@johnnyboy11234/esg-idea-contest 0.3.0 → 0.3.2

package/backend/internal/idea/handler_integration_test.go

@@ -0,0 +1,107 @@
+//go:build integration
+
+package idea_test
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/google/uuid"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/api"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/audit"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/idea"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/server"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/dbtest"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/security"
+)
+
+func TestGetIdeaHandler(t *testing.T) {
+	d := dbtest.New(t)
+	leader := addUser(t, d, "100001", "USER")
+	other := addUser(t, d, "100002", "USER")
+	admin := addUser(t, d, "900001", "ADMIN")
+	n := newIdea(leader.UserID, "Idea A")
+	if err := insert(d, n); err != nil {
+		t.Fatal(err)
+	}
+	aud := audit.New(d, nil)
+	errs := server.ErrorAdapter{Audit: aud}
+	h := idea.Handler{Service: &idea.Service{DB: d, Audit: aud}, ExpectedFilename: expectedBase, Fail: errs.Write}
+
+	call := func(p security.Principal, id uuid.UUID) *httptest.ResponseRecorder {
+		r := chi.NewRouter()
+		r.Get("/ideas/{id}", func(w http.ResponseWriter, req *http.Request) { h.GetIdea(w, req, api.IdeaId(id)) })
+		req := httptest.NewRequest(http.MethodGet, "/ideas/"+id.String(), nil)
+		req = req.WithContext(security.WithPrincipal(context.Background(), p))
+		rec := httptest.NewRecorder()
+		r.ServeHTTP(rec, req)
+		return rec
+	}
+	count := func(where string) (c int) {
+		if err := d.QueryRow(`SELECT COUNT(*) FROM audit_log WHERE ` + where).Scan(&c); err != nil {
+			t.Fatal(err)
+		}
+		return c
+	}
+
+	// Leader: 200, pendingRequests is [] (not null), expected filename.
+	rec := call(leader, n.ID)
+	if rec.Code != 200 {
+		t.Fatalf("leader: %d %s", rec.Code, rec.Body)
+	}
+	var body map[string]any
+	_ = json.Unmarshal(rec.Body.Bytes(), &body)
+	if body["expectedFilenameBase"] != "I_BSID_User 100001_100001_Idea A" ||
+		body["slides"].(map[string]any)["downloadFilename"] != "I_BSID_User 100001_100001_Idea A.pdf" {
+		t.Errorf("filename: %v", body)
+	}
+	if pr, ok := body["pendingRequests"].([]any); !ok || len(pr) != 0 {
+		t.Errorf("pendingRequests = %v", body["pendingRequests"])
+	}
+	if count(`action = 'IDEA_VIEW'`) != 0 {
+		t.Error("a Leader view must not write IDEA_VIEW")
+	}
+
+	// Admin: 200 and one IDEA_VIEW SUCCESS row.
+	if rec := call(admin, n.ID); rec.Code != 200 {
+		t.Fatalf("admin: %d", rec.Code)
+	}
+	if count(`action = 'IDEA_VIEW' AND outcome = 'SUCCESS' AND actor_role = 'ADMIN'`) != 1 {
+		t.Error("admin view: want one IDEA_VIEW SUCCESS row")
+	}
+
+	// Hidden and missing: identical 404 (bar the request ID), both audited DENIED.
+	hidden, missing := call(other, n.ID), call(other, uuid.New())
+	if hidden.Code != 404 || missing.Code != 404 {
+		t.Fatalf("codes %d %d", hidden.Code, missing.Code)
+	}
+	strip := func(rr *httptest.ResponseRecorder) (map[string]any, http.Header) {
+		var m map[string]any
+		_ = json.Unmarshal(rr.Body.Bytes(), &m)
+		delete(m, "requestId")
+		return m, rr.Header()
+	}
+	hb, hh := strip(hidden)
+	mb, mh := strip(missing)
+	if len(hb) != len(mb) || hb["code"] != mb["code"] || hb["detail"] != mb["detail"] {
+		t.Errorf("bodies differ: %v vs %v", hb, mb)
+	}
+	for k := range hh {
+		if hh.Get(k) != mh.Get(k) {
+			t.Errorf("header %s differs: %q vs %q", k, hh.Get(k), mh.Get(k))
+		}
+	}
+	if got := count(`action = 'IDEA_VIEW' AND outcome = 'DENIED' AND status = 404 AND error_code = 'NOT_FOUND'`); got != 2 {
+		t.Errorf("DENIED rows = %d, want 2", got)
+	}
+}
+
+// expectedBase mirrors storage.ExpectedFilenameBase (idea must not import storage).
