task-master/internal/daemon/api/ticket_handlers.go

package api

import (
	"net/http"

	"task/internal/command"
	"task/internal/ticket"
)

func (s *Server) handleListTickets(w http.ResponseWriter, r *http.Request) {
	projectID := r.URL.Query().Get("projectId")
	if projectID == "" {
		writeErr(w, http.StatusBadRequest, "projectId query required")
		return
	}
	if !requireMCPProject(r, projectID) {
		writeErr(w, http.StatusForbidden, "mcp token project mismatch")
		return
	}
	list, err := s.store.List(projectID)
	if err != nil {
		writeErr(w, http.StatusInternalServerError, err.Error())
		return
	}
	writeJSON(w, http.StatusOK, list)
}

func (s *Server) handleGetTicket(w http.ResponseWriter, r *http.Request) {
	id := r.PathValue("id")
	t, err := s.store.Get(id)
	if err != nil {
		writeErr(w, http.StatusNotFound, err.Error())
		return
	}
	if !requireMCPProject(r, t.ProjectID) {
		writeErr(w, http.StatusForbidden, "mcp token project mismatch")
		return
	}
	writeJSON(w, http.StatusOK, t)
}

func (s *Server) handleCreateTicket(w http.ResponseWriter, r *http.Request) {
	var body ticket.Ticket
	if err := readJSON(r, &body); err != nil {
		writeErr(w, http.StatusBadRequest, err.Error())
		return
	}
	if !requireMCPProject(r, body.ProjectID) {
		writeErr(w, http.StatusForbidden, "mcp token project mismatch")
		return
	}
	cmd := &command.CreateTicket{Store: s.store, Ticket: body}
	if err := s.history.Do(cmd); err != nil {
		writeErr(w, http.StatusBadRequest, err.Error())
		return
	}
	s.notify(cmd.Ticket.ProjectID)
	writeJSON(w, http.StatusCreated, cmd.Ticket)
}

func (s *Server) handleUpdateTicket(w http.ResponseWriter, r *http.Request) {
	id := r.PathValue("id")
	before, err := s.store.Get(id)
	if err != nil {
		writeErr(w, http.StatusNotFound, err.Error())
		return
	}
	if !requireMCPProject(r, before.ProjectID) {
		writeErr(w, http.StatusForbidden, "mcp token project mismatch")
		return
	}
	var after ticket.Ticket
	if err := readJSON(r, &after); err != nil {
		writeErr(w, http.StatusBadRequest, err.Error())
		return
	}
	after.ID = id
	if after.ProjectID == "" {
		after.ProjectID = before.ProjectID
	}
	if !requireMCPProject(r, after.ProjectID) {
		writeErr(w, http.StatusForbidden, "mcp token project mismatch")
		return
	}
	cmd := &command.UpdateTicket{Store: s.store, Before: before, After: after}
	if err := s.history.Do(cmd); err != nil {
		writeErr(w, http.StatusBadRequest, err.Error())
		return
	}
	s.notify(after.ProjectID)
	writeJSON(w, http.StatusOK, after)
}

func (s *Server) handleDeleteTicket(w http.ResponseWriter, r *http.Request) {
	id := r.PathValue("id")
	before, err := s.store.Get(id)
	if err != nil {
		writeErr(w, http.StatusNotFound, err.Error())
		return
	}
	if !requireMCPProject(r, before.ProjectID) {
		writeErr(w, http.StatusForbidden, "mcp token project mismatch")
		return
	}
	cmd := &command.DeleteTicket{Store: s.store, Snapshot: before}
	if err := s.history.Do(cmd); err != nil {
		writeErr(w, http.StatusBadRequest, err.Error())
		return
	}
	s.notify(before.ProjectID)
	w.WriteHeader(http.StatusNoContent)
}

func (s *Server) handleMoveTicket(w http.ResponseWriter, r *http.Request) {
	id := r.PathValue("id")
	before, err := s.store.Get(id)
	if err != nil {
		writeErr(w, http.StatusNotFound, err.Error())
		return
	}
	if !requireMCPProject(r, before.ProjectID) {
		writeErr(w, http.StatusForbidden, "mcp token project mismatch")
		return
	}
	var body struct {
		ToProjectID string `json:"toProjectId"`
	}
	if err := readJSON(r, &body); err != nil {
		writeErr(w, http.StatusBadRequest, err.Error())
		return
	}
	// MCP may only move within its project (no cross-project).
	if ClientKind(r.Context()) == ClientMCP && body.ToProjectID != MCPProjectID(r.Context()) {
		writeErr(w, http.StatusForbidden, "mcp cannot move tickets to another project")
		return
	}
	after := before
	after.ProjectID = body.ToProjectID
	cmd := &command.MoveTicket{Store: s.store, TimeStore: s.timeStore, Before: before, After: after}
	if err := s.history.Do(cmd); err != nil {
		writeErr(w, http.StatusBadRequest, err.Error())
		return
	}
	s.notify(before.ProjectID)
	s.notify(body.ToProjectID)
	writeJSON(w, http.StatusOK, cmd.After)
}