package web
import (
"context"
"embed"
"errors"
"fmt"
"html/template"
"io/fs"
"log/slog"
"mime"
"net/http"
"net/url"
"sort"
"strings"
"time"
"github.com/m/projax/internal/aggregate"
"github.com/m/projax/internal/cache"
"github.com/m/projax/internal/itemwrite"
"github.com/m/projax/store"
)
// itemWriteFailure surfaces an *itemwrite.ValidationError to the client.
// HTTP code: 400 for invalid input. The body is a one-line human banner
// keyed on Kind so handlers don't have to duplicate copy-table fragments.
// Phase 5c uses this instead of the pre-existing raw-pgErr-on-failure
// pattern in handleDetailWrite / handleNewSubmit / handleReparent.
func (s *Server) itemWriteFailure(w http.ResponseWriter, r *http.Request, ve *itemwrite.ValidationError) {
w.Header().Set("Content-Type", "text/plain; charset=utf-8")
w.WriteHeader(http.StatusBadRequest)
fmt.Fprintln(w, itemWriteBannerCopy(ve))
s.Logger.Warn("itemwrite reject", "path", r.URL.Path, "kind", ve.Kind, "detail", ve.Detail)
}
// itemWriteBannerCopy maps a ValidationError.Kind to the human-facing
// banner copy. Centralised so web/server.go + web/bulk.go share one
// authoritative phrasing.
func itemWriteBannerCopy(ve *itemwrite.ValidationError) string {
switch ve.Kind {
case itemwrite.KindMissingRequired:
return "Missing required field: " + ve.Detail
case itemwrite.KindInvalidSlugFormat:
return ve.Detail
case itemwrite.KindInvalidStatus:
return ve.Detail
case itemwrite.KindSelfParent:
return "An item cannot be its own parent."
case itemwrite.KindUnknownParent:
return ve.Detail
case itemwrite.KindSlugCollision:
return ve.Detail
case itemwrite.KindCycle:
return "Cannot reparent: this move would put the item in its own ancestor closure."
case itemwrite.KindUnresolvablePath:
return ve.Detail
}
return "Invalid input: " + ve.Detail
}
// Register MIME types stdlib doesn't ship by default. The web-app manifest
// spec requires application/manifest+json for the ` URLs are 302-redirected from a dedicated
// handler (slice C). handleTree stays focused on the tree-as-tree
// surface and no longer hijacks itself based on a query param.
roots, orphans, total, orphanN, matched := applyTreeFilter(items, filter, linkKinds)
counts := computeChipCounts(items, filter, linkKinds, tags)
// Phase 5i Slice B: the card view renders a flat grid of matched items
// (no tree structure). Build from items + filter directly rather than
// reusing the post-prune `roots` (which still keeps ancestors).
cardItems := flatMatchedItems(items, filter, linkKinds)
// Phase 5i Slice C: kanban groups the same matched set into columns.
groupBy := ParseGroupBy(r.URL.Query())
kanban := BuildKanbanBoard(cardItems, groupBy)
groupByChips := GroupByChips("/", filter, groupBy)
data := map[string]any{
"Title": "tree",
"Roots": roots,
"Orphans": orphans,
"Total": total,
"OrphanN": orphanN,
"Matched": matched,
"AllTags": tags,
"Filter": filter,
"Counts": counts,
"Projects": parentOptionsFromItems(items),
"BasePath": "/",
"ProjectChipTarget": "#tree-section",
"ViewType": view,
"ViewTypeChips": ViewTypeChips("/", filter, view),
"CardItems": cardItems,
"Kanban": kanban,
"GroupBy": groupBy,
"GroupByChips": groupByChips,
// ActiveTags kept for backwards-compat with the old template path; removed
// after the template migrates fully.
"ActiveTags": filter.Tags,
}
if r.Header.Get("HX-Request") == "true" {
// Fragment swap: only the tree section. The browser keeps the chip
// chrome (which itself is HTMX-driven) up to date because we push the
// URL via hx-push-url at chip-click time.
s.render(w, r, "tree_section", data)
return
}
s.render(w, r, "tree", data)
}
// linkKindsByItem returns a map: itemID → set of ref_types attached to that item.
