feat: implement shared-album multi-user photo album

Backend (Go/Gin/pgx): env config, pgx pool with retries, Garage S3 client (path-style, region garage), embedded golang-migrate migrations, JWT auth with refresh rotation, albums CRUD, members/roles/invites with no-escalation matrix, photo upload + async imaging/goexif WebP variants, cursor pagination, presigned URLs, likes/comments, SSE hub (album + personal), notifications, share links. Frontend (SvelteKit 2 + Svelte 5 + Tailwind v4): API wrapper with 401 refresh, auth store, all screens, Uploader/PhotoGrid/Lightbox/Comments, SSE client with reconnect + REST catch-up, three themes + system via data-theme. Deploy without Docker: Makefile builds the frontend into backend/static and embeds it (go:embed) into a single statically linked binary; systemd unit and nginx SSE example included. Use gen2brain/webp (-tags nodynamic) instead of cgo kolesa-team/go-webp to keep CGO_ENABLED=0 static builds; design.md/proposal.md updated accordingly.
2026-10-10 12:50:33 +03:00
commit 2b2b342492
105 changed files with 12494 additions and 0 deletions
@@ -0,0 +1,87 @@
+package albums
+
+import (
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+
+	"shared-album/internal/auth"
+	"shared-album/internal/httpx"
+)
+
+type Handler struct {
+	svc *Service
+}
+
+func NewHandler(svc *Service) *Handler { return &Handler{svc: svc} }
+
+func (h *Handler) List(c *gin.Context) {
+	list, err := h.svc.List(c.Request.Context(), auth.UserID(c))
+	if err != nil {
+		httpx.RespondError(c, err)
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"albums": list})
+}
+
+type albumRequest struct {
+	Title       string `json:"title" binding:"required"`
+	Description string `json:"description"`
+}
+
+func (h *Handler) Create(c *gin.Context) {
+	var req albumRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		httpx.RespondError(c, httpx.BadRequest("invalid_request", "title is required"))
+		return
+	}
+	a, err := h.svc.Create(c.Request.Context(), auth.UserID(c), CreateInput(req))
+	if err != nil {
+		httpx.RespondError(c, err)
+		return
+	}
+	c.JSON(http.StatusCreated, gin.H{"album": a})
+}
+
+func (h *Handler) Get(c *gin.Context) {
+	a, role, err := h.svc.Get(c.Request.Context(), c.Param("id"), auth.UserID(c))
+	if err != nil {
+		httpx.RespondError(c, err)
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"album": a, "role": role})
+}
+
+type updateRequest struct {
+	Title        *string `json:"title"`
+	Description  *string `json:"description"`
+	CoverPhotoID *string `json:"cover_photo_id"`
+	ClearCover   bool    `json:"clear_cover"`
+}
+
+func (h *Handler) Update(c *gin.Context) {
+	var req updateRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		httpx.RespondError(c, httpx.BadRequest("invalid_request", "invalid body"))
+		return
+	}
+	a, err := h.svc.Update(c.Request.Context(), c.Param("id"), auth.UserID(c), UpdateInput{
+		Title:        req.Title,
+		Description:  req.Description,
+		CoverPhotoID: req.CoverPhotoID,
+		ClearCover:   req.ClearCover,
+	})
+	if err != nil {
+		httpx.RespondError(c, err)
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"album": a})
+}
+
+func (h *Handler) Delete(c *gin.Context) {
+	if err := h.svc.Delete(c.Request.Context(), c.Param("id"), auth.UserID(c)); err != nil {
+		httpx.RespondError(c, err)
+		return
+	}
+	c.Status(http.StatusNoContent)
+}
@@ -0,0 +1,135 @@
+package albums
+
+import (
+	"context"
+	"errors"
+	"strings"
+
+	"shared-album/internal/auth"
+	"shared-album/internal/httpx"
+	"shared-album/internal/models"
+	"shared-album/internal/roles"
+	"shared-album/internal/sse"
+	"shared-album/internal/storage"
+)
+
+type MemberLookup interface {
+	Role(ctx context.Context, albumID, userID string) (string, error)
+}
+
+type Service struct {
+	store   *Store
+	members MemberLookup
+	hub     *sse.Hub
+	storage *storage.Client
+}
+
+func NewService(store *Store, members MemberLookup, hub *sse.Hub, storage *storage.Client) *Service {
+	return &Service{store: store, members: members, hub: hub, storage: storage}
+}
+
+type CreateInput struct {
+	Title       string
+	Description string
+}
+
+func (s *Service) Create(ctx context.Context, userID string, in CreateInput) (*models.Album, error) {
+	title := strings.TrimSpace(in.Title)
+	if title == "" {
+		return nil, httpx.BadRequest("invalid_title", "title is required")
+	}
+	a := &models.Album{
+		ID:          auth.NewID(),
+		OwnerID:     userID,
+		Title:       title,
+		Description: strings.TrimSpace(in.Description),
+	}
+	if err := s.store.Create(ctx, a); err != nil {
+		return nil, err
+	}
+	return a, nil
+}
+
+func (s *Service) List(ctx context.Context, userID string) ([]models.Album, error) {
+	return s.store.ListForUser(ctx, userID)
+}
+
+func (s *Service) Access(ctx context.Context, albumID, userID string) (*models.Album, string, error) {
+	a, err := s.store.GetByID(ctx, albumID)
+	if err != nil {
