u

src/api/routes/article.js

@@ -2,6 +2,7 @@ import express from 'express';
 import * as db from '../../db/article.js';
 
 const AVIF_BODY_LIMIT = '20mb';
+const FULL_HASH_RE = /^[a-fA-F0-9]{64}$/;
 
 function parsePositiveInt(value, field) {
     const id = Number(value);
@@ -11,11 +12,27 @@ function parsePositiveInt(value, field) {
     return { id };
 }
 
+function parseSku(value) {
+    const sku = typeof value === 'string' ? value.trim() : '';
+    if (!sku) return { error: 'sku is required' };
+    return { sku: decodeURIComponent(sku) };
+}
+
+function parseFullHash(value) {
+    const fullHash = typeof value === 'string' ? value.trim() : '';
+    if (!FULL_HASH_RE.test(fullHash)) {
+        return { error: 'fullHash must be a 64-char hex SHA-256' };
+    }
+    return { fullHash: fullHash.toLowerCase() };
+}
+
 function articleErrorStatus(error) {
     if (error.message === 'Not authorized') return 403;
     if (error.message === 'Parent not found') return 404;
     if (error.message === 'Article not found') return 404;
+    if (error.message === 'Image not found') return 404;
     if (error.message === 'Name required') return 400;
+    if (error.message === 'Invalid image order') return 400;
     return 500;
 }
 
@@ -347,4 +364,176 @@ export function register(app, basePath = '') {
             }
         },
     );
+
+    /**
+     * @openapi
+     * /article/{sku}/image/{fullHash}:
+     *   delete:
+     *     tags: [Article]
+     *     summary: Delete article image
+     *     description: Removes `articlepic` and the `pic` row for this article (`fullHash`). Auth like GET by SKU.
+     *     security:
+     *       - cookieAuth: []
+     *     x-markdown: article/delete-image.md
+     *     parameters:
+     *       - in: path
+     *         name: sku
+     *         required: true
+     *         schema:
+     *           type: string
+     *       - in: path
+     *         name: fullHash
+     *         required: true
+     *         schema:
+     *           type: string
+     *           pattern: '^[a-fA-F0-9]{64}$'
+     *     responses:
+     *       204:
+     *         description: Deleted
+     *       400:
+     *         description: Invalid hash
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       401:
+     *         description: Unauthorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       403:
+     *         description: Not authorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       404:
+     *         description: Article or image not found
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     */
+    app.delete(`${basePath}/article/:sku/image/:fullHash`, async (req, res) => {
+        const skuParsed = parseSku(req.params.sku);
+        if (skuParsed.error) {
+            return res.status(400).json({ error: skuParsed.error });
+        }
+        const hashParsed = parseFullHash(req.params.fullHash);
+        if (hashParsed.error) {
+            return res.status(400).json({ error: hashParsed.error });
+        }
+
+        try {
+            await db.deleteImage(req.user.id, skuParsed.sku, hashParsed.fullHash);
+            res.sendStatus(204);
+        } catch (error) {
+            const status = articleErrorStatus(error);
+            if (status === 500) console.error('Delete article image failed:', error);
+            res.status(status).json({ error: error.message });
+        }
+    });
+
+    /**
+     * @openapi
+     * /article/{sku}/images/order:
+     *   put:
+     *     tags: [Article]
+     *     summary: Reorder article images
+     *     description: |
+     *       Sets `articlepic.sort` to `0..n-1` in the given order.
+     *       `fullHashes` must list every image of the article exactly once.
+     *     security:
+     *       - cookieAuth: []
+     *     x-markdown: article/order-images.md
+     *     parameters:
+     *       - in: path
+     *         name: sku
+     *         required: true
+     *         schema:
+     *           type: string
+     *     requestBody:
+     *       required: true
+     *       content:
+     *         application/json:
+     *           schema:
+     *             type: object
+     *             required: [fullHashes]
+     *             properties:
+     *               fullHashes:
+     *                 type: array
+     *                 items:
+     *                   type: string
+     *                   pattern: '^[a-fA-F0-9]{64}$'
+     *             example:
+     *               fullHashes:
+     *                 - "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+     *                 - "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
+     *     responses:
+     *       200:
+     *         description: New order
+     *         content:
+     *           application/json:
+     *             schema:
+     *               type: object
+     *               properties:
+     *                 fullHashes:
+     *                   type: array
+     *                   items:
+     *                     type: string
+     *       400:
+     *         description: Invalid image order
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       401:
+     *         description: Unauthorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       403:
+     *         description: Not authorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       404:
+     *         description: Article not found
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     */
+    app.put(`${basePath}/article/:sku/images/order`, async (req, res) => {
+        const skuParsed = parseSku(req.params.sku);
+        if (skuParsed.error) {
+            return res.status(400).json({ error: skuParsed.error });
+        }
+
+        const rawHashes = req.body?.fullHashes;
+        if (!Array.isArray(rawHashes)) {
+            return res.status(400).json({ error: 'fullHashes is required' });
+        }
+
+        const fullHashes = [];
+        for (const value of rawHashes) {
+            const parsed = parseFullHash(value);
+            if (parsed.error) {
+                return res.status(400).json({ error: parsed.error });
+            }
+            fullHashes.push(parsed.fullHash);
+        }
+
+        try {
+            const result = await db.orderImages(req.user.id, skuParsed.sku, { fullHashes });
+            res.status(200).json(result);
+        } catch (error) {
+            const status = articleErrorStatus(error);
+            if (status === 500) console.error('Order article images failed:', error);
+            res.status(status).json({ error: error.message });
+        }
+    });
 }