@johnnyboy11234/esg-idea-contest 0.3.0 → 0.3.1

package/backend/internal/account/integration_test.go

@@ -32,7 +32,7 @@ func newEnv(t *testing.T) env {
 	auditSvc := audit.New(db, nil)
 	errs := server.ErrorAdapter{Audit: auditSvc}
 	api := server.API{Account: account.Handler{
-		Service: &account.Service{DB: db, Audit: auditSvc, Policy: account.StubPolicy{}},
+		Service: &account.Service{DB: db, Audit: auditSvc, Policy: account.DefaultPolicy()},
 		Fail:    errs.Write,
 	}}
 	h := apispec.Load(t).Validate(t, server.NewPublic(slog.New(slog.DiscardHandler), server.Mount(api)))
@@ -49,6 +49,8 @@ func (e env) register(body string) *httptest.ResponseRecorder {
 	return rec
 }
 
+const goodPW = "Correct-Horse-1"
+
 func reg(empNo, name, email, pw string) string {
 	b, _ := json.Marshal(map[string]string{"empNo": empNo, "name": name, "email": email, "password": pw})
 	return string(b)
@@ -150,16 +152,16 @@ func TestRegisterSuccess(t *testing.T) {
 
 func TestRegisterConflicts(t *testing.T) {
 	e := newEnv(t)
-	if rec := e.register(reg("089290", "A", "a@x.com", "pw")); rec.Code != 201 {
+	if rec := e.register(reg("089290", "A", "a@x.com", goodPW)); rec.Code != 201 {
 		t.Fatal(rec.Body)
 	}
 
 	cases := []struct {
 		name, body, code, reason string
 	}{
-		{"same employee ID", reg("089290", "B", "b@x.com", "pw"), "EMP_NO_TAKEN", "emp_no_taken"},
-		{"same email, any case", reg("089291", "B", " A@X.COM ", "pw"), "EMAIL_TAKEN", "email_taken"},
-		{"both taken reports the employee ID", reg("089290", "B", "a@x.com", "pw"), "EMP_NO_TAKEN", "emp_no_taken"},
+		{"same employee ID", reg("089290", "B", "b@x.com", goodPW), "EMP_NO_TAKEN", "emp_no_taken"},
+		{"same email, any case", reg("089291", "B", " A@X.COM ", goodPW), "EMAIL_TAKEN", "email_taken"},
+		{"both taken reports the employee ID", reg("089290", "B", "a@x.com", goodPW), "EMP_NO_TAKEN", "emp_no_taken"},
 	}
 	for _, tc := range cases {
 		rec := e.register(tc.body)
@@ -189,14 +191,14 @@ func TestRegisterConflicts(t *testing.T) {
 
 func TestRegisterValidationBeatsConflictAndIsAudited(t *testing.T) {
 	e := newEnv(t)
-	e.register(reg("089290", "A", "a@x.com", "pw"))
+	e.register(reg("089290", "A", "a@x.com", goodPW))
 
