@johnnyboy11234/esg-idea-contest 0.3.0 → 0.3.2

package/backend/internal/idea/list.go

@@ -0,0 +1,166 @@
+package idea
+
+import (
+	"math"
+	"net/http"
+	"regexp"
+	"slices"
+	"time"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/api"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/security"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/web"
+)
+
+const (
+	defaultPageSize = 20
+	maxPageSize     = 100
+	maxPage         = math.MaxInt32 // keeps (page-1)*size far from int overflow
+)
+
+// Closed value sets (PRD 6.6); the idea table's CHECKs list the same values.
+var (
+	categories = []string{"COOL_IDEA", "OUTSTANDING_IMPACT"}
+	orgs       = []string{"AAID", "BSID", "ICSD", "TSID", "PLED", "DEID"}
+	directions = []string{"GREEN_MANUFACTURING", "RESPONSIBLE_SUPPLY_CHAIN", "INCLUSIVE_WORKPLACE",
+		"TALENT_DEVELOPMENT", "CARING_FOR_DISADVANTAGED"}
+	sorts       = []string{"createdAt", "name"}
+	order       = []string{"asc", "desc"}
+	empNoFormat = regexp.MustCompile(`^[0-9]{6}$`)
+)
+
+type summary struct {
+	ID              string `json:"id"`
+	Name            string `json:"name"`
+	Category        string `json:"category"`
+	Org             string `json:"org"`
+	Direction       string `json:"direction"`
+	Leader          person `json:"leader"`
+	MemberCount     int    `json:"memberCount"`
+	MyRelation      any    `json:"myRelation"`
+	CreatedAt       string `json:"createdAt"`
+	SlidesUpdatedAt string `json:"slidesUpdatedAt"`
+}
+
+type page struct {
+	Items []summary `json:"items"`
+	Page  int       `json:"page"`
+	Size  int       `json:"size"`
+	Total int       `json:"total"`
+}
+
+// listQuery is the validated query of GET /ideas.
+type listQuery struct {
+	page, size int
+	filter     ListFilter
+}
+
+// parseList validates every parameter and reports all failures at once, in
+// parameter order, each parameter with its first error (PRD 6.2, 6.6). No
+// invalid value is ignored.
+func parseList(p api.ListIdeasParams) (listQuery, []web.FieldError) {
+	q := listQuery{page: 1, size: defaultPageSize}
+	var errs []web.FieldError
+	bad := func(field string, code web.ErrorCode) {
+		errs = append(errs, web.FieldError{Field: field, Code: code})
+	}
+	if p.Page != nil {
+		if *p.Page < 1 || *p.Page > maxPage {
+			bad("page", web.CodeOutOfRange)
+		} else {
+			q.page = *p.Page
+		}
+	}
+	if p.Size != nil {
+		if *p.Size < 1 || *p.Size > maxPageSize {
+			bad("size", web.CodeOutOfRange)
+		} else {
+			q.size = *p.Size
+		}
+	}
+	enum := func(field string, v *string, allowed []string, dst *string) {
+		if v == nil {
+			return
+		}
+		if !slices.Contains(allowed, *v) {
+			bad(field, web.CodeInvalidEnum)
+			return
+		}
+		*dst = *v
+	}
+	enum("org", p.Org, orgs, &q.filter.Org)
+	enum("category", p.Category, categories, &q.filter.Category)
+	enum("direction", p.Direction, directions, &q.filter.Direction)
+	if p.LeaderEmpNo != nil {
+		if !empNoFormat.MatchString(*p.LeaderEmpNo) {
+			bad("leaderEmpNo", web.CodeInvalidFormat)
+		} else {
+			q.filter.LeaderEmpNo = *p.LeaderEmpNo
+		}
+	}
+	instant := func(field string, v *string) *time.Time {
+		if v == nil {
+			return nil
+		}
+		// RFC 3339 requires the offset or Z, so a bare date or local time fails.
+		t, err := time.Parse(time.RFC3339, *v)
+		if err != nil {
+			bad(field, web.CodeInvalidFormat)
+			return nil
+		}
+		return &t
+	}
+	q.filter.CreatedFrom = instant("createdFrom", p.CreatedFrom)
+	q.filter.CreatedTo = instant("createdTo", p.CreatedTo)
+	if p.Q != nil {
+		q.filter.Q = *p.Q
+	}
+	sort := "createdAt"
+	enum("sort", p.Sort, sorts, &sort)
+	q.filter.SortName = sort == "name"
+	dir := "desc"
+	if q.filter.SortName {
+		dir = "asc"
+	}
+	enum("order", p.Order, order, &dir)
+	q.filter.Desc = dir == "desc"
+	return q, errs
+}
+
+// ListIdeas serves GET /ideas.
+func (h Handler) ListIdeas(w http.ResponseWriter, r *http.Request, params api.ListIdeasParams) {
+	p, ok := security.PrincipalFrom(r.Context())
+	if !ok {
+		h.Fail(w, r, web.NewError(web.CodeUnauthenticated, "authentication required"))
+		return
+	}
+	q, errs := parseList(params)
+	if len(errs) > 0 {
+		e := web.NewError(web.CodeValidationFailed, "invalid query parameter")
+		e.Fields = errs
+		h.Fail(w, r, e)
+		return
+	}
+	rows, total, err := h.Service.List(r.Context(), p, q.filter, q.size, (q.page-1)*q.size)
+	if err != nil {
+		h.Fail(w, r, err)
+		return
+	}
+	out := page{Items: make([]summary, 0, len(rows)), Page: q.page, Size: q.size, Total: total}
+	for _, s := range rows {
+		var rel any // null for Admin
+		if !p.IsAdmin() {
+			rel = "MEMBER"
+			if s.LeaderID == p.UserID {
+				rel = "LEADER"
+			}
+		}
+		out.Items = append(out.Items, summary{
+			ID: s.ID.String(), Name: s.Name, Category: s.Category, Org: s.Org, Direction: s.Direction,
+			Leader:      person{EmpNo: s.LeaderEmpNo, Name: s.LeaderName},
+			MemberCount: s.MemberCount, MyRelation: rel,
+			CreatedAt: web.FormatTime(s.CreatedAt), SlidesUpdatedAt: web.FormatTime(s.SlidesUpdatedAt),
+		})
+	}
+	web.WriteJSON(w, http.StatusOK, out)
+}