// Used by the tree filter for has-link chips. Two ref_types matter at v1:
// caldav-list and gitea-repo.
func (s *Server) linkKindsByItem(ctx context.Context) (map[string]map[string]struct{}, error) {
out := map[string]map[string]struct{}{}
for _, t := range []string{"caldav-list", "gitea-repo"} {
links, err := s.Store.LinksByRefType(ctx, t)
if err != nil {
return nil, err
}
for _, l := range links {
set, ok := out[l.ItemID]
if !ok {
set = map[string]struct{}{}
out[l.ItemID] = set
}
set[t] = struct{}{}
}
}
return out, nil
}
func (s *Server) handleDetail(w http.ResponseWriter, r *http.Request) {
path := strings.TrimPrefix(r.URL.Path, "/i/")
if path == "" {
http.NotFound(w, r)
return
}
// PER URL resolution: try the full path first; if it 404s and the trailing
// segment looks like YYMMDD, retry against the shorter path and surface
// the date as a render hint to scroll/highlight the matching row.
it, err := s.Store.GetByPath(r.Context(), path)
var highlight *time.Time
if errors.Is(err, store.ErrNotFound) {
if base, d := parsePER(path); d != nil {
if it2, err2 := s.Store.GetByPath(r.Context(), base); err2 == nil {
it, err, highlight = it2, nil, d
}
}
}
if err != nil {
s.fail(w, r, err)
return
}
parents, err := s.parentOptions(r.Context())
if err != nil {
s.fail(w, r, err)
return
}
tasks, err := s.detailTodos(r.Context(), it)
if err != nil {
s.Logger.Warn("detail tasks", "path", it.PrimaryPath(), "err", err)
}
issues, err := s.detailIssues(r.Context(), it)
if err != nil {
s.Logger.Warn("detail issues", "path", it.PrimaryPath(), "err", err)
}
openTotal := 0
for _, ri := range issues {
openTotal += ri.OpenCount
}
docs, err := s.Store.DatedLinks(r.Context(), it.ID)
if err != nil {
s.Logger.Warn("detail docs", "path", it.PrimaryPath(), "err", err)
}
documents := computePERs(it.PrimaryPath(), docs)
s.render(w, r, "detail", map[string]any{
"Title": it.Title,
"Item": it,
"ParentOptions": parents,
"StatusOptions": []string{"active", "done", "archived"},
"Tasks": tasks,
"CalDAVOn": s.CalDAV != nil,
"Issues": issues,
"IssuesOpenTotal": openTotal,
"GiteaOn": s.Gitea != nil,
"Documents": documents,
"HighlightDate": highlight,
})
}
func (s *Server) handleDetailWrite(w http.ResponseWriter, r *http.Request) {
path := strings.TrimPrefix(r.URL.Path, "/i/")
if base, ok := strings.CutSuffix(path, "/reparent"); ok {
s.handleReparent(w, r, base)
return
}
if base, ok := strings.CutSuffix(path, "/caldav/create"); ok {
s.handleCalDAVCreate(w, r, base)
return
}
for _, action := range []string{"complete", "reopen", "edit", "delete", "todo-create"} {
if base, ok := strings.CutSuffix(path, "/caldav/todo/"+action); ok {
s.handleCalDAVTodoAction(w, r, base, action)
return
}
}
for _, action := range []string{"close", "reopen", "comment", "create"} {
if base, ok := strings.CutSuffix(path, "/issues/"+action); ok {
s.handleIssueAction(w, r, base, action)
return
}
}
if base, ok := strings.CutSuffix(path, "/links/add"); ok {
s.handleLinksAdd(w, r, base)
return
}
if base, ok := strings.CutSuffix(path, "/links/remove"); ok {
s.handleLinksRemove(w, r, base)
return
}
it, err := s.Store.GetByPath(r.Context(), path)
if err != nil {
s.fail(w, r, err)
return
}
if err := r.ParseForm(); err != nil {
s.fail(w, r, err)
return
}
parentIDs := r.Form["parent_ids"]
if len(parentIDs) == 0 {
// Legacy single-value field for the classify HTMX action.
