issue-7: add moderation flow

[toan-nsc]

Closes #7 :

Add new moderation link on profile for Admin

Only show approved record on browse screen

Displaying the record status on My Profile

Displaying record in queue and history

Summary by CodeRabbit

• New Features
  • Add a moderation workflow for administrators to review, approve, reject, or flag records.
  • New Moderation Queue page with pagination, per-record action buttons, and moderation history.
  • Per-record async actions with loading indicators, success/error toasts, and automatic refresh.
  • Profile UI updates showing moderation status badges and an admin-only Moderation Queue button.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds a moderation subsystem: frontend JS for moderation actions, backend Go moderation repository and HTTP handlers, DB migrations for moderation_status and moderation_actions, template updates for moderation UI and profile admin controls, and wiring in main.go to expose moderation routes and admin checks.

Changes

Cohort / File(s)	Summary
Frontend Moderation UI src/index.js	Added initializeModerationButtons() and moderateRecord() to attach delegated click handlers, manage per-record button/spinner states, POST moderation actions to /api/v1/moderation/{id}, show success/error toasts, and reload on completion.
Moderation Repository & Data Models src/moderation.go, src/model.go	New ModerationStatus type and constants, ModerationAction and ModerationHistoryEntry structs, ModerationRepository interface, and PostgresModerationRepository implementation with methods for status, pending/flagged record queries, action logging, and history. Added helper funcs IsModerationEnabled() and GetInitialModerationStatus(). Also introduced public models (Record, RecordHistory, Category, User, App, RecordPageData) used by handlers/templates.
Moderation HTTP Handler src/moderation_handler.go	New ModerationHandler with GetModerationQueue() (admin auth, pagination, pending records, optional history, template render) and ModerateRecord() (admin auth, UUID validation, JSON decode, status update, action logging, JSON response). Router wired for GET /moderation and POST /api/v1/moderation/{id}.
Record Repository Updates src/record_repository.go	Public-facing queries now filter moderation_status = 'approved', scanning and assigning moderation_status to Record.ModerationStatus, initializing moderation_status on create via GetInitialModerationStatus(), and adjusting counts/pagination to reflect approval filter.
Main Server Wiring src/main.go	Removed several type declarations from this file (moved to model.go), added moderationRepo and moderationHandler, wired API route /api/v1/moderation/ and HTML route /moderation, added admin check to profile data and IsAdmin propagation, minor import cleanup.
Database Migrations src/sql/006_add_moderation.up.sql, src/sql/006_add_moderation.down.sql	Up: add moderation_status column (default 'approved'), index, and moderation_actions table with indexes; initialize existing rows. Down: drop moderation_actions, index, and moderation_status column.
Templates — Moderation & Profile src/templates/moderation.html, src/templates/profile.html	New moderation queue template rendering pending records, approve/reject buttons, spinners, pagination, and moderation history. Profile template updated with admin-only moderation queue button and Status column/badges in "My Entries" table.

Sequence Diagrams

sequenceDiagram
    participant Admin as Admin (Browser)
    participant UI as Frontend JS
    participant API as Moderation API
    participant Repo as Moderation Repo
    participant DB as PostgreSQL

    Admin->>UI: Click Approve/Reject
    activate UI
    UI->>UI: disable buttons, show spinner
    UI->>API: POST /api/v1/moderation/{id} {action}
    deactivate UI

    activate API
    API->>API: authenticate & verify admin
    API->>API: validate UUID, parse action
    API->>Repo: SetRecordStatus(recordId, status)
    activate Repo
    Repo->>DB: UPDATE records SET moderation_status = ?
    DB-->>Repo: OK
    Repo->>DB: INSERT INTO moderation_actions(...)
    DB-->>Repo: OK
    Repo-->>API: success
    deactivate Repo
    API-->>UI: 200 {status}
    deactivate API

    activate UI
    UI->>UI: show toast, reload after toast
    deactivate UI

Loading

sequenceDiagram
    participant Admin as Admin (Browser)
    participant Handler as Moderation Handler
    participant Repo as Moderation Repo
    participant RecordRepo as Record Repository
    participant DB as PostgreSQL
    participant Template as Template Engine

    Admin->>Handler: GET /moderation?page=1
    activate Handler
    Handler->>Handler: authenticate & verify admin
    Handler->>Repo: GetPendingRecords(limit, offset)
    activate Repo
    Repo->>DB: SELECT records WHERE moderation_status='pending_review'
    DB-->>Repo: rows
    Repo->>RecordRepo: enrich records (categories, ror)
    activate RecordRepo
    RecordRepo->>DB: JOIN queries
    DB-->>RecordRepo: related data
    RecordRepo-->>Repo: enriched records
    deactivate RecordRepo
    Repo-->>Handler: []records, total
    deactivate Repo
    Handler->>Repo: GetRecentModerationHistory(limit)
    activate Repo
    Repo->>DB: SELECT FROM moderation_actions ORDER BY created_at DESC
    DB-->>Repo: history
    Repo-->>Handler: []history entries
    deactivate Repo
    Handler->>Template: render moderation.html (records, history, pagination)
    Template-->>Handler: HTML
    Handler-->>Admin: 200 OK (HTML)
    deactivate Handler

Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~50 minutes

Poem

🐰 A little rabbit hops with cheer,
Buttons clicked, the queue draws near,
Approve, reject — the log grows long,
History hums a steady song,
Moderation done, the garden's clear!

---

📜 Recent review details

Configuration used: defaults

Review profile: CHILL

Plan: Free

📥 Commits

Reviewing files that changed from the base of the PR and between ecd2fab and cf3422a.

📒 Files selected for processing (1)

• src/model.go

---

Note

🎁 Summarized by CodeRabbit Free

Your organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Pro by visiting https://app.coderabbit.ai/login.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[NicolasCARPi]

how about moderation_status with 0 for pending approval, -1 for reject and 1 for approved. Instead of a varchar, unless there are other status? Or good reasons to use an english string value?

[toan-nsc]

We can change to number, it's just convention for human friendly. But we need a mapping from number -> status when change to using number

[NicolasCARPi]

thanks!