package/backend/internal/idea/list_integration_test.go

@@ -0,0 +1,252 @@
+//go:build integration
+
+package idea_test
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"slices"
+	"testing"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/api"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/audit"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/idea"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/server"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/dbtest"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/security"
+)
+
+func TestListIdeasHandler(t *testing.T) {
+	d := dbtest.New(t)
+	a := addUser(t, d, "100001", "USER")
+	b := addUser(t, d, "100002", "USER")
+	admin := addUser(t, d, "900001", "ADMIN")
+
+	// a owns 3 Ideas, b owns 1 (different org/category). created_at is set explicitly.
+	mk := func(leader security.Principal, name, org, cat, at string) string {
+		n := newIdea(leader.UserID, name)
+		n.Org, n.Category = org, cat
+		if err := insert(d, n); err != nil {
+			t.Fatal(err)
+		}
+		if _, err := d.Exec(`UPDATE idea SET created_at = ? WHERE id = ?`, at, n.ID.String()); err != nil {
+			t.Fatal(err)
+		}
+		return n.ID.String()
+	}
+	a1 := mk(a, "A1", "BSID", "COOL_IDEA", "2026-03-01 00:00:00.000000")
+	a2 := mk(a, "A2", "BSID", "COOL_IDEA", "2026-03-02 00:00:00.000000")
+	a3 := mk(a, "A3", "AAID", "OUTSTANDING_IMPACT", "2026-03-03 00:00:00.000000")
+	b1 := mk(b, "B1", "AAID", "COOL_IDEA", "2026-03-04 00:00:00.000000")
+
+	aud := audit.New(d, nil)
+	errs := server.ErrorAdapter{Audit: aud}
+	h := idea.Handler{Service: &idea.Service{DB: d, Audit: aud}, ExpectedFilename: expectedBase, Fail: errs.Write}
+
+	call := func(p security.Principal, query string) (int, map[string]any) {
+		v, _ := url.ParseQuery(query)
+		var params api.ListIdeasParams
+		get := func(k string) *string {
+			if !v.Has(k) {
+				return nil
+			}
+			s := v.Get(k)
+			return &s
+		}
+		geti := func(k string) *int {
+			if !v.Has(k) {
+				return nil
+			}
+			var n int
+			_, _ = fmt.Sscan(v.Get(k), &n)
+			return &n
+		}
+		params.Page, params.Size = geti("page"), geti("size")
+		params.Org, params.Category, params.Direction = get("org"), get("category"), get("direction")
+		params.LeaderEmpNo, params.CreatedFrom, params.CreatedTo = get("leaderEmpNo"), get("createdFrom"), get("createdTo")
+		params.Q, params.Sort, params.Order = get("q"), get("sort"), get("order")
+		req := httptest.NewRequest(http.MethodGet, "/ideas?"+query, nil)
+		req = req.WithContext(security.WithPrincipal(context.Background(), p))
+		rec := httptest.NewRecorder()
+		h.ListIdeas(rec, req, params)
+		var body map[string]any
+		_ = json.Unmarshal(rec.Body.Bytes(), &body)
+		return rec.Code, body
+	}
+	ids := func(body map[string]any) (out []string) {
+		for _, it := range body["items"].([]any) {
+			out = append(out, it.(map[string]any)["id"].(string))
+		}
+		return out
+	}
+	eq := func(got, want []string) bool {
+		if len(got) != len(want) {
+			return false
+		}
+		for i := range got {
+			if got[i] != want[i] {
