Function bodies 1,000 total

func (a *S3Adapter) Upload(ctx context.Context, bucket, key string, data []byte, contentType string) error {
	log.Printf("[S3Adapter] Uploading to %s/%s (%d bytes)", bucket, key, len(data))

	_, err := a.client.PutObject(ctx, &s3.PutObjectInput{
		Bucket:      aws.String(bucket),
		Key:         aws.String(key),
		Body:        bytes.NewReader(data),
		ContentType: aws.String(contentType),
	})

	return err
}

func NewAdminHandler(priceToTier map[string]subscription.Tier, subService AdminSubscriptionService, subRepo AdminSubscriptionRepository) *AdminHandler {
	return &AdminHandler{
		priceToTier: priceToTier,
		subService:  subService,
		subRepo:     subRepo,
	}
}

func (h *AdminHandler) FixSubscriptionStripeID(w http.ResponseWriter, r *http.Request) {
	if h.subRepo == nil {
		respondWithError(w, http.StatusInternalServerError, "Admin repository not configured")
		return
	}

	// Get authenticated user ID from context
	ctx := r.Context()
	authenticatedUserID, ok := ctx.Value("userID").(string)
	if !ok || authenticatedUserID == "" {
		respondWithError(w, http.StatusUnauthorized, "Authentication required")
		return
	}

	var req struct {
		StripeCustomerID string `json:"stripe_customer_id"`
	}

	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
		respondWithError(w, http.StatusBadRequest, "Invalid request body")
		return
	}

	if req.StripeCustomerID == "" {
		respondWithError(w, http.StatusBadRequest, "stripe_customer_id is required")
		return
	}

	// Get the subscription for the authenticated user
	sub, err := h.subRepo.GetByUserID(r.Context(), authenticatedUserID)
	if err != nil {
		logger.Error("Failed to get subscription for admin fix"

func (h *AdminHandler) GetPriceMappings(w http.ResponseWriter, r *http.Request) {
	info := subscription.GetPriceMappingInfo(h.priceToTier)

	// Add validation status
	err := subscription.ValidatePriceToTierMapping(h.priceToTier)
	info["validation_status"] = "valid"
	if err != nil {
		info["validation_status"] = "invalid"
		info["validation_error"] = err.Error()
	}

	respondWithJSON(w, http.StatusOK, info)
}

func (h *AdminHandler) TestPriceMapping(w http.ResponseWriter, r *http.Request) {
	priceID := r.URL.Query().Get("price_id")
	if priceID == "" {
		respondWithError(w, http.StatusBadRequest, "price_id parameter is required")
		return
	}

	tier, found := h.priceToTier[priceID]

	response := map[string]interface{}{
		"price_id": priceID,
		"found":    found,
	}

	if found {
		response["tier"] = string(tier)
		response["tier_details"] = subscription.GetTierLimits(tier)
	} else {
		response["error"] = "Price ID not found in mapping"

		// Suggest which env var might need this price ID
		requiredMappings := subscription.RequiredPriceMappings()
		suggestions := []string{}
		for _, mapping := range requiredMappings {
			suggestions = append(suggestions, mapping.EnvVar)
		}
		response["suggestions"] = "Check if this price ID should be set in one of: " + joinStrings(suggestions, ", ")
	}

	status := http.StatusOK
	if !found {
		status = http.StatusNotFound
	}

	respondWithJSON(w, status, response

func (h *AdminHandler) ValidatePriceMappings(w http.ResponseWriter, r *http.Request) {
	err := subscription.ValidatePriceToTierMapping(h.priceToTier)

	response := map[string]interface{}{
		"valid": err == nil,
	}

	if err != nil {
		response["error"] = err.Error()
		respondWithJSON(w, http.StatusOK, response) // 200 with validation result
	} else {
		response["message"] = "All price mappings are valid"
		response["total_mappings"] = len(h.priceToTier)
		respondWithJSON(w, http.StatusOK, response)
	}
}

func joinStrings(strs []string, sep string) string {
	if len(strs) == 0 {
		return ""
	}
	result := strs[0]
	for i := 1; i < len(strs); i++ {
		result += sep + strs[i]
	}
	return result
}

func NewAnalyticsHandler(analyticsService AnalyticsServiceInterface, subscriptionService SubscriptionGetter) *AnalyticsHandler {
	return &AnalyticsHandler{
		analyticsService:    analyticsService,
		subscriptionService: subscriptionService,
	}
}

