module Api
  # POST /api/documents/:document_id/join { token }
  # Redeems a share link. Signed in: the document is added to the account
  # (a membership). Not signed in: only answers what the token grants -- the
  # browser keeps the token and sends it along (X-Share-Token).
  class JoinsController < BaseController
    def create
      doc = Document.find(params[:document_id])
      link = doc.share_links.active.find_by(token: params.require(:token))
      raise ActiveRecord::RecordNotFound unless link
      if Current.user
        DocumentMembership.grant!(document: doc, user: Current.user, role: link.role, source: :link, share_link: link)
      end
      render json: { document: doc.meta_json(role: doc.role_for(user: Current.user, token: link.token)) }
    end
  end
end