Method requireOwnedReview

internal/httpapi/reviews.go:127–136

requireOwnedReview resolves a held message by id, scoped to the account, and returns it (404 if it isn't a hold the account owns). The ownership check is the tenant guard for the id-only review routes.

(ctx context.Context, userID, id string)

// returns it (404 if it isn't a hold the account owns). The ownership check is
// the tenant guard for the id-only review routes.
func (s *Server) requireOwnedReview(ctx context.Context, userID, id string) (*identity.Message, error) {
	if s.deps.GetReviewWithContent == nil {
		return nil, NewError(http.StatusNotImplemented, "not_implemented", "reviews are not available on this deployment")
	}
	msg, err := s.deps.GetReviewWithContent(ctx, userID, id)
	if err != nil || msg == nil {
		return nil, NewError(http.StatusNotFound, "not_found", "review not found")
	}
	return msg, nil
}

func (s *Server) handleGetReview(ctx context.Context, in *getReviewInput) (*reviewDetailOutput, error) {
	p, err := s.requireAccountScope(ctx)