pub async fn add_favorite(
+    State(state): State<AppState>,
+    Extension(username): Extension<String>,
+    Json(req): Json<FavoriteRequest>,
+) -> Result<Json<serde_json::Value>, ApiError> {
+    let user_id = resolve_user_id(&state.storage, &username).await?;
+    state
+        .storage
+        .add_favorite(user_id, MediaId(req.media_id))
+        .await?;
+    Ok(Json(serde_json::json!({"added": true})))
+}
+
+pub async fn remove_favorite(
+    State(state): State<AppState>,
+    Extension(username): Extension<String>,
+    Path(media_id): Path<Uuid>,
+) -> Result<Json<serde_json::Value>, ApiError> {
+    let user_id = resolve_user_id(&state.storage, &username).await?;
+    state
+        .storage
+        .remove_favorite(user_id, MediaId(media_id))
+        .await?;
+    Ok(Json(serde_json::json!({"removed": true})))
+}
+
+pub async fn list_favorites(
+    State(state): State<AppState>,
+    Extension(username): Extension<String>,
+) -> Result<Json<Vec<MediaResponse>>, ApiError> {
+    let user_id = resolve_user_id(&state.storage, &username).await?;
+    let items = state
+        .storage
+        .get_user_favorites(user_id, &Pagination::default())
+        .await?;
+    Ok(Json(items.into_iter().map(MediaResponse::from).collect()))
+}
+
+// ===== Share Links =====
+
+pub async fn create_share_link(
+    State(state): State<AppState>,
+    Extension(username): Extension<String>,
+    Json(req): Json<CreateShareLinkRequest>,
+) -> Result<Json<ShareLinkResponse>, ApiError> {
+    let user_id = resolve_user_id(&state.storage, &username).await?;
+    let token = uuid::Uuid::now_v7().to_string().replace('-', "");
+    let password_hash = match req.password.as_ref() {
+        Some(p) => Some(pinakes_core::users::auth::hash_password(p).map_err(ApiError)?),
+        None => None,
+    };
+    const MAX_EXPIRY_HOURS: u64 = 8760; // 1 year
+    if let Some(h) = req.expires_in_hours
+        && h > MAX_EXPIRY_HOURS {
+            return Err(ApiError(
+                pinakes_core::error::PinakesError::InvalidOperation(format!(
+                    "expires_in_hours cannot exceed {}",
+                    MAX_EXPIRY_HOURS
+                )),
+            ));
+        }
+    let expires_at = req
+        .expires_in_hours
+        .map(|h| chrono::Utc::now() + chrono::Duration::hours(h as i64));
+    let link = state
+        .storage
+        .create_share_link(
+            MediaId(req.media_id),
+            user_id,
+            &token,
+            password_hash.as_deref(),
+            expires_at,
+        )
+        .await?;
+    Ok(Json(ShareLinkResponse::from(link)))
+}
+
+pub async fn access_shared_media(
+    State(state): State<AppState>,
+    Path(token): Path<String>,
+    Query(query): Query<ShareLinkQuery>,
+) -> Result<Json<MediaResponse>, ApiError> {
+    let link = state.storage.get_share_link(&token).await?;
+    // Check expiration
+    if let Some(expires) = link.expires_at
+        && chrono::Utc::now() > expires {
+            return Err(ApiError(
+                pinakes_core::error::PinakesError::InvalidOperation(
+                    "share link has expired".into(),
+                ),
+            ));
+        }
+    // Verify password if set
+    if let Some(ref hash) = link.password_hash {
+        let password = match query.password.as_deref() {
+            Some(p) => p,
+            None => {
+                return Err(ApiError(pinakes_core::error::PinakesError::Authentication(
+                    "password required for this share link".into(),
+                )));
+            }
+        };
+        let valid = pinakes_core::users::auth::verify_password(password, hash).unwrap_or(false);
+        if !valid {
+            return Err(ApiError(pinakes_core::error::PinakesError::Authentication(
+                "invalid share link password".into(),
+            )));
+        }
+    }
+    state.storage.increment_share_views(&token).await?;
+    let item = state.storage.get_media(link.media_id).await?;
+    Ok(Json(MediaResponse::from(item)))
+}