 	// The employee ID is taken, but the email is malformed: 422, never 409.
-	rec := e.register(reg("089290", "B", "a b@x.com", "pw"))
+	rec := e.register(reg("089290", "B", "a b@x.com", goodPW))
 	if rec.Code != 422 || problemCode(t, rec) != "VALIDATION_FAILED" {
 		t.Fatalf("%d %s", rec.Code, rec.Body)
 	}
-	rec = e.register(reg("12 4", "B/C", "ok@x.com", "pw"))
+	rec = e.register(reg("12 4", "B/C", "ok@x.com", goodPW))
 	if rec.Code != 422 {
 		t.Fatalf("%d %s", rec.Code, rec.Body)
 	}
@@ -248,7 +250,7 @@ func TestRegisterRaceHasOneWinner(t *testing.T) {
 		wg.Add(1)
 		go func() {
 			defer wg.Done()
-			codes[i] = e.register(reg("089290", "A", "race"+string(rune('a'+i))+"@x.com", "pw")).Code
+			codes[i] = e.register(reg("089290", "A", "race"+string(rune('a'+i))+"@x.com", goodPW)).Code
 		}()
 	}
 	wg.Wait()
@@ -266,3 +268,37 @@ func TestRegisterRaceHasOneWinner(t *testing.T) {
 		t.Fatalf("codes = %v, users = %d", codes, e.users(t))
 	}
 }
+
+func TestRegisterWeakPasswordListsEveryRuleInTableOrder(t *testing.T) {
+	e := newEnv(t)
+	// Format and policy errors come back together; the password contains the
+	// employee ID, repeats a character and has only two classes.
+	rec := e.register(reg("089290", "A", "nope", "aaa089290"))
+	if rec.Code != 422 || problemCode(t, rec) != "VALIDATION_FAILED" {
+		t.Fatalf("%d %s", rec.Code, rec.Body)
+	}
+	var body struct {
+		Errors []struct{ Field, Code, Rule string }
+	}
+	if err := json.Unmarshal(rec.Body.Bytes(), &body); err != nil {
+		t.Fatal(err)
+	}
+	var got []string
+	for _, f := range body.Errors {
+		got = append(got, f.Field+":"+f.Code+":"+f.Rule)
+	}
+	want := "email:INVALID_FORMAT: password:PASSWORD_POLICY:LENGTH password:PASSWORD_POLICY:COMPLEXITY " +
+		"password:PASSWORD_POLICY:REPEAT password:PASSWORD_POLICY:CONTAINS_EMP_NO"
+	if strings.Join(got, " ") != want {
+		t.Errorf("errors = %v\nwant     %s", got, want)
+	}
+
+	// Alone, a weak password makes PASSWORD_POLICY the top-level code.
+	rec = e.register(reg("089290", "A", "a@x.com", "short"))
+	if rec.Code != 422 || problemCode(t, rec) != "PASSWORD_POLICY" {
+		t.Fatalf("%d %s", rec.Code, rec.Body)
+	}
+	if e.users(t) != 0 {
+		t.Error("a rejected registration created a user")
+	}
+}

package/backend/internal/account/keyboard.go

@@ -0,0 +1,75 @@
+package account
+
+import "strings"
+
+const minKeyboardRun = 4
+
+// keyboardRows are the four rows of US QWERTY (PRD §6.4). Rows do not join
+// and do not wrap: the end of one row is not adjacent to the start of the next.
+var keyboardRows = [...]string{
+	"1234567890-=",
+	"qwertyuiop[]",
+	"asdfghjkl;'",
+	"zxcvbnm,./",
+}
+
+// shiftedRows holds the shifted glyph of each key, position for position with
+// keyboardRows (letters are folded by case instead).
+var shiftedRows = [...]string{
+	"!@#$%^&*()_+",
+	"QWERTYUIOP{}",
+	"ASDFGHJKL:\"",
+	"ZXCVBNM<>?",
+}
+
+// keyPos is a key's row and column on the keyboard.
+type keyPos struct{ row, col int8 }
+
+// keyOf maps every unshifted and shifted glyph to its key. Glyphs on no row
+// (` ~ \ | and anything non-ASCII) are absent and break a run.
+var keyOf = func() map[rune]keyPos {
+	m := make(map[rune]keyPos, 2*len(keyboardRows[0])*4)
+	for r := range keyboardRows {
+		for c, g := range keyboardRows[r] {
+			m[g] = keyPos{int8(r), int8(c)}
+		}
+		for c, g := range shiftedRows[r] {
+			m[g] = keyPos{int8(r), int8(c)}
+		}
+	}
+	return m
+}()
+
+// violatesKeyboardRun: four or more adjacent keys on one row, read left to
+// right or right to left, case-insensitive, a shifted glyph counting as its
+// key (`!@#$` is `1234`). The same key repeated is not a run (that is REPEAT),
+// and a run must keep one direction ("qwer" yes, "qwqw" no).
+func violatesKeyboardRun(pw, _ string) bool {
+	var prev keyPos
+	have, run, dir := false, 0, int8(0)
+	for _, r := range strings.ToLower(pw) {
+		k, ok := keyOf[r]
+		if !ok {
+			have, run, dir = false, 0, 0
+			continue
+		}
+		step := int8(0)
+		if have && k.row == prev.row {
+			step = k.col - prev.col
+		}
+		if step == 1 || step == -1 {
+			if run >= 2 && step == dir {
+				run++
+			} else {
+				run, dir = 2, step
+			}
+		} else {
+			run, dir = 1, 0
+		}
+		prev, have = k, true
+		if run >= minKeyboardRun {
+			return true
+		}
+	}
+	return false
+}

