feat: implement shared-album multi-user photo album

Backend (Go/Gin/pgx): env config, pgx pool with retries, Garage S3 client (path-style, region garage), embedded golang-migrate migrations, JWT auth with refresh rotation, albums CRUD, members/roles/invites with no-escalation matrix, photo upload + async imaging/goexif WebP variants, cursor pagination, presigned URLs, likes/comments, SSE hub (album + personal), notifications, share links. Frontend (SvelteKit 2 + Svelte 5 + Tailwind v4): API wrapper with 401 refresh, auth store, all screens, Uploader/PhotoGrid/Lightbox/Comments, SSE client with reconnect + REST catch-up, three themes + system via data-theme. Deploy without Docker: Makefile builds the frontend into backend/static and embeds it (go:embed) into a single statically linked binary; systemd unit and nginx SSE example included. Use gen2brain/webp (-tags nodynamic) instead of cgo kolesa-team/go-webp to keep CGO_ENABLED=0 static builds; design.md/proposal.md updated accordingly.
2026-10-10 12:50:33 +03:00
commit 2b2b342492
105 changed files with 12494 additions and 0 deletions
@@ -0,0 +1,67 @@
+package social
+
+import (
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+
+	"shared-album/internal/auth"
+	"shared-album/internal/httpx"
+)
+
+type Handler struct {
+	svc *Service
+}
+
+func NewHandler(svc *Service) *Handler { return &Handler{svc: svc} }
+
+func (h *Handler) AddLike(c *gin.Context) {
+	if err := h.svc.AddLike(c.Request.Context(), c.Param("id"), auth.UserID(c)); err != nil {
+		httpx.RespondError(c, err)
+		return
+	}
+	c.Status(http.StatusNoContent)
+}
+
+func (h *Handler) RemoveLike(c *gin.Context) {
+	if err := h.svc.RemoveLike(c.Request.Context(), c.Param("id"), auth.UserID(c)); err != nil {
+		httpx.RespondError(c, err)
+		return
+	}
+	c.Status(http.StatusNoContent)
+}
+
+func (h *Handler) ListComments(c *gin.Context) {
+	list, err := h.svc.ListComments(c.Request.Context(), c.Param("id"), auth.UserID(c))
+	if err != nil {
+		httpx.RespondError(c, err)
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"comments": list})
+}
+
+type commentRequest struct {
+	Text string `json:"text" binding:"required"`
+}
+
+func (h *Handler) AddComment(c *gin.Context) {
+	var req commentRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		httpx.RespondError(c, httpx.BadRequest("invalid_request", "text is required"))
+		return
+	}
+	comment, err := h.svc.AddComment(c.Request.Context(), c.Param("id"), auth.UserID(c), req.Text)
+	if err != nil {
+		httpx.RespondError(c, err)
+		return
+	}
+	c.JSON(http.StatusCreated, gin.H{"comment": comment})
+}
+
+func (h *Handler) DeleteComment(c *gin.Context) {
+	if err := h.svc.DeleteComment(c.Request.Context(), c.Param("id"), auth.UserID(c)); err != nil {
+		httpx.RespondError(c, err)
+		return
+	}
+	c.Status(http.StatusNoContent)
+}
@@ -0,0 +1,171 @@
+package social
+
+import (
+	"context"
+	"errors"
+	"strings"
+
+	"shared-album/internal/auth"
+	"shared-album/internal/httpx"
+	"shared-album/internal/models"
+	"shared-album/internal/roles"
+	"shared-album/internal/sse"
+)
+
+type AlbumAccess interface {
+	Access(ctx context.Context, albumID, userID string) (*models.Album, string, error)
+}
+
+type PhotoLookup interface {
+	GetByID(ctx context.Context, id, viewerID string) (*models.Photo, error)
+}
+
+type Notifier interface {
+	Create(ctx context.Context, userID, typ string, payload map[string]any) error
+}
+
+type Service struct {
+	store  *Store
