files.controller.ts

files.controller.tsapps/api/src/modules/files/files.controller.tsraw ← files5,049 B← Back to the app
1import { Body, Controller, Delete, Get, Inject, Param, Patch, Post, Put, Query, Req, Res } from "@nestjs/common";
2import type { Request, Response } from "express";
3import { FilesService } from "./files.service.js";
4import { ZodValidate } from "../../common/pipes/zod-validation.pipe.js";
5import { requireActor } from "../../common/types.js";
6import {
7  ListFilesQuery,
8  type ListFilesInput,
9  RenameFileDto,
10  type RenameFileInput,
11  RollbackFileDto,
12  type RollbackFileInput,
13  SetPermissionsDto,
14  type SetPermissionsInput,
15} from "./dto.js";
16 
17/**
18 * TASK-0101/0103/0104 — files:
19 *   reads    GET /files (list) · GET /files/:id (detail) · GET /files/:id/download
20 *            GET /files/:id/preview · PATCH /files/:id (rename)
21 *   versions GET /files/:id/versions · POST /files/:id/rollback
22 *            POST /files/:id/versions/prune (delete old versions)
23 *   trash    GET /files/trash · DELETE /files/:id (soft) · DELETE /files/:id?purge=true
24 *            POST /files/:id/restore
25 *   perms    GET /files/:id/permissions · PUT /files/:id/permissions
26 *
27 * ROUTE ORDER: `files/trash` MUST be declared before `files/:id` — the router
28 * matches in registration order, otherwise "trash" is captured as an id.
29 *
30 * `download`/`preview` redirect via the raw Express response — the global
31 * exception filter would otherwise JSON-encode every thrown error, which is
32 * exactly what we want for permission failures (403 envelope + audit), but a
33 * 302 must reach the client as a real redirect.
34 */
35@Controller()
36export class FilesController {
37  constructor(@Inject(FilesService) private readonly files: FilesService) {}
38 
39  @Get("files")
40  list(@Query(ZodValidate(ListFilesQuery)) query: ListFilesInput, @Req() req: Request) {
41    const workspaceId = req.auth?.workspaceId;
42    if (!workspaceId) {
43      return { data: [], nextCursor: null };
44    }
45    return this.files.list(workspaceId, requireActor(req), query);
46  }
47 
48  /** TASK-0104 — workspace trash (deletedAt set). BEFORE `files/:id`. */
49  @Get("files/trash")
50  trash(@Req() req: Request) {
51    const workspaceId = req.auth?.workspaceId;
52    if (!workspaceId) return [];
53    return this.files.trashList(workspaceId, requireActor(req));
54  }
55 
56  @Get("files/:id")
57  get(@Param("id") id: string, @Req() req: Request) {
58    return this.files.get(id, requireActor(req), req);
59  }
60 
61  @Get("files/:id/download")
62  download(@Param("id") id: string, @Req() req: Request, @Res() res: Response) {
63    // A rejection (403/404/410/415) propagates to the global exception
64    // filter, which writes the canonical envelope — nothing is sent to the
65    // socket before that point, so the redirect and the error paths are
66    // mutually exclusive.
67    return this.files
68      .download(id, requireActor(req), req)
69      .then((r) => res.redirect(302, r.location));
70  }
71 
72  @Get("files/:id/preview")
73  preview(@Param("id") id: string, @Req() req: Request, @Res() res: Response) {
74    return this.files
75      .preview(id, requireActor(req), req)
76      .then((r) => res.redirect(302, r.location));
77  }
78 
79  /** TASK-0104 — version list. */
80  @Get("files/:id/versions")
81  versions(@Param("id") id: string, @Req() req: Request) {
82    return this.files.versions(id, requireActor(req), req);
83  }
84 
85  /** TASK-0104 — make version n current (key swap). */
86  @Post("files/:id/rollback")
87  rollback(
88    @Param("id") id: string,
89    @Body(ZodValidate(RollbackFileDto)) body: RollbackFileInput,
90    @Req() req: Request,
91  ) {
92    return this.files.rollback(id, requireActor(req), body, req);
93  }
94 
95  /** TASK-0104 — delete old versions (admin "Delete old versions"). */
96  @Post("files/:id/versions/prune")
97  prune(@Param("id") id: string, @Req() req: Request) {
98    return this.files.deleteOldVersions(id, requireActor(req), req);
99  }
100 
101  /** TASK-0104 — trash (soft) or purge (hard, `?purge=true`). */
102  @Delete("files/:id")
103  remove(@Param("id") id: string, @Query("purge") purge: string | undefined, @Req() req: Request) {
104    return this.files.remove(id, requireActor(req), req, purge === "true" || purge === "1");
105  }
106 
107  /** TASK-0104 — restore from trash. */
108  @Post("files/:id/restore")
109  restore(@Param("id") id: string, @Req() req: Request) {
110    return this.files.restore(id, requireActor(req), req);
111  }
112 
113  /** TASK-0104 — file-level permission overrides (list). */
114  @Get("files/:id/permissions")
115  listPermissions(@Param("id") id: string, @Req() req: Request) {
116    return this.files.listPermissions(id, requireActor(req), req);
117  }
118 
119  /** TASK-0104 — file-level permission overrides (replace). */
120  @Put("files/:id/permissions")
121  setPermissions(
122    @Param("id") id: string,
123    @Body(ZodValidate(SetPermissionsDto)) body: SetPermissionsInput,
124    @Req() req: Request,
125  ) {
126    return this.files.setPermissions(id, requireActor(req), body, req);
127  }
128 
129  @Patch("files/:id")
130  rename(
131    @Param("id") id: string,
132    @Body(ZodValidate(RenameFileDto)) body: RenameFileInput,
133    @Req() req: Request,
134  ) {
135    return this.files.rename(id, requireActor(req), body, req);
136  }
137}
138