Changeset 0.8.0.1 (#43)

2026-02-22 00:39:45 +00:00
parent 8925e8dcbf
commit 1adef94617
14 changed files with 902 additions and 16 deletions
--- a/server/handlers/teams.go
+++ b/server/handlers/teams.go
@@ -0,0 +1,509 @@
+package handlers
+
+import (
+	"database/sql"
+	"fmt"
+	"net/http"
+	"strconv"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+
+	"git.gobha.me/xcaliber/chat-switchboard/database"
+)
+
+// ── Request types ───────────────────────────
+
+type createTeamRequest struct {
+	Name        string `json:"name" binding:"required,min=1,max=200"`
+	Description string `json:"description,omitempty"`
+}
+
+type updateTeamRequest struct {
+	Name        *string `json:"name,omitempty"`
+	Description *string `json:"description,omitempty"`
+	IsActive    *bool   `json:"is_active,omitempty"`
+	Settings    *string `json:"settings,omitempty"` // JSON string
+}
+
+type addMemberRequest struct {
+	UserID string `json:"user_id" binding:"required"`
+	Role   string `json:"role" binding:"required,oneof=admin member"`
+}
+
+type updateMemberRequest struct {
+	Role string `json:"role" binding:"required,oneof=admin member"`
+}
+
+// ── Handler ─────────────────────────────────
+
+type TeamHandler struct{}
+
+func NewTeamHandler() *TeamHandler { return &TeamHandler{} }
+
+// ── Admin: List All Teams ───────────────────
+
+func (h *TeamHandler) ListTeams(c *gin.Context) {
+	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
+	perPage, _ := strconv.Atoi(c.DefaultQuery("per_page", "50"))
+	if page < 1 {
+		page = 1
+	}
+	if perPage < 1 || perPage > 100 {
+		perPage = 50
+	}
+	offset := (page - 1) * perPage
+
+	var total int
+	if err := database.DB.QueryRow(`SELECT COUNT(*) FROM teams`).Scan(&total); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to count teams"})
+		return
+	}
+
+	rows, err := database.DB.Query(`
+		SELECT t.id, t.name, t.description, t.created_by, t.is_active,
+		       COALESCE(t.settings::text, '{}'), t.created_at, t.updated_at,
+		       COALESCE(mc.cnt, 0) AS member_count
+		FROM teams t
+		LEFT JOIN (
+			SELECT team_id, COUNT(*) AS cnt FROM team_members GROUP BY team_id
+		) mc ON mc.team_id = t.id
+		ORDER BY t.name ASC
+		LIMIT $1 OFFSET $2
+	`, perPage, offset)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "query failed"})
+		return
+	}
+	defer rows.Close()
+
+	var teams []gin.H
+	for rows.Next() {
+		var id, name, desc, createdBy, settings string
+		var isActive bool
+		var memberCount int
+		var createdAt, updatedAt sql.NullTime
+		if err := rows.Scan(&id, &name, &desc, &createdBy, &isActive, &settings,
+			&createdAt, &updatedAt, &memberCount); err != nil {
+			continue
+		}
+		teams = append(teams, gin.H{
+			"id":           id,
+			"name":         name,
+			"description":  desc,
+			"created_by":   createdBy,
+			"is_active":    isActive,
+			"settings":     settings,
+			"member_count": memberCount,
+			"created_at":   createdAt.Time,
+			"updated_at":   updatedAt.Time,
+		})
+	}
+	if teams == nil {
+		teams = []gin.H{}
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"data":     teams,
+		"total":    total,
+		"page":     page,
+		"per_page": perPage,
+	})
+}
+
+// ── Admin: Create Team ──────────────────────
+
+func (h *TeamHandler) CreateTeam(c *gin.Context) {
+	adminID := getUserID(c)
+
+	var req createTeamRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	var id string
+	err := database.DB.QueryRow(`
+		INSERT INTO teams (name, description, created_by)
+		VALUES ($1, $2, $3)
+		RETURNING id
+	`, req.Name, req.Description, adminID).Scan(&id)
+	if err != nil {
+		if isUniqueViolation(err) {
+			c.JSON(http.StatusConflict, gin.H{"error": "team name already exists"})
+			return
+		}
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to create team"})
+		return
+	}
+
+	c.JSON(http.StatusCreated, gin.H{"id": id, "name": req.Name})
+}
+
+// ── Admin: Get Team ─────────────────────────
+
+func (h *TeamHandler) GetTeam(c *gin.Context) {
+	teamID := c.Param("id")
+
+	var name, desc, createdBy, settings string
+	var isActive bool
+	var memberCount int
+	var createdAt, updatedAt sql.NullTime
+
+	err := database.DB.QueryRow(`
+		SELECT t.name, t.description, t.created_by, t.is_active,
+		       COALESCE(t.settings::text, '{}'), t.created_at, t.updated_at,
+		       (SELECT COUNT(*) FROM team_members WHERE team_id = t.id)
+		FROM teams t WHERE t.id = $1
+	`, teamID).Scan(&name, &desc, &createdBy, &isActive, &settings,
+		&createdAt, &updatedAt, &memberCount)
+	if err == sql.ErrNoRows {
+		c.JSON(http.StatusNotFound, gin.H{"error": "team not found"})