+	albums AlbumAccess
+	photos PhotoLookup
+	hub    *sse.Hub
+	notify Notifier
+}
+
+func NewService(store *Store, albums AlbumAccess, photos PhotoLookup, hub *sse.Hub, notify Notifier) *Service {
+	return &Service{store: store, albums: albums, photos: photos, hub: hub, notify: notify}
+}
+
+func (s *Service) requireComment(ctx context.Context, photo *models.Photo, userID string) (string, error) {
+	_, role, err := s.albums.Access(ctx, photo.AlbumID, userID)
+	if err != nil {
+		return "", err
+	}
+	if !roles.CanComment(role) {
+		return "", httpx.Forbidden("forbidden", "you do not have permission to interact with photos")
+	}
+	return role, nil
+}
+
+func (s *Service) AddLike(ctx context.Context, photoID, userID string) error {
+	photo, err := s.photos.GetByID(ctx, photoID, userID)
+	if err != nil {
+		if errors.Is(err, ErrNotFound) {
+			return httpx.NotFound("photo_not_found", "photo not found")
+		}
+		return err
+	}
+	if _, err := s.requireComment(ctx, photo, userID); err != nil {
+		return err
+	}
+	if err := s.store.Like(ctx, photoID, userID); err != nil {
+		return err
+	}
+	s.hub.Publish(photo.AlbumID, "like.added", map[string]string{
+		"photo_id": photoID, "album_id": photo.AlbumID, "user_id": userID,
+	})
+	if s.notify != nil && photo.UploaderID != userID {
+		_ = s.notify.Create(ctx, photo.UploaderID, "like.added", map[string]any{
+			"photo_id": photoID, "album_id": photo.AlbumID, "user_id": userID,
+		})
+	}
+	return nil
+}
+
+func (s *Service) RemoveLike(ctx context.Context, photoID, userID string) error {
+	photo, err := s.photos.GetByID(ctx, photoID, userID)
+	if err != nil {
+		if errors.Is(err, ErrNotFound) {
+			return httpx.NotFound("photo_not_found", "photo not found")
+		}
+		return err
+	}
+	if _, err := s.requireComment(ctx, photo, userID); err != nil {
+		return err
+	}
+	if err := s.store.Unlike(ctx, photoID, userID); err != nil {
+		return err
+	}
+	s.hub.Publish(photo.AlbumID, "like.removed", map[string]string{
+		"photo_id": photoID, "album_id": photo.AlbumID, "user_id": userID,
+	})
+	return nil
+}
+
+func (s *Service) AddComment(ctx context.Context, photoID, userID, text string) (*models.Comment, error) {
+	text = strings.TrimSpace(text)
+	if text == "" {
+		return nil, httpx.BadRequest("invalid_text", "comment text is required")
+	}
+	photo, err := s.photos.GetByID(ctx, photoID, userID)
+	if err != nil {
+		if errors.Is(err, ErrNotFound) {
+			return nil, httpx.NotFound("photo_not_found", "photo not found")
+		}
+		return nil, err
+	}
+	if _, err := s.requireComment(ctx, photo, userID); err != nil {
+		return nil, err
+	}
+	c := &models.Comment{
+		ID:      auth.NewID(),
+		PhotoID: photoID,
+		UserID:  userID,
+		Text:    text,
+	}
+	if err := s.store.CreateComment(ctx, c); err != nil {
+		return nil, err
+	}
+	list, err := s.store.ListComments(ctx, photoID)
+	if err == nil {
+		for _, item := range list {
+			if item.ID == c.ID {
+				c.User = item.User
+				break
+			}
+		}
+	}
+	s.hub.Publish(photo.AlbumID, "comment.created", c)
+	if s.notify != nil && photo.UploaderID != userID {
+		_ = s.notify.Create(ctx, photo.UploaderID, "comment.created", map[string]any{
+			"photo_id": photoID, "album_id": photo.AlbumID, "user_id": userID, "comment_id": c.ID,
+		})
+	}
+	return c, nil
+}
+
+func (s *Service) ListComments(ctx context.Context, photoID, userID string) ([]models.Comment, error) {
+	photo, err := s.photos.GetByID(ctx, photoID, userID)
+	if err != nil {
