more cart

cmd/cart/pool-server.go

@@ -605,6 +605,49 @@ func (s *PoolServer) RemoveVoucherHandler(w http.ResponseWriter, r *http.Request
 	return nil
 }
 
+// SetRecoveryContactRequest is the wire shape clients send to
+// PUT /cart/recovery-contact. It mirrors proto SetRecoveryContact with
+// JSON-friendly types; sending an empty JSON object clears all contact info.
+type SetRecoveryContactRequest struct {
+	Email      string           `json:"email,omitempty"`
+	PushTokens []cart.PushToken `json:"pushTokens,omitempty"`
+}
+
+// toMessage builds the proto message from the JSON request body.
+func (s *SetRecoveryContactRequest) toMessage() *messages.SetRecoveryContact {
+	out := &messages.SetRecoveryContact{Email: s.Email}
+	if len(s.PushTokens) > 0 {
+		out.PushTokens = make([]*messages.PushToken, 0, len(s.PushTokens))
+		for _, t := range s.PushTokens {
+			out.PushTokens = append(out.PushTokens, &messages.PushToken{
+				Platform: t.Platform,
+				Token:    t.Token,
+			})
+		}
+	}
+	return out
+}
+
+func (s *PoolServer) SetRecoveryContactHandler(w http.ResponseWriter, r *http.Request, cartId cart.CartId) error {
+	if r.Method != http.MethodPut {
+		w.WriteHeader(http.StatusMethodNotAllowed)
+		return nil
+	}
+	req := SetRecoveryContactRequest{}
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		w.WriteHeader(http.StatusBadRequest)
+		w.Write([]byte(err.Error()))
+		return err
+	}
+	reply, err := s.ApplyLocal(r.Context(), cartId, req.toMessage())
+	if err != nil {
+		w.WriteHeader(http.StatusInternalServerError)
+		w.Write([]byte(err.Error()))
+		return err
+	}
+	return s.WriteResult(w, reply)
+}
+
 func (s *PoolServer) SetUserIdHandler(w http.ResponseWriter, r *http.Request, cartId cart.CartId) error {
 	setUserId := messages.SetUserId{}
 	err := json.NewDecoder(r.Body).Decode(&setUserId)
@@ -747,6 +790,10 @@ func (s *PoolServer) Serve(mux *http.ServeMux) {
 	handleFunc("PUT /cart/subscription-details", CookieCartIdHandler(s.ProxyHandler(s.SubscriptionDetailsHandler)))
 	handleFunc("DELETE /cart/voucher/{voucherId}", CookieCartIdHandler(s.ProxyHandler(s.RemoveVoucherHandler)))
 	handleFunc("PUT /cart/user", CookieCartIdHandler(s.ProxyHandler(s.SetUserIdHandler)))
+	// PUT only — SetRecoveryContact is PUT/replace semantics. We deliberately
+	// do NOT allow POST here to avoid conflicts with any future POST→create
+	// semantics on /cart paths.
+	handleFunc("PUT /cart/recovery-contact", CookieCartIdHandler(s.ProxyHandler(s.SetRecoveryContactHandler)))
 
 	handleFunc("PUT /cart/item/{itemId}/marking", CookieCartIdHandler(s.ProxyHandler(s.LineItemMarkingHandler)))
 	handleFunc("DELETE /cart/item/{itemId}/marking", CookieCartIdHandler(s.ProxyHandler(s.RemoveLineItemMarkingHandler)))
@@ -763,6 +810,7 @@ func (s *PoolServer) Serve(mux *http.ServeMux) {
 	handleFunc("PUT /cart/byid/{id}/voucher", CookieCartIdHandler(s.ProxyHandler(s.AddVoucherHandler)))
 	handleFunc("DELETE /cart/byid/{id}/voucher/{voucherId}", CookieCartIdHandler(s.ProxyHandler(s.RemoveVoucherHandler)))
 	handleFunc("PUT /cart/byid/{id}/user", CartIdHandler(s.ProxyHandler(s.SetUserIdHandler)))
+	handleFunc("PUT /cart/byid/{id}/recovery-contact", CartIdHandler(s.ProxyHandler(s.SetRecoveryContactHandler)))
 	handleFunc("PUT /cart/byid/{id}/item/{itemId}/marking", CartIdHandler(s.ProxyHandler(s.LineItemMarkingHandler)))
 	handleFunc("DELETE /cart/byid/{id}/item/{itemId}/marking", CartIdHandler(s.ProxyHandler(s.RemoveLineItemMarkingHandler)))
 	handleFunc("PUT /cart/byid/{id}/item/{itemId}/custom-fields", CartIdHandler(s.ProxyHandler(s.SetCustomFieldsHandler)))