package/backend/internal/account/keyboard_test.go

@@ -0,0 +1,43 @@
+package account
+
+import "testing"
+
+func TestViolatesKeyboardRun(t *testing.T) {
+	for _, tc := range []struct {
+		pw   string
+		want bool
+	}{
+		{"", false},
+		{"qwe", false},
+		{"qwer", true},
+		{"rewq", true},
+		{"QwEr", true},
+		{"1234", true},
+		{"4321", true},
+		{"!@#$", true},
+		{"1@3$", true},
+		{"=-09", true},
+		{"[poi", true},
+		{"zxcv", true},
+		{"/.,m", true},
+		{"asdf", true},
+		{"';lk", true},
+		{"{POI", true},
+		{"xqwertyx", true},
+		{"p-asdf", true}, // rows do not join: only asdf counts
+		{"pasd", false},  // no wrap row to row
+		{"0-=q", false},  // "0-=" is 3 keys, then a new row
+		{"qwewq", false}, // direction change restarts the count
+		{"qw~er", false},
+		{"qwdf", false},
+		{"qqqq", false},
+		{"1111", false},
+		{"`123", false},
+		{"éqwe", false},
+		{"aaa-sdf", false},
+	} {
+		if got := violatesKeyboardRun(tc.pw, ""); got != tc.want {
+			t.Errorf("violatesKeyboardRun(%q) = %v, want %v", tc.pw, got, tc.want)
+		}
+	}
+}

package/backend/internal/account/logging_integration_test.go

@@ -43,7 +43,7 @@ func TestRegisterLogsNeverContainPassword(t *testing.T) {
 	auditSvc := audit.New(db, log)
 	errs := server.ErrorAdapter{Audit: auditSvc, Log: log}
 	api := server.API{Account: account.Handler{
-		Service: &account.Service{DB: db, Audit: auditSvc, Policy: account.StubPolicy{}},
+		Service: &account.Service{DB: db, Audit: auditSvc, Policy: account.DefaultPolicy()},
 		Fail:    errs.Write,
 	}}
 	e := env{db: db, h: apispec.Load(t).Validate(t, server.NewPublic(log, server.Mount(api)))}

