Build post chat and attachment workflows

backend/internal/calendar/routes.go

@@ -22,6 +22,7 @@ type Routes struct {
 	store              Store
 	provider           Provider
 	commemorative      CommemorativeProvider
+	chatEvents         *ChatEventHub
 	uploadMaxSizeBytes int64
 	uploadAllowedMIMEs map[string]bool
 	storageDriver      string
@@ -54,6 +55,7 @@ func NewRoutes(store Store, provider Provider, commemorative CommemorativeProvid
 		store:              store,
 		provider:           provider,
 		commemorative:      commemorative,
+		chatEvents:         NewChatEventHub(),
 		uploadMaxSizeBytes: int64(options.UploadMaxSizeMB) * 1024 * 1024,
 		uploadAllowedMIMEs: allowedMIMEs,
 		storageDriver:      options.StorageDriver,
@@ -80,7 +82,15 @@ func (r Routes) Register(router *gin.RouterGroup, requireAuth gin.HandlerFunc) {
 	router.DELETE("/items/:itemId", r.cancelCalendarItem)
 	router.GET("/items/:itemId/attachments", r.listAttachments)
 	router.POST("/items/:itemId/attachments", r.uploadAttachment)
+	router.GET("/items/:itemId/chat", r.listChatMessages)
+	router.GET("/items/:itemId/chat/stream", r.streamChatMessages)
+	router.POST("/items/:itemId/chat", r.createChatMessage)
+	router.PATCH("/chat/messages/:messageId", r.updateChatMessage)
+	router.DELETE("/chat/messages/:messageId", r.deleteChatMessage)
+	router.POST("/chat/messages/:messageId/attachments", r.uploadChatAttachment)
+	router.GET("/chat/attachments/:attachmentId/download", r.downloadChatAttachment)
 	router.GET("/attachments/:attachmentId/download", r.downloadAttachment)
+	router.DELETE("/attachments/:attachmentId", r.deleteAttachment)
 }
 
 func (r Routes) holidays(c *gin.Context) {
@@ -604,6 +614,376 @@ func (r Routes) listAttachments(c *gin.Context) {
 	c.JSON(http.StatusOK, gin.H{"attachments": attachments})
 }
 
+func (r Routes) listChatMessages(c *gin.Context) {
+	claims, ok := auth.ClaimsFromContext(c)
+	if !ok {
+		c.JSON(http.StatusUnauthorized, gin.H{"message": "Autenticacao obrigatoria."})
+		return
+	}
+
+	channel := strings.TrimSpace(c.Query("channel"))
+	if channel == "" {
+		channel = ChatChannelExternal
+	}
+	if !isValidChatChannel(channel) {
+		c.JSON(http.StatusBadRequest, gin.H{"message": "Canal de chat invalido."})
+		return
+	}
+	if channel == ChatChannelInternal && claims.Role == users.RoleClientViewer {
+		c.JSON(http.StatusForbidden, gin.H{"message": "Permissao insuficiente."})
+		return
+	}
+
+	viewerUserID := ""
+	if claims.Role == users.RoleClientViewer {
+		viewerUserID = claims.UserID
+	}
+
+	item, err := r.store.FindCalendarItem(c.Request.Context(), c.Param("itemId"), viewerUserID)
+	if errors.Is(err, ErrCalendarItemNotFound) {
+		c.JSON(http.StatusNotFound, gin.H{"message": "Postagem nao encontrada."})
+		return
+	}
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"message": "Nao foi possivel carregar a postagem."})
+		return
+	}
+
+	messages, err := r.store.ListChatMessages(c.Request.Context(), item.ID, channel)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"message": "Nao foi possivel carregar mensagens."})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{"messages": messages})
+}
+
+func (r Routes) streamChatMessages(c *gin.Context) {
+	claims, ok := auth.ClaimsFromContext(c)
+	if !ok {
+		c.JSON(http.StatusUnauthorized, gin.H{"message": "Autenticacao obrigatoria."})
+		return
+	}
+
+	channel := strings.TrimSpace(c.Query("channel"))
+	if channel == "" {
+		channel = ChatChannelExternal
+	}
+	if !isValidChatChannel(channel) {
+		c.JSON(http.StatusBadRequest, gin.H{"message": "Canal de chat invalido."})