func (h *AnalyticsHandler) getAnalyticsAccess(ctx context.Context, userID string) analytics.AnalyticsAccess {
	sub, err := h.subscriptionService.GetSubscription(ctx, userID)
	if err != nil {
		// Log subscription lookup errors - this could indicate a service issue
		// affecting paying users who should have access
		logger.Error("Failed to get subscription for analytics access, defaulting to no access", map[string]interface{}{
			"userID": userID,
			"error":  err.Error(),
		})
		return analytics.GetAnalyticsAccess("none", false)
	}
	if sub == nil {
		// No subscription is a legitimate state - user is on free tier
		return analytics.GetAnalyticsAccess("none", false)
	}

	limits := subscription.GetTierLimits(sub.Tier)
	isStudio := sub.Tier == subscription.TierStudio

	return analytics.GetAnalyticsAccess(limits.AnalyticsLevel, isStudio)
}

func (h *AnalyticsHandler) GetDashboardSummary(w http.ResponseWriter, r *http.Request) {
	ctx := r.Context()

	// Get photographer ID from context (set by auth middleware)
	photographerID, ok := ctx.Value("userID").(string)
	if !ok {
		respondError(w, errors.NewUnauthorized("User ID not found"))
		return
	}

	// Get tier-based access
	access := h.getAnalyticsAccess(ctx, photographerID)

	summary, err := h.analyticsService.GetDashboardSummary(ctx, photographerID)
	if err != nil {
		respondError(w, err)
		return
	}

	// Filter summary based on tier access
	filteredSummary := analytics.FilterDashboardSummary(summary, access)

	respondJSON(w, http.StatusOK, analytics.TierFilteredSummaryResponse{
		DashboardSummary: filteredSummary,
		Access:           access,
	})
}

func (h *AnalyticsHandler) GetGalleriesAnalytics(w http.ResponseWriter, r *http.Request) {
	ctx := r.Context()

	// Get photographer ID from context
	photographerID, ok := ctx.Value("userID").(string)
	if !ok {
		respondError(w, errors.NewUnauthorized("User ID not found"))
		return
	}

	// Get tier-based access
	access := h.getAnalyticsAccess(ctx, photographerID)

	// Parse query parameters
	limit := 20
	if limitStr := r.URL.Query().Get("limit"); limitStr != "" {
		if parsed, err := strconv.Atoi(limitStr); err == nil && parsed > 0 {
			limit = parsed
		}
	}

	sortBy := r.URL.Query().Get("sortBy")
	if sortBy == "" {
		sortBy = "views"
	}

	galleries, err := h.analyticsService.GetGalleriesAnalytics(ctx, photographerID, limit, sortBy)
	if err != nil {
		respondError(w, err)
		return
	}

	// Filter galleries based on tier access
	filteredGalleries := analytics.FilterGalleryAnalytics(galleries, access)

	respondJSON(w, http.StatusOK, analytics.TierFilteredGalleriesResponse{
		Galleries: fil

func (h *AnalyticsHandler) GetTopPhotos(w http.ResponseWriter, r *http.Request) {
	ctx := r.Context()

	// Get photographer ID from context
	photographerID, ok := ctx.Value("userID").(string)
	if !ok {
		respondError(w, errors.NewUnauthorized("User ID not found"))
		return
	}

	// Get tier-based access
	access := h.getAnalyticsAccess(ctx, photographerID)

	// Parse query parameters
	limit := 10
	if limitStr := r.URL.Query().Get("limit"); limitStr != "" {
		if parsed, err := strconv.Atoi(limitStr); err == nil && parsed > 0 {
			limit = parsed
		}
	}

	metric := r.URL.Query().Get("metric")
	if metric == "" {
		metric = "favorites"
	}

	photos, err := h.analyticsService.GetTopPhotos(ctx, photographerID, limit, metric)
	if err != nil {
		respondError(w, err)
		return
	}

	// Filter photos based on tier access
	filteredPhotos := analytics.FilterTopPhotos(photos, access)

	respondJSON(w, http.StatusOK, analytics.TierFilteredTopPhotosResponse{
		Photos: filteredPhotos,
		Access: access,
	})
}

func (h *AnalyticsHandler) GetClientBehavior(w http.ResponseWriter, r *http.Request) {
	ctx := r.Context()

	// Get photographer ID from context
	photographerID, ok := ctx.Value("userID").(string)
	if !ok {
		respondError(w, errors.NewUnauthorized("User ID not found"))
		return
	}

	// Get tier-based access
	access := h.getAnalyticsAccess(ctx, photographerID)

