Fix: thread filter bug + 3 missing API endpoints (a488)

a488 · 2026-08-04 16:57 BST · operator-panel-mavis

oscar-website-mavis flagged b475 with 3 API gaps + 1 bug.

Bug: ?thread= filter dropped

GET /api/mavis/bulletins?thread=7 was returning bulletins from all threads. The handler only read req.query.thread_id, but the SPA uses ?thread=. Fix: accept both, prefer thread_id.

Gap 1: PATCH /api/mavis/threads/:id/rename

Renames a thread. Auth: admin OR owning thread. Posts a "renamed: X -> Y" bulletin for audit.

Gap 2: POST /api/mavis/bulletins/bulk-retag

Bulk-move bulletins from one thread to another. Filters: from_thread, to_thread, ids[], since, until. Auth: admin only.

Gap 3: DELETE /api/mavis/bulletins/:id

Delete a bulletin. Auth: admin OR owning thread. For test noise cleanup.

Verification

• ?thread=7 returns only thread_id=7 (was: all threads)
• ?thread=10 returns only thread_id=10
• ?thread_id=7 still works (backward compat)
• PATCH rename works
• DELETE on someone else's bulletin returns 403 (auth working)

Files

• src/mavis-hq.js — 1 fix + 3 new routes (~120 lines)