+				return false
+			}
+		}
+		return true
+	}
+
+	// User sees only own Ideas, newest first; myRelation LEADER; envelope.
+	code, body := call(a, "")
+	if code != 200 || !eq(ids(body), []string{a3, a2, a1}) || body["total"].(float64) != 3 ||
+		body["page"].(float64) != 1 || body["size"].(float64) != 20 {
+		t.Fatalf("user list: %d %v", code, body)
+	}
+	if rel := body["items"].([]any)[0].(map[string]any)["myRelation"]; rel != "LEADER" {
+		t.Errorf("myRelation = %v", rel)
+	}
+	// Admin sees all, myRelation null.
+	code, body = call(admin, "")
+	if code != 200 || !eq(ids(body), []string{b1, a3, a2, a1}) {
+		t.Fatalf("admin list: %d %v", code, body)
+	}
+	if rel, ok := body["items"].([]any)[0].(map[string]any)["myRelation"]; !ok || rel != nil {
+		t.Errorf("admin myRelation = %v", rel)
+	}
+	// A user with nothing gets [] not null.
+	if _, body = call(addUser(t, d, "100003", "USER"), ""); body["items"] == nil || body["total"].(float64) != 0 {
+		t.Errorf("empty: %v", body)
+	}
+
+	// Paging: size 2, page 2; beyond last page is 200 and empty with total intact.
+	_, body = call(admin, "size=2&page=2")
+	if !eq(ids(body), []string{a2, a1}) || body["total"].(float64) != 4 {
+		t.Errorf("page 2: %v", body)
+	}
+	code, body = call(admin, "size=2&page=3")
+	if code != 200 || len(ids(body)) != 0 || body["total"].(float64) != 4 {
+		t.Errorf("page 3: %d %v", code, body)
+	}
+
+	// Filters.
+	for q, want := range map[string][]string{
+		"org=BSID":                      {a2, a1},
+		"category=OUTSTANDING_IMPACT":   {a3},
+		"leaderEmpNo=100002":            {b1},
+		"org=AAID&category=COOL_IDEA":   {b1},
+		"direction=TALENT_DEVELOPMENT":  {b1, a3, a2, a1},
+		"direction=GREEN_MANUFACTURING": nil,
+		// [from, to) is half-open: 03-02 is included, 03-04 (== to) is not.
+		"createdFrom=2026-03-02T00:00:00Z&createdTo=2026-03-04T00:00:00Z": {a3, a2},
+		// Offset is honoured: 08:00+08:00 is 00:00Z.
+		"createdFrom=2026-03-04T08:00:00%2B08:00": {b1},
+	} {
+		if _, body = call(admin, q); !eq(ids(body), want) {
+			t.Errorf("%s: got %v want %v", q, ids(body), want)
+		}
+	}
+	// Filters never widen visibility.
+	if _, body = call(a, "leaderEmpNo=100002"); len(ids(body)) != 0 {
+		t.Errorf("user saw another Leader's Idea: %v", body)
+	}
+
+	// 422 with the right field code; top-level VALIDATION_FAILED.
+	for q, field := range map[string]string{
+		"size=101": "size", "page=0": "page", "org=XXXX": "org", "category=": "category",
+		"createdFrom=2026-03-01": "createdFrom", "leaderEmpNo=1": "leaderEmpNo",
+		"sort=id": "sort", "sort=": "sort", "order=up": "order", "order=ASC": "order",
+	} {
+		code, body = call(admin, q)
+		if code != 422 || body["code"] != "VALIDATION_FAILED" ||
+			body["errors"].([]any)[0].(map[string]any)["field"] != field {
+			t.Errorf("%s: %d %v", q, code, body)
+		}
+	}
+	if _, body = call(admin, "org=X"); body["errors"].([]any)[0].(map[string]any)["code"] != "INVALID_ENUM" {
+		t.Errorf("org code: %v", body)
+	}
+}
+
+func TestListIdeasSearchSort(t *testing.T) {
+	d := dbtest.New(t)
