feat: enhance Admin and report services with CRUD operations and intervention links

services/ReportService.cc

@@ -1,5 +1,6 @@
 #include "services/ReportService.h"
 
+#include "common/Crypto.h"
 #include "common/GeoJson.h"
 #include "common/Validation.h"
 #include "repositories/Sql.h"
@@ -11,6 +12,7 @@
 #include <set>
 #include <sstream>
 #include <algorithm>
+#include <cctype>
 
 namespace visione::services
 {
@@ -34,6 +36,14 @@ Json::Value success()
     return body;
 }
 
+Json::Value successWithLink(const std::string &url, const std::string &expiresAt)
+{
+    auto body = success();
+    body["url"] = url;
+    body["expires_at"] = expiresAt;
+    return body;
+}
+
 bool isAllowedStatus(const std::string &status)
 {
     static const std::set<std::string> statuses = {
@@ -56,6 +66,15 @@ bool canTransition(const std::string &from, const std::string &to)
     return it != transitions.end() && it->second.contains(to);
 }
 
+std::string maskedLastName(const std::string &lastName)
+{
+    if (lastName.empty())
+    {
+        return {};
+    }
+    return std::string(1, static_cast<char>(std::toupper(lastName.front()))) + ".";
+}
+
 std::optional<long long> findArea(double latitude, double longitude)
 {
     const auto result = drogon::app().getDbClient()->execSqlSync(
@@ -109,6 +128,27 @@ bool canModifyReport(const auth::UserContext &user, long long reportId)
     return !result.empty();
 }
 
+bool canOwnOrModifyReport(const auth::UserContext &user, long long reportId)
+{
+    if (auth::isAdmin(user))
+    {
+        return true;
+    }
+    if (!auth::canOperateReports(user))
+    {
+        return false;
+    }
+    const auto result = drogon::app().getDbClient()->execSqlSync(
+        "SELECT assigned_operator_id FROM reports WHERE id = ?",
+        reportId);
+    if (result.empty())
+    {
+        return false;
+    }
+    return result[0]["assigned_operator_id"].isNull() ||
+           result[0]["assigned_operator_id"].as<long long>() == user.id;
+}
+
 bool canFlagReportContent(const auth::UserContext &user, long long reportId)
 {
     if (!auth::canOperateReports(user))
@@ -260,6 +300,27 @@ std::optional<long long> assignedOperator(long long reportId)
     return rows[0]["assigned_operator_id"].as<long long>();
 }
 
+std::optional<long long> activeAssignmentId(long long reportId)
+{
+    const auto rows = drogon::app().getDbClient()->execSqlSync(
+        "SELECT id FROM assignments WHERE report_id = ? AND ended_at IS NULL "
+        "ORDER BY assigned_at DESC LIMIT 1",
+        reportId);
+    if (rows.empty())
+    {
+        return std::nullopt;
+    }
+    return rows[0]["id"].as<long long>();
+}
+
+void revokeActiveLinksForReport(long long reportId)
+{
+    drogon::app().getDbClient()->execSqlSync(
+        "UPDATE intervention_access_links SET revoked_at = NOW() "
+        "WHERE report_id = ? AND revoked_at IS NULL AND expires_at > NOW()",
+        reportId);
+}
+
 void notifyReportOwner(long long reportId,
                        const std::string &type,
                        const std::string &title,
@@ -271,6 +332,50 @@ void notifyReportOwner(long long reportId,
         UserService::createNotification(*owner, type, title, body, reportId);
     }
 }
+
+Json::Value buildInterventionSummaryRow(const drogon::orm::Row &row,
+                                        const drogon::orm::Result &mediaRows,
+                                        const drogon::orm::Result &messageRows,
+                                        bool publicView)
+{
+    auto response = success();
+    Json::Value summary = repositories::rowToJson(row, reportSchema());
+    summary["category_name"] = row["category_name"].as<std::string>();
+    if (!row["area_name"].isNull())
+    {
+        summary["area_name"] = row["area_name"].as<std::string>();
+    }
+    if (!row["assigned_team_name"].isNull())
+    {
+        summary["assigned_team_name"] = row["assigned_team_name"].as<std::string>();
+    }
+    if (publicView)
+    {
+        summary["citizen_name"] = row["first_name"].as<std::string>() + " " +
+                                  maskedLastName(row["last_name"].as<std::string>());
+        if (!row["phone"].isNull())
+        {
+            summary["phone"] = row["phone"].as<std::string>();
+        }
+        response["summary"] = std::move(summary);
+        response["media"] = repositories::resultToJson(mediaRows, reportMediaSchema());
+        response["latest_messages"] =
+            repositories::resultToJson(messageRows, messageSchema());
+        return response;
+    }
+    summary["first_name"] = row["first_name"].as<std::string>();
+    summary["last_name"] = row["last_name"].as<std::string>();
+    if (!row["phone"].isNull())
+    {
+        summary["phone"] = row["phone"].as<std::string>();
+    }
+    summary["email"] = row["email"].as<std::string>();
+    response["summary"] = std::move(summary);
+    response["media"] = repositories::resultToJson(mediaRows, reportMediaSchema());
+    response["latest_messages"] =
+        repositories::resultToJson(messageRows, messageSchema());
+    return response;
+}
 }  // namespace
 
