// Copyright (c) 2019-2026 Alexander Medvednikov. All rights reserved.
// Use of this source code is governed by a GPL license that can be found in the LICENSE file.
module main

import veb

struct ApiRepoView {
    id          int
    name        string
    full_name   string
    user_name   string
    description string
    is_public   bool
    stars       int
    open_issues int
    open_prs    int
    branches    int
    created_at  int
}

struct ApiIssueView {
    id             int
    number         int
    repo_id        int
    title          string
    body           string
    author         string
    status         string
    comments_count int
    created_at     int
}

struct ApiPullView {
    id             int
    repo_id        int
    title          string
    description    string
    head_branch    string
    base_branch    string
    author         string
    status         string
    comments_count int
    created_at     int
    merged_at      int
}

struct ApiUserView {
    id        int
    username  string
    full_name string
    avatar    string
}

struct ApiCommentView {
    id         int
    author     string
    text       string
    created_at int
}

fn (mut app App) repo_to_api(repo Repo) ApiRepoView {
    return ApiRepoView{
        id:          repo.id
        name:        repo.name
        full_name:   '${repo.user_name}/${repo.name}'
        user_name:   repo.user_name
        description: repo.description
        is_public:   repo.is_public
        stars:       repo.nr_stars
        open_issues: repo.nr_open_issues
        open_prs:    repo.nr_open_prs
        branches:    repo.nr_branches
        created_at:  repo.created_at
    }
}

fn (mut app App) issue_to_api(issue Issue) ApiIssueView {
    author := app.get_username_by_id(issue.author_id) or { '' }
    status := if issue.status == .closed { 'closed' } else { 'open' }
    return ApiIssueView{
        id:             issue.id
        number:         issue.id
        repo_id:        issue.repo_id
        title:          issue.title
        body:           issue.text
        author:         author
        status:         status
        comments_count: issue.comments_count
        created_at:     issue.created_at
    }
}

fn (mut app App) pr_to_api(pr PullRequest) ApiPullView {
    author := app.get_username_by_id(pr.author_id) or { '' }
    status := match unsafe { PrStatus(pr.status) } {
        .open { 'open' }
        .closed { 'closed' }
        .merged { 'merged' }
    }

    return ApiPullView{
        id:             pr.id
        repo_id:        pr.repo_id
        title:          pr.title
        description:    pr.description
        head_branch:    pr.head_branch
        base_branch:    pr.base_branch
        author:         author
        status:         status
        comments_count: pr.comments_count
        created_at:     pr.created_at
        merged_at:      pr.merged_at
    }
}

fn (ctx &Context) api_bearer_token() string {
    header := ctx.get_header(.authorization) or { return '' }
    parts := header.fields()
    if parts.len != 2 || parts[0] != 'Bearer' {
        return ''
    }
    return parts[1]
}

fn (mut app App) api_user_from_ctx(ctx &Context) ?User {
    token := ctx.api_bearer_token()
    if token == '' {
        if ctx.logged_in {
            return ctx.user
        }
        return none
    }
    return app.user_for_api_token(token)
}

fn (mut ctx Context) api_unauthorized() veb.Result {
    ctx.send_custom_error(401, 'Unauthorized')
    return ctx.json({
        'success': 'false'
        'message': 'authentication required'
    })
}

fn (mut ctx Context) api_not_found() veb.Result {
    ctx.send_custom_error(404, 'Not Found')
    return ctx.json({
        'success': 'false'
        'message': 'not found'
    })
}

@['/api/v1/me']
pub fn (mut app App) api_v1_me(mut ctx Context) veb.Result {
    user := app.api_user_from_ctx(ctx) or { return ctx.api_unauthorized() }
    return ctx.json(ApiUserView{
        id:        user.id
        username:  user.username
        full_name: user.full_name
        avatar:    user.avatar
    })
}

@['/api/v1/users/:username']
pub fn (mut app App) api_v1_user(mut ctx Context, username string) veb.Result {
    user := app.get_user_by_username(username) or { return ctx.api_not_found() }
    return ctx.json(ApiUserView{
        id:        user.id
        username:  user.username
        full_name: user.full_name
        avatar:    user.avatar
    })
}

@['/api/v1/users/:username/repos']
pub fn (mut app App) api_v1_user_repos(mut ctx Context, username string) veb.Result {
    user := app.get_user_by_username(username) or { return ctx.api_not_found() }
    repos := app.find_user_public_repos(user.id)
    mut out := []ApiRepoView{cap: repos.len}
    for r in repos {
        out << app.repo_to_api(r)
    }
    return ctx.json(out)
}