+		return
+	}
+	if channel == ChatChannelInternal && claims.Role == users.RoleClientViewer {
+		c.JSON(http.StatusForbidden, gin.H{"message": "Permissao insuficiente."})
+		return
+	}
+
+	viewerUserID := ""
+	if claims.Role == users.RoleClientViewer {
+		viewerUserID = claims.UserID
+	}
+
+	item, err := r.store.FindCalendarItem(c.Request.Context(), c.Param("itemId"), viewerUserID)
+	if errors.Is(err, ErrCalendarItemNotFound) {
+		c.JSON(http.StatusNotFound, gin.H{"message": "Postagem nao encontrada."})
+		return
+	}
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"message": "Nao foi possivel carregar a postagem."})
+		return
+	}
+
+	events, unsubscribe := r.chatEvents.Subscribe(item.ID, channel)
+	defer unsubscribe()
+
+	c.Header("Content-Type", "text/event-stream")
+	c.Header("Cache-Control", "no-cache")
+	c.Header("Connection", "keep-alive")
+	c.Header("X-Accel-Buffering", "no")
+
+	flusher, ok := c.Writer.(http.Flusher)
+	if !ok {
+		c.JSON(http.StatusInternalServerError, gin.H{"message": "Streaming nao suportado."})
+		return
+	}
+
+	_, _ = c.Writer.Write([]byte("event: ready\ndata: ok\n\n"))
+	flusher.Flush()
+
+	heartbeat := time.NewTicker(25 * time.Second)
+	defer heartbeat.Stop()
+
+	for {
+		select {
+		case <-c.Request.Context().Done():
+			return
+		case <-events:
+			_, _ = c.Writer.Write([]byte("event: chat\ndata: refresh\n\n"))
+			flusher.Flush()
+		case <-heartbeat.C:
+			_, _ = c.Writer.Write([]byte("event: ping\ndata: keepalive\n\n"))
+			flusher.Flush()
+		}
+	}
+}
+
+type createChatMessageRequest struct {
+	Channel string `json:"channel"`
+	Body    string `json:"body" binding:"max=4000"`
+}
+
+func (r Routes) createChatMessage(c *gin.Context) {
+	claims, ok := auth.ClaimsFromContext(c)
+	if !ok {
+		c.JSON(http.StatusUnauthorized, gin.H{"message": "Autenticacao obrigatoria."})
+		return
+	}
+
+	var input createChatMessageRequest
+	if err := c.ShouldBindJSON(&input); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"message": "Informe uma mensagem valida."})
+		return
+	}
+
+	channel := strings.TrimSpace(input.Channel)
+	if channel == "" {
+		channel = ChatChannelExternal
+	}
+	if !isValidChatChannel(channel) {
+		c.JSON(http.StatusBadRequest, gin.H{"message": "Canal de chat invalido."})
+		return
+	}
+	if channel == ChatChannelInternal && claims.Role == users.RoleClientViewer {
+		c.JSON(http.StatusForbidden, gin.H{"message": "Permissao insuficiente."})
+		return
+	}
+
+	body := strings.TrimSpace(input.Body)
+	if body == "" {
+		c.JSON(http.StatusBadRequest, gin.H{"message": "Informe uma mensagem valida."})
+		return
+	}
+
+	viewerUserID := ""
+	if claims.Role == users.RoleClientViewer {
+		viewerUserID = claims.UserID
+	}
+
+	item, err := r.store.FindCalendarItem(c.Request.Context(), c.Param("itemId"), viewerUserID)
+	if errors.Is(err, ErrCalendarItemNotFound) {
+		c.JSON(http.StatusNotFound, gin.H{"message": "Postagem nao encontrada."})
+		return
+	}
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"message": "Nao foi possivel carregar a postagem."})
+		return
+	}
+
+	message, err := r.store.CreateChatMessage(c.Request.Context(), CreateChatMessageInput{
+		CalendarItemID: item.ID,
+		Channel:        channel,
+		Body:           body,
+		CreatedBy:      claims.UserID,
+	})
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"message": "Nao foi possivel enviar a mensagem."})
+		return
+	}
+
+	_ = r.store.RecordAudit(c.Request.Context(), claims.UserID, "chat_message.created", "calendar_item", item.ID, map[string]any{
+		"channel": channel,
+	})
