feat(api): user-scope and org-scope project board endpoints #2
Reference in New Issue
Block a user
Delete Branch "user-org-project-api"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Closes #1.
Mirrors the existing repo-scope project board REST API onto user and org namespaces, so projects at
/{owner}/-/projects/become programmatically manageable (link issues, list column membership, move cards between columns) without browser-session auth.What's new
routers/api/v1/user/project.go— 13 handlers, registered under/api/v1/users/{username}/projects/...(gated byAccessTokenScopeCategoryIssue; writes require owner==doer or site admin)routers/api/v1/org/project.go— 13 handlers, registered under/api/v1/orgs/{org}/projects/...(writes requirereqOrgMembership())api_user_project_test.go,api_org_project_test.go) covering CRUD, columns, issue add/remove/move, list-per-column, and the permission matrixtestAPIMoveProjectIssuefor the existing repo-scopeMoveProjectIssueendpointmake generate-swaggerregeneratedtemplates/swagger/v1_json.tmplandv1_openapi3_json.tmplStyle choices
reqOrgMembership(), notreqOrgOwnership()— any org member can manage project boards, matching how the web UI behaves.ListProjectColumnIssuesfor user/org skips theOwner+Doerfilter — theproject_issueINNER JOIN oncolumn_idalready constrains the result. AddingOwnerwas over-restrictive in tests (issuePullAccessibleRepoCondexcluded valid issues). Trade-off: if issues from private repos the caller can't access end up on a board, they're listed. Matches the trust-the-board-membership pattern the web layer takes.Tests
Targeted run:
go test -tags sqlite -run 'TestAPIProjects|TestAPIUserProjects|TestAPIOrgProjects' ./tests/integration/...— all green.go vet,gofmtclean. No DB migrations needed (projecttable already hasOwnerID).Adds the missing REST surface that mirrors the existing repo-scope project API onto user and organization namespaces, so projects at /{owner}/-/projects/ become programmatically manageable (linking issues, listing column membership, moving cards between columns) without browser-session auth. Routes registered under /api/v1/users/{username}/projects/... and /api/v1/orgs/{org}/projects/..., gated by AccessTokenScopeCategoryIssue. User-scope writes require owner==doer or site admin; org-scope writes require org membership. Handlers copy the repo-scope shape rather than refactoring the existing repo handlers, keeping shipping code untouched. Integration tests cover CRUD, columns, issue add/remove/move, listing per column, and the permission matrix (owner/non-member/admin) for both scopes.The repo-scope POST .../projects/{id}/issues/{issue_id}/move handler had no test coverage. Adds testAPIMoveProjectIssue with happy-path move, 422 on non-existent target column, and 404 when the issue isn't in the project.