 Json::Value ReportService::createReport(const auth::UserContext &user,
@@ -493,6 +598,44 @@ Json::Value ReportService::otherOperatorReports(
     return pagedReportResponse(result, pageValue, perPageValue);
 }
 
+Json::Value ReportService::listCategories(const auth::UserContext &user)
+{
+    if (user.id == 0)
+    {
+        return failure("forbidden");
+    }
+    auto response = success();
+    response["categories"] = repositories::resultToJson(
+        drogon::app().getDbClient()->execSqlSync(
+            "SELECT * FROM report_categories WHERE active = TRUE ORDER BY name"));
+    return response;
+}
+
+Json::Value ReportService::listAreas()
+{
+    auto response = success();
+    response["areas"] = repositories::resultToJson(
+        drogon::app().getDbClient()->execSqlSync(
+            "SELECT * FROM areas WHERE active = TRUE ORDER BY name"));
+    return response;
+}
+
+Json::Value ReportService::listOperatorTeams(const auth::UserContext &user)
+{
+    if (!auth::canManageReports(user))
+    {
+        return failure("forbidden");
+    }
+    auto response = success();
+    response["teams"] = repositories::resultToJson(
+        drogon::app().getDbClient()->execSqlSync(
+            "SELECT t.*, tc.name AS category_name, a.name AS area_name "
+            "FROM teams t JOIN team_categories tc ON tc.id = t.team_category_id "
+            "LEFT JOIN areas a ON a.id = t.area_id "
+            "WHERE t.active = TRUE ORDER BY t.name"));
+    return response;
+}
+
 Json::Value ReportService::reportDetail(const auth::UserContext &user,
                                         long long reportId)
 {
@@ -549,19 +692,64 @@ Json::Value ReportService::interventionSummary(const auth::UserContext &user,
     {
         return failure("report_not_found");
     }
-    auto response = success();
-    response["summary"] = repositories::rowToJson(report[0], reportSchema());
-    response["media"] = repositories::resultToJson(db->execSqlSync(
+    return buildInterventionSummaryRow(report[0],
+                                       db->execSqlSync(
         "SELECT * FROM report_photos WHERE report_id = ? ORDER BY id",
         reportId),
-        reportMediaSchema());
-    response["latest_messages"] = repositories::resultToJson(db->execSqlSync(
+                                       db->execSqlSync(
         "SELECT m.id, m.user_id, u.first_name, u.last_name, m.body, m.created_at "
         "FROM messages m JOIN users u ON u.id = m.user_id "
         "WHERE m.report_id = ? ORDER BY m.created_at DESC LIMIT 5",
         reportId),
-        messageSchema());
-    return response;
+                                       false);
+}
+
+Json::Value ReportService::publicInterventionSummary(const std::string &token)
+{
+    auto db = drogon::app().getDbClient();
+    const auto rows = db->execSqlSync(
+        "SELECT l.report_id "
+        "FROM intervention_access_links l "
+        "WHERE l.token_hash = ? AND l.revoked_at IS NULL AND l.expires_at > NOW() "
+        "LIMIT 1",
+        crypto::hashSecret(token));
+    if (rows.empty())
+    {
+        return failure("intervention_link_not_found");
+    }
+    const auto reportId = rows[0]["report_id"].as<long long>();
+    const auto report = db->execSqlSync(
+        "SELECT r.*, c.name AS category_name, a.name AS area_name, "
+        "u.first_name, u.last_name, u.phone, "
+        "t.name AS assigned_team_name "
+        "FROM reports r "
+        "JOIN users u ON u.id = r.user_id "
+        "JOIN report_categories c ON c.id = r.category_id "
+        "LEFT JOIN areas a ON a.id = r.area_id "
+        "LEFT JOIN assignments ass ON ass.report_id = r.id AND ass.ended_at IS NULL "
+        "LEFT JOIN teams t ON t.id = ass.team_id "
+        "WHERE r.id = ?",
+        reportId);
+    if (report.empty())
+    {
+        return failure("intervention_link_not_found");
+    }
+    db->execSqlSync(
+        "UPDATE intervention_access_links SET last_accessed_at = NOW() "
+        "WHERE token_hash = ?",
+        crypto::hashSecret(token));
+    return buildInterventionSummaryRow(report[0],
+                                       db->execSqlSync(
+        "SELECT * FROM report_photos WHERE report_id = ? ORDER BY id",
+        reportId),
+                                       db->execSqlSync(
+        "SELECT m.id, m.user_id, u.first_name, u.last_name, m.body, m.created_at "
+        "FROM messages m JOIN users u ON u.id = m.user_id "
+        "WHERE m.report_id = ? AND u.id <> ? "
+        "ORDER BY m.created_at DESC LIMIT 5",
+        reportId,
+        report[0]["user_id"].as<long long>()),
+                                       true);
 }
 