+
+	r.chatEvents.Publish(item.ID, channel)
+
+	c.JSON(http.StatusCreated, gin.H{"message": message})
+}
+
+type updateChatMessageRequest struct {
+	Body string `json:"body" binding:"required,min=1,max=4000"`
+}
+
+func (r Routes) updateChatMessage(c *gin.Context) {
+	claims, ok := auth.ClaimsFromContext(c)
+	if !ok {
+		c.JSON(http.StatusUnauthorized, gin.H{"message": "Autenticacao obrigatoria."})
+		return
+	}
+
+	var input updateChatMessageRequest
+	if err := c.ShouldBindJSON(&input); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"message": "Informe uma mensagem valida."})
+		return
+	}
+
+	message, err := r.authorizedChatMessage(c, claims, c.Param("messageId"), true)
+	if err != nil {
+		return
+	}
+	if message.DeletedAt != nil {
+		c.JSON(http.StatusNotFound, gin.H{"message": "Mensagem nao encontrada."})
+		return
+	}
+	if len(message.Attachments) > 0 {
+		c.JSON(http.StatusBadRequest, gin.H{"message": "Mensagens com anexos nao podem ser editadas."})
+		return
+	}
+
+	updated, err := r.store.UpdateChatMessage(c.Request.Context(), message.ID, strings.TrimSpace(input.Body))
+	if errors.Is(err, ErrChatMessageNotFound) {
+		c.JSON(http.StatusNotFound, gin.H{"message": "Mensagem nao encontrada."})
+		return
+	}
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"message": "Nao foi possivel editar a mensagem."})
+		return
+	}
+
+	r.chatEvents.Publish(updated.CalendarItemID, updated.Channel)
+
+	c.JSON(http.StatusOK, gin.H{"message": updated})
+}
+
+func (r Routes) deleteChatMessage(c *gin.Context) {
+	claims, ok := auth.ClaimsFromContext(c)
+	if !ok {
+		c.JSON(http.StatusUnauthorized, gin.H{"message": "Autenticacao obrigatoria."})
+		return
+	}
+
+	message, err := r.authorizedChatMessage(c, claims, c.Param("messageId"), true)
+	if err != nil {
+		return
+	}
+	if message.DeletedAt != nil {
+		c.JSON(http.StatusNotFound, gin.H{"message": "Mensagem nao encontrada."})
+		return
+	}
+
+	deleted, err := r.store.DeleteChatMessage(c.Request.Context(), message.ID)
+	if errors.Is(err, ErrChatMessageNotFound) {
+		c.JSON(http.StatusNotFound, gin.H{"message": "Mensagem nao encontrada."})
+		return
+	}
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"message": "Nao foi possivel excluir a mensagem."})
+		return
+	}
+
+	r.chatEvents.Publish(deleted.CalendarItemID, deleted.Channel)
+
+	c.JSON(http.StatusOK, gin.H{"message": deleted})
+}
+
+func (r Routes) uploadChatAttachment(c *gin.Context) {
+	claims, ok := auth.ClaimsFromContext(c)
+	if !ok {
+		c.JSON(http.StatusUnauthorized, gin.H{"message": "Autenticacao obrigatoria."})
+		return
+	}
+
+	message, err := r.authorizedChatMessage(c, claims, c.Param("messageId"), false)
+	if err != nil {
+		return
+	}
+	if message.DeletedAt != nil {
+		c.JSON(http.StatusNotFound, gin.H{"message": "Mensagem nao encontrada."})
+		return
+	}
+	if message.CreatedBy == nil || *message.CreatedBy != claims.UserID {
+		c.JSON(http.StatusForbidden, gin.H{"message": "Permissao insuficiente."})
+		return
+	}
+
+	upload, err := r.saveUploadedFile(c, filepath.Join("chat", message.ID))
+	if err != nil {
+		return
+	}
+
+	attachment, err := r.store.CreateChatAttachment(c.Request.Context(), CreateChatAttachmentInput{
+		ChatMessageID:    message.ID,
+		OriginalFilename: upload.originalFilename,
+		StoredFilename:   upload.storedFilename,
+		MimeType:         upload.mimeType,
+		SizeBytes:        upload.sizeBytes,
+		StorageDriver:    r.storageDriver,
+		StoragePath:      upload.storagePath,
+		CreatedBy:        claims.UserID,
+	})
+	if err != nil {
+		_ = os.Remove(upload.storagePath)
