mastodon/app/controllers/api/v1/collection_items_controller.rb

# frozen_string_literal: true

class Api::V1::CollectionItemsController < Api::BaseController
  include Authorization
  include DeprecationConcern

  deprecate_api '2026-06-10', if: :alpha_path?

  before_action -> { doorkeeper_authorize! :write, :'write:collections' }

  before_action :require_user!

  before_action :set_collection
  before_action :set_account, only: [:create]
  before_action :set_collection_item, only: [:destroy, :revoke]

  after_action :verify_authorized

  def create
    authorize @collection, :update?
    authorize @account, :feature?

    @item = AddAccountToCollectionService.new.call(@collection, @account)

    render json: @item, serializer: REST::CollectionItemSerializer, adapter: :json
  end

  def destroy
    authorize @collection, :update?

    DeleteCollectionItemService.new.call(@collection_item)

    head 200
  end

  def revoke
    authorize @collection_item, :revoke?

    RevokeCollectionItemService.new.call(@collection_item)

    head 200
  end

  private

  def set_collection
    @collection = Collection.find(params[:collection_id])
  end

  def set_account
    return render(json: { error: '`account_id` parameter is missing' }, status: 422) if params[:account_id].blank?

    @account = Account.without_requested_deletion.find(params[:account_id])
  end

  def set_collection_item
    @collection_item = @collection.collection_items.find(params[:id])
  end
end