* Protected API route to update selection description
*
* @route PATCH /api/files/selections/:selectionId/description
* @authentication Required
* @param {string} selectionId - Selection ID from URL parameter
* @param {Object} body - Request body containing description
* @returns {Object} Response containing updated selection
* @error 400 - If selectionId is invalid or description is missing
* @error 403 - If user doesn't have EDIT permission for the dataset
* @error 404 - If selection not found
* @error 500 - If database operation fails
* @description Updates the description for a specific selection
*/
files.patch("/selections/:selectionId/description", authenticate, async (c) => {
try {
const jwtPayload = (c as unknown as { jwtPayload: JWTPayload }).jwtPayload;
const userId = jwtPayload.sub;
const selectionId = c.req.param("selectionId");
// Validate selection ID format
if (!isValidFileId(selectionId)) {
return c.json({
error: "Invalid selection ID format"
}, 400);
}
// Parse request body
const body = await c.req.json();
const { description } = body;
if (typeof description !== 'string') {
return c.json({
error: "Missing or invalid description"
}, 400);
}
// Connect to database
const db = createDatabase(c.env);
// Get selection and dataset info for permission check
const selectionResult = await db
.select({
id: selection.id,
datasetId: selection.datasetId,
active: selection.active
})
.from(selection)
.where(eq(selection.id, selectionId))
.limit(1);
if (selectionResult.length === 0) {
return c.json({
error: "Selection not found"
}, 404);
}
const selectionRecord = selectionResult[0];
if (!selectionRecord.active) {
return c.json({
error: "Selection is not active"
}, 404);
}
// Check if user has EDIT permission for this dataset
const hasPermission = await checkUserPermission(db, userId, selectionRecord.datasetId, 'EDIT');
if (!hasPermission) {
return c.json({
error: "Access denied: No EDIT permission for this dataset"
}, 403);
}
// Update the selection description
await db
.update(selection)
.set({
description: description || null,
lastModified: new Date(),
modifiedBy: userId
})
.where(eq(selection.id, selectionId));
return c.json({
data: {
selectionId,
description
}
});
} catch (error) {
return c.json(standardErrorResponse(error, "updating selection description"), 500);
}
});
/**