@['/api/v1/repos/:username/:repo_name']
pub fn (mut app App) api_v1_repo(mut ctx Context, username string, repo_name string) veb.Result {
    repo := app.find_repo_by_name_and_username(repo_name, username) or {
        return ctx.api_not_found()
    }
    caller := app.api_user_from_ctx(ctx) or { User{} }
    if !repo.is_public && !app.has_user_repo_read_access(ctx, caller.id, repo.id) {
        return ctx.api_not_found()
    }
    return ctx.json(app.repo_to_api(repo))
}

@['/api/v1/repos/:username/:repo_name/issues']
pub fn (mut app App) api_v1_repo_issues(mut ctx Context, username string, repo_name string) veb.Result {
    repo := app.find_repo_by_name_and_username(repo_name, username) or {
        return ctx.api_not_found()
    }
    caller := app.api_user_from_ctx(ctx) or { User{} }
    if !repo.is_public && !app.has_user_repo_read_access(ctx, caller.id, repo.id) {
        return ctx.api_not_found()
    }
    issues := app.find_repo_issues_as_page(repo.id, 0)
    mut out := []ApiIssueView{cap: issues.len}
    for i in issues {
        out << app.issue_to_api(i)
    }
    return ctx.json(out)
}

@['/api/v1/repos/:username/:repo_name/issues/:id']
pub fn (mut app App) api_v1_repo_issue(mut ctx Context, username string, repo_name string, id string) veb.Result {
    repo := app.find_repo_by_name_and_username(repo_name, username) or {
        return ctx.api_not_found()
    }
    caller := app.api_user_from_ctx(ctx) or { User{} }
    if !repo.is_public && !app.has_user_repo_read_access(ctx, caller.id, repo.id) {
        return ctx.api_not_found()
    }
    issue := app.find_issue_by_id(id.int()) or { return ctx.api_not_found() }
    if issue.repo_id != repo.id {
        return ctx.api_not_found()
    }
    return ctx.json(app.issue_to_api(issue))
}

@['/api/v1/repos/:username/:repo_name/issues'; post]
pub fn (mut app App) api_v1_create_issue(mut ctx Context, username string, repo_name string) veb.Result {
    user := app.api_user_from_ctx(ctx) or { return ctx.api_unauthorized() }
    repo := app.find_repo_by_name_and_username(repo_name, username) or {
        return ctx.api_not_found()
    }
    if !app.has_user_repo_read_access(ctx, user.id, repo.id) && !repo.is_public {
        return ctx.api_not_found()
    }
    title := ctx.form['title']
    body := ctx.form['body']
    if title == '' {
        ctx.send_custom_error(400, 'Bad Request')
        return ctx.json({
            'success': 'false'
            'message': 'title is required'
        })
    }
    new_id := app.add_issue_returning_id(repo.id, user.id, title, body) or {
        ctx.send_custom_error(500, 'Internal Server Error')
        return ctx.json({
            'success': 'false'
            'message': 'failed to create issue'
        })
    }
    issue := app.find_issue_by_id(new_id) or { return ctx.api_not_found() }
    return ctx.json(app.issue_to_api(issue))
}

@['/api/v1/repos/:username/:repo_name/pulls']
pub fn (mut app App) api_v1_repo_pulls(mut ctx Context, username string, repo_name string) veb.Result {
    repo := app.find_repo_by_name_and_username(repo_name, username) or {
        return ctx.api_not_found()
    }
    caller := app.api_user_from_ctx(ctx) or { User{} }
    if !repo.is_public && !app.has_user_repo_read_access(ctx, caller.id, repo.id) {
        return ctx.api_not_found()
    }
    prs := app.find_repo_pull_requests(repo.id, .open)
    mut out := []ApiPullView{cap: prs.len}
    for pr in prs {
        out << app.pr_to_api(pr)
    }
    return ctx.json(out)
}

@['/api/v1/repos/:username/:repo_name/pulls/:id']
pub fn (mut app App) api_v1_repo_pull(mut ctx Context, username string, repo_name string, id string) veb.Result {
    repo := app.find_repo_by_name_and_username(repo_name, username) or {
        return ctx.api_not_found()
    }
    caller := app.api_user_from_ctx(ctx) or { User{} }
    if !repo.is_public && !app.has_user_repo_read_access(ctx, caller.id, repo.id) {
        return ctx.api_not_found()
    }
    pr := app.find_pull_request_by_id(id.int()) or { return ctx.api_not_found() }
    if pr.repo_id != repo.id {
        return ctx.api_not_found()
    }
    return ctx.json(app.pr_to_api(pr))
}