	// If user doesn't have client behavior access (Studio only), return empty data with access info
	if !access.ClientBehavior {
		respondJSON(w, http.StatusOK, analytics.TierFilteredClientBehaviorResponse{
			ClientBehaviorAnalytics: &analytics.ClientBehaviorAnalytics{
				Devices:  analytics.DeviceDistribution{},
				Browsers: []analytics.BrowserDistribution{},
			},
			Access: access,
		})
		return
	}

	behavior, err := h.analyticsService.GetClientBehavior(ctx, photographerID)
	if err != nil {
		respondError(w, err)
		return
	}

	respondJSON(w, http.StatusOK, analytics.TierFilteredClientBehaviorResponse{
		ClientBehaviorAnalytic

func (h *AuthHandler) GetMe(w http.ResponseWriter, r *http.Request) {
	// Get user ID from context (set by auth middleware)
	userID, ok := r.Context().Value("userID").(string)
	if !ok || userID == "" {
		logger.Error("No user ID in context", nil)
		respondWithError(w, http.StatusUnauthorized, "Unauthorized")
		return
	}

	// Get email from context (from Cognito JWT)
	email, _ := r.Context().Value("email").(string)
	name, _ := r.Context().Value("name").(string)

	// Try to get photographer from database
	p, err := h.photographerRepo.GetByID(r.Context(), userID)

	// If photographer doesn't exist, create them (first time login)
	if err == photographer.ErrNotFound {
		// SECURITY FIX: Don't log PII (email) - only log anonymized identifiers
		logger.Info("Creating new photographer profile", map[string]interface{}{
			"userID": userID,
		})

		// Create new photographer with defaults
		p = &photographer.Photographer{
			UserID:      userID,
			Email:       email,
			Name:        name,
			Pr

func respondWithJSON(w http.ResponseWriter, code int, payload interface{}) {
	response, err := json.Marshal(payload)
	if err != nil {
		w.WriteHeader(http.StatusInternalServerError)
		w.Write([]byte(`{"error": "Failed to marshal response"}`))
		return
	}

	w.Header().Set("Content-Type", "application/json")
	w.WriteHeader(code)
	w.Write(response)
}

func (h *BaseHandler) Handle(handler RequestHandler, w http.ResponseWriter, r *http.Request) {
	// Step 1: Validate the request
	if err := handler.ValidateRequest(r); err != nil {
		h.respondError(w, err)
		return
	}

	// Step 2: Execute the business logic
	result, err := handler.Execute(r)
	if err != nil {
		h.respondError(w, err)
		return
	}

	// Step 3: Format and send the response
	status, response := handler.FormatResponse(result)
	h.respondJSON(w, status, response)
}

func (h *BaseHandler) respondJSON(w http.ResponseWriter, status int, data interface{}) {
	w.Header().Set("Content-Type", "application/json")
	w.WriteHeader(status)
	if data != nil {
		json.NewEncoder(w).Encode(data)
	}
}

func (h *BaseHandler) respondError(w http.ResponseWriter, err error) {
	if appErr, ok := err.(*errors.AppError); ok {
		// Sanitize the error message before sending to client
		sanitizedErr := security.SanitizeForClient(appErr.Code, appErr.Message)
		h.respondJSON(w, appErr.Code, map[string]string{
			"error": sanitizedErr.Message,
		})
	} else {
		logger.Error("Unexpected error", map[string]interface{}{"error": err.Error()})
		// Use sanitizer for generic errors too
		sanitizedErr := security.SanitizeForClient(http.StatusInternalServerError, err.Error())
		h.respondJSON(w, http.StatusInternalServerError, map[string]string{
			"error": sanitizedErr.Message,
		})
	}
}

func WrapHandler(handler RequestHandler) http.HandlerFunc {
	base := &BaseHandler{}
	return func(w http.ResponseWriter, r *http.Request) {
		base.Handle(handler, w, r)
	}
}

func NewClientHandler(
	galleryService *gallery.Service,
	photoService *photo.Service,
	sessionService *auth.SessionService,
	zipJobService *zipjob.Service,
	subscriptionService *subscription.Service,
) *ClientHandler {
	return &ClientHandler{
		galleryService:      galleryService,
		photoService:        photoService,
		sessionService:      sessionService,
		zipJobService:       zipJobService,
		subscriptionService: subscriptionService,
		cookieDomain:        "",             // Set via WithCookieConfig
		sessionTTL:          24 * time.Hour, // Default 24 hours
	}
}

func (h *ClientHandler) shouldShowBadge(ctx context.Context, photographerID string) bool {
	if h.subscriptionService == nil {
		// If subscription service not configured, default to showing badge (safer)
		return true
	}

	sub, err := h.subscriptionService.GetSubscription(ctx, photographerID)
	if err != nil {
		// On error, default to showing badge (conservative approach)
		return true
	}

	// Show badge only for free tier users
	return !sub.IsPaid()
}

func (h *ClientHandler) VerifyPassword(w http.ResponseWriter, r *http.Request) {
	ctx := r.Context()

	var req VerifyPasswordRequest
	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
		respondError(w, errors.NewBadRequest("Invalid request body"))
		return
	}

	if req.CustomURL == "" {
		respondError(w, errors.NewBadRequest("customUrl is required"))
		return
	}
	if req.Password == "" {
		respondError(w, errors.NewBadRequest("password is required"))
		return
	}

