Method handleCreateComment

internal/server/handlers_comments.go:65–133

handleCreateComment adds a new comment to an item.

(w http.ResponseWriter, r *http.Request)

// handleCreateComment adds a new comment to an item.
func (s *Server) handleCreateComment(w http.ResponseWriter, r *http.Request) {
	workspaceID, ok := s.getWorkspaceID(w, r)
	if !ok {
		return
	}

	itemSlug := chi.URLParam(r, "itemSlug")
	item, err := s.store.ResolveItem(workspaceID, itemSlug)
	if err != nil {
		writeInternalError(w, err)
		return
	}
	if item == nil {
		s.writeItemResolveError(w, r, workspaceID, itemSlug)
		return
	}
	if !s.requireItemVisible(w, r, workspaceID, item) {
		return
	}
	// Check edit permission (grant-aware for guests)
	if !s.requireEditPermission(w, r, workspaceID, item.ID, item.CollectionID) {
		return
	}

	var input models.CommentCreate
	if err := decodeJSON(r, &input); err != nil {
		writeError(w, http.StatusBadRequest, "bad_request", err.Error())
		return
	}

	if input.Body == "" {
		writeError(w, http.StatusBadRequest, "bad_request", "body is required")
		return
	}

	// Set author from authenticated user if available
	if u := currentUser(r); u != nil && input.Author == "" {
		input.Author = u.Name
	}

	// Derive actor/source from auth context
	actor, source := actorFromRequest(r)
	if input.CreatedBy == "" {
		input.CreatedBy = actor
	}
	if input.Source == "" {
		input.Source = source
	}

	// Log activity first so we can link the comment to the activity record.
	// This prevents duplicate timeline entries (one for the comment, one for the activity).
	// Only set ActivityID on success — comments.activity_id has a FK constraint,
	// and CreateActivity returns an ID even on insert failure.
	if activityID, err := s.logActivityWithMetaReturningID(workspaceID, item.ID, "commented", r, ""); err == nil && activityID != "" {
		input.ActivityID = activityID
	}

	comment, err := s.store.CreateComment(workspaceID, item.ID, currentUserID(r), input)