@['/api/v1/repos/:username/:repo_name/pulls/:id/comments']
pub fn (mut app App) api_v1_pull_comments(mut ctx Context, username string, repo_name string, id string) veb.Result {
    repo := app.find_repo_by_name_and_username(repo_name, username) or {
        return ctx.api_not_found()
    }
    caller := app.api_user_from_ctx(ctx) or { User{} }
    if !repo.is_public && !app.has_user_repo_read_access(ctx, caller.id, repo.id) {
        return ctx.api_not_found()
    }
    pr := app.find_pull_request_by_id(id.int()) or { return ctx.api_not_found() }
    if pr.repo_id != repo.id {
        return ctx.api_not_found()
    }
    comments := app.get_pr_comments(pr.id)
    mut out := []ApiCommentView{cap: comments.len}
    for c in comments {
        author := app.get_username_by_id(c.author_id) or { '' }
        out << ApiCommentView{
            id:         c.id
            author:     author
            text:       c.text
            created_at: c.created_at
        }
    }
    return ctx.json(out)
}

struct ApiDiscussionView {
    id             int
    repo_id        int
    title          string
    body           string
    category       string
    author         string
    is_locked      bool
    is_answered    bool
    answer_id      int
    comments_count int
    created_at     int
}

struct ApiMilestoneView {
    id          int
    repo_id     int
    title       string
    description string
    due_date    int
    is_closed   bool
    created_at  int
}

struct ApiProjectView {
    id          int
    repo_id     int
    name        string
    description string
    created_at  int
}

struct ApiProjectCardView {
    id         int
    column_id  int
    title      string
    note       string
    position   int
    issue_id   int
    created_at int
}

struct ApiProjectColumnView {
    id         int
    project_id int
    name       string
    position   int
    cards      []ApiProjectCardView
}

struct ApiProjectDetailView {
    project ApiProjectView
    columns []ApiProjectColumnView
}

struct ApiWebhookView {
    id            int
    repo_id       int
    url           string
    events        []string
    is_active     bool
    last_status   int
    last_delivery int
    created_at    int
}

fn (mut app App) discussion_to_api(d Discussion) ApiDiscussionView {
    author := app.get_username_by_id(d.author_id) or { '' }
    return ApiDiscussionView{
        id:             d.id
        repo_id:        d.repo_id
        title:          d.title
        body:           d.body
        category:       d.category
        author:         author
        is_locked:      d.is_locked
        is_answered:    d.is_answered
        answer_id:      d.answer_id
        comments_count: d.comments_count
        created_at:     d.created_at
    }
}

fn (mut app App) milestone_to_api(m Milestone) ApiMilestoneView {
    return ApiMilestoneView{
        id:          m.id
        repo_id:     m.repo_id
        title:       m.title
        description: m.description
        due_date:    m.due_date
        is_closed:   m.is_closed
        created_at:  m.created_at
    }
}

fn (mut app App) project_to_api(p Project) ApiProjectView {
    return ApiProjectView{
        id:          p.id
        repo_id:     p.repo_id
        name:        p.name
        description: p.description
        created_at:  p.created_at
    }
}

fn (mut app App) project_card_to_api(c ProjectCard) ApiProjectCardView {
    return ApiProjectCardView{
        id:         c.id
        column_id:  c.column_id
        title:      c.title
        note:       c.note
        position:   c.position
        issue_id:   c.issue_id
        created_at: c.created_at
    }
}

fn (w &Webhook) to_api() ApiWebhookView {
    return ApiWebhookView{
        id:            w.id
        repo_id:       w.repo_id
        url:           w.url
        events:        w.event_list()
        is_active:     w.is_active
        last_status:   w.last_status
        last_delivery: w.last_delivery
        created_at:    w.created_at
    }
}

@['/api/v1/repos/:username/:repo_name/discussions']
pub fn (mut app App) api_v1_repo_discussions(mut ctx Context, username string, repo_name string) veb.Result {
    repo := app.find_repo_by_name_and_username(repo_name, username) or {
        return ctx.api_not_found()
    }
    caller := app.api_user_from_ctx(ctx) or { User{} }
    if !repo.is_public && !app.has_user_repo_read_access(ctx, caller.id, repo.id) {
        return ctx.api_not_found()
    }
    discussions := app.list_repo_discussions(repo.id)
    mut out := []ApiDiscussionView{cap: discussions.len}
    for d in discussions {
        out << app.discussion_to_api(d)
    }
    return ctx.json(out)
}