+		c.JSON(http.StatusInternalServerError, gin.H{"message": "Nao foi possivel registrar o anexo."})
+		return
+	}
+
+	r.chatEvents.Publish(message.CalendarItemID, message.Channel)
+
+	c.JSON(http.StatusCreated, gin.H{"attachment": attachment})
+}
+
+func (r Routes) downloadChatAttachment(c *gin.Context) {
+	claims, ok := auth.ClaimsFromContext(c)
+	if !ok {
+		c.JSON(http.StatusUnauthorized, gin.H{"message": "Autenticacao obrigatoria."})
+		return
+	}
+
+	viewerUserID := ""
+	if claims.Role == users.RoleClientViewer {
+		viewerUserID = claims.UserID
+	}
+
+	attachment, err := r.store.FindChatAttachment(c.Request.Context(), c.Param("attachmentId"), viewerUserID)
+	if errors.Is(err, ErrAttachmentNotFound) {
+		c.JSON(http.StatusNotFound, gin.H{"message": "Anexo nao encontrado."})
+		return
+	}
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"message": "Nao foi possivel carregar o anexo."})
+		return
+	}
+
+	c.Header("Content-Type", attachment.MimeType)
+	c.Header("Content-Disposition", `attachment; filename="`+strings.ReplaceAll(attachment.OriginalFilename, `"`, "")+`"`)
+	c.File(attachment.StoragePath)
+}
+
+func (r Routes) authorizedChatMessage(c *gin.Context, claims auth.Claims, messageID string, requireOwner bool) (ChatMessage, error) {
+	message, err := r.store.FindChatMessage(c.Request.Context(), messageID)
+	if errors.Is(err, ErrChatMessageNotFound) {
+		c.JSON(http.StatusNotFound, gin.H{"message": "Mensagem nao encontrada."})
+		return ChatMessage{}, err
+	}
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"message": "Nao foi possivel carregar a mensagem."})
+		return ChatMessage{}, err
+	}
+	if message.Channel == ChatChannelInternal && claims.Role == users.RoleClientViewer {
+		c.JSON(http.StatusForbidden, gin.H{"message": "Permissao insuficiente."})
+		return ChatMessage{}, errors.New("forbidden")
+	}
+
+	viewerUserID := ""
+	if claims.Role == users.RoleClientViewer {
+		viewerUserID = claims.UserID
+	}
+	if _, err := r.store.FindCalendarItem(c.Request.Context(), message.CalendarItemID, viewerUserID); err != nil {
+		if errors.Is(err, ErrCalendarItemNotFound) {
+			c.JSON(http.StatusNotFound, gin.H{"message": "Postagem nao encontrada."})
+		} else {
+			c.JSON(http.StatusInternalServerError, gin.H{"message": "Nao foi possivel carregar a postagem."})
+		}
+		return ChatMessage{}, err
+	}
+
+	if requireOwner && claims.Role != users.RoleSuperAdmin && (message.CreatedBy == nil || *message.CreatedBy != claims.UserID) {
+		c.JSON(http.StatusForbidden, gin.H{"message": "Permissao insuficiente."})
+		return ChatMessage{}, errors.New("forbidden")
+	}
+
+	return message, nil
+}
+
 func (r Routes) uploadAttachment(c *gin.Context) {
 	claims, ok := auth.ClaimsFromContext(c)
 	if !ok || (claims.Role != users.RoleSuperAdmin && claims.Role != users.RoleAgencyUser) {
@@ -611,75 +991,23 @@ func (r Routes) uploadAttachment(c *gin.Context) {
 		return
 	}
 
-	c.Request.Body = http.MaxBytesReader(c.Writer, c.Request.Body, r.uploadMaxSizeBytes)
-	file, header, err := c.Request.FormFile("file")
+	upload, err := r.saveUploadedFile(c, c.Param("itemId"))
 	if err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"message": "Envie um arquivo valido."})
-		return
-	}
-	defer file.Close()
-
-	if header.Size > r.uploadMaxSizeBytes {
-		c.JSON(http.StatusBadRequest, gin.H{"message": "Arquivo acima do limite permitido."})
-		return
-	}
-
-	head := make([]byte, 512)
-	n, err := file.Read(head)
-	if err != nil && err != io.EOF {
-		c.JSON(http.StatusBadRequest, gin.H{"message": "Nao foi possivel ler o arquivo."})