	// Verify gallery password
	g, err := h.galleryService.VerifyPassword(ctx, req.CustomURL, req.Password)
	if err != nil {
		respondError(w, err)
		return
	}

	// Set showBadge based on photographer's subscription
	g.ShowBadge = h.shouldShowBadge(ctx, g.PhotographerID)

	// Get client info from request
	ipAddress := r.Header.Get("X-Forwarded-For")
	if ipAddress == "" {
		ipAddress = r.RemoteAddr
	}
	userAgent := r.Header.Get("User-Agent")

	// Create session
	sessionToken, err := h.sessionService.CreateSession(ctx, g.G

func (h *ClientHandler) ValidateSession(w http.ResponseWriter, r *http.Request) {
	ctx := r.Context()

	// Get session info from context (set by middleware)
	galleryID, ok := ctx.Value("galleryID").(string)
	if !ok {
		respondError(w, errors.NewUnauthorized("Invalid or expired session"))
		return
	}
	sessionID, ok := ctx.Value("sessionID").(string)
	if !ok {
		respondError(w, errors.NewUnauthorized("Invalid or expired session"))
		return
	}

	respondJSON(w, http.StatusOK, map[string]interface{}{
		"valid":     true,
		"galleryId": galleryID,
		"sessionId": sessionID,
	})
}

func (h *ClientHandler) ClearSession(w http.ResponseWriter, r *http.Request) {
	// Clear the cookie
	clearCookie := security.BuildClearCookie(security.SessionCookieName, h.cookieDomain)
	w.Header().Set("Set-Cookie", clearCookie)

	respondJSON(w, http.StatusOK, map[string]interface{}{
		"message": "Session cleared",
	})
}

func (h *ClientHandler) GetGallery(w http.ResponseWriter, r *http.Request) {
	ctx := r.Context()
	customURL := getURLParam(r, "customUrl")

	// Session should be verified by middleware
	g, err := h.galleryService.GetByCustomURL(ctx, customURL)
	if err != nil {
		respondError(w, err)
		return
	}

	// Don't expose password
	g.Password = ""

	// Set showBadge based on photographer's subscription
	g.ShowBadge = h.shouldShowBadge(ctx, g.PhotographerID)

	respondJSON(w, http.StatusOK, g)
}

func (h *ClientHandler) ListPhotos(w http.ResponseWriter, r *http.Request) {
	ctx := r.Context()

	// Get gallery ID from session context (set by middleware)
	galleryID, ok := ctx.Value("galleryID").(string)
	if !ok {
		respondError(w, errors.NewUnauthorized("Gallery ID not found in session"))
		return
	}

	limit := 50 // default
	var lastKey map[string]interface{}

	photos, nextKey, err := h.photoService.ListByGallery(ctx, galleryID, limit, lastKey)
	if err != nil {
		respondError(w, err)
		return
	}

	respondJSON(w, http.StatusOK, map[string]interface{}{
		"photos":  photos,
		"lastKey": nextKey,
	})
}

func (h *ClientHandler) GetDownloadURL(w http.ResponseWriter, r *http.Request) {
	ctx := r.Context()
	photoID := getURLParam(r, "photoId")

	url, err := h.photoService.GetDownloadURL(ctx, photoID)
	if err != nil {
		respondError(w, err)
		return
	}

	respondJSON(w, http.StatusOK, map[string]interface{}{
		"downloadUrl": url,
	})
}

func (h *ClientHandler) ToggleFavorite(w http.ResponseWriter, r *http.Request) {
	ctx := r.Context()
	photoID := getURLParam(r, "photoId")

	// Get session info from context (set by middleware)
	galleryID, ok := ctx.Value("galleryID").(string)
	if !ok {
		respondError(w, errors.NewUnauthorized("Gallery ID not found in session"))
		return
	}
	sessionID, ok := ctx.Value("sessionID").(string)
	if !ok {
		respondError(w, errors.NewUnauthorized("Session ID not found"))
		return
	}

	favorited, err := h.photoService.ToggleFavorite(ctx, galleryID, sessionID, photoID)
	if err != nil {
		respondError(w, err)
		return
	}

	respondJSON(w, http.StatusOK, map[string]interface{}{
		"isFavorited": favorited,
	})
}

func (h *ClientHandler) GetSessionFavorites(w http.ResponseWriter, r *http.Request) {
	ctx := r.Context()

