Cyrene_v2/internal/services/gateway/history_write.go

package gateway

import (
	"context"
	"encoding/json"
	"errors"
	"net/http"
	"strings"
	"unicode/utf8"

	apperr "git.yeij.top/AskaEth/Cyrene_v2/internal/errors"
	"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/history"
)

// This file owns the session/message write endpoints added for the Android
// collaboration batch ③a: PATCH /sessions/{id} (A4 rename + D5 pin), PATCH
// /messages/{id} (D3 edit) and DELETE /messages/{id} (D3 delete). All are owner/admin
// history writes; the reads and DTOs live in history.go. The D3 edit/delete paths also
// broadcast their outcome over the WS hub (message_edited / message_deleted, see
// ws_hub.go) so the account's other browsers stay in sync without a manual re-read.

// patchSessionRequest is the PATCH /api/v1/sessions/{id} body. All fields are
// pointers so an absent field is distinguishable from an explicit zero value:
// title renames the session (A4), pinned sets/unets the pin (D5), personaId
// rebinds the session's role (design/22 §4.5, an explicit "" clears the binding
// back to "inherit the global default"), and at least one must be present.
type patchSessionRequest struct {
	Title     *string `json:"title"`
	Pinned    *bool   `json:"pinned"`
	PersonaID *string `json:"personaId"`
}

// maxSessionTitleRunes bounds a client-supplied session title so a display row never
// overflows. It is a display-only bound: identity and permissions never derive from
// the title (project red line).
const maxSessionTitleRunes = 80

// handlePatchSession updates a persistent session's display metadata — its title
// (A4), its pinned flag (D5) — and/or its role binding (design/22 §4.5). All three
// are metadata: unlike DELETE they are allowed on the fixed main session. A request
// carrying none of the fields answers 400, as do an empty/whitespace or over-long
// title and an unknown personaId; an unknown session id answers 404. Rebinding a
// role does not touch the stored conversation — the messages keep the role that
// spoke them (design/22 §7-5) — it only changes which role answers from the next
// turn on. It is owner/admin-gated like the other history writes. The response
// echoes only the fields that were changed, so a title-only PATCH keeps its pre-D5
// {id,title} shape.
func (s *Server) handlePatchSession(w http.ResponseWriter, r *http.Request) {
	if s.history == nil {
		writeError(w, &apperr.AppError{Code: "not_implemented", Message: "会话历史服务未配置（未注入 HistoryStore）", HTTPCode: http.StatusNotImplemented})
		return
	}
	id := r.PathValue("id")
	if id == "" {
		writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "session id is required"))
		return
	}
	var req patchSessionRequest
	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
		writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "invalid request body"))
		return
	}
	if req.Title == nil && req.Pinned == nil && req.PersonaID == nil {
		writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "title, pinned or personaId is required"))
		return
	}
	resp := map[string]any{"id": id}
	if req.Title != nil {
		title := strings.TrimSpace(*req.Title)
		if title == "" {
			writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "title is required"))
			return
		}
		if utf8.RuneCountInString(title) > maxSessionTitleRunes {
			writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "title is too long (max 80 characters)"))
			return
		}
		if err := s.history.RenameSession(r.Context(), id, title); err != nil {
			s.writeSessionPatchError(w, err, id, "rename session")
			return
		}
		resp["title"] = title
	}
	if req.Pinned != nil {
		if err := s.history.SetPinned(r.Context(), id, *req.Pinned); err != nil {
			s.writeSessionPatchError(w, err, id, "pin session")
			return
		}
		resp["pinned"] = *req.Pinned
	}
	if req.PersonaID != nil {
		personaID := strings.TrimSpace(*req.PersonaID)
		if !s.requireKnownPersona(w, personaID) {
			return
		}
		if err := s.setSessionPersona(r.Context(), id, personaID); err != nil {
			s.writeSessionPatchError(w, err, id, "set session persona")
			return
		}
		resp["personaId"] = personaID
	}
	writeJSON(w, http.StatusOK, resp)
}

// setSessionPersona rebinds a session's role through the store's optional
// role-writer. A store without it answers 501 rather than reporting a binding that
// was never written.
func (s *Server) setSessionPersona(ctx context.Context, sessionID, personaID string) error {
	writer, ok := s.history.(sessionPersonaWriter)
	if !ok {
		return errPersonaBindingUnsupported
	}
	return writer.SetSessionPersona(ctx, sessionID, personaID)
}

// writeSessionPatchError maps a RenameSession/SetPinned/SetSessionPersona failure to
// its response: ErrSessionNotFound → 404, a store that cannot bind roles → 501,
// anything else → 500 (logged under op).
func (s *Server) writeSessionPatchError(w http.ResponseWriter, err error, id, op string) {
	if errors.Is(err, history.ErrSessionNotFound) {
		writeError(w, apperr.Wrap(apperr.ErrNotFound, "not_found", "session %q not found", id))
		return
	}
	if errors.Is(err, errPersonaBindingUnsupported) {
		writeError(w, &apperr.AppError{Code: "not_implemented", Message: "会话角色绑定需要支持 personaId 的 HistoryStore", HTTPCode: http.StatusNotImplemented})
		return
	}
	s.log.Error(op, "err", err, "session", id)
	writeError(w, apperr.Wrap(apperr.ErrInternal, "session_failed", "failed to update session"))
}