+		return
+	}
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "query failed"})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"id":           teamID,
+		"name":         name,
+		"description":  desc,
+		"created_by":   createdBy,
+		"is_active":    isActive,
+		"settings":     settings,
+		"member_count": memberCount,
+		"created_at":   createdAt.Time,
+		"updated_at":   updatedAt.Time,
+	})
+}
+
+// ── Admin: Update Team ──────────────────────
+
+func (h *TeamHandler) UpdateTeam(c *gin.Context) {
+	teamID := c.Param("id")
+
+	var req updateTeamRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	// Build dynamic update
+	sets := []string{}
+	args := []interface{}{}
+	argN := 1
+
+	if req.Name != nil {
+		sets = append(sets, "name = $"+strconv.Itoa(argN))
+		args = append(args, *req.Name)
+		argN++
+	}
+	if req.Description != nil {
+		sets = append(sets, "description = $"+strconv.Itoa(argN))
+		args = append(args, *req.Description)
+		argN++
+	}
+	if req.IsActive != nil {
+		sets = append(sets, "is_active = $"+strconv.Itoa(argN))
+		args = append(args, *req.IsActive)
+		argN++
+	}
+	if req.Settings != nil {
+		sets = append(sets, "settings = $"+strconv.Itoa(argN)+"::jsonb")
+		args = append(args, *req.Settings)
+		argN++
+	}
+
+	if len(sets) == 0 {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "no fields to update"})
+		return
+	}
+
+	query := "UPDATE teams SET "
+	for i, s := range sets {
+		if i > 0 {
+			query += ", "
+		}
+		query += s
+	}
+	query += " WHERE id = $" + strconv.Itoa(argN)
+	args = append(args, teamID)
+
+	res, err := database.DB.Exec(query, args...)
+	if err != nil {
+		if isUniqueViolation(err) {
+			c.JSON(http.StatusConflict, gin.H{"error": "team name already exists"})
+			return
+		}
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "update failed"})
+		return
+	}
+	if n, _ := res.RowsAffected(); n == 0 {
+		c.JSON(http.StatusNotFound, gin.H{"error": "team not found"})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{"ok": true})
+}
+
+// ── Admin: Delete Team ──────────────────────
+
+func (h *TeamHandler) DeleteTeam(c *gin.Context) {
+	teamID := c.Param("id")
+
+	res, err := database.DB.Exec(`DELETE FROM teams WHERE id = $1`, teamID)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "delete failed"})
+		return
+	}
+	if n, _ := res.RowsAffected(); n == 0 {
+		c.JSON(http.StatusNotFound, gin.H{"error": "team not found"})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{"ok": true})
+}
+
+// ── Members: List ───────────────────────────
+
+func (h *TeamHandler) ListMembers(c *gin.Context) {
+	teamID := c.Param("id")
+
+	rows, err := database.DB.Query(`
+		SELECT tm.id, tm.user_id, tm.role, tm.joined_at,
+		       u.email, COALESCE(u.display_name, '') AS display_name, u.role AS user_role
+		FROM team_members tm
+		JOIN users u ON u.id = tm.user_id
+		WHERE tm.team_id = $1
+		ORDER BY tm.role ASC, u.email ASC
+	`, teamID)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "query failed"})
+		return
+	}
+	defer rows.Close()
+
+	var members []gin.H
+	for rows.Next() {
+		var id, userID, role, email, displayName, userRole string
+		var joinedAt sql.NullTime
+		if err := rows.Scan(&id, &userID, &role, &joinedAt, &email, &displayName, &userRole); err != nil {
+			continue
+		}
+		members = append(members, gin.H{
+			"id":           id,
+			"user_id":      userID,
+			"role":         role,
+			"joined_at":    joinedAt.Time,
+			"email":        email,
+			"display_name": displayName,
+			"user_role":    userRole,
+		})
+	}
+	if members == nil {
+		members = []gin.H{}
+	}
+
+	c.JSON(http.StatusOK, gin.H{"data": members})
+}
+
+// ── Members: Add ────────────────────────────
+
+func (h *TeamHandler) AddMember(c *gin.Context) {
+	teamID := c.Param("id")
+
+	var req addMemberRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	// Verify team exists
+	var exists bool
+	database.DB.QueryRow(`SELECT EXISTS(SELECT 1 FROM teams WHERE id = $1)`, teamID).Scan(&exists)
+	if !exists {
+		c.JSON(http.StatusNotFound, gin.H{"error": "team not found"})
+		return
+	}
+
+	// Verify user exists
+	database.DB.QueryRow(`SELECT EXISTS(SELECT 1 FROM users WHERE id = $1)`, req.UserID).Scan(&exists)
+	if !exists {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "user not found"})
+		return
+	}
+
+	var id string
+	err := database.DB.QueryRow(`
+		INSERT INTO team_members (team_id, user_id, role)
+		VALUES ($1, $2, $3)
+		RETURNING id
+	`, teamID, req.UserID, req.Role).Scan(&id)
+	if err != nil {
+		if isUniqueViolation(err) {
