@@ -49,18 +49,18 @@ func createMessage(w http.ResponseWriter, r *http.Request) {
4949 http .Error (w , `{"error":"invalid json"}` , http .StatusBadRequest )
5050 return
5151 }
52- // determine caller role and canonical author
53- // resolve canonical author (from signature, or backend-provided body/header)
54- if author , code , msg := auth .ResolveAuthorFromRequest (r , m .Author ); code != 0 {
55- http .Error (w , msg , code )
56- return
57- } else {
58- m .Author = author
59- }
60- // Ensure message role is present. Default to "user" when omitted.
61- if m .Role == "" {
62- m .Role = "user"
63- }
52+ // determine caller role and canonical author
53+ // resolve canonical author (from signature, or backend-provided body/header)
54+ if author , code , msg := auth .ResolveAuthorFromRequest (r , m .Author ); code != 0 {
55+ http .Error (w , msg , code )
56+ return
57+ } else {
58+ m .Author = author
59+ }
60+ // Ensure message role is present. Default to "user" when omitted.
61+ if m .Role == "" {
62+ m .Role = "user"
63+ }
6464 // Always generate server-side IDs for messages to avoid client-side impersonation
6565 if m .Thread == "" {
6666 m .Thread = utils .GenThreadID ()
@@ -185,18 +185,18 @@ func updateMessage(w http.ResponseWriter, r *http.Request) {
185185 http .Error (w , `{"error":"invalid json"}` , http .StatusBadRequest )
186186 return
187187 }
188- m .ID = id
189- // determine caller role and canonical author
190- if author , code , msg := auth .ResolveAuthorFromRequest (r , m .Author ); code != 0 {
191- http .Error (w , msg , code )
192- return
193- } else {
194- m .Author = author
195- }
196- // Ensure role is present; default to "user" if omitted
197- if m .Role == "" {
198- m .Role = "user"
199- }
188+ m .ID = id
189+ // determine caller role and canonical author
190+ if author , code , msg := auth .ResolveAuthorFromRequest (r , m .Author ); code != 0 {
191+ http .Error (w , msg , code )
192+ return
193+ } else {
194+ m .Author = author
195+ }
196+ // Ensure role is present; default to "user" if omitted
197+ if m .Role == "" {
198+ m .Role = "user"
199+ }
200200 if m .Thread == "" {
201201 m .Thread = utils .GenThreadID ()
202202 }
@@ -244,17 +244,17 @@ func deleteMessage(w http.ResponseWriter, r *http.Request) {
244244 http .Error (w , `{"error":"invalid stored message"}` , http .StatusInternalServerError )
245245 return
246246 }
247- // verify author owns the message (or is admin)
248- author , code , msg := auth .ResolveAuthorFromRequest (r , "" )
249- if code != 0 {
250- http .Error (w , msg , code )
251- return
252- }
253- role := r .Header .Get ("X-Role-Name" )
254- if role != "admin" && m .Author != author {
255- http .Error (w , `{"error":"author does not match"}` , http .StatusForbidden )
256- return
257- }
247+ // verify author owns the message (or is admin)
248+ author , code , msg := auth .ResolveAuthorFromRequest (r , "" )
249+ if code != 0 {
250+ http .Error (w , msg , code )
251+ return
252+ }
253+ role := r .Header .Get ("X-Role-Name" )
254+ if role != "admin" && m .Author != author {
255+ http .Error (w , `{"error":"author does not match"}` , http .StatusForbidden )
256+ return
257+ }
258258 m .Deleted = true
259259 m .TS = time .Now ().UTC ().UnixNano ()
260260 b , _ := json .Marshal (m )
@@ -288,7 +288,6 @@ func listMessageVersions(w http.ResponseWriter, r *http.Request) {
288288 }{ID : id , Versions : out })
289289}
290290
291-
292291// getReactions handles GET /messages/{id}/reactions to list all reactions for a message.
293292// Path parameter: "id" (string, required): message ID.
294293// Response: 200 with JSON object {id, reactions}, or 404/500 on error.
0 commit comments