 Json::Value ReportService::updateStatus(const auth::UserContext &user,
@@ -725,31 +913,57 @@ Json::Value ReportService::assignTeam(const auth::UserContext &user,
                                       long long reportId,
                                       const Json::Value &body)
 {
-    if (!canModifyReport(user, reportId) || !validation::hasNumber(body, "team_id"))
+    if (!canOwnOrModifyReport(user, reportId))
     {
         return failure("forbidden");
     }
+    if (!validation::hasNumber(body, "team_id"))
+    {
+        return failure("invalid_team");
+    }
 
     auto db = drogon::app().getDbClient();
     const auto current = db->execSqlSync(
-        "SELECT status FROM reports WHERE id = ?",
+        "SELECT status, assigned_operator_id FROM reports WHERE id = ?",
         reportId);
     if (current.empty())
     {
         return failure("report_not_found");
     }
+    if (!auth::isAdmin(user) && !current[0]["assigned_operator_id"].isNull() &&
+        current[0]["assigned_operator_id"].as<long long>() != user.id)
+    {
+        return failure("report_owned_by_other_operator");
+    }
     const auto oldStatus = current[0]["status"].as<std::string>();
-    if (!canTransition(oldStatus, "ASSIGNED"))
+    if (oldStatus != "OPEN" && !canTransition(oldStatus, "ASSIGNED"))
     {
         return failure("invalid_status_transition");
     }
     const auto team = db->execSqlSync(
-        "SELECT id FROM teams WHERE id = ? AND active = TRUE",
+        "SELECT id, active FROM teams WHERE id = ?",
         body["team_id"].asInt64());
     if (team.empty())
     {
         return failure("team_not_found");
     }
+    if (!team[0]["active"].as<bool>())
+    {
+        return failure("invalid_reference");
+    }
+
+    if (oldStatus == "OPEN")
+    {
+        db->execSqlSync(
+            "UPDATE reports SET assigned_operator_id = ?, status = 'ASSIGNED' WHERE id = ?",
+            user.id,
+            reportId);
+    }
+    else
+    {
+        db->execSqlSync("UPDATE reports SET status = 'ASSIGNED' WHERE id = ?",
+                        reportId);
+    }
 