if v := strings.TrimSpace(r.FormValue("parent_id")); v != "" {
parentIDs = []string{v}
}
}
parentIDs = dedupeStrings(parentIDs)
title := strings.TrimSpace(r.FormValue("title"))
slug := strings.TrimSpace(r.FormValue("slug"))
status := strings.TrimSpace(r.FormValue("status"))
if ve := itemwrite.ValidateFormat(itemwrite.Input{
ID: it.ID, Title: title, Slug: slug, Status: status, ParentIDs: parentIDs, Path: it.PrimaryPath(),
}); ve != nil {
s.itemWriteFailure(w, r, ve)
return
}
if ve := itemwrite.ValidateAgainstStore(r.Context(), s.Store, itemwrite.Input{
ID: it.ID, Title: title, Slug: slug, Status: status, ParentIDs: parentIDs, Path: it.PrimaryPath(),
}); ve != nil {
s.itemWriteFailure(w, r, ve)
return
}
in := store.UpdateInput{
Title: title,
Slug: slug,
ParentIDs: parentIDs,
ContentMD: r.FormValue("content_md"),
Status: status,
Pinned: r.FormValue("pinned") == "1",
Archived: r.FormValue("archived") == "1",
Tags: parseCSV(r.FormValue("tags")),
Management: parseCSV(r.FormValue("management")),
// Phase 4d public-listing fields. The form includes the toggle + four
// inputs whenever the user has edit access; missing fields fall through
// to zero (false / "" / empty array), which matches "make private +
// clear values" semantics — by design.
Public: r.FormValue("public") == "1",
PublicDescription: r.FormValue("public_description"),
PublicLiveURL: strings.TrimSpace(r.FormValue("public_live_url")),
PublicSourceURL: strings.TrimSpace(r.FormValue("public_source_url")),
PublicScreenshots: parseScreenshotList(r.Form["public_screenshots"]),
// Phase 4f: timeline-exclude form field is a multi-value checkbox set
// (`name="timeline_exclude" value="todos"`, …). parseTimelineExcludeList
// keeps only the known kinds so a stray value can't poison the array.
TimelineExclude: parseTimelineExcludeList(r.Form["timeline_exclude"]),
}
updated, err := s.Store.Update(r.Context(), it.ID, in)
if err != nil {
s.fail(w, r, err)
return
}
http.Redirect(w, r, "/i/"+updated.PrimaryPath(), http.StatusSeeOther)
}
// handleReparent replaces parent_ids. /admin/classify uses this to move
// a root mai-managed item under a chosen parent without touching other fields.
// HTMX-friendly: returns a fragment when HX-Request is set.
func (s *Server) handleReparent(w http.ResponseWriter, r *http.Request, path string) {
it, err := s.Store.GetByPath(r.Context(), path)
if err != nil {
s.fail(w, r, err)
return
}
if err := r.ParseForm(); err != nil {
s.fail(w, r, err)
return
}
parentIDs := r.Form["parent_ids"]
if len(parentIDs) == 0 {
if v := strings.TrimSpace(r.FormValue("parent_id")); v != "" {
parentIDs = []string{v}
}
}
parentIDs = dedupeStrings(parentIDs)
if len(parentIDs) == 0 {
http.Error(w, "reparent: parent_ids required", http.StatusBadRequest)
return
}
// Reparent doesn't change title/slug/status, so the validator only
// exercises rules around parent_ids: self-parent, unknown-parent,
// cycle. Format check runs against the existing item's fields.
if ve := itemwrite.ValidateFormat(itemwrite.Input{
ID: it.ID, Title: it.Title, Slug: it.Slug, Status: it.Status, ParentIDs: parentIDs, Path: it.PrimaryPath(),
}); ve != nil {
s.itemWriteFailure(w, r, ve)
return
}
if ve := itemwrite.ValidateAgainstStore(r.Context(), s.Store, itemwrite.Input{
ID: it.ID, Title: it.Title, Slug: it.Slug, Status: it.Status, ParentIDs: parentIDs, Path: it.PrimaryPath(),
}); ve != nil {
s.itemWriteFailure(w, r, ve)
return
}
moved, err := s.Store.Reparent(r.Context(), it.ID, parentIDs)
if err != nil {
s.fail(w, r, err)
return
}
if r.Header.Get("HX-Request") == "true" {
fmt.Fprintf(w, `Moved to %s filter strip
// silently dropped.