+	u := addUser(t, d, "100001", "USER")
+	admin := addUser(t, d, "900001", "ADMIN")
+	svc := &idea.Service{DB: d}
+
+	mk := func(name, at string) string {
+		n := newIdea(u.UserID, name)
+		if err := insert(d, n); err != nil {
+			t.Fatal(err)
+		}
+		if _, err := d.Exec(`UPDATE idea SET created_at = ? WHERE id = ?`, at, n.ID.String()); err != nil {
+			t.Fatal(err)
+		}
+		return n.ID.String()
+	}
+	pct := mk("100% green", "2026-03-01 00:00:00.000000")
+	und := mk("a_b", "2026-03-02 00:00:00.000000")
+	axb := mk("axb", "2026-03-03 00:00:00.000000")
+	bang := mk("Hi!", "2026-03-04 00:00:00.000000")
+	upper := mk("ZETA Solar", "2026-03-05 00:00:00.000000")
+	zh := mk("綠能創意", "2026-03-06 00:00:00.000000")
+
+	names := func(f idea.ListFilter) (out []string) {
+		rows, _, err := svc.List(context.Background(), admin, f, 100, 0)
+		if err != nil {
+			t.Fatal(err)
+		}
+		for _, r := range rows {
+			out = append(out, r.ID.String())
+		}
+		return out
+	}
+	same := func(got, want []string) bool { return fmt.Sprint(got) == fmt.Sprint(want) }
+
+	for _, tc := range []struct {
+		q    string
+		want []string
+	}{
+		{"%", []string{pct}},      // not a wildcard
+		{"_", []string{und}},      // not a wildcard: axb does not match
+		{"a_b", []string{und}},    // axb does not match
+		{"!", []string{bang}},     // the escape character itself is literal
+		{"zeta", []string{upper}}, // case-insensitive
+		{"SOLAR", []string{upper}},
+		{"綠能", []string{zh}},
+		{"nothing", nil},
+		{"", []string{zh, upper, bang, axb, und, pct}}, // empty term is no filter
+	} {
+		if got := names(idea.ListFilter{Q: tc.q, Desc: true}); !same(got, tc.want) {
+			t.Errorf("q=%q: got %v want %v", tc.q, got, tc.want)
+		}
+	}
+
+	// created_at both ways; name by code point (digits < upper < lower < CJK).
+	if got := names(idea.ListFilter{Desc: false}); !same(got, []string{pct, und, axb, bang, upper, zh}) {
+		t.Errorf("createdAt asc: %v", got)
+	}
+	if got := names(idea.ListFilter{SortName: true}); !same(got, []string{pct, bang, upper, und, axb, zh}) {
+		t.Errorf("name asc: %v", got)
+	}
+	if got := names(idea.ListFilter{SortName: true, Desc: true}); !same(got, []string{zh, axb, und, upper, bang, pct}) {
+		t.Errorf("name desc: %v", got)
+	}
+
+	// Equal sort keys fall back to id (MariaDB UUID order, not text order), in the sort direction. Same created_at for all.
+	if _, err := d.Exec(`UPDATE idea SET created_at = '2026-04-01 00:00:00.000000'`); err != nil {
+		t.Fatal(err)
+	}
+	asc, desc := names(idea.ListFilter{}), names(idea.ListFilter{Desc: true})
+	if len(asc) != 6 {
+		t.Errorf("tie-break asc: %v", asc)
+	}
+	slices.Reverse(desc)
+	if !same(asc, desc) {
+		t.Errorf("tie-break desc is not the reverse of asc: %v vs %v", asc, desc)
+	}
+
+	// A User's search never reaches another Leader's Ideas.
+	other := addUser(t, d, "100002", "USER")
+	if rows, _, err := svc.List(context.Background(), other, idea.ListFilter{Q: "zeta"}, 10, 0); err != nil || len(rows) != 0 {
+		t.Errorf("search widened visibility: %v %v", rows, err)
+	}
+}

