diff --git a/backend/src/controllers/studentMaterialsController.js b/backend/src/controllers/studentMaterialsController.js index 69f674c..a7cca86 100644 --- a/backend/src/controllers/studentMaterialsController.js +++ b/backend/src/controllers/studentMaterialsController.js @@ -45,6 +45,22 @@ function create(req, res) { res.status(201).json({ id: Number(r.lastInsertRowid) }); } +/* PATCH /api/materials/:id — rename / edit one of the current user's items. + Editable: title, body. (collection_id/tags wired in a later phase.) */ +function update(req, res) { + const row = db.prepare('SELECT user_id FROM student_materials WHERE id = ?').get(req.params.id); + if (!row) return res.status(404).json({ error: 'not found' }); + if (row.user_id !== req.user.id) return res.status(403).json({ error: 'forbidden' }); + const b = req.body || {}; + const fields = [], args = []; + if (b.title !== undefined) { fields.push('title = ?'); args.push(String(b.title || '').slice(0, 300)); } + if (b.body !== undefined) { fields.push('body = ?'); args.push(b.body != null ? String(b.body).slice(0, 60000) : null); } + if (!fields.length) return res.json({ ok: true }); + args.push(req.params.id); + db.prepare(`UPDATE student_materials SET ${fields.join(', ')} WHERE id = ?`).run(...args); + res.json({ ok: true }); +} + /* DELETE /api/materials/:id — remove one of the current user's items */ function remove(req, res) { const row = db.prepare('SELECT user_id FROM student_materials WHERE id = ?').get(req.params.id); @@ -54,4 +70,4 @@ function remove(req, res) { res.json({ ok: true }); } -module.exports = { list, create, remove }; +module.exports = { list, create, update, remove }; diff --git a/backend/src/routes/materials.js b/backend/src/routes/materials.js index 3297d32..e728a97 100644 --- a/backend/src/routes/materials.js +++ b/backend/src/routes/materials.js @@ -9,6 +9,8 @@ router.use(authMiddleware); router.get('/', c.list); router.post('/', c.create); // @public-by-design: router-level authMiddleware (above) + per-row ownership check in handler +router.patch('/:id', c.update); +// @public-by-design: router-level authMiddleware (above) + per-row ownership check in handler router.delete('/:id', c.remove); module.exports = router; diff --git a/frontend/my-materials.html b/frontend/my-materials.html index 06178a8..0d71952 100644 --- a/frontend/my-materials.html +++ b/frontend/my-materials.html @@ -39,6 +39,7 @@