+func expectedBase(category, org, leaderName, leaderEmpNo, ideaName string) (string, error) {
+	return "I_" + org + "_" + leaderName + "_" + leaderEmpNo + "_" + ideaName, nil
+}

package/backend/internal/idea/integration_test.go

@@ -0,0 +1,149 @@
+//go:build integration
+
+package idea_test
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"strings"
+	"testing"
+
+	"github.com/google/uuid"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/idea"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/idea/internal/store"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/db"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/dbtest"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/security"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/web"
+)
+
+const hash = "$2a$10$" + "abcdefghijklmnopqrstuuabcdefghijklmnopqrstuuabcdefghi" // 7 + 53 chars
+
+func addUser(t *testing.T, d *sql.DB, empNo, role string) security.Principal {
+	t.Helper()
+	id := uuid.New()
+	var email any
+	if role == "USER" {
+		email = empNo + "@example.com"
+	}
+	if _, err := d.Exec(`INSERT INTO app_user (id, emp_no, name, email, password_hash, role) VALUES (?,?,?,?,?,?)`,
+		id.String(), empNo, "User "+empNo, email, hash, role); err != nil {
+		t.Fatal(err)
+	}
+	return security.Principal{UserID: id, EmpNo: empNo, Role: security.Role(role)}
+}
+
+func newIdea(leader uuid.UUID, name string) store.NewIdea {
+	id := uuid.New()
+	return store.NewIdea{
+		ID: id, LeaderID: leader, Category: "COOL_IDEA", Org: "BSID", Direction: "TALENT_DEVELOPMENT",
+		Name: name, Summary: "s",
+		Slides: store.Slides{ObjectKey: "slides/" + id.String() + "/" + uuid.NewString() + ".pdf",
+			Ext: "pdf", Size: 1024, SHA256: strings.Repeat("ab", 32)},
+	}
+}
+
+func insert(d *sql.DB, n store.NewIdea) error {
+	tx, err := d.Begin()
+	if err != nil {
+		return err
+	}
+	if err := store.InsertIdea(context.Background(), tx, n); err != nil {
+		_ = tx.Rollback()
+		return err
+	}
+	return tx.Commit()
+}
+
+func TestVisibilityPerRole(t *testing.T) {
+	d := dbtest.New(t)
+	leader := addUser(t, d, "100001", "USER")
+	other := addUser(t, d, "100002", "USER")
+	admin := addUser(t, d, "900001", "ADMIN")
+	n := newIdea(leader.UserID, "Idea A")
+	if err := insert(d, n); err != nil {
+		t.Fatal(err)
+	}
+	svc := &idea.Service{DB: d}
+	ctx := context.Background()
+
+	for _, tc := range []struct {
+		who     string
+		p       security.Principal
+		visible bool
+	}{{"leader", leader, true}, {"admin", admin, true}, {"other user", other, false}} {
+		got, err := svc.Get(ctx, n.ID, tc.p)
+		if tc.visible {
+			if err != nil || got.ID != n.ID || got.LeaderEmpNo != "100001" || got.Version != 0 || got.Slides.Ext != "pdf" {
+				t.Errorf("%s: got %+v, %v", tc.who, got, err)
+			}
+			continue
+		}
+		if !isNotFound(err) {
+			t.Errorf("%s: want NOT_FOUND, got %v", tc.who, err)
+		}
+	}
+
+	// A missing Idea is indistinguishable from a hidden one.
