eyecandy and delete

backend/app/api/links.py

@@ -5,7 +5,7 @@ from fastapi import APIRouter, Header, HTTPException, status
 import logging
 from pydantic import BaseModel
 
-from backend.app.services.link_service import create_link, list_public_links, list_tags, update_link
+from backend.app.services.link_service import create_link, delete_link, list_public_links, list_tags, update_link
 from backend.app.services.plugin_manager import plugin_manager
 from backend.app.services.token_service import validate_token
 
@@ -73,6 +73,21 @@ def update_link_endpoint(
     return record
 
 
+@router.delete('/links/{link_id}')
+def delete_link_endpoint(
+    link_id: str,
+    authorization: str | None = Header(default=None),
+):
+    if not authorization or not authorization.startswith('Bearer '):
+        raise HTTPException(status_code=401, detail='Missing or invalid Authorization header')
+    info = validate_token(authorization.replace('Bearer ', '', 1))
+    if info is None:
+        raise HTTPException(status_code=401, detail='Token expired or invalid')
+    if not delete_link(link_id, info['user_id']):
+        raise HTTPException(status_code=404, detail='Link not found or not owned by user')
+    return {'status': 'deleted', 'id': link_id}
+
+
 @router.get('/links')
 def list_links():
     return list_public_links()

backend/app/services/link_service.py

@@ -157,6 +157,16 @@ def update_link(
     return record
 
 
+def delete_link(link_id: str, user_id: str) -> bool:
+    with get_connection() as conn:
+        cursor = conn.execute(
+            'DELETE FROM links WHERE id = ? AND user_id = ?',
+            (link_id, user_id),
+        )
+        conn.commit()
+    return cursor.rowcount > 0
+
+
 def list_public_users():
     with get_connection() as conn:
         rows = conn.execute(

backend/tests/test_api.py

@@ -334,6 +334,11 @@ def test_only_link_owner_can_edit_link():
     })
     assert denied.status_code == 404
 
+    deleted = client.delete(f'/api/links/{link_id}', headers=owner_headers)
+    assert deleted.status_code == 200
+    assert client.delete(f'/api/links/{link_id}', headers=owner_headers).status_code == 404
+    assert client.delete(f'/api/links/{link_id}', headers=login_headers('bob')).status_code == 404
+
 
 def test_logout_revokes_token_and_admin_can_list_plugins():
     headers = login_headers()
@@ -396,7 +401,8 @@ def test_public_and_admin_pages_render_html():
     assert '<a id="auth-username" class="user-name" href="/">' in admin_page
     assert 'admin.js?v=5' in admin_page
     feed_script = client.get('/static/feed.js?v=7').text
-    assert 'if (item.is_owner)' in feed_script
+    assert 'if (item.is_owner && !showIdentity)' in feed_script
+    assert 'deleteEntry(item, deleteButton)' in feed_script
     assert 'tag.toLowerCase() === pref.tag.toLowerCase()' in feed_script
     assert 'return `${date.getFullYear()} ${months[date.getMonth()]} ${date.getDate()} - ${hours}:${minutes}`' in feed_script
     assert 'edit-tag-options' in feed_script