+		if errors.Is(err, ErrNotFound) {
+			return nil, httpx.NotFound("photo_not_found", "photo not found")
+		}
+		return nil, err
+	}
+	if _, _, err := s.albums.Access(ctx, photo.AlbumID, userID); err != nil {
+		return nil, err
+	}
+	return s.store.ListComments(ctx, photoID)
+}
+
+func (s *Service) DeleteComment(ctx context.Context, commentID, userID string) error {
+	c, err := s.store.GetComment(ctx, commentID)
+	if err != nil {
+		if errors.Is(err, ErrNotFound) {
+			return httpx.NotFound("comment_not_found", "comment not found")
+		}
+		return err
+	}
+	photo, err := s.photos.GetByID(ctx, c.PhotoID, userID)
+	if err != nil {
+		return err
+	}
+	_, role, err := s.albums.Access(ctx, photo.AlbumID, userID)
+	if err != nil {
+		return err
+	}
+	if c.UserID != userID && !roles.CanDeleteAnyPhoto(role) {
+		return httpx.Forbidden("forbidden", "you cannot delete this comment")
+	}
+	return s.store.DeleteComment(ctx, commentID)
+}
@@ -0,0 +1,91 @@
+package social
+
+import (
+	"context"
+	"errors"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"shared-album/internal/models"
+)
+
+var ErrNotFound = errors.New("not found")
+
+type Store struct {
+	pool *pgxpool.Pool
+}
+
+func NewStore(pool *pgxpool.Pool) *Store { return &Store{pool: pool} }
+
+func (s *Store) Like(ctx context.Context, photoID, userID string) error {
+	_, err := s.pool.Exec(ctx,
+		`INSERT INTO likes (photo_id, user_id) VALUES ($1, $2)
+		 ON CONFLICT (photo_id, user_id) DO NOTHING`, photoID, userID)
+	return err
+}
+
+func (s *Store) Unlike(ctx context.Context, photoID, userID string) error {
+	_, err := s.pool.Exec(ctx,
+		`DELETE FROM likes WHERE photo_id = $1 AND user_id = $2`, photoID, userID)
+	return err
+}
+
+func (s *Store) CreateComment(ctx context.Context, c *models.Comment) error {
+	return s.pool.QueryRow(ctx,
+		`INSERT INTO comments (id, photo_id, user_id, text)
+		 VALUES ($1, $2, $3, $4)
+		 RETURNING created_at, updated_at`,
+		c.ID, c.PhotoID, c.UserID, c.Text,
+	).Scan(&c.CreatedAt, &c.UpdatedAt)
+}
+
+func (s *Store) ListComments(ctx context.Context, photoID string) ([]models.Comment, error) {
+	rows, err := s.pool.Query(ctx,
+		`SELECT c.id, c.photo_id, c.user_id, c.text, c.created_at, c.updated_at,
+		        u.id, u.name, COALESCE(u.avatar_url, '')
+		 FROM comments c
+		 JOIN users u ON u.id = c.user_id
+		 WHERE c.photo_id = $1
+		 ORDER BY c.created_at`, photoID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	out := []models.Comment{}
+	for rows.Next() {
+		var c models.Comment
+		if err := rows.Scan(&c.ID, &c.PhotoID, &c.UserID, &c.Text, &c.CreatedAt, &c.UpdatedAt,
+			&c.User.ID, &c.User.Name, &c.User.AvatarURL); err != nil {
+			return nil, err
+		}
+		out = append(out, c)
+	}
+	return out, rows.Err()
+}
+
+func (s *Store) GetComment(ctx context.Context, id string) (*models.Comment, error) {
+	var c models.Comment
+	err := s.pool.QueryRow(ctx,
+		`SELECT id, photo_id, user_id, text, created_at, updated_at FROM comments WHERE id = $1`, id).
+		Scan(&c.ID, &c.PhotoID, &c.UserID, &c.Text, &c.CreatedAt, &c.UpdatedAt)
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return nil, ErrNotFound
+		}
+		return nil, err
+	}
+	return &c, nil
+}
+
+func (s *Store) DeleteComment(ctx context.Context, id string) error {
+	tag, err := s.pool.Exec(ctx, `DELETE FROM comments WHERE id = $1`, id)
+	if err != nil {
+		return err
+	}
+	if tag.RowsAffected() == 0 {
+		return ErrNotFound
+	}
+	return nil
+}