+	_, errMissing := svc.Get(ctx, uuid.New(), leader)
+	_, errHidden := svc.Get(ctx, n.ID, other)
+	if !isNotFound(errMissing) || errMissing.Error() != errHidden.Error() {
+		t.Errorf("missing %v vs hidden %v", errMissing, errHidden)
+	}
+}
+
+func isNotFound(err error) bool {
+	var we *web.Error
+	return errors.As(err, &we) && we.Error() == "NOT_FOUND"
+}
+
+func TestUniqueLeaderName(t *testing.T) {
+	d := dbtest.New(t)
+	a := addUser(t, d, "100001", "USER")
+	b := addUser(t, d, "100002", "USER")
+	if err := insert(d, newIdea(a.UserID, "Same")); err != nil {
+		t.Fatal(err)
+	}
+	err := insert(d, newIdea(a.UserID, "Same"))
+	if key, ok := db.DuplicateKey(err); !ok || key != "uq_idea_leader_name" {
+		t.Errorf("same leader, same name: key %q ok %v err %v", key, ok, err)
+	}
+	if err := insert(d, newIdea(a.UserID, "same")); err != nil {
+		t.Errorf("name is case-sensitive: %v", err)
+	}
+	if err := insert(d, newIdea(b.UserID, "Same")); err != nil {
+		t.Errorf("names are unique per leader, not globally: %v", err)
+	}
+}
+
+func TestChecksRejectBadRows(t *testing.T) {
+	d := dbtest.New(t)
+	a := addUser(t, d, "100001", "USER")
+	for name, mut := range map[string]func(*store.NewIdea){
+		"category":       func(n *store.NewIdea) { n.Category = "X" },
+		"org":            func(n *store.NewIdea) { n.Org = "ZZZZ" },
+		"direction":      func(n *store.NewIdea) { n.Direction = "X" },
+		"empty name":     func(n *store.NewIdea) { n.Name = "" },
+		"slash name":     func(n *store.NewIdea) { n.Name = "a/b" },
+		"long name":      func(n *store.NewIdea) { n.Name = strings.Repeat("好", 76) },
+		"empty summary":  func(n *store.NewIdea) { n.Summary = "" },
+		"ext":            func(n *store.NewIdea) { n.Slides.Ext = "docx" },
+		"size zero":      func(n *store.NewIdea) { n.Slides.Size = 0 },
+		"size over 5MiB": func(n *store.NewIdea) { n.Slides.Size = 5*1024*1024 + 1 },
+		"sha upper":      func(n *store.NewIdea) { n.Slides.SHA256 = strings.Repeat("AB", 32) },
+		"no leader":      func(n *store.NewIdea) { n.LeaderID = uuid.New() },
+	} {
+		n := newIdea(a.UserID, "ok")
+		mut(&n)
+		if err := insert(d, n); err == nil {
+			t.Errorf("%s: row accepted", name)
+		}
+	}
+	n := newIdea(a.UserID, strings.Repeat("好", 75))
+	n.Slides.Size = 5 * 1024 * 1024
+	if err := insert(d, n); err != nil {
+		t.Errorf("boundary values rejected: %v", err)
+	}
+}

package/backend/internal/idea/internal/store/list.go

@@ -0,0 +1,146 @@
+package store
+
+import (
+	"context"
+	"database/sql"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/google/uuid"
+)
+
+// ListFilter is the validated filter set of GET /ideas (PRD 6.6). A nil or
+// empty field means "no filter". CreatedFrom is inclusive, CreatedTo exclusive.
+type ListFilter struct {
+	Org, Category, Direction string
+	LeaderEmpNo              string
+	CreatedFrom, CreatedTo   *time.Time
+	// Q is a case-insensitive "name contains" term; %, _ and the escape
+	// character are literal.
+	Q string
+	// SortName sorts by name (code point order) instead of created_at; Desc is
+	// the direction. The handler resolves the per-field default direction.
+	SortName, Desc bool
+}
+
+// likeEscape is the ESCAPE character of the name search. It is not a backslash,
+// so the SQL literal does not depend on NO_BACKSLASH_ESCAPES.
+const likeEscape = "!"
+
+// containsPattern turns a user term into a LIKE pattern matching names that
+// contain it, with every wildcard escaped.
+func containsPattern(q string) string {
+	r := strings.NewReplacer(likeEscape, likeEscape+likeEscape, "%", likeEscape+"%", "_", likeEscape+"_")
+	return "%" + r.Replace(q) + "%"
+}
+
+func (f ListFilter) orderBy() string {
+	dir := "ASC"
+	if f.Desc {
+		dir = "DESC"
+	}
+	col := "i.created_at"
+	if f.SortName {
+		col = "i.name"
+	}
+	return col + " " + dir + ", i.id " + dir
+}
+
+// Summary is one row of the list (IdeaSummary: no summary text).
