Implements get photos for an item

README.md

@@ -43,6 +43,5 @@ All endpoints except `/signup` and `/login` require a JWT bearer token.
 
 ## TODO
 
-- `GET /hunt/{huntId}/team/{teamId}/item/{itemId}/photo` — list photos for a team's item
 - `GET /lead/hunt/{huntId}/team` — leaderboard: teams with scores for a hunt
 - `GET /lead/hunt/{huntId}/hunter` — leaderboard: hunters with scores for a hunt

src/main/kotlin/net/halfbinary/scavengerhuntapi/controller/ItemController.kt

@@ -30,7 +30,7 @@ class ItemController(private val huntService: HuntService) {
 
     @GetMapping("/{itemId}")
     fun getItem(@PathVariable huntId: HuntId, @PathVariable itemId: ItemId): ResponseEntity<ItemResponse> {
-        TODO("Get detailed information about the specified Item for the specified Hunt")
+        TODO("Maybe not needed: Get detailed information about the specified Item for the specified Hunt")
     }
 
     @PreAuthorize("hasRole('ADMIN')")

src/main/kotlin/net/halfbinary/scavengerhuntapi/controller/TeamController.kt

@@ -61,8 +61,9 @@ class TeamController(private val teamService: TeamService, private val photoServ
     @Operation(summary = "Get list of photo information for the specified Team, Hunt, and Item")
     fun getItemPhotos(@PathVariable huntId: HuntId,
                         @PathVariable teamId: TeamId,
-                        @PathVariable itemId: ItemId): ResponseEntity<List<PhotoResponse>> {
+                        @PathVariable itemId: ItemId,
-        TODO("Get list of photo information for the specified Team, Hunt, and Item")
+                        authentication: Authentication): ResponseEntity<List<PhotoResponse>> {
+        return ResponseEntity.ok(photoService.getItemPhotos(huntId, teamId, itemId, authentication.name))
     }
 
     @PatchMapping("/{teamId}/item/{itemId}/photo/{photoId}")

src/main/kotlin/net/halfbinary/scavengerhuntapi/service/PhotoService.kt

@@ -157,6 +157,24 @@ class PhotoService(
         photoRepository.save(photoRecord.copy(status = PhotoStatus.REMOVED, statusChangeDateTime = LocalDateTime.now()))
     }
 
+    fun getItemPhotos(huntId: HuntId, teamId: TeamId, itemId: ItemId, email: String): List<PhotoResponse> {
+        val requestingHunter = hunterService.getHunterByEmail(email)
+
+        if (!requestingHunter.isAdmin) {
+            val team = try {
+                teamService.getTeamForHunterInHunt(huntId, email)
+            } catch (_: NotFoundException) {
+                throw ForbiddenException()
+            }
+            if (team.id != teamId) throw ForbiddenException()
+        }
+
+        val teamHunterIds = teamService.getHunterIdsForTeam(teamId)
+        return photoRepository.findByHuntIdAndItemId(huntId, itemId)
+            .filter { it.hunterId in teamHunterIds && it.status != PhotoStatus.REMOVED }
+            .map { it.toDomain().toResponse(hunterService.getHunterById(it.hunterId)) }
+    }
+
     fun updatePhotoStatus(photoId: PhotoId, status: PhotoStatus) {
         val record = photoRepository.findByIdOrNull(photoId)
             ?: throw NotFoundException(PHOTO_NOT_FOUND)