Changeset 0.28.0.8 (#180)

server/handlers/memory.go

@@ -43,7 +43,10 @@ func (h *MemoryHandler) ListMyMemories(c *gin.Context) {
 		return
 	}
 
-	c.JSON(http.StatusOK, gin.H{"memories": memories})
+	if memories == nil {
+		memories = []models.Memory{}
+	}
+	c.JSON(http.StatusOK, gin.H{"data": memories})
 }
 
 // UpdateMemory updates a memory's key/value/confidence.
@@ -84,7 +87,7 @@ func (h *MemoryHandler) UpdateMemory(c *gin.Context) {
 		existing.Confidence = *body.Confidence
 	}
 
-	if err := h.stores.Memories.Upsert(c.Request.Context(), existing); err != nil {
+	if err := h.stores.Memories.Update(c.Request.Context(), existing); err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}
@@ -128,6 +131,11 @@ func (h *MemoryHandler) ApproveMemory(c *gin.Context) {
 		return
 	}
 
+	if existing.Status != models.MemoryStatusPendingReview {
+		c.JSON(http.StatusConflict, gin.H{"error": "only pending_review memories can be approved"})
+		return
+	}
+
 	existing.Status = models.MemoryStatusActive
 	if err := h.stores.Memories.Upsert(c.Request.Context(), existing); err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
@@ -140,8 +148,26 @@ func (h *MemoryHandler) ApproveMemory(c *gin.Context) {
 // RejectMemory archives a pending_review memory.
 // POST /api/v1/memories/:id/reject
 func (h *MemoryHandler) RejectMemory(c *gin.Context) {
+	userID := c.GetString("user_id")
 	memoryID := c.Param("id")
 
+	existing, err := h.stores.Memories.GetByID(c.Request.Context(), memoryID)
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "memory not found"})
+		return
+	}
+
+	// Ownership check: user can only reject their own user-scope memories
+	if existing.Scope == models.MemoryScopeUser && existing.OwnerID != userID {
+		c.JSON(http.StatusForbidden, gin.H{"error": "not your memory"})
+		return
+	}
+
+	if existing.Status != models.MemoryStatusPendingReview {
+		c.JSON(http.StatusConflict, gin.H{"error": "only pending_review memories can be rejected"})
+		return
+	}
+
 	if err := h.stores.Memories.Archive(c.Request.Context(), memoryID); err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
@@ -156,15 +182,23 @@ func (h *MemoryHandler) MemoryCount(c *gin.Context) {
 	userID := c.GetString("user_id")
 	ctx := c.Request.Context()
 
-	active, _ := h.stores.Memories.CountByOwner(ctx, models.MemoryScopeUser, userID)
+	active, err := h.stores.Memories.CountByOwner(ctx, models.MemoryScopeUser, userID)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
 
 	// Count pending by listing
-	pending, _ := h.stores.Memories.List(ctx, models.MemoryFilter{
+	pending, err := h.stores.Memories.List(ctx, models.MemoryFilter{
 		Scope:   models.MemoryScopeUser,
 		OwnerID: userID,
 		Status:  models.MemoryStatusPendingReview,
 		Limit:   1000,
 	})
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
 
 	c.JSON(http.StatusOK, gin.H{
 		"active":  active,
@@ -177,22 +211,18 @@ func (h *MemoryHandler) MemoryCount(c *gin.Context) {
 // ListPendingReview returns all pending_review memories (admin only).
 // GET /api/v1/admin/memories/pending
 func (h *MemoryHandler) ListPendingReview(c *gin.Context) {
-	// This should be called from the admin route group which already checks admin role.
-	// We query across all users by listing each scope.
 	ctx := c.Request.Context()
 
-	// Query pending memories directly via raw SQL for efficiency
-	var memories []models.Memory
+	memories, err := h.stores.Memories.ListByStatus(ctx, models.MemoryStatusPendingReview, 200)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
 
-	userMemories, _ := h.stores.Memories.List(ctx, models.MemoryFilter{
-		Scope:   models.MemoryScopeUser,
-		OwnerID: "%", // This won't work with List — we need a custom query
-		Status:  models.MemoryStatusPendingReview,
-		Limit:   100,
-	})
-	memories = append(memories, userMemories...)
-
-	c.JSON(http.StatusOK, gin.H{"memories": memories})
+	if memories == nil {
+		memories = []models.Memory{}
+	}
+	c.JSON(http.StatusOK, gin.H{"data": memories})
 }
 
 // BulkApprove approves multiple memories at once.
@@ -213,6 +243,9 @@ func (h *MemoryHandler) BulkApprove(c *gin.Context) {
 		if err != nil {
 			continue
 		}
+		if existing.Status != models.MemoryStatusPendingReview {
+			continue
+		}
 		existing.Status = models.MemoryStatusActive
 		if err := h.stores.Memories.Upsert(ctx, existing); err == nil {
 			approved++