	// Get session info from context
	galleryID, ok := ctx.Value("galleryID").(string)
	if !ok {
		respondError(w, errors.NewUnauthorized("Gallery ID not found in session"))
		return
	}
	sessionID, ok := ctx.Value("sessionID").(string)
	if !ok {
		respondError(w, errors.NewUnauthorized("Session ID not found"))
		return
	}

	favorites, err := h.photoService.ListFavoritesBySession(ctx, galleryID, sessionID)
	if err != nil {
		respondError(w, err)
		return
	}

	respondJSON(w, http.StatusOK, map[string]interface{}{
		"favorites": favorites,
	})
}

func (h *ClientHandler) InitiateZipDownload(w http.ResponseWriter, r *http.Request) {
	ctx := r.Context()

	// Get gallery ID from session context (set by middleware)
	galleryID, ok := ctx.Value("galleryID").(string)
	if !ok {
		respondError(w, errors.NewUnauthorized("Gallery ID not found in session"))
		return
	}

	// Get gallery for the name (for filename)
	customURL := getURLParam(r, "customUrl")
	g, err := h.galleryService.GetByCustomURL(ctx, customURL)
	if err != nil {
		respondError(w, err)
		return
	}

	// Block downloads when not enabled for the current phase
	if !g.DownloadsEnabled {
		respondError(w, errors.NewForbidden("Downloads are not available for this gallery"))
		return
	}

	// Generate a safe filename from gallery name
	filename := sanitizeFilename(g.Name) + ".zip"

	// Initiate async ZIP job
	job, err := h.zipJobService.InitiateZipJob(ctx, galleryID, filename)
	if err != nil {
		respondError(w, err)
		return
	}

	respondJSON(w, http.StatusAccepted, map[string]interfa

func (h *ClientHandler) GetZipJobStatus(w http.ResponseWriter, r *http.Request) {
	ctx := r.Context()

	// Get gallery ID from session context (set by middleware)
	galleryID, ok := ctx.Value("galleryID").(string)
	if !ok {
		respondError(w, errors.NewUnauthorized("Gallery ID not found in session"))
		return
	}

	jobID := getURLParam(r, "jobId")

	if jobID == "" {
		respondError(w, errors.NewBadRequest("Job ID is required"))
		return
	}

	job, err := h.zipJobService.GetJobStatus(ctx, jobID)
	if err != nil {
		respondError(w, err)
		return
	}

	if job == nil {
		respondError(w, errors.NewNotFound("Job"))
		return
	}

	// Verify the job belongs to the session's gallery (prevent IDOR)
	if job.GalleryID != galleryID {
		respondError(w, errors.NewNotFound("Job"))
		return
	}

	response := map[string]interface{}{
		"jobId":      job.JobID,
		"status":     job.Status,
		"progress":   job.Progress,
		"photoCount": job.PhotoCount,
		"createdAt":  job.CreatedAt,
	}

	// Include download URL if co

func (h *ClientHandler) DownloadGalleryZip(w http.ResponseWriter, r *http.Request) {
	ctx := r.Context()

	// Get gallery ID from session context (set by middleware)
	galleryID, ok := ctx.Value("galleryID").(string)
	if !ok {
		respondError(w, errors.NewUnauthorized("Gallery ID not found in session"))
		return
	}

	// Get gallery for the name (for filename)
	customURL := getURLParam(r, "customUrl")
	g, err := h.galleryService.GetByCustomURL(ctx, customURL)
	if err != nil {
		respondError(w, err)
		return
	}

	// Block downloads when not enabled for the current phase
	if !g.DownloadsEnabled {
		respondError(w, errors.NewForbidden("Downloads are not available for this gallery"))
		return
	}

	// Generate a safe filename from gallery name
	filename := sanitizeFilename(g.Name) + ".zip"

	// Generate the ZIP, upload to S3, and get download URL (sync - may timeout)
	downloadURL, err := h.photoService.GenerateGalleryZipURL(ctx, galleryID, filename)
	if err != nil {
		respondError(w, err)
		re

func sanitizeFilename(name string) string {
	// Replace spaces with hyphens
	name = strings.ReplaceAll(name, " ", "-")

	// Remove any characters that aren't alphanumeric, hyphens, or underscores
	reg := regexp.MustCompile(`[^a-zA-Z0-9\-_]`)
	name = reg.ReplaceAllString(name, "")