+		if errors.Is(err, ErrNotFound) {
+			return nil, "", httpx.NotFound("album_not_found", "album not found")
+		}
+		return nil, "", err
+	}
+	if a.OwnerID == userID {
+		return a, roles.Owner, nil
+	}
+	role, err := s.members.Role(ctx, albumID, userID)
+	if err != nil {
+		return nil, "", err
+	}
+	if role == "" {
+		return nil, "", httpx.NotFound("album_not_found", "album not found")
+	}
+	return a, role, nil
+}
+
+func (s *Service) Get(ctx context.Context, albumID, userID string) (*models.Album, string, error) {
+	return s.Access(ctx, albumID, userID)
+}
+
+type UpdateInput struct {
+	Title        *string
+	Description  *string
+	CoverPhotoID *string
+	ClearCover   bool
+}
+
+func (s *Service) Update(ctx context.Context, albumID, userID string, in UpdateInput) (*models.Album, error) {
+	a, role, err := s.Access(ctx, albumID, userID)
+	if err != nil {
+		return nil, err
+	}
+	if !roles.CanEditAlbum(role) {
+		return nil, httpx.Forbidden("forbidden", "only owner and admin can edit the album")
+	}
+	if in.Title != nil {
+		title := strings.TrimSpace(*in.Title)
+		if title == "" {
+			return nil, httpx.BadRequest("invalid_title", "title cannot be empty")
+		}
+		a.Title = title
+	}
+	if in.Description != nil {
+		a.Description = strings.TrimSpace(*in.Description)
+	}
+	if in.ClearCover {
+		a.CoverPhotoID = nil
+	} else if in.CoverPhotoID != nil {
+		a.CoverPhotoID = in.CoverPhotoID
+	}
+	if err := s.store.Update(ctx, a); err != nil {
+		return nil, err
+	}
+	s.hub.Publish(albumID, "album.updated", a)
+	return a, nil
+}
+
+func (s *Service) Delete(ctx context.Context, albumID, userID string) error {
+	a, role, err := s.Access(ctx, albumID, userID)
+	if err != nil {
+		return err
+	}
+	if role != roles.Owner {
+		return httpx.Forbidden("forbidden", "only the owner can delete the album")
+	}
+	if err := s.store.Delete(ctx, a.ID); err != nil {
+		return err
+	}
+	if s.storage != nil {
+		_ = s.storage.DeletePrefix(ctx, "albums/"+a.ID+"/")
+	}
+	s.hub.Publish(albumID, "album.deleted", map[string]string{"id": a.ID})
+	return nil
+}
@@ -0,0 +1,100 @@
+package albums
+
+import (
+	"context"
+	"errors"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"shared-album/internal/httpx"
+	"shared-album/internal/models"
+)
+
+var ErrNotFound = errors.New("album not found")
+
+type Store struct {
+	pool *pgxpool.Pool
+}
+
+func NewStore(pool *pgxpool.Pool) *Store { return &Store{pool: pool} }
+
+func (s *Store) Create(ctx context.Context, a *models.Album) error {
+	return s.pool.QueryRow(ctx,
+		`INSERT INTO albums (id, owner_id, title, description, cover_photo_id)
+		 VALUES ($1, $2, $3, $4, $5)
+		 RETURNING created_at, updated_at`,
+		a.ID, a.OwnerID, a.Title, a.Description, a.CoverPhotoID,
+	).Scan(&a.CreatedAt, &a.UpdatedAt)
+}
+
+func (s *Store) OwnerID(ctx context.Context, id string) (string, error) {
+	var ownerID string
+	err := s.pool.QueryRow(ctx, `SELECT owner_id FROM albums WHERE id = $1`, id).Scan(&ownerID)
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return "", httpx.NotFound("album_not_found", "album not found")
+		}
+		return "", err
+	}
+	return ownerID, nil
+}
+
+func (s *Store) GetByID(ctx context.Context, id string) (*models.Album, error) {
+	var a models.Album
+	err := s.pool.QueryRow(ctx,
+		`SELECT id, owner_id, title, description, cover_photo_id, created_at, updated_at
+		 FROM albums WHERE id = $1`, id).
+		Scan(&a.ID, &a.OwnerID, &a.Title, &a.Description, &a.CoverPhotoID, &a.CreatedAt, &a.UpdatedAt)
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return nil, ErrNotFound
+		}
+		return nil, err
+	}
+	return &a, nil
+}
+
+func (s *Store) ListForUser(ctx context.Context, userID string) ([]models.Album, error) {
+	rows, err := s.pool.Query(ctx,
+		`SELECT a.id, a.owner_id, a.title, a.description, a.cover_photo_id, a.created_at, a.updated_at
+		 FROM albums a
+		 LEFT JOIN album_members m ON m.album_id = a.id AND m.user_id = $1
+		 WHERE a.owner_id = $1 OR m.user_id IS NOT NULL
+		 ORDER BY a.created_at DESC`, userID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	out := []models.Album{}
+	for rows.Next() {
+		var a models.Album
+		if err := rows.Scan(&a.ID, &a.OwnerID, &a.Title, &a.Description, &a.CoverPhotoID, &a.CreatedAt, &a.UpdatedAt); err != nil {
+			return nil, err
+		}
+		out = append(out, a)
+	}
+	return out, rows.Err()
+}
+
+func (s *Store) Update(ctx context.Context, a *models.Album) error {
+	return s.pool.QueryRow(ctx,
+		`UPDATE albums
+		 SET title = $2, description = $3, cover_photo_id = $4, updated_at = now()
+		 WHERE id = $1
+		 RETURNING updated_at`,
+		a.ID, a.Title, a.Description, a.CoverPhotoID,
+	).Scan(&a.UpdatedAt)
+}
+
+func (s *Store) Delete(ctx context.Context, id string) error {
+	tag, err := s.pool.Exec(ctx, `DELETE FROM albums WHERE id = $1`, id)
+	if err != nil {
+		return err
+	}
+	if tag.RowsAffected() == 0 {
+		return ErrNotFound
+	}
+	return nil
+}