package/backend/internal/account/password.go

@@ -0,0 +1,125 @@
+package account
+
+import (
+	"strings"
+	"unicode/utf8"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/web"
+)
+
+// Password policy (PRD §6.4). Rule ids are the wire contract (errors[].rule).
+const (
+	RuleLength        = "LENGTH"
+	RuleCharset       = "CHARSET"
+	RuleComplexity    = "COMPLEXITY"
+	RuleCommon        = "COMMON_PASSWORD"
+	RuleKeyboardRun   = "KEYBOARD_RUN"
+	RuleSequence      = "SEQUENCE"
+	RuleRepeat        = "REPEAT"
+	RuleContainsEmpNo = "CONTAINS_EMP_NO"
+)
+
+const (
+	minPassLen     = 12
+	maxPassLen     = 64 // code points
+	minPassClasses = 3
+	maxRepeat      = 2 // 3+ identical characters in a row is a violation
+)
+
+// Rule is one row of the §6.4 table. Violated reports whether password breaks
+// the rule; empNo is "" when the submitted employee ID is malformed.
+type Rule struct {
+	ID       string
+	Violated func(password, empNo string) bool
+}
+
+// Policy runs its rules in order and reports every violated one. The slice
+// order is the PRD §6.4 table order, which is part of the contract
+// (testdata/password.json): later PRs add their rule at its table position.
+type Policy struct{ Rules []Rule }
+
+// DefaultPolicy returns the rules implemented so far, in table order.
+// SEQUENCE and COMMON_PASSWORD arrive with B1b-03 and later.
+func DefaultPolicy() *Policy {
+	return &Policy{Rules: []Rule{
+		{RuleLength, violatesLength},
+		{RuleCharset, violatesCharset},
+		{RuleComplexity, violatesComplexity},
+		{RuleKeyboardRun, violatesKeyboardRun},
+		{RuleRepeat, violatesRepeat},
+		{RuleContainsEmpNo, violatesEmpNo},
+	}}
+}
+
+// Check implements PasswordPolicy. Each violation is a PASSWORD_POLICY error
+// on field "password" carrying the rule id.
+func (p *Policy) Check(password, empNo string) []web.FieldError {
+	var out []web.FieldError
+	for _, r := range p.Rules {
+		if r.Violated(password, empNo) {
+			out = append(out, web.FieldError{Field: fieldPassword, Code: web.CodePasswordPolicy, Rule: r.ID})
+		}
+	}
+	return out
+}
+
+func violatesLength(pw, _ string) bool {
+	n := utf8.RuneCountInString(pw)
+	return n < minPassLen || n > maxPassLen
+}
+
+func violatesCharset(pw, _ string) bool {
+	for _, r := range pw {
+		if r < 0x20 || r > 0x7E { // also catches U+FFFD from invalid UTF-8
+			return true
+		}
+	}
+	return false
+}
+
+// violatesComplexity counts upper, lower, digit and symbol; a symbol is any
+// printable non-alphanumeric ASCII character, space included. Characters
+// outside printable ASCII belong to no class (CHARSET reports them).
+func violatesComplexity(pw, _ string) bool {
+	var upper, lower, digit, symbol bool
+	for _, r := range pw {
+		switch {
+		case r >= 'A' && r <= 'Z':
+			upper = true
+		case r >= 'a' && r <= 'z':
+			lower = true
+		case r >= '0' && r <= '9':
+			digit = true
+		case r >= 0x20 && r <= 0x7E:
+			symbol = true
+		}
+	}
+	n := 0
+	for _, c := range [...]bool{upper, lower, digit, symbol} {
+		if c {
+			n++
+		}
+	}
+	return n < minPassClasses
+}
+
+// violatesRepeat: the same character three or more times in a row, compared
+// exactly (case-sensitive: "aAa" is fine).
+func violatesRepeat(pw, _ string) bool {
+	run, prev := 0, rune(-1)
+	for _, r := range pw {
+		if r == prev {
+			run++
+		} else {
+			run, prev = 1, r
+		}
+		if run > maxRepeat {
+			return true
+		}
+	}
+	return false
+}
+
+func violatesEmpNo(pw, empNo string) bool {
+	return empNo != "" && strings.Contains(pw, empNo)
+}

package/backend/internal/account/validate.go

@@ -9,10 +9,9 @@ import (
 
 // Field limits (PRD §6.3).
 const (
-	empNoLen     = 6
-	maxNameLen   = 50
-	maxEmailLen  = 254
-	maxPassBytes = 72 // bcrypt silently ignores (x/crypto: rejects) anything longer
+	empNoLen    = 6
+	maxNameLen  = 50
+	maxEmailLen = 254
 )
 
 // Field names as they appear in errors[]; the order is the form order.
@@ -65,28 +64,12 @@ func checkEmail(s string) (string, text.Problem) {
 }
 