+type Summary struct {
+	ID              uuid.UUID
+	Name            string
+	Category        string
+	Org             string
+	Direction       string
+	LeaderID        uuid.UUID
+	LeaderEmpNo     string
+	LeaderName      string
+	MemberCount     int
+	CreatedAt       time.Time
+	SlidesUpdatedAt time.Time
+}
+
+// dbTime is the DATETIME(6) literal of an instant; the database stores UTC.
+func dbTime(t time.Time) string { return t.UTC().Format("2006-01-02 15:04:05.000000") }
+
+// ListVisible returns one page of the Ideas the viewer may see, in the requested order
+// (id is the final tie-breaker), and the total number of matches. It is built
+// on VisibleWhere like every other read. A page beyond the last is empty.
+func ListVisible(ctx context.Context, q interface {
+	QueryContext(ctx context.Context, query string, args ...any) (*sql.Rows, error)
+	QueryRowContext(ctx context.Context, query string, args ...any) *sql.Row
+}, viewer uuid.UUID, isAdmin bool, f ListFilter, limit, offset int) ([]Summary, int, error) {
+	admin := 0
+	if isAdmin {
+		admin = 1
+	}
+	where := []string{VisibleWhere}
+	args := []any{admin, viewer.String()}
+	add := func(cond string, v any) {
+		where = append(where, cond)
+		args = append(args, v)
+	}
+	if f.Org != "" {
+		add("i.org = ?", f.Org)
+	}
+	if f.Category != "" {
+		add("i.category = ?", f.Category)
+	}
+	if f.Direction != "" {
+		add("i.direction = ?", f.Direction)
+	}
+	if f.LeaderEmpNo != "" {
+		add("u.emp_no = ?", f.LeaderEmpNo)
+	}
+	if f.Q != "" {
+		add("LOWER(i.name) LIKE LOWER(?) ESCAPE '"+likeEscape+"'", containsPattern(f.Q))
+	}
+	if f.CreatedFrom != nil {
+		add("i.created_at >= ?", dbTime(*f.CreatedFrom))
+	}
+	if f.CreatedTo != nil {
+		add("i.created_at < ?", dbTime(*f.CreatedTo))
+	}
+	cond := strings.Join(where, " AND ")
+
+	var total int
+	if err := q.QueryRowContext(ctx,
+		`SELECT COUNT(*) FROM idea i JOIN app_user u ON u.id = i.leader_id WHERE `+cond, args...).Scan(&total); err != nil {
+		return nil, 0, fmt.Errorf("count ideas: %w", err)
+	}
+
+	// TODO(B5-01): memberCount counts ACCEPTED idea_member rows (Leader excluded).
+	rows, err := q.QueryContext(ctx,
+		`SELECT i.id, i.name, i.category, i.org, i.direction, i.leader_id, u.emp_no, u.name,
+		        0, i.created_at, i.slides_updated_at
+		   FROM idea i JOIN app_user u ON u.id = i.leader_id
+		  WHERE `+cond+`
+		  ORDER BY `+f.orderBy()+`
+		  LIMIT ? OFFSET ?`, append(args, limit, offset)...)