+			c.JSON(http.StatusConflict, gin.H{"error": "user is already a member"})
+			return
+		}
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to add member"})
+		return
+	}
+
+	c.JSON(http.StatusCreated, gin.H{"id": id})
+}
+
+// ── Members: Update Role ────────────────────
+
+func (h *TeamHandler) UpdateMember(c *gin.Context) {
+	memberID := c.Param("memberId")
+
+	var req updateMemberRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	res, err := database.DB.Exec(`
+		UPDATE team_members SET role = $1 WHERE id = $2
+	`, req.Role, memberID)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "update failed"})
+		return
+	}
+	if n, _ := res.RowsAffected(); n == 0 {
+		c.JSON(http.StatusNotFound, gin.H{"error": "member not found"})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{"ok": true})
+}
+
+// ── Members: Remove ─────────────────────────
+
+func (h *TeamHandler) RemoveMember(c *gin.Context) {
+	memberID := c.Param("memberId")
+
+	res, err := database.DB.Exec(`DELETE FROM team_members WHERE id = $1`, memberID)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "remove failed"})
+		return
+	}
+	if n, _ := res.RowsAffected(); n == 0 {
+		c.JSON(http.StatusNotFound, gin.H{"error": "member not found"})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{"ok": true})
+}
+
+// ── User: My Teams ──────────────────────────
+
+func (h *TeamHandler) MyTeams(c *gin.Context) {
+	userID := getUserID(c)
+
+	rows, err := database.DB.Query(`
+		SELECT t.id, t.name, t.description, t.is_active,
+		       COALESCE(t.settings::text, '{}'),
+		       tm.role AS my_role,
+		       (SELECT COUNT(*) FROM team_members WHERE team_id = t.id) AS member_count
+		FROM teams t
+		JOIN team_members tm ON tm.team_id = t.id AND tm.user_id = $1
+		WHERE t.is_active = true
+		ORDER BY t.name ASC
+	`, userID)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "query failed"})
+		return
+	}
+	defer rows.Close()
+
+	var teams []gin.H
+	for rows.Next() {
+		var id, name, desc, settings, myRole string
+		var isActive bool
+		var memberCount int
+		if err := rows.Scan(&id, &name, &desc, &isActive, &settings, &myRole, &memberCount); err != nil {
+			continue
+		}
+		teams = append(teams, gin.H{
+			"id":           id,
+			"name":         name,
+			"description":  desc,
+			"is_active":    isActive,
+			"settings":     settings,
+			"my_role":      myRole,
+			"member_count": memberCount,
+		})
+	}
+	if teams == nil {
+		teams = []gin.H{}
+	}
+
+	c.JSON(http.StatusOK, gin.H{"data": teams})
+}
+
+// ── Helpers ─────────────────────────────────
+
+// isUniqueViolation checks if a PG error is a unique constraint violation.
+func isUniqueViolation(err error) bool {
+	if err == nil {
+		return false
+	}
+	return strings.Contains(err.Error(), "duplicate key")
+}
+
+// IsTeamAdmin checks if a user is an admin of the given team.
+func IsTeamAdmin(userID, teamID string) bool {
+	var role string
+	err := database.DB.QueryRow(`
+		SELECT role FROM team_members WHERE team_id = $1 AND user_id = $2
+	`, teamID, userID).Scan(&role)
+	return err == nil && role == "admin"
+}
+
+// IsTeamMember checks if a user belongs to the given team (any role).
+func IsTeamMember(userID, teamID string) bool {
+	var exists bool
+	database.DB.QueryRow(`
+		SELECT EXISTS(SELECT 1 FROM team_members WHERE team_id = $1 AND user_id = $2)
+	`, teamID, userID).Scan(&exists)
+	return exists
+}
+
+// enforcePrivateProviderPolicy checks if a user belongs to any team that
+// requires private providers, and if so, verifies the resolved config is
+// marked as private. Returns nil if allowed, error if blocked.
+func enforcePrivateProviderPolicy(userID, configID string) error {
+	if configID == "" {
+		return nil
+	}
+
+	// Check if user belongs to any team with require_private_providers policy
+	var requiresPrivate bool
+	err := database.DB.QueryRow(`
+		SELECT EXISTS(
+			SELECT 1 FROM team_members tm
+			JOIN teams t ON t.id = tm.team_id
+			WHERE tm.user_id = $1
+			  AND t.is_active = true
+			  AND t.settings->>'require_private_providers' = 'true'
+		)
+	`, userID).Scan(&requiresPrivate)
+	if err != nil || !requiresPrivate {
+		return nil
+	}
+
+	// User is in a restricted team — verify the config is private
+	var isPrivate bool
+	err = database.DB.QueryRow(`
+		SELECT COALESCE(is_private, false) FROM api_configs WHERE id = $1
+	`, configID).Scan(&isPrivate)
+	if err != nil {
+		return nil // config lookup failed, allow (fail open)
+	}
+	if !isPrivate {
+		return fmt.Errorf("your team requires private providers — this provider sends data externally")
+	}
+	return nil
+}