 // PasswordPolicy checks a candidate password and lists every violation, in
-// PRD §6.4 table order. empNo is the submitted employee ID when it is
+// PRD §6.4 table order (see Policy). empNo is the submitted employee ID when it is
 // well-formed and "" otherwise (the CONTAINS_EMP_NO rule is then skipped).
 type PasswordPolicy interface {
 	Check(password, empNo string) []web.FieldError
 }
 
-// StubPolicy is the placeholder until B1b-01 delivers the §6.4 rules. It only
-// refuses what the account cannot store: an empty password and one bcrypt
-// cannot hash (longer than 72 bytes). Everything else is accepted.
-type StubPolicy struct{}
-
-// Check implements PasswordPolicy.
-func (StubPolicy) Check(password, _ string) []web.FieldError {
-	switch {
-	case password == "":
-		return []web.FieldError{{Field: fieldPassword, Code: web.CodeRequired}}
-	case len(password) > maxPassBytes:
-		return []web.FieldError{{Field: fieldPassword, Code: web.CodeOutOfRange}}
-	}
-	return nil
-}
-
 // topCode is the response code of a 422: the first field error's code when it
 // is a specific registered code, else VALIDATION_FAILED (error-codes.md §2).
 func topCode(fields []web.FieldError) web.ErrorCode {

package/backend/internal/api/api.gen.go

@@ -71,6 +71,27 @@ func (e LoginResponseRole) Valid() bool {
 	}
 }
 
+// CreateIdeaForm defines model for CreateIdeaForm.
+type CreateIdeaForm struct {
+	// Category COOL_IDEA or OUTSTANDING_IMPACT
+	Category string `json:"category"`
+
+	// Direction One of the five ESG directions (PRD 6.6)
+	Direction string `json:"direction"`
+
+	// Name 1-75 code points after clean-up; no / \ : * ? " < > |
+	Name string `json:"name"`
+
+	// Org AAID, BSID, ICSD, TSID, PLED or DEID
+	Org string `json:"org"`
+
+	// Slides One PDF or PPTX, at most 5 MiB, named {I|O}_{org}_{leaderName}_{leaderEmpNo}_{name}.{pdf|pptx}
+	Slides openapi_types.File `json:"slides"`
+
+	// Summary 1-300 code points after clean-up
+	Summary string `json:"summary"`
+}
+
 // CsrfTokenResponse defines model for CsrfTokenResponse.
 type CsrfTokenResponse struct {
 	Token string `json:"token"`
@@ -93,6 +114,9 @@ type FieldError struct {
 	Code     string  `json:"code"`
 	Expected *string `json:"expected,omitempty"`
 	Field    string  `json:"field"`
+
+	// Rule PASSWORD_POLICY only, the violated rule id (PRD 6.4)
+	Rule *string `json:"rule,omitempty"`
 }
 
