added short text field

README.md

@@ -22,6 +22,7 @@ HTTP API providing user/client message handling for an fmsg host. Exposes CRUD o
 | `FMSG_API_MAX_DATA_SIZE`| `10`                 | Maximum message data size in megabytes                  |
 | `FMSG_API_MAX_ATTACH_SIZE`| `10`               | Maximum attachment file size in megabytes               |
 | `FMSG_API_MAX_MSG_SIZE`| `20`                  | Maximum total message size (data + attachments) in megabytes |
+| `FMSG_API_SHORT_TEXT_SIZE`| `768`               | Maximum bytes of message body returned inline as `short_text` for `text/*` UTF-8 messages |
 | `FMSG_CORS_ORIGINS` | *(optional)*             | Comma-separated list of browser origins allowed via CORS, e.g. `https://example.com,https://www.example.com`. Use `*` to allow any origin. When unset, no CORS headers are emitted (server-to-server callers are unaffected). |
 
 Standard PostgreSQL environment variables (`PGHOST`, `PGPORT`, `PGUSER`,
@@ -252,7 +253,7 @@ When `add_to` recipients are provided, `add_to_from` is automatically populated
 
 | Status | Condition |
 | ------ | --------- |
-| `400`  | Missing/invalid fields or empty `to` |
+| `400`  | Missing/invalid fields, empty `to`, `topic` set together with `pid`, or `add_to`/`add_to_from` set without `pid` |
 | `403`  | `from` does not match authenticated user |
 
 ### GET `/fmsg/:id`
@@ -279,10 +280,18 @@ Retrieves a single message by ID. The authenticated user must be a participant 
   "topic": "Hello",
   "type": "text/plain",
   "size": 12,
+  "short_text": "hello world",
   "attachments": []
 }
 ```
 
+The `short_text` field is included only when the message `type` is `text/*` and
+the stored body is valid UTF-8. When `FMSG_API_SHORT_TEXT_SIZE` is greater than
+`0`, it contains up to that many bytes (default 768) of the body, truncated on
+a UTF-8 rune boundary, so UIs can render a preview without a separate
+`GET /fmsg/:id/data` round-trip. Set `FMSG_API_SHORT_TEXT_SIZE=0` to disable
+`short_text` generation.
+
 **Errors:**
 
 | Status | Condition |
@@ -298,7 +307,7 @@ Updates a draft message. Only the owner (`from`) may update, and the message mus
 
 | Status | Condition |
 | ------ | --------- |
-| `400`  | Invalid fields |
+| `400`  | Invalid fields, `topic` set together with `pid`, or `add_to`/`add_to_from` set without `pid` |
 | `403`  | Not the owner, or message already sent |
 | `404`  | Message not found |
 
@@ -349,7 +358,7 @@ New addresses must be distinct among themselves (case-insensitive).
 
 | Status | Condition |
 | ------ | --------- |
-| `400`  | Empty `add_to` or duplicate addresses in request |
+| `400`  | Empty `add_to`, duplicate addresses, or target message has no `pid` |
 | `403`  | Authenticated user is not an existing participant (sender or `to` recipient) |
 | `404`  | Message not found |
 

src/handlers/attachments.go

@@ -30,7 +30,7 @@ func NewAttachmentHandler(database *db.DB, dataDir string, maxAttachSize, maxMsg
 	return &AttachmentHandler{DB: database, DataDir: dataDir, MaxAttachSize: maxAttachSize, MaxMsgSize: maxMsgSize}
 }
 
-// Upload handles POST /api/v1/messages/:id/attachments.
+// Upload handles POST /fmsg/:id/attachments.
 func (h *AttachmentHandler) Upload(c *gin.Context) {
 	identity := middleware.GetIdentity(c)
 	msgID, ok := parseID(c)
@@ -166,7 +166,7 @@ func (h *AttachmentHandler) Upload(c *gin.Context) {
 	c.JSON(http.StatusCreated, gin.H{"filename": intendedFilename, "size": written})
 }
 
-// Download handles GET /api/v1/messages/:id/attachments/:filename.
+// Download handles GET /fmsg/:id/attachments/:filename.
 func (h *AttachmentHandler) Download(c *gin.Context) {
 	identity := middleware.GetIdentity(c)
 	msgID, ok := parseID(c)
@@ -239,7 +239,7 @@ func (h *AttachmentHandler) Download(c *gin.Context) {
 	c.FileAttachment(cleanPath, filename)
 }
 
-// DeleteAttachment handles DELETE /api/v1/messages/:id/attachments/:filename.
+// DeleteAttachment handles DELETE /fmsg/:id/attachments/:filename.
 func (h *AttachmentHandler) DeleteAttachment(c *gin.Context) {
 	identity := middleware.GetIdentity(c)
 	msgID, ok := parseID(c)