@['/api/v1/repos/:username/:repo_name/discussions/:id']
pub fn (mut app App) api_v1_repo_discussion(mut ctx Context, username string, repo_name string, id string) veb.Result {
    repo := app.find_repo_by_name_and_username(repo_name, username) or {
        return ctx.api_not_found()
    }
    caller := app.api_user_from_ctx(ctx) or { User{} }
    if !repo.is_public && !app.has_user_repo_read_access(ctx, caller.id, repo.id) {
        return ctx.api_not_found()
    }
    discussion := app.find_discussion(id.int()) or { return ctx.api_not_found() }
    if discussion.repo_id != repo.id {
        return ctx.api_not_found()
    }
    return ctx.json(app.discussion_to_api(discussion))
}

@['/api/v1/repos/:username/:repo_name/discussions'; post]
pub fn (mut app App) api_v1_create_discussion(mut ctx Context, username string, repo_name string) veb.Result {
    user := app.api_user_from_ctx(ctx) or { return ctx.api_unauthorized() }
    repo := app.find_repo_by_name_and_username(repo_name, username) or {
        return ctx.api_not_found()
    }
    if !repo.is_public && !app.has_user_repo_read_access(ctx, user.id, repo.id) {
        return ctx.api_not_found()
    }
    title := ctx.form['title']
    body := ctx.form['body']
    raw_cat := ctx.form['category']
    if title == '' {
        ctx.send_custom_error(400, 'Bad Request')
        return ctx.json({
            'success': 'false'
            'message': 'title is required'
        })
    }
    cat := if raw_cat in ['general', 'qa', 'announcement', 'idea'] { raw_cat } else { 'general' }
    new_id := app.add_discussion(repo.id, user.id, title, body, cat) or {
        ctx.send_custom_error(500, 'Internal Server Error')
        return ctx.json({
            'success': 'false'
            'message': 'failed to create discussion'
        })
    }
    discussion := app.find_discussion(new_id) or { return ctx.api_not_found() }
    return ctx.json(app.discussion_to_api(discussion))
}

@['/api/v1/repos/:username/:repo_name/discussions/:id/comments']
pub fn (mut app App) api_v1_discussion_comments(mut ctx Context, username string, repo_name string, id string) veb.Result {
    repo := app.find_repo_by_name_and_username(repo_name, username) or {
        return ctx.api_not_found()
    }
    caller := app.api_user_from_ctx(ctx) or { User{} }
    if !repo.is_public && !app.has_user_repo_read_access(ctx, caller.id, repo.id) {
        return ctx.api_not_found()
    }
    discussion := app.find_discussion(id.int()) or { return ctx.api_not_found() }
    if discussion.repo_id != repo.id {
        return ctx.api_not_found()
    }
    comments := app.get_discussion_comments(discussion.id)
    mut out := []ApiCommentView{cap: comments.len}
    for c in comments {
        author := app.get_username_by_id(c.author_id) or { '' }
        out << ApiCommentView{
            id:         c.id
            author:     author
            text:       c.text
            created_at: c.created_at
        }
    }
    return ctx.json(out)
}

@['/api/v1/repos/:username/:repo_name/discussions/:id/comments'; post]
pub fn (mut app App) api_v1_create_discussion_comment(mut ctx Context, username string, repo_name string, id string) veb.Result {
    user := app.api_user_from_ctx(ctx) or { return ctx.api_unauthorized() }
    repo := app.find_repo_by_name_and_username(repo_name, username) or {
        return ctx.api_not_found()
    }
    if !repo.is_public && !app.has_user_repo_read_access(ctx, user.id, repo.id) {
        return ctx.api_not_found()
    }
    discussion := app.find_discussion(id.int()) or { return ctx.api_not_found() }
    if discussion.repo_id != repo.id {
        return ctx.api_not_found()
    }
    if discussion.is_locked {
        ctx.send_custom_error(403, 'Forbidden')
        return ctx.json({
            'success': 'false'
            'message': 'discussion is locked'
        })
    }
    text := ctx.form['text']
    if text == '' {
        ctx.send_custom_error(400, 'Bad Request')
        return ctx.json({
            'success': 'false'
            'message': 'text is required'
        })
    }
    app.add_discussion_comment(discussion.id, user.id, text) or {
        ctx.send_custom_error(500, 'Internal Server Error')
        return ctx.json({
            'success': 'false'
            'message': 'failed to add comment'
        })
    }
    return ctx.json({
        'success': 'true'
    })
}