 // IdeaDetail defines model for IdeaDetail.
@@ -245,6 +269,33 @@ type RegisterParams struct {
 type ListIdeasParams struct {
 	Page *int `form:"page,omitempty" json:"page,omitempty"`
 	Size *int `form:"size,omitempty" json:"size,omitempty"`
+
+	// Org Closed set; an invalid value is 422 INVALID_ENUM (never ignored). Validated in the handler.
+	Org         *string `form:"org,omitempty" json:"org,omitempty"`
+	Category    *string `form:"category,omitempty" json:"category,omitempty"`
+	Direction   *string `form:"direction,omitempty" json:"direction,omitempty"`
+	LeaderEmpNo *string `form:"leaderEmpNo,omitempty" json:"leaderEmpNo,omitempty"`
+
+	// CreatedFrom ISO 8601 instant with offset or Z; inclusive. Validated in the handler.
+	CreatedFrom *string `form:"createdFrom,omitempty" json:"createdFrom,omitempty"`
+
+	// CreatedTo ISO 8601 instant with offset or Z; exclusive. Validated in the handler.
+	CreatedTo *string `form:"createdTo,omitempty" json:"createdTo,omitempty"`
+
+	// Q Case-insensitive "name contains"; `%` and `_` are literal.
+	Q *string `form:"q,omitempty" json:"q,omitempty"`
+
+	// Sort createdAt (default) or name; anything else is 422 INVALID_ENUM. Validated in the handler.
+	Sort *string `form:"sort,omitempty" json:"sort,omitempty"`
+
+	// Order asc or desc (default desc for createdAt, asc for name); anything else is 422 INVALID_ENUM. Validated in the handler.
+	Order *string `form:"order,omitempty" json:"order,omitempty"`
+}
+
+// CreateIdeaParams defines parameters for CreateIdea.
+type CreateIdeaParams struct {
+	// XCSRFToken Session-bound token from GET /auth/csrf. Mandatory on every write, but enforced by the CSRF middleware (403 CSRF_INVALID), so the generated wrapper must not reject its absence first (400).
+	XCSRFToken *CsrfToken `json:"X-CSRF-Token,omitempty"`
 }
 
 // LoginJSONRequestBody defines body for Login for application/json ContentType.
@@ -253,6 +304,9 @@ type LoginJSONRequestBody = LoginRequest
 // RegisterJSONRequestBody defines body for Register for application/json ContentType.
 type RegisterJSONRequestBody = RegisterRequest
 
+// CreateIdeaMultipartRequestBody defines body for CreateIdea for multipart/form-data ContentType.
+type CreateIdeaMultipartRequestBody = CreateIdeaForm
+
 // ServerInterface represents all server handlers.
 type ServerInterface interface {
 	// GetCsrfToken Session-bound CSRF token (anonymous before login)
@@ -276,6 +330,9 @@ type ServerInterface interface {
 	// ListIdeas List Ideas visible to the caller
 	// (GET /ideas)
 	ListIdeas(w http.ResponseWriter, r *http.Request, params ListIdeasParams)
+	// CreateIdea Create an Idea with its slides (User only)
+	// (POST /ideas)
+	CreateIdea(w http.ResponseWriter, r *http.Request, params CreateIdeaParams)
 	// GetIdea Idea detail
 	// (GET /ideas/{id})
 	GetIdea(w http.ResponseWriter, r *http.Request, id IdeaId)
@@ -327,6 +384,12 @@ func (_ Unimplemented) ListIdeas(w http.ResponseWriter, r *http.Request, params
 	w.WriteHeader(http.StatusNotImplemented)
 }
 
+// CreateIdea Create an Idea with its slides (User only)
+// (POST /ideas)
+func (_ Unimplemented) CreateIdea(w http.ResponseWriter, r *http.Request, params CreateIdeaParams) {
+	w.WriteHeader(http.StatusNotImplemented)
+}
+
 // GetIdea Idea detail
 // (GET /ideas/{id})
 func (_ Unimplemented) GetIdea(w http.ResponseWriter, r *http.Request, id IdeaId) {
@@ -542,6 +605,123 @@ func (siw *ServerInterfaceWrapper) ListIdeas(w http.ResponseWriter, r *http.Requ
 		return
 	}
 