	// Limit length
	if len(name) > 50 {
		name = name[:50]
	}

	// Default if empty
	if name == "" {
		name = "gallery"
	}

	return name
}

func (h *ClientProofingHandler) CheckProofingEnabled(w http.ResponseWriter, r *http.Request) {
	ctx := r.Context()

	galleryID, ok := ctx.Value("galleryID").(string)
	if !ok {
		respondError(w, errors.NewUnauthorized("Gallery ID not found in session"))
		return
	}

	enabled, err := h.proofingService.IsProofingEnabled(ctx, galleryID)
	if err != nil {
		respondError(w, err)
		return
	}

	respondJSON(w, http.StatusOK, map[string]interface{}{
		"proofingEnabled": enabled,
	})
}

func (h *ClientProofingHandler) CreateComment(w http.ResponseWriter, r *http.Request) {
	ctx := r.Context()

	galleryID, ok := ctx.Value("galleryID").(string)
	if !ok {
		respondError(w, errors.NewUnauthorized("Gallery ID not found in session"))
		return
	}

	sessionID, ok := ctx.Value("sessionID").(string)
	if !ok {
		respondError(w, errors.NewUnauthorized("Session ID not found"))
		return
	}

	var req CreateCommentRequest
	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
		respondError(w, errors.NewBadRequest("Invalid request body"))
		return
	}

	if req.PhotoID == "" {
		respondError(w, errors.NewBadRequest("photoId is required"))
		return
	}
	if req.Text == "" {
		respondError(w, errors.NewBadRequest("text is required"))
		return
	}

	comment, err := h.proofingService.CreateComment(ctx, proofing.CreateCommentRequest{
		PhotoID:   req.PhotoID,
		GalleryID: galleryID,
		SessionID: sessionID,
		Text:      req.Text,
	})
	if err != nil {
		respondError(w, err)
		return
	}

	

func (h *ClientProofingHandler) GetMyComments(w http.ResponseWriter, r *http.Request) {
	ctx := r.Context()

	galleryID, ok := ctx.Value("galleryID").(string)
	if !ok {
		respondError(w, errors.NewUnauthorized("Gallery ID not found in session"))
		return
	}

	sessionID, ok := ctx.Value("sessionID").(string)
	if !ok {
		respondError(w, errors.NewUnauthorized("Session ID not found"))
		return
	}

	comments, err := h.proofingService.ListCommentsForSession(ctx, galleryID, sessionID)
	if err != nil {
		respondError(w, err)
		return
	}

	respondJSON(w, http.StatusOK, map[string]interface{}{
		"comments": comments,
		"count":    len(comments),
	})
}

func (h *ClientProofingHandler) DeleteComment(w http.ResponseWriter, r *http.Request) {
	ctx := r.Context()

	galleryID, ok := ctx.Value("galleryID").(string)
	if !ok {
		respondError(w, errors.NewUnauthorized("Gallery ID not found in session"))
		return
	}

	sessionID, ok := ctx.Value("sessionID").(string)
	if !ok {
		respondError(w, errors.NewUnauthorized("Session ID not found"))
		return
	}

	photoID := getURLParam(r, "photoId")
	commentID := getURLParam(r, "commentId")

	if photoID == "" || commentID == "" {
		respondError(w, errors.NewBadRequest("photoId and commentId are required"))
		return
	}

	err := h.proofingService.DeleteComment(ctx, galleryID, photoID, commentID, sessionID)
	if err != nil {
		respondError(w, err)
		return
	}

	w.WriteHeader(http.StatusNoContent)
}

func (h *ClientProofingHandler) CreateEditRequest(w http.ResponseWriter, r *http.Request) {
	ctx := r.Context()

	galleryID, ok := ctx.Value("galleryID").(string)
	if !ok {
		respondError(w, errors.NewUnauthorized("Gallery ID not found in session"))
		return
	}

	sessionID, ok := ctx.Value("sessionID").(string)
	if !ok {
		respondError(w, errors.NewUnauthorized("Session ID not found"))
		return
	}

	var req CreateEditRequestRequest
	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
		respondError(w, errors.NewBadRequest("Invalid request body"))
		return
	}

	if req.PhotoID == "" {
		respondError(w, errors.NewBadRequest("photoId is required"))
		return
	}
	if req.RequestType == "" {
		respondError(w, errors.NewBadRequest("requestType is required"))
		return
	}
	if req.Description == "" {
		respondError(w, errors.NewBadRequest("description is required"))
		return
	}

	editRequest, err := h.proofingService.CreateEditRequest(ctx, proofing.CreateEditRequestInput{
		PhotoID:     r

func (h *ClientProofingHandler) GetMyEditRequests(w http.ResponseWriter, r *http.Request) {
	ctx := r.Context()

	galleryID, ok := ctx.Value("galleryID").(string)
	if !ok {
		respondError(w, errors.NewUnauthorized("Gallery ID not found in session"))
		return
	}

	sessionID, ok := ctx.Value("sessionID").(string)
	if !ok {
		respondError(w, errors.NewUnauthorized("Session ID not found"))
		return
	}

	requests, err := h.proofingService.ListEditRequestsForSession(ctx, galleryID, sessionID)
	if err != nil {
		respondError(w, err)
		return
	}