-		return
-	}
-	if _, err := file.Seek(0, io.SeekStart); err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"message": "Nao foi possivel processar o arquivo."})
-		return
-	}
-
-	mimeType := http.DetectContentType(head[:n])
-	if len(r.uploadAllowedMIMEs) > 0 && !r.uploadAllowedMIMEs[mimeType] {
-		c.JSON(http.StatusBadRequest, gin.H{"message": "Tipo de arquivo nao permitido."})
-		return
-	}
-
-	storedFilename, err := randomStoredFilename(header.Filename)
-	if err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"message": "Nao foi possivel preparar o arquivo."})
-		return
-	}
-
-	itemDir := filepath.Join(r.storageLocalPath, c.Param("itemId"))
-	if err := os.MkdirAll(itemDir, 0o750); err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"message": "Nao foi possivel preparar o armazenamento."})
-		return
-	}
-
-	storagePath := filepath.Join(itemDir, storedFilename)
-	destination, err := os.OpenFile(storagePath, os.O_CREATE|os.O_EXCL|os.O_WRONLY, 0o640)
-	if err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"message": "Nao foi possivel salvar o arquivo."})
-		return
-	}
-	defer destination.Close()
-
-	sizeBytes, err := io.Copy(destination, file)
-	if err != nil {
-		_ = os.Remove(storagePath)
-		c.JSON(http.StatusInternalServerError, gin.H{"message": "Nao foi possivel salvar o arquivo."})
 		return
 	}
 
 	attachment, err := r.store.CreateAttachment(c.Request.Context(), CreateAttachmentInput{
 		CalendarItemID:   c.Param("itemId"),
-		OriginalFilename: filepath.Base(header.Filename),
-		StoredFilename:   storedFilename,
-		MimeType:         mimeType,
-		SizeBytes:        sizeBytes,
+		OriginalFilename: upload.originalFilename,
+		StoredFilename:   upload.storedFilename,
+		MimeType:         upload.mimeType,
+		SizeBytes:        upload.sizeBytes,
 		StorageDriver:    r.storageDriver,
-		StoragePath:      storagePath,
+		StoragePath:      upload.storagePath,
 		CreatedBy:        claims.UserID,
 	})
 	if err != nil {
-		_ = os.Remove(storagePath)
+		_ = os.Remove(upload.storagePath)
 		c.JSON(http.StatusInternalServerError, gin.H{"message": "Nao foi possivel registrar o anexo."})
 		return
 	}
@@ -694,6 +1022,96 @@ func (r Routes) uploadAttachment(c *gin.Context) {
 	c.JSON(http.StatusCreated, gin.H{"attachment": attachment})
 }
 
+type savedUpload struct {
+	originalFilename string
+	storedFilename   string
+	mimeType         string
+	sizeBytes        int64
+	storagePath      string
+}
+
+func (r Routes) saveUploadedFile(c *gin.Context, relativeDir string) (savedUpload, error) {
+	c.Request.Body = http.MaxBytesReader(c.Writer, c.Request.Body, r.uploadMaxSizeBytes)
+	file, header, err := c.Request.FormFile("file")
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"message": "Envie um arquivo valido."})
+		return savedUpload{}, err
+	}
+	defer file.Close()
+
+	if header.Size > r.uploadMaxSizeBytes {
+		c.JSON(http.StatusBadRequest, gin.H{"message": "Arquivo acima do limite permitido."})
+		return savedUpload{}, errors.New("file too large")
+	}
+
+	head := make([]byte, 512)
+	n, err := file.Read(head)
+	if err != nil && err != io.EOF {
+		c.JSON(http.StatusBadRequest, gin.H{"message": "Nao foi possivel ler o arquivo."})
+		return savedUpload{}, err
+	}
+	if _, err := file.Seek(0, io.SeekStart); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"message": "Nao foi possivel processar o arquivo."})
+		return savedUpload{}, err
+	}
+
+	mimeType := normalizeUploadMimeType(http.DetectContentType(head[:n]), header.Filename)
+	if len(r.uploadAllowedMIMEs) > 0 && !r.uploadAllowedMIMEs[mimeType] {