func parseValues(q url.Values, key string) []string {
if vs, ok := q[key]; ok {
return parseCSV(strings.Join(vs, ","))
}
return []string{}
}
func parseCSV(raw string) []string {
if strings.TrimSpace(raw) == "" {
return []string{}
}
seen := map[string]struct{}{}
out := []string{}
for _, part := range strings.FieldsFunc(raw, func(r rune) bool {
return r == ',' || r == ' ' || r == '\t' || r == '\n'
}) {
t := strings.ToLower(strings.TrimSpace(part))
if t == "" {
continue
}
if _, ok := seen[t]; ok {
continue
}
seen[t] = struct{}{}
out = append(out, t)
}
return out
}
func (s *Server) handleNewForm(w http.ResponseWriter, r *http.Request) {
parentPath := r.URL.Query().Get("parent")
var parent *store.Item
if parentPath != "" {
p, err := s.Store.GetByPath(r.Context(), parentPath)
if err != nil {
s.fail(w, r, err)
return
}
parent = p
}
s.render(w, r, "new", map[string]any{
"Title": "new",
"Parent": parent,
"StatusOptions": []string{"active", "done", "archived"},
})
}
func (s *Server) handleNewSubmit(w http.ResponseWriter, r *http.Request) {
if err := r.ParseForm(); err != nil {
s.fail(w, r, err)
return
}
kind := strings.TrimSpace(r.FormValue("kind"))
if kind == "" {
kind = "project"
}
parentIDs := r.Form["parent_ids"]
if len(parentIDs) == 0 {
if v := strings.TrimSpace(r.FormValue("parent_id")); v != "" {
parentIDs = []string{v}
}
}
parentIDs = dedupeStrings(parentIDs)
title := strings.TrimSpace(r.FormValue("title"))
slug := strings.TrimSpace(r.FormValue("slug"))
status := strings.TrimSpace(r.FormValue("status"))
// New items have no ID yet — pre-flight format checks (title/slug/status)
// then DB-aware checks (parent existence + slug collision under parents).
if ve := itemwrite.ValidateFormat(itemwrite.Input{
Title: title, Slug: slug, Status: status, ParentIDs: parentIDs,
}); ve != nil {
s.itemWriteFailure(w, r, ve)
return
}
if ve := itemwrite.ValidateAgainstStore(r.Context(), s.Store, itemwrite.Input{
Title: title, Slug: slug, Status: status, ParentIDs: parentIDs,
}); ve != nil {
s.itemWriteFailure(w, r, ve)
return
}
in := store.CreateInput{
Kind: []string{kind},
Title: title,
Slug: slug,
ParentIDs: parentIDs,
ContentMD: r.FormValue("content_md"),
Status: status,
Tags: parseCSV(r.FormValue("tags")),
Management: parseCSV(r.FormValue("management")),
}
it, err := s.Store.Create(r.Context(), in)
if err != nil {
s.fail(w, r, err)
return
}
http.Redirect(w, r, "/i/"+it.PrimaryPath(), http.StatusSeeOther)
}
func (s *Server) handleClassify(w http.ResponseWriter, r *http.Request) {
orphans, err := s.Store.MaiOrphans(r.Context())
if err != nil {
s.fail(w, r, err)
return
}
parents, err := s.parentOptions(r.Context())
if err != nil {
s.fail(w, r, err)
return
}
s.render(w, r, "classify", map[string]any{
"Title": "classify",
"Orphans": orphans,
"ParentOptions": parents,
})
}
// --- helpers ---
// ParentOption is a flat option for the parent .
type ParentOption struct {
ID string
Path string
}
func (s *Server) parentOptions(ctx context.Context) ([]ParentOption, error) {
items, err := s.Store.ListAll(ctx)
if err != nil {
return nil, err
}
return parentOptionsFromItems(items), nil
}
// parentOptionsFromItems builds the same flat option list parentOptions
// returns, but from an already-loaded items slice. Callers that have already
// fetched items (handleTree, handleDashboard, …) use this to avoid a second
// ListAll round-trip when they only need the picker options.
func parentOptionsFromItems(items []*store.Item) []ParentOption {
out := make([]ParentOption, 0, len(items))
for _, it := range items {
out = append(out, ParentOption{ID: it.ID, Path: it.PrimaryPath()})
}
sort.Slice(out, func(i, j int) bool { return out[i].Path < out[j].Path })
return out
}
// (buildForest + nodeHasAllTags removed in Phase 3b — superseded by
// applyTreeFilter in tree_filter.go which handles every filter dimension.)
// render writes the named page to w, looking up the user's chosen theme from
// the projax_theme cookie on r so the layout's `` and
// `