	respondJSON(w, http.StatusOK, map[string]interface{}{
		"editRequests": requests,
		"count":        len(requests),
	})
}

func (h *DomainHandler) GetDomainConfig(w http.ResponseWriter, r *http.Request) {
	ctx := r.Context()

	userID, ok := ctx.Value("userID").(string)
	if !ok {
		respondError(w, errors.NewUnauthorized("User ID not found"))
		return
	}

	config, err := h.domainService.GetDomainConfig(ctx, userID)
	if err != nil {
		respondError(w, err)
		return
	}

	respondJSON(w, http.StatusOK, config)
}

func (h *DomainHandler) RequestSubdomain(w http.ResponseWriter, r *http.Request) {
	ctx := r.Context()

	userID, ok := ctx.Value("userID").(string)
	if !ok {
		respondError(w, errors.NewUnauthorized("User ID not found"))
		return
	}

	var req customdomain.RequestSubdomainInput
	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
		respondError(w, errors.NewBadRequest("Invalid request body"))
		return
	}

	if req.Subdomain == "" {
		respondError(w, errors.NewBadRequest("Subdomain is required"))
		return
	}

	config, err := h.domainService.RequestSubdomain(ctx, userID, req.Subdomain)
	if err != nil {
		switch err {
		case customdomain.ErrSubdomainTaken:
			respondError(w, errors.NewConflict("Subdomain is already taken"))
		case customdomain.ErrSubdomainInvalid:
			respondError(w, errors.NewBadRequest("Subdomain is invalid: must be 3-63 lowercase alphanumeric characters or hyphens"))
		case customdomain.ErrSubdomainReserved:
			respondError(w, errors.NewBadRequest("Subdomain is r

func (h *DomainHandler) RequestCustomDomain(w http.ResponseWriter, r *http.Request) {
	ctx := r.Context()

	userID, ok := ctx.Value("userID").(string)
	if !ok {
		respondError(w, errors.NewUnauthorized("User ID not found"))
		return
	}

	var req customdomain.RequestCustomDomainInput
	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
		respondError(w, errors.NewBadRequest("Invalid request body"))
		return
	}

	if req.Domain == "" {
		respondError(w, errors.NewBadRequest("Domain is required"))
		return
	}

	config, err := h.domainService.RequestCustomDomain(ctx, userID, req.Domain)
	if err != nil {
		switch err {
		case customdomain.ErrCustomDomainTaken:
			respondError(w, errors.NewConflict("Domain is already registered by another user"))
		case customdomain.ErrCustomDomainInvalid:
			respondError(w, errors.NewBadRequest("Domain format is invalid"))
		default:
			logger.Error("Failed to request custom domain", map[string]interface{}{"error": err.Error()})
			respondError(w, e

func (h *DomainHandler) VerifyDomain(w http.ResponseWriter, r *http.Request) {
	ctx := r.Context()

	userID, ok := ctx.Value("userID").(string)
	if !ok {
		respondError(w, errors.NewUnauthorized("User ID not found"))
		return
	}

	config, err := h.domainService.VerifyDomain(ctx, userID)
	if err != nil {
		switch err {
		case customdomain.ErrVerificationFailed:
			// Return the config with pending status and instructions
			respondJSON(w, http.StatusOK, map[string]interface{}{
				"verified":        false,
				"message":         "DNS record not found. Please add the TXT record and try again.",
				"dnsInstructions": config.DNSInstructions,
			})
		case customdomain.ErrNoPendingDomain:
			respondError(w, errors.NewBadRequest("No pending domain to verify"))
		case customdomain.ErrDomainAlreadyActive:
			respondError(w, errors.NewBadRequest("Domain is already active"))
		default:
			logger.Error("Failed to verify domain", map[string]interface{}{"error": err.Error()})
			respondError(w, err

func (h *DomainHandler) RemoveDomain(w http.ResponseWriter, r *http.Request) {
	ctx := r.Context()

	userID, ok := ctx.Value("userID").(string)
	if !ok {
		respondError(w, errors.NewUnauthorized("User ID not found"))
		return
	}

	if err := h.domainService.RemoveDomain(ctx, userID); err != nil {
		logger.Error("Failed to remove domain", map[string]interface{}{"error": err.Error()})
		respondError(w, errors.NewInternalServer("Failed to remove domain"))
		return
	}

	w.WriteHeader(http.StatusNoContent)
}

func NewGalleryHandler(galleryService GalleryService, tierGate *middleware.TierGateMiddleware, photographerGetter PhotographerGetter, subscriptionChecker SubscriptionFeatureChecker) *GalleryHandler {
	return &GalleryHandler{
		galleryService:      galleryService,
		tierGate:            tierGate,
		photographerGetter:  photographerGetter,
		subscriptionChecker: subscriptionChecker,
	}
}

func (h *GalleryHandler) validateExpirationLimit(ctx context.Context, w http.ResponseWriter, photographerID string, expiresAt *time.Time) bool {
	if expiresAt == nil || h.subscriptionChecker == nil {
		return true
	}