+	// ------------- Optional query parameter "org" -------------
+
+	err = runtime.BindQueryParameterWithOptions("form", true, false, "org", r.URL.Query(), &params.Org, runtime.BindQueryParameterOptions{Type: "string", Format: ""})
+	if err != nil {
+		var requiredError *runtime.RequiredParameterError
+		if errors.As(err, &requiredError) {
+			siw.ErrorHandlerFunc(w, r, &RequiredParamError{ParamName: "org"})
+		} else {
+			siw.ErrorHandlerFunc(w, r, &InvalidParamFormatError{ParamName: "org", Err: err})
+		}
+		return
+	}
+
+	// ------------- Optional query parameter "category" -------------
+
+	err = runtime.BindQueryParameterWithOptions("form", true, false, "category", r.URL.Query(), &params.Category, runtime.BindQueryParameterOptions{Type: "string", Format: ""})
+	if err != nil {
+		var requiredError *runtime.RequiredParameterError
+		if errors.As(err, &requiredError) {
+			siw.ErrorHandlerFunc(w, r, &RequiredParamError{ParamName: "category"})
+		} else {
+			siw.ErrorHandlerFunc(w, r, &InvalidParamFormatError{ParamName: "category", Err: err})
+		}
+		return
+	}
+
+	// ------------- Optional query parameter "direction" -------------
+
+	err = runtime.BindQueryParameterWithOptions("form", true, false, "direction", r.URL.Query(), &params.Direction, runtime.BindQueryParameterOptions{Type: "string", Format: ""})
+	if err != nil {
+		var requiredError *runtime.RequiredParameterError
+		if errors.As(err, &requiredError) {
+			siw.ErrorHandlerFunc(w, r, &RequiredParamError{ParamName: "direction"})
+		} else {
+			siw.ErrorHandlerFunc(w, r, &InvalidParamFormatError{ParamName: "direction", Err: err})
+		}
+		return
+	}
+
+	// ------------- Optional query parameter "leaderEmpNo" -------------
+
+	err = runtime.BindQueryParameterWithOptions("form", true, false, "leaderEmpNo", r.URL.Query(), &params.LeaderEmpNo, runtime.BindQueryParameterOptions{Type: "string", Format: ""})
+	if err != nil {
+		var requiredError *runtime.RequiredParameterError
+		if errors.As(err, &requiredError) {
+			siw.ErrorHandlerFunc(w, r, &RequiredParamError{ParamName: "leaderEmpNo"})
+		} else {
+			siw.ErrorHandlerFunc(w, r, &InvalidParamFormatError{ParamName: "leaderEmpNo", Err: err})
+		}
+		return
+	}
+
+	// ------------- Optional query parameter "createdFrom" -------------
+
+	err = runtime.BindQueryParameterWithOptions("form", true, false, "createdFrom", r.URL.Query(), &params.CreatedFrom, runtime.BindQueryParameterOptions{Type: "string", Format: ""})
+	if err != nil {
+		var requiredError *runtime.RequiredParameterError
+		if errors.As(err, &requiredError) {
+			siw.ErrorHandlerFunc(w, r, &RequiredParamError{ParamName: "createdFrom"})
+		} else {
+			siw.ErrorHandlerFunc(w, r, &InvalidParamFormatError{ParamName: "createdFrom", Err: err})
+		}
+		return
+	}
+
+	// ------------- Optional query parameter "createdTo" -------------
+
+	err = runtime.BindQueryParameterWithOptions("form", true, false, "createdTo", r.URL.Query(), &params.CreatedTo, runtime.BindQueryParameterOptions{Type: "string", Format: ""})
+	if err != nil {
+		var requiredError *runtime.RequiredParameterError
+		if errors.As(err, &requiredError) {
+			siw.ErrorHandlerFunc(w, r, &RequiredParamError{ParamName: "createdTo"})
+		} else {
+			siw.ErrorHandlerFunc(w, r, &InvalidParamFormatError{ParamName: "createdTo", Err: err})
+		}
+		return
+	}
+
+	// ------------- Optional query parameter "q" -------------
+
+	err = runtime.BindQueryParameterWithOptions("form", true, false, "q", r.URL.Query(), &params.Q, runtime.BindQueryParameterOptions{Type: "string", Format: ""})
+	if err != nil {
+		var requiredError *runtime.RequiredParameterError
+		if errors.As(err, &requiredError) {
+			siw.ErrorHandlerFunc(w, r, &RequiredParamError{ParamName: "q"})
+		} else {
+			siw.ErrorHandlerFunc(w, r, &InvalidParamFormatError{ParamName: "q", Err: err})
+		}
+		return
+	}
+
+	// ------------- Optional query parameter "sort" -------------
+
+	err = runtime.BindQueryParameterWithOptions("form", true, false, "sort", r.URL.Query(), &params.Sort, runtime.BindQueryParameterOptions{Type: "string", Format: ""})
+	if err != nil {
+		var requiredError *runtime.RequiredParameterError
+		if errors.As(err, &requiredError) {
+			siw.ErrorHandlerFunc(w, r, &RequiredParamError{ParamName: "sort"})
+		} else {
+			siw.ErrorHandlerFunc(w, r, &InvalidParamFormatError{ParamName: "sort", Err: err})
+		}
+		return
+	}
+
+	// ------------- Optional query parameter "order" -------------
+
+	err = runtime.BindQueryParameterWithOptions("form", true, false, "order", r.URL.Query(), &params.Order, runtime.BindQueryParameterOptions{Type: "string", Format: ""})
+	if err != nil {
+		var requiredError *runtime.RequiredParameterError
+		if errors.As(err, &requiredError) {
+			siw.ErrorHandlerFunc(w, r, &RequiredParamError{ParamName: "order"})
+		} else {
+			siw.ErrorHandlerFunc(w, r, &InvalidParamFormatError{ParamName: "order", Err: err})
+		}
+		return
+	}
+
 	handler := http.Handler(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		siw.Handler.ListIdeas(w, r, params)
 	}))
@@ -553,6 +733,47 @@ func (siw *ServerInterfaceWrapper) ListIdeas(w http.ResponseWriter, r *http.Requ
 	handler.ServeHTTP(w, r)
 }
 