package/backend/internal/idea/list_test.go

@@ -0,0 +1,96 @@
+package idea
+
+import (
+	"testing"
+	"time"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/api"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/web"
+)
+
+func ptr[T any](v T) *T { return &v }
+
+func TestParseListDefaults(t *testing.T) {
+	q, errs := parseList(api.ListIdeasParams{})
+	if len(errs) != 0 || q.page != 1 || q.size != 20 {
+		t.Fatalf("q=%+v errs=%v", q, errs)
+	}
+}
+
+func TestParseListErrors(t *testing.T) {
+	tests := []struct {
+		name string
+		p    api.ListIdeasParams
+		want []web.FieldError
+	}{
+		{"page 0", api.ListIdeasParams{Page: ptr(0)}, []web.FieldError{{Field: "page", Code: web.CodeOutOfRange}}},
+		{"size 101", api.ListIdeasParams{Size: ptr(101)}, []web.FieldError{{Field: "size", Code: web.CodeOutOfRange}}},
+		{"size 0", api.ListIdeasParams{Size: ptr(0)}, []web.FieldError{{Field: "size", Code: web.CodeOutOfRange}}},
+		{"bad org", api.ListIdeasParams{Org: ptr("XXXX")}, []web.FieldError{{Field: "org", Code: web.CodeInvalidEnum}}},
+		{"empty org not ignored", api.ListIdeasParams{Org: ptr("")}, []web.FieldError{{Field: "org", Code: web.CodeInvalidEnum}}},
+		{"lower-case category", api.ListIdeasParams{Category: ptr("cool_idea")}, []web.FieldError{{Field: "category", Code: web.CodeInvalidEnum}}},
+		{"bad direction", api.ListIdeasParams{Direction: ptr("X")}, []web.FieldError{{Field: "direction", Code: web.CodeInvalidEnum}}},
+		{"short emp no", api.ListIdeasParams{LeaderEmpNo: ptr("12345")}, []web.FieldError{{Field: "leaderEmpNo", Code: web.CodeInvalidFormat}}},
+		{"date only", api.ListIdeasParams{CreatedFrom: ptr("2026-01-01")}, []web.FieldError{{Field: "createdFrom", Code: web.CodeInvalidFormat}}},
+		{"no offset", api.ListIdeasParams{CreatedTo: ptr("2026-01-01T00:00:00")}, []web.FieldError{{Field: "createdTo", Code: web.CodeInvalidFormat}}},
+		{"all, in parameter order", api.ListIdeasParams{Size: ptr(500), Page: ptr(-1), Org: ptr("x"), CreatedTo: ptr("nope")},
+			[]web.FieldError{{Field: "page", Code: web.CodeOutOfRange}, {Field: "size", Code: web.CodeOutOfRange},
+				{Field: "org", Code: web.CodeInvalidEnum}, {Field: "createdTo", Code: web.CodeInvalidFormat}}},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			_, got := parseList(tc.p)
+			if len(got) != len(tc.want) {
+				t.Fatalf("got %v, want %v", got, tc.want)
+			}
+			for i := range got {
+				if got[i] != tc.want[i] {
+					t.Errorf("[%d] got %v, want %v", i, got[i], tc.want[i])
+				}
+			}
+		})
+	}
+}
+
+func TestParseListValid(t *testing.T) {
+	q, errs := parseList(api.ListIdeasParams{
+		Page: ptr(3), Size: ptr(100), Org: ptr("BSID"), Category: ptr("COOL_IDEA"), Direction: ptr("TALENT_DEVELOPMENT"),
+		LeaderEmpNo: ptr("000123"), CreatedFrom: ptr("2026-01-01T08:00:00+08:00"), CreatedTo: ptr("2026-02-01T00:00:00.5Z"),
+	})
+	if len(errs) != 0 {
+		t.Fatal(errs)
+	}
+	if q.page != 3 || q.size != 100 || q.filter.Org != "BSID" || q.filter.LeaderEmpNo != "000123" {
+		t.Errorf("q = %+v", q)
+	}
+	if !q.filter.CreatedFrom.Equal(time.Date(2026, 1, 1, 0, 0, 0, 0, time.UTC)) {
+		t.Errorf("from = %v", q.filter.CreatedFrom)
+	}
+}
+
+func TestParseListSortOrder(t *testing.T) {
+	for _, tc := range []struct {
+		sort, order *string
+		name, desc  bool
+	}{
+		{nil, nil, false, true},
+		{ptr("createdAt"), nil, false, true},
+		{ptr("createdAt"), ptr("asc"), false, false},
+		{ptr("name"), nil, true, false},
+		{ptr("name"), ptr("desc"), true, true},
+		{nil, ptr("asc"), false, false},
+	} {
+		q, errs := parseList(api.ListIdeasParams{Sort: tc.sort, Order: tc.order})
+		if len(errs) != 0 || q.filter.SortName != tc.name || q.filter.Desc != tc.desc {
+			t.Errorf("%v %v: %+v %v", tc.sort, tc.order, q.filter, errs)
+		}
+	}
+	_, errs := parseList(api.ListIdeasParams{Sort: ptr("id"), Order: ptr("DESC"), Q: ptr("x")})
+	if len(errs) != 2 || errs[0] != (web.FieldError{Field: "sort", Code: web.CodeInvalidEnum}) ||
+		errs[1] != (web.FieldError{Field: "order", Code: web.CodeInvalidEnum}) {
+		t.Errorf("errs = %v", errs)
+	}
+	if q, _ := parseList(api.ListIdeasParams{Q: ptr("50%_")}); q.filter.Q != "50%_" {
+		t.Errorf("q = %q", q.filter.Q)
+	}
+}

