UpdateFields updates arbitrary fields on an article row (inside a tx).

UpdatePollFields patches poll scalar columns inside a tx.

UpdateRoomLastMessage refreshes chat_room.last_message_* fields.

UpdateStatus sets the status column (0 = valid, 1 = expired).

UserCollectionIDsForGalgame returns the ids of the user's collections that currently contain the galgame.

Users returns a map of id -> User. Missing IDs are absent (not nil entries). Order is irrelevant; caller looks up by id. The function transparently:

aggregate folds per-link verdicts into the resource-level verdict. See CheckShare for the rules. Split out so the conservative logic is unit-tested.

────────────────────────────────────────── Shared helpers ──────────────────────────────────────────

applyGameTypeFilter narrows to galgames classified as a given WORK type by their raters. The type lives in galgame_rating.galgame_type — a JSONB array

applyRatingFilter adds the advanced rating WHEREs. minRatingCount is a high-confidence gate (only games with enough votes); minRating filters on the s

applyReleaseFilter adds inclusive release_date bounds when present. Bounds are pre-resolved "YYYY-MM-DD" strings (PG casts the literal to date). Setti

applyTransforms runs the post-render HTML rewrites (code/table/spoiler/video wrappers) and the single server-side sanitization pass shared by every re

buildListQuery returns a pre-filtered *gorm.DB with `status != 1` applied.

buildReactionSummaries turns the windowed rows for ONE target + the viewer's own keys + a hydrated user map into ordered DTO summaries — each carries

cacheResult best-effort stores the enriched result with activityCacheTTL. A redis/marshal failure is ignored — caching must never break the response.

cachedBatch serves a per-(id,sfw) TTL cache over a batch fetch: returns the hits, calls `fetch` for ONLY the misses, then caches the results — includi

callPatchAuthMe is the shared post-validation path for UpdateBio / UpdateUsername. Pulls the access token, calls the OAuth client, and hands errors ba

canViewResults returns true if the caller is allowed to see vote counts / voter identities according to the poll's result_visibility setting.

clearReplyReaction removes the user's `reaction` on a reply if present (like⇄ dislike exclusion), reversing the like count + moemoepoint for a 'like'.

clearTopicReaction removes the user's `reaction` if present (for like⇄dislike exclusion), reversing the like count + moemoepoint when it was a 'like'.

collectCategoryIDs returns the unique category IDs from a slice of rows.

collectWebsiteIDs returns the IDs from a slice of website rows.

contains is a thin wrapper so the test reads as English prose.

contentImageHash extracts the base 64-hex content hash from a /image/<hash> token, ignoring any _variant suffix (every variant of a hash shares the ma

U2: cover/screenshot row mappers. Plain field-by-field copy — wire shape is identical (snake_case JSON tags); the wrappers exist so the frontend-expos

decodeCursor parses an opaque cursor into a repository.Cursor. Empty → nil (first page). A malformed cursor also → nil: a stale/garbage token just res

decodeProviderNames safely turns the row's jsonb provider_name bytes into a string slice. A null/empty/invalid value yields an empty slice rather than

────────────────────────────────────────── small int-set helpers ──────────────────────────────────────────

doJSONWithToken is do/doJSON but authenticates as the END USER (Bearer) rather than the client-credentials Basic header — for acting-on-behalf-of- use

enrichAndHydrate runs the full row → item pipeline: galgame name/brief enrichment (which drops brief-missing rows), topic rich-card enrichment, then O

────────────────────────────────────────── Internal helpers ──────────────────────────────────────────

────────────────────────────────────────── Helpers ────────────────────────────────────────── findOrCreatePrivateRoom returns the (roomID, roomName) f

findReactionStatus resolves which of `ids` the user reacted to with `reaction` in `table` (the reaction-aware sibling of findInteractionStatus; shared

getCachedResult returns a cached activity Result, and true on a hit. Fail-open: redis.Nil (miss) or ANY error (redis down, bad JSON) is treated as a m

groupResourceMeta bucketises rows from galgame_resource into per-galgame platform/language sets (preserving insertion order + dedup).

────────────────────────────────────────── Row → item assembly ──────────────────────────────────────────

intArrayLit renders an int slice as a Postgres array literal ("{1,2,3}", or "{}" for empty) for `= ANY(?::int[])` — one bound param instead of an N-pl

mapListRows enriches topic card rows with tags+sections and maps to DTOs. Identity (UserName/UserAvatar) is hydrated from OAuth via userclient since k

mapOAuthError translates an *oauth.Error into the kungal AppError shape so the response keeps its standard {code, message, data} envelope. OAuth's env

marshalDomain produces a jsonb-compatible payload for the website's alternate-domain list. The column is a jsonb default '[]', so we always emit a JSO

newGoldmark builds a goldmark instance with the project's shared extension / parser config. hardWraps adds html.WithHardWraps() so a single newline re

normalizeCoverImages validates the incoming cover tokens, drops duplicates (keeping first-seen order), and returns them ready to persist. A malformed

parseCollectionPage reads page/limit with sane defaults (page>=1, 1<=limit<=50).

postEnvelope POSTs a JSON-serialized payload to OAuth and decodes the standard envelope. Used by ExchangeCode and RefreshOAuthToken — both hit /oauth/

recount sets parentTable.countCol = COUNT(child rows) for the given surviving parent ids. Identifiers are caller-owned constants — never user input —

refreshSession is the lock-winner path: actually call OAuth, mutate the passed-in session in place, and write the result back to Redis. Failure branc

renewSlidingSession implements the rolling half of the session-timeout model: while the user is active it slides the cookie + Redis TTL forward, so a

replyPlainPreview is the reply's markdown-stripped content, used for pin-reply solution notification previews. (The Phase-4 migration folded legacy mu

resolveAvatarURL maps a user's avatar to a render-ready URL. The new avatar pipeline (POST /auth/me/avatar) writes only `avatar_image_hash` and leaves

resolveBannerURL prefers the content-addressed hash (image_service) and falls back to the legacy free-form Banner URL while the migration is in flight

rowToDownloadDetail maps a resource row + links + liked flag + owner to the rowToMeta shapes the credential-free metadata returned by the page endpoin

rowToScores pulls the per-axis scores off a rating row.

sanitizeViewerIDs de-dups and drops the owner (implicitly always a viewer).

────────────────────────────────────────── Shared slice/CSV utilities ──────────────────────────────────────────

translateValidationErrors converts validator errors to user-friendly Chinese messages, avoiding exposure of internal struct/field names.

────────────────────────────────────────── Helpers ────────────────────────────────────────── trimNonEmpty trims whitespace from each string and drops

waitForRefresh is the lock-loser path. Another request is currently refreshing this user's token; instead of racing through with the stale access toke

websiteCardsFromRows maps slim website rows to WebsiteCard DTOs given the pre-loaded category-name and tag-level-sum maps. Both maps may be nil / emp