// patchMessageRequest is the PATCH /api/v1/messages/{id} body. Content is a pointer so
// an absent field is rejected rather than treated as an empty edit.
type patchMessageRequest struct {
	Content *string `json:"content"`
}

// maxMessageContentRunes bounds an edited message body. It is a storage/display bound
// on the edit path only; inbound chat messages are not subject to it.
const maxMessageContentRunes = 4000

// handlePatchMessage edits a single message's content (Android collaboration batch ③a,
// D3). Only content changes — role/timestamp/platform stay as stored — and the response
// returns the updated message so the client can upsert it by id without a re-read. An
// empty/whitespace or over-long content answers 400, an unknown id answers 404, and a
// missing HistoryStore answers 501. It is owner/admin-gated.
func (s *Server) handlePatchMessage(w http.ResponseWriter, r *http.Request) {
	if s.history == nil {
		writeError(w, &apperr.AppError{Code: "not_implemented", Message: "会话历史服务未配置（未注入 HistoryStore）", HTTPCode: http.StatusNotImplemented})
		return
	}
	id := r.PathValue("id")
	if id == "" {
		writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "message id is required"))
		return
	}
	var req patchMessageRequest
	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
		writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "invalid request body"))
		return
	}
	if req.Content == nil {
		writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "content is required"))
		return
	}
	content := *req.Content
	if strings.TrimSpace(content) == "" {
		writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "content is required"))
		return
	}
	if utf8.RuneCountInString(content) > maxMessageContentRunes {
		writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "content is too long (max 4000 characters)"))
		return
	}
	msg, err := s.history.UpdateMessage(r.Context(), id, content)
	if err != nil {
		if errors.Is(err, history.ErrMessageNotFound) {
			writeError(w, apperr.Wrap(apperr.ErrNotFound, "not_found", "message %q not found", id))
			return
		}
		s.log.Error("history update message", "err", err, "message", id)
		writeError(w, apperr.Wrap(apperr.ErrInternal, "message_failed", "failed to update message"))
		return
	}
	// Broadcast the edit so every other browser of the account re-renders the same
	// bubble without a refresh (the message_persisted realtime-sync contract, D3 edit
	// path). Thinking is stripped from the frame to match the persisted/replay
	// contract; the REST reply keeps it because the messages routes are owner/admin-only.
	edited := toHistoryMessage(msg)
	edited.Thinking = ""
	s.hub.broadcastMessageEdited(edited)
	writeJSON(w, http.StatusOK, toHistoryMessage(msg))
}

// handleDeleteMessage removes a single message (D3). An unknown id answers 404, a
// missing HistoryStore 501. It is owner/admin-gated. A successful delete is
// broadcast as a `message_deleted` frame so every browser of the account drops the
// row without a refresh; the owning session is read before the row disappears.
func (s *Server) handleDeleteMessage(w http.ResponseWriter, r *http.Request) {
	if s.history == nil {
		writeError(w, &apperr.AppError{Code: "not_implemented", Message: "会话历史服务未配置（未注入 HistoryStore）", HTTPCode: http.StatusNotImplemented})
		return
	}
	id := r.PathValue("id")
	if id == "" {
		writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "message id is required"))
		return
	}
	sessionID := s.messageSession(r.Context(), id)
	if err := s.history.DeleteMessage(r.Context(), id); err != nil {
		if errors.Is(err, history.ErrMessageNotFound) {
			writeError(w, apperr.Wrap(apperr.ErrNotFound, "not_found", "message %q not found", id))
			return
		}
		s.log.Error("history delete message", "err", err, "message", id)
		writeError(w, apperr.Wrap(apperr.ErrInternal, "message_failed", "failed to delete message"))
		return
	}
	s.hub.broadcastMessageDeleted(sessionID, id)
	writeJSON(w, http.StatusOK, map[string]any{"deleted": id})
}

// messageLookup is the optional narrower view of HistoryStore used by DELETE to learn
// a message's owning session before it is removed (afterwards there is nothing left to
// ask). *history.Store implements it; a store that does not simply yields an unscoped
// frame, which the client resolves by the globally unique message id.
type messageLookup interface {
	GetMessage(ctx context.Context, id string) (history.Message, error)
}

// messageSession returns the session id owning message id, or "" when the store cannot
// answer (no lookup surface, unknown id, or a read error). A blank session is safe for
// the broadcast: the message id is globally unique, so a client that falls back to an
// id-only filter can only ever touch that message's own conversation.
func (s *Server) messageSession(ctx context.Context, id string) string {
	lookup, ok := s.history.(messageLookup)
	if !ok {
		return ""
	}
	msg, err := lookup.GetMessage(ctx, id)
	if err != nil {
		s.log.Debug("history message session lookup", "err", err, "message", id)
		return ""
	}
	return msg.SessionID
}