package/backend/internal/idea/service.go

@@ -0,0 +1,54 @@
+// Package idea owns the idea table and is the only way to read an Idea
+// (Backend.md 8): every read goes through the visibility query.
+package idea
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+
+	"github.com/google/uuid"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/audit"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/deadline"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/idea/internal/store"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/security"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/web"
+)
+
+// Idea is the module's read model of one Idea.
+type Idea = store.Idea
+
+// Service reads and creates Ideas.
+type Service struct {
+	DB    *sql.DB
+	Audit *audit.Service
+	// Gate, Slides and Aborter are needed by Create only; Objects by Create
+	// and Download.
+	Gate    deadline.SubmissionGate
+	Slides  SlideRules
+	Objects ObjectStore
+	Aborter UploadAborter
+}
+
+// Get returns the Idea if the caller may see it. A missing Idea and a hidden
+// one both return the same NOT_FOUND error; the handler audits it as DENIED.
+func (s *Service) Get(ctx context.Context, id uuid.UUID, caller security.Principal) (Idea, error) {
+	got, err := store.GetVisible(ctx, s.DB, id, caller.UserID, caller.IsAdmin())
+	if errors.Is(err, store.ErrNotFound) {
+		return Idea{}, web.NewError(web.CodeNotFound, "")
+	}
+	return got, err
+}
+
+// Summary is the module's read model of one list row.
+type Summary = store.Summary
+
+// ListFilter is the validated filter set of the list.
+type ListFilter = store.ListFilter
+
+// List returns one page of the Ideas the caller may see and the total match
+// count. limit and offset are already validated by the handler.
+func (s *Service) List(ctx context.Context, caller security.Principal, f ListFilter, limit, offset int) ([]Summary, int, error) {
+	return store.ListVisible(ctx, s.DB, caller.UserID, caller.IsAdmin(), f, limit, offset)
+}

package/backend/internal/server/api.go

@@ -7,6 +7,7 @@ import (
 	"github.com/brian-huanggg/AwardRegistration/backend/internal/api"
 	"github.com/brian-huanggg/AwardRegistration/backend/internal/auth"
 	"github.com/brian-huanggg/AwardRegistration/backend/internal/deadline"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/idea"
 )
 
