Bookstore API

// Task is the first prototype model. Its ID is a string (UUID) primary
// key rather than an int64 auto-increment column — goninja.NewUUID fills
// it in on Create — proving the generator's ID type isn't hardcoded to
// int64 (see Model.IDGoType in internal/codegen/ir.go).
type Task struct {
    ID    string `gorm:"primaryKey;type:uuid" json:"id" goninja:"list,retrieve"`
    Title string `json:"title" goninja:"list,retrieve,create,update" validate:"required,max=200"`
    Done  bool   `json:"done" goninja:"list,retrieve,create,update,filter"`
}

// Author is the second prototype model, distinct in shape from Task, used
// to prove the generator isn't special-cased to a single struct. Book
// (below) references it as a belongs-to relation, proving automatic
// Preload on Retrieve; Books here is the reverse side — a has-many
// relation — proving codegen's has-many support.
type Author struct {
    ID    string `gorm:"primaryKey;type:uuid" json:"id" goninja:"list,retrieve"`
    Name  string `json:"name" goninja:"list,retrieve,create,update,filter" validate:"required,max=120"`
    Bio   string `json:"bio" goninja:"retrieve,create,update" validate:"max=2000"`
    Books []Book `json:"books" goninja:"retrieve"`
}

// Book carries a real belongs-to relation to Author. Only the retrieve
// schema pulls in the full Author — list stays lean by construction.
// Price/Published/AuthorID/CreatedAt are filter-tagged, together
// exercising:
// GET /books?published=true&price_min=10&created_at=2024-01-01T00:00:00Z&order=-created_at&limit=20
type Book struct {
    ID        string    `gorm:"primaryKey;type:uuid" json:"id" goninja:"list,retrieve"`
    Title     string    `json:"title" goninja:"list,retrieve,create,update" validate:"required,max=200"`
    AuthorID  string    `json:"author_id" goninja:"list,retrieve,create,update,filter" validate:"required,uuid4"`
    Author    Author    `json:"author" goninja:"retrieve"`
    Price     float64   `json:"price" goninja:"list,retrieve,create,update,filter" validate:"min=0"`
    Published bool      `json:"published" goninja:"list,retrieve,create,update,filter"`
    CreatedAt time.Time `gorm:"autoCreateTime" json:"created_at" goninja:"list,retrieve,filter"`
}

$ go run ./cmd/goninja generate \
    -models ./examples/prototype/models \
    -out ./examples/prototype/internal/api \
    -package api \
    -models-import github.com/caspel26/goninja/examples/prototype/models

$ make generate-prototype

func main() {
    dsn := os.Getenv("PROTOTYPE_DSN")
    if dsn == "" {
        log.Fatal("PROTOTYPE_DSN is required, e.g. \"host=localhost user=youruser dbname=goninja_prototype sslmode=disable\"")
    }

    db, err := gorm.Open(postgres.Open(dsn), &gorm.Config{Logger: gormlogger.Default.LogMode(gormlogger.Warn)})
    if err != nil {
        log.Fatalf("connecting to database: %v", err)
    }

    if err := db.AutoMigrate(&models.Author{}, &models.Book{}, &models.Task{}); err != nil {
        log.Fatalf("running migrations: %v", err)
    }

    mux := http.NewServeMux()
    app := goninja.NewAPI("goninja prototype", "0.1.0")

    // PROTOTYPE_API_KEY is optional — set it to see goninja.Authenticator
    // protect create/update/delete (and, via actionAuth below, publish
    // too) end to end; unset, the prototype stays fully public for
    // frictionless local exploration. actionAuth is nil in that case, so
    // bookActions leaves publish's Auth unset (falls back to whatever
    // ResourceConfig.Auth/Config.DefaultAuth.Routes say, i.e. public here).
    apiKey := os.Getenv("PROTOTYPE_API_KEY")
    var actionAuth *goninja.RouteAuth
    if apiKey != "" {
        actionAuth = &goninja.RouteAuth{Auth: []goninja.Authenticator{newAPIKeyAuth(apiKey)}}
    }

    bookAPI := api.NewBookResource(db, goninja.Actions(bookActions, actionAuth)) // adds POST /books/{id}/publish; see bookpublish.go

    resources := []goninja.Resource{
        api.NewTaskResource(db),
        api.NewAuthorResource(db),
        bookAPI,
    }

    if apiKey != "" {
        cfg := goninja.Config{
            DefaultAuth: goninja.AuthPolicy{
                Routes: []goninja.Route{goninja.RouteCreate, goninja.RouteUpdate, goninja.RouteDelete},
                Auth:   []goninja.Authenticator{newAPIKeyAuth(apiKey)},
            },
        }
        app.MountWithConfig(mux, cfg, resources...)
        log.Println("PROTOTYPE_API_KEY set: create/update/delete/publish require X-API-Key")
    } else {
        app.Mount(mux, resources...)
    }
    // docsui.ReDoc() is a drop-in alternative to docsui.SwaggerUI() here.
    app.MountDocs(mux, "/docs", docsui.SwaggerUI())

    log.Fatal(http.ListenAndServe(":8080", mux))
}

type apiKeyUser struct{}

func (apiKeyUser) ID() string { return "api-key-client" }

// newAPIKeyAuth builds a goninja.APIKeyHeader — the built-in Authenticator
// for a credential carried in a header — against a real generated
// resource. A real deployment would look the key up against a store
// instead of comparing against one fixed value.
func newAPIKeyAuth(key string) goninja.APIKeyHeader {
    return goninja.APIKeyHeader{
        Verify: func(got string) (goninja.User, bool) {
            if subtle.ConstantTimeCompare([]byte(got), []byte(key)) != 1 {
                return nil, false
            }
            return apiKeyUser{}, true
        },
    }
}

// bookActions returns the custom actions to declare on r via
// goninja.Actions (main.go) — auth may be nil, see the "Auth on an
// Action" section of Custom Actions for why it's a parameter here
// instead of a separate Config.DefaultAuth.Routes entry.
func bookActions(r *api.BookResource, auth *goninja.RouteAuth) []goninja.Action {
    return []goninja.Action{
        {
            Name:    "publish",
            Detail:  true,
            Method:  http.MethodPost,
            UrlPath: "publish",
            Handler: publishBookHandler(r),
            Summary: "Publish a book",
            Responses: map[string]openapi.Response{
                "200": {Description: "OK"},
                "404": {Description: "Not found"},
            },
            Auth: auth,
        },
    }
}

// publishBookHandler flips a book's Published flag and returns the
// updated row — reuses the generated Retrieve to build the response
// instead of duplicating its Preload/error-mapping logic.
func publishBookHandler(r *api.BookResource) http.HandlerFunc {
    return func(w http.ResponseWriter, req *http.Request) {
        ctx := req.Context()
        id := req.PathValue("id")
        if err := r.DB(ctx).Model(&models.Book{}).Where("id = ?", id).
            Update("published", true).Error; err != nil {
            goninja.Respond(w, r.ErrorMapper(), err)
            return
        }
        out, err := r.Retrieve(ctx, id)
        if err != nil {
            goninja.Respond(w, r.ErrorMapper(), err)
            return
        }
        goninja.RespondJSON(w, http.StatusOK, out)
    }
}

$ export PROTOTYPE_DSN="host=localhost user=$(whoami) dbname=goninja_prototype sslmode=disable"
$ make run-prototype