agent

func (*CommentHandler) Create ¶ added in v0.3.0

func (h *CommentHandler) Create(w http.ResponseWriter, r *http.Request)

Create handles POST /api/v1/content/{id}/comments. It resolves the content by id (404 NOT_FOUND when missing, and 404 — never 403 — when the caller is neither owner nor Admin and the content is a draft, so existence is not disclosed), rejects commenting when the content has comments disabled (403 FORBIDDEN), then delegates to SubmitComment which validates the text (1–2000 chars, no HTML → ErrInvalidCommentText → 400 VALIDATION_ERROR) and persists the comment in the "pending" moderation status. Like the rest of the agent surface, success is 200 (the browser realm returns 201; the agent realm standardizes on 200 via response.Success).

func (*CommentHandler) Delete ¶ added in v0.3.0

func (h *CommentHandler) Delete(w http.ResponseWriter, r *http.Request)

Delete handles DELETE /api/v1/content/{id}/comments/{commentId}. The path content id is bound to the comment (a mismatch — the comment belongs to other content — is rejected with a clean 404, no disclosure), then an Admin may delete any comment (DeleteComment) while any other caller may delete only their own (DeleteOwnComment, which returns ErrCommentNotFound — a 404 with no ownership disclosure — when the comment is missing or belongs to someone else). Success is 204 No Content.

func (*CommentHandler) List ¶ added in v0.3.0

func (h *CommentHandler) List(w http.ResponseWriter, r *http.Request)

List handles GET /api/v1/content/{id}/comments. An Admin sees the moderation view (every comment, any status — mirroring the browser realm's admin-gated moderation queue); any other caller sees only approved comments, mirroring the public GET /api/v1/public/content_items/{slug}/comments. Both are scoped by the same visibility model as Create (published, or owned by the caller, or Admin; else 404). Comments-disabled content yields an empty list for non-admins (admins still moderate); the data array is always present, even when empty.

func (*CommentHandler) UpdateStatus ¶ added in v0.3.0

func (h *CommentHandler) UpdateStatus(w http.ResponseWriter, r *http.Request)

UpdateStatus handles PUT /api/v1/content/{id}/comments/{commentId}/status. It is admin-only (a non-admin API key gets 403 FORBIDDEN). The path content id is bound to the comment (a mismatch yields a clean 404), then it delegates to UpdateCommentStatus, which validates the status (a valid contentdomain.CommentStatus — pending/approved/rejected/spam; an unknown value returns ErrInvalidCommentStatus → 400 VALIDATION_ERROR). The updated comment is returned so the caller sees the new status.

func (*ContentHandler) Create ¶

func (h *ContentHandler) Create(w http.ResponseWriter, r *http.Request)

Create handles POST /api/v1/content. It maps the streamlined agent payload onto a contentdomain.CreateContentRequest (reusing the same validation + plugin hook path as the admin surface) and returns the created content in the envelope.

func (*ContentHandler) Delete ¶

func (h *ContentHandler) Delete(w http.ResponseWriter, r *http.Request)

Delete handles DELETE /api/v1/content/{id}. It pre-fetches for the ownership check (404 on not-found or not-owned-per-role) then delegates to the existing ContentService.DeleteContent. A successful delete returns 204 No Content; a subsequent GET returns 404 (the service hard-deletes for Admins and scoped-deletes otherwise).

func (*ContentHandler) Get ¶

func (h *ContentHandler) Get(w http.ResponseWriter, r *http.Request)

Get handles GET /api/v1/content/{id}. It returns the content in the envelope, or 404 NOT_FOUND when it does not exist OR the caller is not allowed to see it.

Visibility scoping (review fix for the GET IDOR): the underlying GetByID returns content regardless of owner/status, so the handler enforces "published OR owned by the requesting user" and otherwise returns NOT_FOUND (never FORBIDDEN, so existence is not disclosed to unauthorized callers). This mirrors the ownership pattern the admin Update/DeleteContent paths use (existing.UserID != userID).

func (*ContentHandler) List ¶

func (h *ContentHandler) List(w http.ResponseWriter, r *http.Request)

List handles GET /api/v1/content. It returns the caller's own content (any status — drafts + published) in newest-first order using opaque keyset (cursor) pagination, each item projected via the ContentProjection whitelist. hasMore/nextCursor are computed by requesting limit+1 rows; nextCursor is the opaque token of the last item on the current page and is only present when there is another page.

