From 75d75248e1949d7b1a9d4843e82ede80cf6b9d17 Mon Sep 17 00:00:00 2001
From: IRHM <irhm@sbond.co>
Date: Sun, 28 Jun 2026 00:15:57 +0100
Subject: [PATCH] Remove AddActivity endpoint

it isn't used and is only a way for others to potentially add activity to other peoples watched entries since user owning the watched entry is not validated on the endpoint.

Co-Authored-By: Dreddy <24421368+dredsen@users.noreply.github.com>
---
 server/feature/activity/activity.go |  5 +++++
 server/feature/activity/router.go   | 17 -----------------
 2 files changed, 5 insertions(+), 17 deletions(-)

diff --git a/server/feature/activity/activity.go b/server/feature/activity/activity.go
index c7bc9bc5..777fb4ab 100644
--- a/server/feature/activity/activity.go
+++ b/server/feature/activity/activity.go
@@ -35,6 +35,11 @@ func (s *Service) GetActivity(
 	return *activity, nil
 }
 
+// NOTE: Currently this function doesn't verify if `userId` owns the referenced
+// watched item at `ar.WatchedID`. If we ever need this function to work from an
+// "AddActivity" endpoint on the API, we should create another func that has
+// that validation, since this func is only for internal operations!
+// AddActivity: Only for internal use.
 func (s *Service) AddActivity(
 	userId uint,
 	ar domain.ActivityAddProps,
diff --git a/server/feature/activity/router.go b/server/feature/activity/router.go
index 94d5575f..f4517be3 100644
--- a/server/feature/activity/router.go
+++ b/server/feature/activity/router.go
@@ -27,7 +27,6 @@ func (r *Router) AddRoutes() {
 	activity := r.br.Router.Group("/activity").Use(authmiddleware.AuthRequired(nil, r.br.Cfg))
 
 	activity.GET(":watchedId", r.GetActivity)
-	activity.POST("", r.AddActivity)
 	activity.PUT(":id", r.UpdateActivity)
 	activity.DELETE(":id", r.DeleteActivity)
 }
@@ -47,22 +46,6 @@ func (r *Router) GetActivity(c *gin.Context) {
 	c.JSON(http.StatusOK, activity)
 }
 
-func (r *Router) AddActivity(c *gin.Context) {
-	userId := c.MustGet("userId").(uint)
-	var ar domain.ActivityAddRequest
-	err := c.ShouldBindJSON(&ar)
-	if err == nil {
-		response, err := r.service.AddActivity(userId, ar)
-		if err != nil {
-			c.JSON(http.StatusForbidden, router.ErrorResponse{Error: err.Error()})
-			return
-		}
-		c.JSON(http.StatusOK, response)
-		return
-	}
-	c.AbortWithStatusJSON(http.StatusBadRequest, router.ErrorResponse{Error: err.Error()})
-}
-
 func (r *Router) UpdateActivity(c *gin.Context) {
 	userId := c.MustGet("userId").(uint)
 	id, err := strconv.ParseUint(c.Param("id"), 10, 32)