     db->execSqlSync(
         "UPDATE assignments SET ended_at = NOW() "
@@ -761,8 +975,6 @@ Json::Value ReportService::assignTeam(const auth::UserContext &user,
         reportId,
         body["team_id"].asInt64(),
         user.id);
-    db->execSqlSync("UPDATE reports SET status = 'ASSIGNED' WHERE id = ?",
-                    reportId);
     db->execSqlSync(
         "INSERT INTO report_status_history "
         "(report_id, old_status, new_status, changed_by_user_id, note) "
@@ -770,6 +982,7 @@ Json::Value ReportService::assignTeam(const auth::UserContext &user,
         reportId,
         oldStatus,
         user.id);
+    revokeActiveLinksForReport(reportId);
     notifyReportOwner(reportId,
                       "team_assigned",
                       "Team assigned",
@@ -895,6 +1108,92 @@ Json::Value ReportService::flagMessage(const auth::UserContext &user,
     return response;
 }
 
+Json::Value ReportService::teamSuggestions(const auth::UserContext &user,
+                                           long long reportId)
+{
+    if (!auth::canManageReports(user))
+    {
+        return failure("forbidden");
+    }
+    auto db = drogon::app().getDbClient();
+    const auto reportRows = db->execSqlSync(
+        "SELECT id, category_id, area_id FROM reports WHERE id = ?",
+        reportId);
+    if (reportRows.empty())
+    {
+        return failure("report_not_found");
+    }
+    const auto result = db->execSqlSync(
+        "SELECT t.*, tc.name AS category_name, a.name AS area_name, "
+        "CASE "
+        "  WHEN t.area_id = r.area_id THEN 'area_and_category' "
+        "  WHEN t.area_id IS NULL THEN 'category_only' "
+        "  ELSE 'fallback_global' "
+        "END AS match_reason, "
+        "CASE WHEN t.area_id = r.area_id THEN 0 "
+        "     WHEN t.area_id IS NULL THEN 1 "
+        "     ELSE 2 END AS rank_value "
+        "FROM reports r "
+        "JOIN report_category_team_categories map ON map.report_category_id = r.category_id "
+        "JOIN teams t ON t.team_category_id = map.team_category_id AND t.active = TRUE "
+        "JOIN team_categories tc ON tc.id = t.team_category_id "
+        "LEFT JOIN areas a ON a.id = t.area_id "
+        "WHERE r.id = ? AND (t.area_id = r.area_id OR t.area_id IS NULL) "
+        "ORDER BY rank_value, t.name",
+        reportId);
+
+    auto response = success();
+    response["suggestions"] = Json::arrayValue;
+    for (size_t i = 0; i < result.size(); ++i)
+    {
+        auto item = repositories::rowToJson(result[i]);
+        item["is_recommended"] = (i == 0);
+        response["suggestions"].append(std::move(item));
+    }
+    return response;
+}
+
+Json::Value ReportService::createInterventionLink(const auth::UserContext &user,
+                                                  long long reportId)
+{
+    if (!canModifyReport(user, reportId))
+    {
+        return failure("forbidden");
+    }
+    const auto assignmentId = activeAssignmentId(reportId);
+    if (!assignmentId)
+    {
+        return failure("invalid_status_transition");
+    }
+    auto token = crypto::randomToken();
+    auto db = drogon::app().getDbClient();
+    revokeActiveLinksForReport(reportId);
+    db->execSqlSync(
+        "INSERT INTO intervention_access_links "
+        "(report_id, assignment_id, token_hash, created_by_user_id, expires_at) "
+        "VALUES (?, ?, ?, ?, DATE_ADD(NOW(), INTERVAL 7 DAY))",
+        reportId,
+        *assignmentId,
+        crypto::hashSecret(token),
+        user.id);
+    const auto expiresRows = db->execSqlSync(
+        "SELECT expires_at FROM intervention_access_links WHERE token_hash = ?",
+        crypto::hashSecret(token));
+    return successWithLink("/api/v1/interventions/" + token,
+                           expiresRows[0]["expires_at"].as<std::string>());
+}
+
+Json::Value ReportService::revokeInterventionLink(const auth::UserContext &user,
+                                                  long long reportId)
+{
+    if (!canModifyReport(user, reportId))
+    {
+        return failure("forbidden");
+    }
+    revokeActiveLinksForReport(reportId);
+    return success();
+}
+
 Json::Value ReportService::openDataReports(const std::optional<std::string> &page,
                                            const std::optional<std::string> &perPage)
 {