Optional filters: ?tag=foo&tag=bar (AND-of-tags), ?language=en, ?status=draft|published, ?post_type=post, ?author=alice (admin only — non-admins get 403), ?search=foo (min 2 chars). All filters AND with the cursor pagination. The agent v1 surface scopes to the caller's own content; the author filter is meaningful only for admins because the agent handler never expands the userID scope (admin still sees their own content here — use the admin surface for cross-user listings).

func (*ContentHandler) Publish ¶

func (h *ContentHandler) Publish(w http.ResponseWriter, r *http.Request)

Publish handles POST /api/v1/content/{id}/publish. It delegates to ContentService.Publish so ownership, the draft→published transition, SEO auto-generation, and the AfterPublish hook fire through the same domain path the Update endpoint uses. The endpoint accepts an empty body and is idempotent: publishing an already-published post returns 200 with the current projection, fires no hook, runs no SEO regen.

A non-admin caller must be the owner; otherwise 404 (never 403, so existence is not disclosed). An admin can publish another user's content. Validation and persistence errors map to the same error envelope the other endpoints use.

func (*ContentHandler) SetSystemFields ¶ added in v0.2.0

func (h *ContentHandler) SetSystemFields(w http.ResponseWriter, r *http.Request)

SetSystemFields handles PUT /api/v1/content/{id}/system-fields. System fields are admin-managed metadata (e.g. editorial_status, internal_notes), so this endpoint is admin-only: a non-admin caller gets 403. It mirrors the browser admin's system-fields endpoint but lives in the Bearer/agent realm so the CLI can set them with an admin API key. It delegates to ContentService.SetSystemFields, which validates each key against the post type's system-field schema and each value's type — an unknown key returns ErrUnknownSystemFieldKey and a bad value returns ErrSystemFieldValidation (both → 400 VALIDATION_ERROR via handleError).

func (*ContentHandler) Unpublish ¶

func (h *ContentHandler) Unpublish(w http.ResponseWriter, r *http.Request)

Unpublish handles POST /api/v1/content/{id}/unpublish. It delegates to ContentService.Unpublish so the status flip persists through the same domain path. The endpoint accepts an empty body and is idempotent: unpublishing an already-draft post returns 200 with the current projection, fires no hook, runs no SEO regen. Unpublish never fires the AfterPublish hook (the hook is wired to the draft→published edge only).

Same ownership/role contract as Publish: 404 (not 403) for non-admin non-owners; admins can unpublish anyone's content.

func (*ContentHandler) Update ¶

func (h *ContentHandler) Update(w http.ResponseWriter, r *http.Request)

Update handles PUT /api/v1/content/{id}. It pre-fetches the existing content for an ownership check (404 NOT_FOUND when the caller is neither owner nor Admin — existence is never disclosed) and then delegates to the existing ContentService.Update so hooks + custom-field validation run through the same domain path the admin uses. format=tiptap stores the body unchanged; markdown is rejected (Story 2.4).

v1 settable on update: title, body, format, postType, customFields, isPublished, tags, language. Server-managed (preserved from the existing item): SEO metadata (metaDescription, ogTitle, ogDescription), allowComments, translationGroupId.

func (*MediaHandler) Get ¶

func (h *MediaHandler) Get(w http.ResponseWriter, r *http.Request)

Get handles GET /api/v1/media/{id}. It returns the media in the envelope, or 404 NOT_FOUND when it does not exist OR the caller is not allowed to see it (ownership scoping: only the owner or an Admin may read a given item — existence is never disclosed, consistent with the content visibility model).

func (*MediaHandler) List ¶

func (h *MediaHandler) List(w http.ResponseWriter, r *http.Request)

List handles GET /api/v1/media. It returns the caller's own media in newest-first order using opaque keyset (cursor) pagination — the SAME contract as the content list. It reuses the agent package's cursor helpers and the response package's SuccessList/ Pagination/ListMeta types (introduced for this reuse in Story 2.2).

func (*MediaHandler) Upload ¶

func (h *MediaHandler) Upload(w http.ResponseWriter, r *http.Request)

Upload handles POST /api/v1/media. It parses a required `file` part and an optional JSON `metadata` part (carrying altText) from multipart/form-data, maps them onto a mediadomain.UploadRequest, and delegates to the existing MediaService.Upload. A missing `file` part returns 400 VALIDATION_ERROR; the service's own validation (mime/size/alt text) and dedup flow through handleMediaError.