+		c.JSON(http.StatusBadRequest, gin.H{"message": "Tipo de arquivo nao permitido."})
+		return savedUpload{}, errors.New("invalid mime")
+	}
+
+	storedFilename, err := randomStoredFilename(header.Filename)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"message": "Nao foi possivel preparar o arquivo."})
+		return savedUpload{}, err
+	}
+
+	storageDir := filepath.Join(r.storageLocalPath, filepath.Clean(relativeDir))
+	if err := os.MkdirAll(storageDir, 0o750); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"message": "Nao foi possivel preparar o armazenamento."})
+		return savedUpload{}, err
+	}
+
+	storagePath := filepath.Join(storageDir, storedFilename)
+	destination, err := os.OpenFile(storagePath, os.O_CREATE|os.O_EXCL|os.O_WRONLY, 0o640)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"message": "Nao foi possivel salvar o arquivo."})
+		return savedUpload{}, err
+	}
+	defer destination.Close()
+
+	sizeBytes, err := io.Copy(destination, file)
+	if err != nil {
+		_ = os.Remove(storagePath)
+		c.JSON(http.StatusInternalServerError, gin.H{"message": "Nao foi possivel salvar o arquivo."})
+		return savedUpload{}, err
+	}
+
+	return savedUpload{
+		originalFilename: filepath.Base(header.Filename),
+		storedFilename:   storedFilename,
+		mimeType:         mimeType,
+		sizeBytes:        sizeBytes,
+		storagePath:      storagePath,
+	}, nil
+}
+
+func normalizeUploadMimeType(detected string, filename string) string {
+	switch strings.ToLower(filepath.Ext(filename)) {
+	case ".docx":
+		if detected == "application/zip" || detected == "application/octet-stream" {
+			return "application/vnd.openxmlformats-officedocument.wordprocessingml.document"
+		}
+	case ".doc":
+		if detected == "application/octet-stream" {
+			return "application/msword"
+		}
+	}
+
+	return detected
+}
+
 func (r Routes) downloadAttachment(c *gin.Context) {
 	claims, ok := auth.ClaimsFromContext(c)
 	if !ok {
@@ -721,6 +1139,37 @@ func (r Routes) downloadAttachment(c *gin.Context) {
 	c.File(attachment.StoragePath)
 }
 
+func (r Routes) deleteAttachment(c *gin.Context) {
+	claims, ok := auth.ClaimsFromContext(c)
+	if !ok || (claims.Role != users.RoleSuperAdmin && claims.Role != users.RoleAgencyUser) {
+		c.JSON(http.StatusForbidden, gin.H{"message": "Permissao insuficiente."})
+		return
+	}
+
+	attachment, err := r.store.DeleteAttachment(c.Request.Context(), c.Param("attachmentId"))
+	if errors.Is(err, ErrAttachmentNotFound) {
+		c.JSON(http.StatusNotFound, gin.H{"message": "Anexo nao encontrado."})
+		return
+	}
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"message": "Nao foi possivel excluir o anexo."})
+		return
+	}
+
+	if attachment.StorageDriver == "local" {
+		_ = os.Remove(attachment.StoragePath)
+	}
+
+	_ = r.store.RecordAudit(c.Request.Context(), claims.UserID, "attachment.deleted", "calendar_item_attachment", attachment.ID, map[string]any{
+		"calendar_item_id": attachment.CalendarItemID,
+		"filename":         attachment.OriginalFilename,
+		"mime_type":        attachment.MimeType,
+		"size_bytes":       attachment.SizeBytes,
+	})
+
+	c.JSON(http.StatusOK, gin.H{"attachment": attachment})
+}
+
 func randomStoredFilename(original string) (string, error) {
 	bytes := make([]byte, 16)
 	if _, err := rand.Read(bytes); err != nil {
@@ -738,3 +1187,12 @@ func isValidCalendarItemStatus(status string) bool {
 		return false
 	}
 }
+
+func isValidChatChannel(channel string) bool {
+	switch channel {
+	case ChatChannelExternal, ChatChannelInternal:
+		return true
+	default:
+		return false
+	}
+}