internal/web/posts.go

@@ -14,6 +14,8 @@ import (
 	"plumber/internal/store"
 )
 
+// handleCreatePost creates either a root question or a reply. Replies are
+// limited to the root author and admins, and cannot be added to hidden threads.
 func (s *Server) handleCreatePost(w http.ResponseWriter, r *http.Request) {
 	if !s.requireCSRF(w, r) {
 		return
@@ -84,6 +86,8 @@ func (s *Server) handleCreatePost(w http.ResponseWriter, r *http.Request) {
 	)
 }
 
+// handleEditPost updates only a post's body after verifying that the current
+// homeowner owns it or that an admin is editing an admin-authored post.
 func (s *Server) handleEditPost(w http.ResponseWriter, r *http.Request) {
 	if !s.requireCSRF(w, r) {
 		return
@@ -134,6 +138,8 @@ func (s *Server) handleEditPost(w http.ResponseWriter, r *http.Request) {
 	)
 }
 
+// postAndRoot loads a post and follows its immutable parent chain to the root.
+// It returns both so callers can authorize against the thread and redirect to it.
 func (s *Server) postAndRoot(ctx context.Context, postID string) (*store.Post, *store.Post, error) {
 	postID = strings.TrimSpace(postID)
 	if postID == "" {
@@ -158,6 +164,8 @@ func (s *Server) postAndRoot(ctx context.Context, postID string) (*store.Post, *
 	return post, current, nil
 }
 
+// canEditPost keeps homeowner posts owner-only while allowing admins to edit
+// posts authored by an admin.
 func canEditPost(user *store.User, post *store.Post) bool {
 	if user == nil || post == nil {
 		return false