Cyrene_v2/internal/services/gateway/history_write.go

package gateway

import (
	"context"
	"encoding/json"
	"errors"
	"net/http"
	"strings"
	"unicode/utf8"

	apperr "git.yeij.top/AskaEth/Cyrene_v2/internal/errors"
	"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/history"
)

// This file owns the session/message write endpoints added for the Android
// collaboration batch ③a: PATCH /sessions/{id} (A4 rename + D5 pin), PATCH
// /messages/{id} (D3 edit) and DELETE /messages/{id} (D3 delete). All are owner/admin
// history writes; the reads and DTOs live in history.go. The D3 edit/delete paths also
// broadcast their outcome over the WS hub (message_edited / message_deleted, see
// ws_hub.go) so the account's other browsers stay in sync without a manual re-read.

// patchSessionRequest is the PATCH /api/v1/sessions/{id} body. Both fields are pointers
// so an absent field is distinguishable from an explicit zero value: title renames the
// session (A4), pinned sets/unets the pin (D5), and at least one must be present.
type patchSessionRequest struct {
	Title  *string `json:"title"`
	Pinned *bool   `json:"pinned"`
}

// maxSessionTitleRunes bounds a client-supplied session title so a display row never
// overflows. It is a display-only bound: identity and permissions never derive from
// the title (project red line).
const maxSessionTitleRunes = 80

// handlePatchSession updates a persistent session's display metadata: its title (A4)
// and/or its pinned flag (D5). Both are display/order-only, so unlike DELETE they are
// allowed on the fixed main session. A request carrying neither field answers 400, as
// do an empty/whitespace or over-long title; an unknown session id answers 404. It is
// owner/admin-gated like the other history writes. The response echoes only the fields
// that were changed, so a title-only PATCH keeps its pre-D5 {id,title} shape.
func (s *Server) handlePatchSession(w http.ResponseWriter, r *http.Request) {
	if s.history == nil {
		writeError(w, &apperr.AppError{Code: "not_implemented", Message: "会话历史服务未配置（未注入 HistoryStore）", HTTPCode: http.StatusNotImplemented})
		return
	}
	id := r.PathValue("id")
	if id == "" {
		writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "session id is required"))
		return
	}
	var req patchSessionRequest
	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
		writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "invalid request body"))
		return
	}
	if req.Title == nil && req.Pinned == nil {
		writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "title or pinned is required"))
		return
	}
	resp := map[string]any{"id": id}
	if req.Title != nil {
		title := strings.TrimSpace(*req.Title)
		if title == "" {
			writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "title is required"))
			return
		}
		if utf8.RuneCountInString(title) > maxSessionTitleRunes {
			writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "title is too long (max 80 characters)"))
			return
		}
		if err := s.history.RenameSession(r.Context(), id, title); err != nil {
			s.writeSessionPatchError(w, err, id, "rename session")
			return
		}
		resp["title"] = title
	}
	if req.Pinned != nil {
		if err := s.history.SetPinned(r.Context(), id, *req.Pinned); err != nil {
			s.writeSessionPatchError(w, err, id, "pin session")
			return
		}
		resp["pinned"] = *req.Pinned
	}
	writeJSON(w, http.StatusOK, resp)
}

// writeSessionPatchError maps a RenameSession/SetPinned failure to its response:
// ErrSessionNotFound → 404, anything else → 500 (logged under op).
func (s *Server) writeSessionPatchError(w http.ResponseWriter, err error, id, op string) {
	if errors.Is(err, history.ErrSessionNotFound) {
		writeError(w, apperr.Wrap(apperr.ErrNotFound, "not_found", "session %q not found", id))
		return
	}
	s.log.Error(op, "err", err, "session", id)
	writeError(w, apperr.Wrap(apperr.ErrInternal, "session_failed", "failed to update session"))
}

// patchMessageRequest is the PATCH /api/v1/messages/{id} body. Content is a pointer so
// an absent field is rejected rather than treated as an empty edit.
type patchMessageRequest struct {
	Content *string `json:"content"`
}

// maxMessageContentRunes bounds an edited message body. It is a storage/display bound
// on the edit path only; inbound chat messages are not subject to it.
const maxMessageContentRunes = 4000