@['/api/v1/repos/:username/:repo_name/milestones']
pub fn (mut app App) api_v1_repo_milestones(mut ctx Context, username string, repo_name string) veb.Result {
    repo := app.find_repo_by_name_and_username(repo_name, username) or {
        return ctx.api_not_found()
    }
    caller := app.api_user_from_ctx(ctx) or { User{} }
    if !repo.is_public && !app.has_user_repo_read_access(ctx, caller.id, repo.id) {
        return ctx.api_not_found()
    }
    milestones := app.list_repo_milestones(repo.id)
    mut out := []ApiMilestoneView{cap: milestones.len}
    for m in milestones {
        out << app.milestone_to_api(m)
    }
    return ctx.json(out)
}

@['/api/v1/repos/:username/:repo_name/milestones/:id']
pub fn (mut app App) api_v1_repo_milestone(mut ctx Context, username string, repo_name string, id string) veb.Result {
    repo := app.find_repo_by_name_and_username(repo_name, username) or {
        return ctx.api_not_found()
    }
    caller := app.api_user_from_ctx(ctx) or { User{} }
    if !repo.is_public && !app.has_user_repo_read_access(ctx, caller.id, repo.id) {
        return ctx.api_not_found()
    }
    milestone := app.find_milestone(id.int()) or { return ctx.api_not_found() }
    if milestone.repo_id != repo.id {
        return ctx.api_not_found()
    }
    return ctx.json(app.milestone_to_api(milestone))
}

@['/api/v1/repos/:username/:repo_name/milestones'; post]
pub fn (mut app App) api_v1_create_milestone(mut ctx Context, username string, repo_name string) veb.Result {
    user := app.api_user_from_ctx(ctx) or { return ctx.api_unauthorized() }
    repo := app.find_repo_by_name_and_username(repo_name, username) or {
        return ctx.api_not_found()
    }
    if repo.user_id != user.id {
        ctx.send_custom_error(403, 'Forbidden')
        return ctx.json({
            'success': 'false'
            'message': 'only the repo owner can create milestones'
        })
    }
    title := ctx.form['title']
    desc := ctx.form['description']
    due := parse_yyyy_mm_dd(ctx.form['due_date'])
    if title == '' {
        ctx.send_custom_error(400, 'Bad Request')
        return ctx.json({
            'success': 'false'
            'message': 'title is required'
        })
    }
    new_id := app.add_milestone(repo.id, title, desc, due) or {
        ctx.send_custom_error(500, 'Internal Server Error')
        return ctx.json({
            'success': 'false'
            'message': 'failed to create milestone'
        })
    }
    milestone := app.find_milestone(new_id) or { return ctx.api_not_found() }
    return ctx.json(app.milestone_to_api(milestone))
}

@['/api/v1/repos/:username/:repo_name/projects']
pub fn (mut app App) api_v1_repo_projects(mut ctx Context, username string, repo_name string) veb.Result {
    repo := app.find_repo_by_name_and_username(repo_name, username) or {
        return ctx.api_not_found()
    }
    caller := app.api_user_from_ctx(ctx) or { User{} }
    if !repo.is_public && !app.has_user_repo_read_access(ctx, caller.id, repo.id) {
        return ctx.api_not_found()
    }
    projects := app.list_repo_projects(repo.id)
    mut out := []ApiProjectView{cap: projects.len}
    for p in projects {
        out << app.project_to_api(p)
    }
    return ctx.json(out)
}

@['/api/v1/repos/:username/:repo_name/projects/:id']
pub fn (mut app App) api_v1_repo_project(mut ctx Context, username string, repo_name string, id string) veb.Result {
    repo := app.find_repo_by_name_and_username(repo_name, username) or {
        return ctx.api_not_found()
    }
    caller := app.api_user_from_ctx(ctx) or { User{} }
    if !repo.is_public && !app.has_user_repo_read_access(ctx, caller.id, repo.id) {
        return ctx.api_not_found()
    }
    project := app.find_project(id.int()) or { return ctx.api_not_found() }
    if project.repo_id != repo.id {
        return ctx.api_not_found()
    }
    columns := app.list_project_columns(project.id)
    mut col_views := []ApiProjectColumnView{cap: columns.len}
    for col in columns {
        cards := app.list_project_cards(col.id)
        mut card_views := []ApiProjectCardView{cap: cards.len}
        for c in cards {
            card_views << app.project_card_to_api(c)
        }
        col_views << ApiProjectColumnView{
            id:         col.id
            project_id: col.project_id
            name:       col.name
            position:   col.position
            cards:      card_views
        }
    }
    return ctx.json(ApiProjectDetailView{
        project: app.project_to_api(project)
        columns: col_views
    })
}

