Now it's time to implement the functionality of our web service. Add the following code:

func (s *Server) handlePollsGet(w http.ResponseWriter,
 r *http.Request) { 
  session := s.db.Copy() 
  defer session.Close() 
  c := session.DB("ballots").C("polls") 
  var q *mgo.Query 
  p := NewPath(r.URL.Path) 
  if p.HasID() { 
    // get specific poll 
    q = c.FindId(bson.ObjectIdHex(p.ID)) 
  } else { 
    // get all polls 
    q = c.Find(nil) 
  } 
  var result []*poll 
  if err := q.All(&result); err != nil { 
    respondErr(w, r, http.StatusInternalServerError, err) 
    return 
  } 
  respond(w, r, http.StatusOK, &result) 
} 

The very first thing we do in each of our sub handler functions is create a copy of the database session that will allow us to interact with MongoDB. We then use mgo to create an object referring to the polls collection in the database – if you remember, this is where our polls live.

We then build up an mgo.Query object by parsing the path. If an ID is present, we use the FindId method on the polls collection; otherwise, we pass nil to the Find method, which indicates that we want to select all the polls. We are converting the ID from a string to a bson.ObjectId type with the ObjectIdHex method so that we can refer to the polls with their numerical (hex) identifiers.

Since the All method expects to generate a collection of  poll objects, we define the result as []*poll or a slice of pointers to poll types. Calling the All method on the query will cause mgo to use its connection to MongoDB to read all the polls and populate the result object.

Now that we have added some functionality, let's try out our API for the first time. If you are using the same MongoDB instance that we set up in the previous chapter, you should already have some data in the polls collection; to see our API working properly, you should ensure there are at least two polls in the database.

If you need to add other polls to the database, in a terminal, run the mongo command to open a database shell that will allow you to interact with MongoDB. Then, enter the following commands to add some test polls:

> use ballots
switched to db ballots
> db.polls.insert({"title":"Test  poll","options":
     ["one","two","three"]})
> db.polls.insert({"title":"Test poll  two","options":
     ["four","five","six"]})

In a terminal, navigate to your api folder and build and run the project:

go build -o api
./api

Now make a GET request to the /polls/ endpoint by navigating to http://localhost:8080/polls/?key=abc123 in your browser; remember to include the trailing slash. The result will be an array of polls in the JSON format.

Copy and paste one of the IDs from the polls list and insert it before the ? character in the browser to access the data for a specific poll, for example, http://localhost:8080/polls/5415b060a02cd4adb487c3ae?key=abc123. Note that instead of returning all the polls, it only returns one.

You might have also noticed that although we are only returning a single poll, this poll value is still nested inside an array. This is a deliberate design decision made for two reasons: the first and most important reason is that nesting makes it easier for users of the API to write code to consume the data. If users are always expecting a JSON array, they can write strong types that describe that expectation rather than having one type for single polls and another for collections of polls. As an API designer, this is your decision to make. The second reason we left the object nested in an array is that it makes the API code simpler, allowing us to just change the mgo.Query object and leave the rest of the code the same.

Clients should be able to make a POST request to /polls/ in order to create a poll. Let's add the following code inside the POST case:

func (s *Server) handlePollsPost(w http.ResponseWriter, 
 r *http.Request) { 
  session := s.db.Copy() 
  defer session.Close() 
  c := session.DB("ballots").C("polls") 
  var p poll 
  if err := decodeBody(r, &p); err != nil { 
    respondErr(w, r, http.StatusBadRequest, "failed to
     read poll from request", err) 
    return 
  } 
  apikey, ok := APIKey(r.Context()) 
  if ok { 
    p.APIKey = apikey 
  } 
  p.ID = bson.NewObjectId() 
  if err := c.Insert(p); err != nil { 
    respondErr(w, r, http.StatusInternalServerError,
     "failed to insert 
    poll", err) 
    return 
  } 
  w.Header().Set("Location", "polls/"+p.ID.Hex()) 
  respond(w, r, http.StatusCreated, nil) 
} 

After we get a copy of the database session like earlier, we attempt to decode the body of the request that, according to RESTful principles, should contain a representation of the poll object the client wants to create. If an error occurs, we use the respondErr helper to write the error to the user and immediately exit from the function. We then generate a new unique ID for the poll and use the mgo package's Insert method to send it into the database. We then set the Location header of the response and respond with a 201 http.StatusCreated message, pointing to the URL from which the newly created poll may be accessed. Some APIs return the object instead of providing a link to it; there is no concrete standard so it's up to you as the designer.

The final piece of functionality we are going to include in our API is the ability to delete polls. By making a request with the DELETE HTTP method to the URL of a poll (such as/polls/5415b060a02cd4adb487c3ae), we want to be able to remove the poll from the database and return a 200 Success response:

func (s *Server) handlePollsDelete(w http.ResponseWriter, 
  r *http.Request) { 
  session := s.db.Copy() 
  defer session.Close() 
  c := session.DB("ballots").C("polls") 
  p := NewPath(r.URL.Path) 
  if !p.HasID() { 
    respondErr(w, r, http.StatusMethodNotAllowed,
      "Cannot delete all polls.") 
    return 
  } 
  if err := c.RemoveId(bson.ObjectIdHex(p.ID)); err != nil { 
    respondErr(w, r, http.StatusInternalServerError,
     "failed to delete poll", err) 
    return 
  } 
  respond(w, r, http.StatusOK, nil) // ok 
} 

Similar to the GET case, we parse the path, but this time, we respond with an error if the path does not contain an ID. For now, we don't want people to be able to delete all polls with one request, and so we use the suitable StatusMethodNotAllowed code. Then, using the same collection we used in the previous cases, we call RemoveId, passing the ID in the path after converting it into a bson.ObjectId type. Assuming things go well, we respond with an http.StatusOK message with no body.

In order for our DELETE capability to work over CORS, we must do a little extra work to support the way CORS browsers handle some HTTP methods such as DELETE. A CORS browser will actually send a preflight request (with an HTTP method of OPTIONS), asking for permission to make a DELETE request (listed in the Access-Control-Request-Method request header), and the API must respond appropriately in order for the request to work. Add another case in the switch statement for OPTIONS:

case "OPTIONS": 
  w.Header().Add("Access-Control-Allow-Methods", "DELETE") 
  respond(w, r, http.StatusOK, nil) 
  return 

If the browser asks for permission to send a DELETE request, the API will respond by setting the Access-Control-Allow-Methods header to DELETE, thus overriding the default * value that we set in our withCORS wrapper handler. In the real world, the value for the Access-Control-Allow-Methods header will change in response to the request made, but since DELETE is the only case we are supporting, we can hardcode it for now.