+// CreateIdea operation middleware
+func (siw *ServerInterfaceWrapper) CreateIdea(w http.ResponseWriter, r *http.Request) {
+
+	var err error
+	_ = err
+
+	// Parameter object where we will unmarshal all parameters from the context
+	var params CreateIdeaParams
+
+	headers := r.Header
+
+	// ------------- Optional header parameter "X-CSRF-Token" -------------
+	if valueList, found := headers[http.CanonicalHeaderKey("X-CSRF-Token")]; found {
+		var XCSRFToken CsrfToken
+		n := len(valueList)
+		if n != 1 {
+			siw.ErrorHandlerFunc(w, r, &TooManyValuesForParamError{ParamName: "X-CSRF-Token", Count: n})
+			return
+		}
+
+		err = runtime.BindStyledParameterWithOptions("simple", "X-CSRF-Token", valueList[0], &XCSRFToken, runtime.BindStyledParameterOptions{ParamLocation: runtime.ParamLocationHeader, Explode: false, Required: false, Type: "string", Format: ""})
+		if err != nil {
+			siw.ErrorHandlerFunc(w, r, &InvalidParamFormatError{ParamName: "X-CSRF-Token", Err: err})
+			return
+		}
+
+		params.XCSRFToken = &XCSRFToken
+
+	}
+
+	handler := http.Handler(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		siw.Handler.CreateIdea(w, r, params)
+	}))
+
+	for _, middleware := range siw.HandlerMiddlewares {
+		handler = middleware(handler)
+	}
+
+	handler.ServeHTTP(w, r)
+}
+
 // GetIdea operation middleware
 func (siw *ServerInterfaceWrapper) GetIdea(w http.ResponseWriter, r *http.Request) {
 
@@ -713,6 +934,9 @@ func HandlerWithOptions(si ServerInterface, options ChiServerOptions) http.Handl
 	r.Group(func(r chi.Router) {
 		r.Get(options.BaseURL+"/ideas", wrapper.ListIdeas)
 	})
+	r.Group(func(r chi.Router) {
+		r.Post(options.BaseURL+"/ideas", wrapper.CreateIdea)
+	})
 	r.Group(func(r chi.Router) {
 		r.Get(options.BaseURL+"/ideas/{id}", wrapper.GetIdea)
 	})