@['/api/v1/repos/:username/:repo_name/projects'; post]
pub fn (mut app App) api_v1_create_project(mut ctx Context, username string, repo_name string) veb.Result {
    user := app.api_user_from_ctx(ctx) or { return ctx.api_unauthorized() }
    repo := app.find_repo_by_name_and_username(repo_name, username) or {
        return ctx.api_not_found()
    }
    if repo.user_id != user.id {
        ctx.send_custom_error(403, 'Forbidden')
        return ctx.json({
            'success': 'false'
            'message': 'only the repo owner can create projects'
        })
    }
    name := ctx.form['name']
    desc := ctx.form['description']
    if name == '' {
        ctx.send_custom_error(400, 'Bad Request')
        return ctx.json({
            'success': 'false'
            'message': 'name is required'
        })
    }
    new_id := app.add_project(repo.id, name, desc) or {
        ctx.send_custom_error(500, 'Internal Server Error')
        return ctx.json({
            'success': 'false'
            'message': 'failed to create project'
        })
    }
    project := app.find_project(new_id) or { return ctx.api_not_found() }
    return ctx.json(app.project_to_api(project))
}

@['/api/v1/repos/:username/:repo_name/webhooks']
pub fn (mut app App) api_v1_repo_webhooks(mut ctx Context, username string, repo_name string) veb.Result {
    user := app.api_user_from_ctx(ctx) or { return ctx.api_unauthorized() }
    repo := app.find_repo_by_name_and_username(repo_name, username) or {
        return ctx.api_not_found()
    }
    if repo.user_id != user.id {
        return ctx.api_not_found()
    }
    hooks := app.list_repo_webhooks(repo.id)
    mut out := []ApiWebhookView{cap: hooks.len}
    for w in hooks {
        out << w.to_api()
    }
    return ctx.json(out)
}

@['/api/v1/repos/:username/:repo_name/webhooks/:id']
pub fn (mut app App) api_v1_repo_webhook(mut ctx Context, username string, repo_name string, id string) veb.Result {
    user := app.api_user_from_ctx(ctx) or { return ctx.api_unauthorized() }
    repo := app.find_repo_by_name_and_username(repo_name, username) or {
        return ctx.api_not_found()
    }
    if repo.user_id != user.id {
        return ctx.api_not_found()
    }
    wh := app.find_webhook_by_id(id.int()) or { return ctx.api_not_found() }
    if wh.repo_id != repo.id {
        return ctx.api_not_found()
    }
    return ctx.json(wh.to_api())
}

@['/api/v1/repos/:username/:repo_name/webhooks'; post]
pub fn (mut app App) api_v1_create_webhook(mut ctx Context, username string, repo_name string) veb.Result {
    user := app.api_user_from_ctx(ctx) or { return ctx.api_unauthorized() }
    repo := app.find_repo_by_name_and_username(repo_name, username) or {
        return ctx.api_not_found()
    }
    if repo.user_id != user.id {
        ctx.send_custom_error(403, 'Forbidden')
        return ctx.json({
            'success': 'false'
            'message': 'only the repo owner can create webhooks'
        })
    }
    url := ctx.form['url'].trim_space()
    secret := ctx.form['secret']
    events := ctx.form['events'].trim_space()
    if url == '' || !(url.starts_with('http://') || url.starts_with('https://')) {
        ctx.send_custom_error(400, 'Bad Request')
        return ctx.json({
            'success': 'false'
            'message': 'valid http(s) url is required'
        })
    }
    events_str := if events == '' { 'push,issue,pr,comment,release' } else { events }
    app.add_webhook(repo.id, url, secret, events_str) or {
        ctx.send_custom_error(500, 'Internal Server Error')
        return ctx.json({
            'success': 'false'
            'message': 'failed to create webhook'
        })
    }
    hooks := app.list_repo_webhooks(repo.id)
    if hooks.len == 0 {
        return ctx.api_not_found()
    }
    return ctx.json(hooks[0].to_api())
}