go-crm improvements

apps/go-crm/internal/handlers/questions.go

@@ -11,6 +11,11 @@ import (
 )
 
 func ListQuestions(w http.ResponseWriter, r *http.Request) {
+	accountID, ok := requireAuth(w, r)
+	if !ok {
+		return
+	}
+
 	limit, _ := strconv.Atoi(r.URL.Query().Get("limit"))
 	offset, _ := strconv.Atoi(r.URL.Query().Get("offset"))
 	clientID, _ := strconv.ParseInt(r.URL.Query().Get("client_id"), 10, 64)
@@ -24,13 +29,13 @@ func ListQuestions(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	clients, err := db.ListClients(DB, limit, offset)
+	clients, err := db.ListClients(DB, accountID, limit, offset)
 	if err != nil {
 		http.Error(w, err.Error(), http.StatusInternalServerError)
 		return
 	}
 
-	customers, err := db.ListCustomers(DB, clientID, limit, offset)
+	customers, err := db.ListCustomers(DB, accountID, clientID, limit, offset)
 	if err != nil {
 		http.Error(w, err.Error(), http.StatusInternalServerError)
 		return
@@ -65,6 +70,11 @@ func ListQuestions(w http.ResponseWriter, r *http.Request) {
 }
 
 func CreateQuestion(w http.ResponseWriter, r *http.Request) {
+	_, ok := requireAuth(w, r)
+	if !ok {
+		return
+	}
+
 	r.ParseForm()
 	clientID, _ := strconv.ParseInt(r.FormValue("client_id"), 10, 64)
 	customerID, _ := strconv.ParseInt(r.FormValue("customer_id"), 10, 64)
@@ -86,6 +96,11 @@ func CreateQuestion(w http.ResponseWriter, r *http.Request) {
 }
 
 func ViewQuestion(w http.ResponseWriter, r *http.Request) {
+	_, ok := requireAuth(w, r)
+	if !ok {
+		return
+	}
+
 	id, _ := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
 	var q db.Question
 	err := DB.QueryRow("SELECT question_id, client_id, customer_id, question, timestamp, status, created_at FROM questions WHERE question_id = ?", id).Scan(&q.QuestionID, &q.ClientID, &q.CustomerID, &q.Question, &q.Timestamp, &q.Status, &q.CreatedAt)
@@ -99,6 +114,11 @@ func ViewQuestion(w http.ResponseWriter, r *http.Request) {
 }
 
 func UpdateQuestion(w http.ResponseWriter, r *http.Request) {
+	_, ok := requireAuth(w, r)
+	if !ok {
+		return
+	}
+
 	id, _ := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
 	r.ParseForm()
 	clientID, _ := strconv.ParseInt(r.FormValue("client_id"), 10, 64)
@@ -112,11 +132,21 @@ func UpdateQuestion(w http.ResponseWriter, r *http.Request) {
 }
 
 func DeleteQuestion(w http.ResponseWriter, r *http.Request) {
+	_, ok := requireAuth(w, r)
+	if !ok {
+		return
+	}
+
 	id, _ := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
 	DB.Exec("DELETE FROM questions WHERE question_id = ?", id)
 }
 
 func ListAnswers(w http.ResponseWriter, r *http.Request) {
+	accountID, ok := requireAuth(w, r)
+	if !ok {
+		return
+	}
+
 	limit, _ := strconv.Atoi(r.URL.Query().Get("limit"))
 	offset, _ := strconv.Atoi(r.URL.Query().Get("offset"))
 	questionID, _ := strconv.ParseInt(r.URL.Query().Get("question_id"), 10, 64)
@@ -124,7 +154,7 @@ func ListAnswers(w http.ResponseWriter, r *http.Request) {
 		limit = 20
 	}
 
-	answers, err := db.ListAnswersWithDetails(DB, questionID, limit, offset)
+	answers, err := db.ListAnswersWithDetails(DB, accountID, questionID, limit, offset)
 	if err != nil {
 		http.Error(w, err.Error(), http.StatusInternalServerError)
 		return
@@ -224,6 +254,11 @@ func ListAnswers(w http.ResponseWriter, r *http.Request) {
 }
 
 func CreateAnswer(w http.ResponseWriter, r *http.Request) {
+	accountID, ok := requireAuth(w, r)
+	if !ok {
+		return
+	}
+
 	r.ParseForm()
 	questionID, _ := strconv.ParseInt(r.FormValue("question_id"), 10, 64)
 
@@ -234,6 +269,13 @@ func CreateAnswer(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	var checkID int64
+	err = DB.QueryRow("SELECT client_id FROM clients WHERE client_id = ? AND account_id = ?", clientID, accountID).Scan(&checkID)
+	if err != nil {
+		http.Error(w, "Invalid question", http.StatusBadRequest)
+		return
+	}
+
 	answer := db.Answer{
 		ClientID:   clientID,
 		QuestionID: questionID,
@@ -252,6 +294,11 @@ func CreateAnswer(w http.ResponseWriter, r *http.Request) {
 }
 
 func ViewAnswer(w http.ResponseWriter, r *http.Request) {
+	_, ok := requireAuth(w, r)
+	if !ok {
+		return
+	}
+
 	id, _ := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
 	var a db.Answer
 	err := DB.QueryRow("SELECT answer_id, client_id, question_id, answer, timestamp, status, created_at FROM answers WHERE answer_id = ?", id).Scan(&a.AnswerID, &a.ClientID, &a.QuestionID, &a.Answer, &a.Timestamp, &a.Status, &a.CreatedAt)
@@ -265,6 +312,11 @@ func ViewAnswer(w http.ResponseWriter, r *http.Request) {
 }
 
 func UpdateAnswer(w http.ResponseWriter, r *http.Request) {
+	_, ok := requireAuth(w, r)
+	if !ok {
+		return
+	}
+
 	id, _ := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
 	r.ParseForm()
 	questionID, _ := strconv.ParseInt(r.FormValue("question_id"), 10, 64)
@@ -277,6 +329,11 @@ func UpdateAnswer(w http.ResponseWriter, r *http.Request) {
 }
 
 func DeleteAnswer(w http.ResponseWriter, r *http.Request) {
+	_, ok := requireAuth(w, r)
+	if !ok {
+		return
+	}
+
 	id, _ := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
 	DB.Exec("DELETE FROM answers WHERE answer_id = ?", id)
 }