+	if err != nil {
+		return nil, 0, fmt.Errorf("list ideas: %w", err)
+	}
+	defer func() { _ = rows.Close() }()
+	out := []Summary{}
+	for rows.Next() {
+		var s Summary
+		var id, lid string
+		if err := rows.Scan(&id, &s.Name, &s.Category, &s.Org, &s.Direction, &lid, &s.LeaderEmpNo,
+			&s.LeaderName, &s.MemberCount, &s.CreatedAt, &s.SlidesUpdatedAt); err != nil {
+			return nil, 0, fmt.Errorf("scan idea: %w", err)
+		}
+		if s.ID, err = uuid.Parse(id); err != nil {
+			return nil, 0, fmt.Errorf("idea id: %w", err)
+		}
+		if s.LeaderID, err = uuid.Parse(lid); err != nil {
+			return nil, 0, fmt.Errorf("idea leader id: %w", err)
+		}
+		out = append(out, s)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, 0, fmt.Errorf("list ideas: %w", err)
+	}
+	return out, total, nil
+}

package/backend/internal/idea/internal/store/list_test.go

@@ -0,0 +1,33 @@
+package store
+
+import "testing"
+
+func TestContainsPattern(t *testing.T) {
+	for in, want := range map[string]string{
+		"abc": "%abc%",
+		"50%": "%50!%%",
+		"a_b": "%a!_b%",
+		"hi!": "%hi!!%",
+		"%_!": "%!%!_!!%",
+		`a\b`: `%a\b%`,
+		"綠能":  "%綠能%",
+		"":    "%%",
+	} {
+		if got := containsPattern(in); got != want {
+			t.Errorf("containsPattern(%q) = %q, want %q", in, got, want)
+		}
+	}
+}
+
+func TestOrderBy(t *testing.T) {
+	for f, want := range map[ListFilter]string{
+		{}:                           "i.created_at ASC, i.id ASC",
+		{Desc: true}:                 "i.created_at DESC, i.id DESC",
+		{SortName: true}:             "i.name ASC, i.id ASC",
+		{SortName: true, Desc: true}: "i.name DESC, i.id DESC",
+	} {
+		if got := f.orderBy(); got != want {
+			t.Errorf("%+v: %q, want %q", f, got, want)
+		}
+	}
+}

package/backend/internal/idea/internal/store/store.go

@@ -0,0 +1,166 @@
+// Package store holds the SQL of the idea module. Only the idea module may
+// import it (Go's internal rule); no other module touches the idea table.
+package store
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+	"time"
+
+	"github.com/google/uuid"
+)
+
+// ErrNotFound is returned when no row exists or the viewer may not see it. The
+// two cases are deliberately indistinguishable (PRD 6.6, Backend.md 8).
+var ErrNotFound = errors.New("idea not found")
+
+// Querier is satisfied by *sql.DB, *sql.Tx and *sql.Conn.
+type Querier interface {
+	QueryRowContext(ctx context.Context, query string, args ...any) *sql.Row
+}
+
+// NewIdea is a row to insert. Every value is already validated and cleaned;
+// the table's CHECKs are the second line of defence (V005).
+type NewIdea struct {
+	ID        uuid.UUID
+	LeaderID  uuid.UUID
+	Category  string
+	Org       string
+	Direction string
+	Name      string
+	Summary   string
+	Slides    Slides
+}
+
+// Slides is the slide metadata stored on the idea row (D22).
+type Slides struct {
+	ObjectKey string // slides/{ideaId}/{uuid}.{ext}
+	Ext       string // pdf | pptx
+	Size      int64
+	SHA256    string // lower-case hex
+}
+
+// Idea is a row of idea joined with its Leader's public fields.
+type Idea struct {
+	ID              uuid.UUID
+	Category        string
+	Org             string
+	Direction       string
+	Name            string
+	Summary         string
+	LeaderID        uuid.UUID
+	LeaderEmpNo     string
+	LeaderName      string
+	Slides          Slides
+	SlidesUpdatedAt time.Time
+	Version         uint32
+	CreatedAt       time.Time
+	UpdatedAt       time.Time
+}
+
+// InsertIdea inserts an Idea in the caller's transaction. A unique-key
+// violation on uq_idea_leader_name is returned as the driver error; the
+// service maps it with db.DuplicateKey to IDEA_DUPLICATE.
+func InsertIdea(ctx context.Context, tx *sql.Tx, n NewIdea) error {
+	_, err := tx.ExecContext(ctx,
+		`INSERT INTO idea (id, leader_id, category, org, direction, name, summary,
+		                   slides_object_key, slides_ext, slides_size, slides_sha256)
+		 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+		n.ID.String(), n.LeaderID.String(), n.Category, n.Org, n.Direction, n.Name, n.Summary,
+		n.Slides.ObjectKey, n.Slides.Ext, n.Slides.Size, n.Slides.SHA256)
+	if err != nil {
+		return fmt.Errorf("insert idea: %w", err)
+	}
+	return nil
+}
+
+// VisibleWhere is the one visibility predicate (PRD 6.6: an Idea is visible to
+// its Leader, its approved Members and Admins). Every read of an Idea, single
+// or list, is built on it; no other code decides who may see an Idea.