// handlePatchMessage edits a single message's content (Android collaboration batch ③a,
// D3). Only content changes — role/timestamp/platform stay as stored — and the response
// returns the updated message so the client can upsert it by id without a re-read. An
// empty/whitespace or over-long content answers 400, an unknown id answers 404, and a
// missing HistoryStore answers 501. It is owner/admin-gated.
func (s *Server) handlePatchMessage(w http.ResponseWriter, r *http.Request) {
	if s.history == nil {
		writeError(w, &apperr.AppError{Code: "not_implemented", Message: "会话历史服务未配置（未注入 HistoryStore）", HTTPCode: http.StatusNotImplemented})
		return
	}
	id := r.PathValue("id")
	if id == "" {
		writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "message id is required"))
		return
	}
	var req patchMessageRequest
	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
		writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "invalid request body"))
		return
	}
	if req.Content == nil {
		writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "content is required"))
		return
	}
	content := *req.Content
	if strings.TrimSpace(content) == "" {
		writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "content is required"))
		return
	}
	if utf8.RuneCountInString(content) > maxMessageContentRunes {
		writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "content is too long (max 4000 characters)"))
		return
	}
	msg, err := s.history.UpdateMessage(r.Context(), id, content)
	if err != nil {
		if errors.Is(err, history.ErrMessageNotFound) {
			writeError(w, apperr.Wrap(apperr.ErrNotFound, "not_found", "message %q not found", id))
			return
		}
		s.log.Error("history update message", "err", err, "message", id)
		writeError(w, apperr.Wrap(apperr.ErrInternal, "message_failed", "failed to update message"))
		return
	}
	// Broadcast the edit so every other browser of the account re-renders the same
	// bubble without a refresh (the message_persisted realtime-sync contract, D3 edit
	// path). Thinking is stripped from the frame to match the persisted/replay
	// contract; the REST reply keeps it because the messages routes are owner/admin-only.
	edited := toHistoryMessage(msg)
	edited.Thinking = ""
	s.hub.broadcastMessageEdited(edited)
	writeJSON(w, http.StatusOK, toHistoryMessage(msg))
}

// handleDeleteMessage removes a single message (D3). An unknown id answers 404, a
// missing HistoryStore 501. It is owner/admin-gated. A successful delete is
// broadcast as a `message_deleted` frame so every browser of the account drops the
// row without a refresh; the owning session is read before the row disappears.
func (s *Server) handleDeleteMessage(w http.ResponseWriter, r *http.Request) {
	if s.history == nil {
		writeError(w, &apperr.AppError{Code: "not_implemented", Message: "会话历史服务未配置（未注入 HistoryStore）", HTTPCode: http.StatusNotImplemented})
		return
	}
	id := r.PathValue("id")
	if id == "" {
		writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "message id is required"))
		return
	}
	sessionID := s.messageSession(r.Context(), id)
	if err := s.history.DeleteMessage(r.Context(), id); err != nil {
		if errors.Is(err, history.ErrMessageNotFound) {
			writeError(w, apperr.Wrap(apperr.ErrNotFound, "not_found", "message %q not found", id))
			return
		}
		s.log.Error("history delete message", "err", err, "message", id)
		writeError(w, apperr.Wrap(apperr.ErrInternal, "message_failed", "failed to delete message"))
		return
	}
	s.hub.broadcastMessageDeleted(sessionID, id)
	writeJSON(w, http.StatusOK, map[string]any{"deleted": id})
}

// messageLookup is the optional narrower view of HistoryStore used by DELETE to learn
// a message's owning session before it is removed (afterwards there is nothing left to
// ask). *history.Store implements it; a store that does not simply yields an unscoped
// frame, which the client resolves by the globally unique message id.
type messageLookup interface {
	GetMessage(ctx context.Context, id string) (history.Message, error)
}

// messageSession returns the session id owning message id, or "" when the store cannot
// answer (no lookup surface, unknown id, or a read error). A blank session is safe for
// the broadcast: the message id is globally unique, so a client that falls back to an
// id-only filter can only ever touch that message's own conversation.
func (s *Server) messageSession(ctx context.Context, id string) string {
	lookup, ok := s.history.(messageLookup)
	if !ok {
		return ""
	}
	msg, err := lookup.GetMessage(ctx, id)
	if err != nil {
		s.log.Debug("history message session lookup", "err", err, "message", id)
		return ""
	}
	return msg.SessionID
}