 // API composes the module handlers into api.ServerInterface. Operations whose
@@ -19,6 +20,7 @@ type API struct {
 	Me       auth.MeHandler
 	Account  account.Handler
 	Deadline deadline.Handler
+	Ideas    idea.Handler
 }
 
 // GetDeadline serves GET /deadline.
@@ -42,3 +44,23 @@ func (a API) Logout(w http.ResponseWriter, r *http.Request, _ api.LogoutParams)
 
 // GetMe serves GET /auth/me.
 func (a API) GetMe(w http.ResponseWriter, r *http.Request) { a.Me.GetMe(w, r) }
+
+// GetIdea serves GET /ideas/{id}.
+func (a API) GetIdea(w http.ResponseWriter, r *http.Request, id api.IdeaId) {
+	a.Ideas.GetIdea(w, r, id)
+}
+
+// CreateIdea serves POST /ideas.
+func (a API) CreateIdea(w http.ResponseWriter, r *http.Request, _ api.CreateIdeaParams) {
+	a.Ideas.CreateIdea(w, r)
+}
+
+// ListIdeas serves GET /ideas.
+func (a API) ListIdeas(w http.ResponseWriter, r *http.Request, params api.ListIdeasParams) {
+	a.Ideas.ListIdeas(w, r, params)
+}
+
+// DownloadSlides serves GET /ideas/{id}/slides.
+func (a API) DownloadSlides(w http.ResponseWriter, r *http.Request, id api.IdeaId) {
+	a.Ideas.DownloadSlides(w, r, id)
+}

package/backend/internal/server/binding.go

@@ -18,6 +18,10 @@ func Mount(si api.ServerInterface) func(chi.Router) {
 			BaseRouter:       r,
 			ErrorHandlerFunc: BindingError,
 		})
+		// HEAD on the download must never run the GET handler, which writes an
+		// audit row (D47). chi already answers 405; the explicit route keeps
+		// the rule independent of that router default (D59).
+		r.Head(SlidesPath, web.MethodNotAllowed)
 	}
 }
 

package/backend/internal/server/public.go

@@ -31,6 +31,7 @@ var WriteActions = map[string]string{
 	http.MethodPost + " /api/v1/auth/login":    "AUTH_LOGIN",
 	http.MethodPost + " /api/v1/auth/register": "AUTH_REGISTER",
 	http.MethodPost + " /api/v1/auth/logout":   "AUTH_LOGOUT",
+	http.MethodPost + " /api/v1/ideas":         "IDEA_CREATE",
 }
 
 // ActionFor returns the audit action of r, or "" when unknown.

package/backend/internal/server/server.go

@@ -6,6 +6,7 @@ import (
 	"database/sql"
 	"log/slog"
 	"net/http"
+	"strings"
 	"sync/atomic"
 	"time"
 
@@ -32,13 +33,31 @@ func NewPublic(log *slog.Logger, mount func(chi.Router), extra ...func(http.Hand
 	}
 	// The chain wraps the router instead of using r.Use: chi skips r.Use
 	// middleware (also for NotFound) while no route is registered.
-	h := web.AcceptCheck(r)
+	h := web.AcceptCheck(r, IsFileDownload)
 	for i := len(extra) - 1; i >= 0; i-- {
 		h = extra[i](h)
 	}
 	return web.RequestID(web.AccessLog(log)(web.Recover(log)(h)))
 }
 
+// SlidesPath is the slide download route under /api/v1.
+const SlidesPath = "/api/v1/ideas/{id}/slides"
+
+// IsFileDownload reports whether r targets the slide download, which serves a
+// file and therefore skips the JSON Accept check. HEAD is included so that it
+// answers 405, never 406. Errors on this route are still problem+json.
+func IsFileDownload(r *http.Request) bool {
+	if r.Method != http.MethodGet && r.Method != http.MethodHead {
+		return false
+	}
+	rest, ok := strings.CutPrefix(r.URL.Path, "/api/v1/ideas/")
+	if !ok {
+		return false
+	}
+	id, tail, ok := strings.Cut(rest, "/")
+	return ok && id != "" && tail == "slides"
+}
+
 // Check reports whether one dependency is usable; a non-nil error makes
 // readiness answer 503. Only dependencies a request cannot do without belong
 // here: the database yes, MinIO no (PRD §8.3, Architecture §12).