	// Use Ceil to round up partial days - a gallery expiring in 30.5 days
	// should be checked against the 31-day limit, not the 30-day limit
	hours := time.Until(*expiresAt).Hours()
	if hours < 0 {
		hours = 0
	}
	days := int(math.Ceil(hours / 24))

	gateResult, err := h.subscriptionChecker.GateGalleryExpiration(ctx, photographerID, days)
	if err != nil {
		logger.Error("Failed to check gallery expiration limit", map[string]interface{}{
			"photographerId": photographerID,
			"days":           days,
			"error":          err.Error(),
		})
		respondError(w, errors.NewInternalServer("Failed to check expiration limit"))
		return false
	}

	if !gateResult.Allowed {
		w.Header().Set("Content-Type", "application/json")
		w.WriteHeader(http.StatusPaymentRequired)
		if err := json

func (h *GalleryHandler) gateFeature(ctx context.Context, w http.ResponseWriter, photographerID, feature, message string) bool {
	if h.subscriptionChecker == nil {
		logger.Error("subscriptionChecker is nil, denying feature access", map[string]interface{}{
			"photographerId": photographerID,
			"feature":        feature,
		})
		w.Header().Set("Content-Type", "application/json")
		w.WriteHeader(http.StatusServiceUnavailable)
		json.NewEncoder(w).Encode(map[string]interface{}{
			"error":   "service_unavailable",
			"message": "Unable to verify feature access. Please try again later.",
		})
		return false
	}

	hasFeature, err := h.subscriptionChecker.HasFeature(ctx, photographerID, feature)
	if err != nil {
		logger.Error("Failed to check feature", map[string]interface{}{
			"photographerId": photographerID,
			"feature":        feature,
			"error":          err.Error(),
		})
		respondError(w, errors.NewInternalServer("Failed to check feature access"))
		return false
	}

	if !hasFeature

func (h *GalleryHandler) GetGallery(w http.ResponseWriter, r *http.Request) {
	ctx := r.Context()
	galleryID := getURLParam(r, "id")

	// Use strongly consistent read when photographer ID is available (authenticated request)
	// This avoids GSI eventual consistency issues when fetching immediately after creation
	var g interface{}
	var err error

	if photographerID, ok := ctx.Value("userID").(string); ok && photographerID != "" {
		g, err = h.galleryService.GetByIDForPhotographer(ctx, galleryID, photographerID)
	} else {
		g, err = h.galleryService.GetByID(ctx, galleryID)
	}

	if err != nil {
		respondError(w, err)
		return
	}

	respondJSON(w, http.StatusOK, g)
}

func (h *GalleryHandler) ListGalleries(w http.ResponseWriter, r *http.Request) {
	ctx := r.Context()

	photographerID, ok := ctx.Value("userID").(string)
	if !ok {
		respondError(w, errors.NewUnauthorized("User ID not found"))
		return
	}

	limit := 20 // default limit
	var lastKey map[string]interface{}

	galleries, nextKey, err := h.galleryService.ListByPhotographer(ctx, photographerID, limit, lastKey)
	if err != nil {
		respondError(w, err)
		return
	}

	response := map[string]interface{}{
		"galleries": galleries,
		"lastKey":   nextKey,
	}

	respondJSON(w, http.StatusOK, response)
}

func (h *GalleryHandler) DeleteGallery(w http.ResponseWriter, r *http.Request) {
	ctx := r.Context()
	galleryID := getURLParam(r, "id")

	// Get photographer ID from context (set by auth middleware)
	photographerID, ok := ctx.Value("userID").(string)
	if !ok || photographerID == "" {
		respondError(w, errors.NewUnauthorized("User ID not found"))
		return
	}

	// SECURITY: Verify ownership before allowing delete (IDOR prevention)
	existingGallery, err := h.galleryService.GetByID(ctx, galleryID)
	if err != nil {
		respondError(w, err)
		return
	}
	if existingGallery.PhotographerID != photographerID {
		logger.Warn("IDOR attempt: user tried to delete gallery they don't own", map[string]interface{}{
			"userId":    photographerID,
			"galleryId": galleryID,
			"ownerId":   existingGallery.PhotographerID,
		})
		respondError(w, errors.NewForbidden("You do not have permission to delete this gallery"))
		return
	}

	if err := h.galleryService.Delete(ctx, galleryID); err != nil {
		respondErro