+// Arguments, in order: is_admin (0/1, CAST AS SIGNED in sqlc terms, rule R4),
+// viewer user id. It assumes the idea table is aliased i.
+//
+// TODO(B5-01): add the approved-Member branch
+//
+//	OR EXISTS (SELECT 1 FROM idea_member m WHERE m.idea_id = i.id
+//	           AND m.user_id = ? AND m.status = 'ACCEPTED')
+//
+// when the idea_member table exists. Until then Members cannot exist.
+const VisibleWhere = `(? = 1 OR i.leader_id = ?)`
+
+const selectIdea = `
+SELECT i.id, i.category, i.org, i.direction, i.name, i.summary,
+       i.leader_id, u.emp_no, u.name,
+       i.slides_object_key, i.slides_ext, i.slides_size, i.slides_sha256, i.slides_updated_at,
+       i.version, i.created_at, i.updated_at
+  FROM idea i
+  JOIN app_user u ON u.id = i.leader_id`
+
+// GetVisible is the single visibility query for one Idea. A missing Idea and
+// an Idea the viewer may not see both return ErrNotFound.
+func GetVisible(ctx context.Context, q Querier, id, viewer uuid.UUID, isAdmin bool) (Idea, error) {
+	var (
+		out           Idea
+		sid, lid, vid string
+		admin         int
+	)
+	admin = 0
+	if isAdmin {
+		admin = 1
+	}
+	vid = viewer.String()
+	err := q.QueryRowContext(ctx, selectIdea+` WHERE i.id = ? AND `+VisibleWhere,
+		id.String(), admin, vid).Scan(
+		&sid, &out.Category, &out.Org, &out.Direction, &out.Name, &out.Summary,
+		&lid, &out.LeaderEmpNo, &out.LeaderName,
+		&out.Slides.ObjectKey, &out.Slides.Ext, &out.Slides.Size, &out.Slides.SHA256, &out.SlidesUpdatedAt,
+		&out.Version, &out.CreatedAt, &out.UpdatedAt)
+	if errors.Is(err, sql.ErrNoRows) {
+		return Idea{}, ErrNotFound
+	}
+	if err != nil {
+		return Idea{}, fmt.Errorf("select idea: %w", err)
+	}
+	if out.ID, err = uuid.Parse(sid); err != nil {
+		return Idea{}, fmt.Errorf("idea id: %w", err)
+	}
+	if out.LeaderID, err = uuid.Parse(lid); err != nil {
+		return Idea{}, fmt.Errorf("idea leader id: %w", err)
+	}
+	return out, nil
+}
+
+// ErrNoLeader is returned by LeaderName when the user row is gone, which a
+// valid session rules out; the caller treats it as an internal error.
+var ErrNoLeader = errors.New("leader account not found")
+
+// LeaderName returns the account name of user id: the expected filename takes
+// the Leader's name from the account, never from the form (PRD 6.6).
+func LeaderName(ctx context.Context, q Querier, id uuid.UUID) (string, error) {
+	var name string
+	err := q.QueryRowContext(ctx, `SELECT name FROM app_user WHERE id = ?`, id.String()).Scan(&name)
+	if errors.Is(err, sql.ErrNoRows) {
+		return "", ErrNoLeader
+	}
+	if err != nil {
+		return "", fmt.Errorf("select leader name: %w", err)
+	}
+	return name, nil
+}
+
+// NameTaken is the read-only duplicate pre-check of create: it saves an upload
+// in the common case, while uq_idea_leader_name stays authoritative.
+func NameTaken(ctx context.Context, q Querier, leader uuid.UUID, name string) (bool, error) {
+	var one int
+	err := q.QueryRowContext(ctx, `SELECT 1 FROM idea WHERE leader_id = ? AND name = ?`,
+		leader.String(), name).Scan(&one)
+	if errors.Is(err, sql.ErrNoRows) {
+		return false, nil
+	}
+	if err != nil {
+		return false, fmt.Errorf("select idea name: %w", err)
+	}
+	return true, nil
+}