cw1_3

@app.route("/review/<userId>/<itemId>", methods=["GET", "POST"])
def reviewItem(userId, itemId):
    """Add a Review"""
    from flask import escape
    #Check for user
    if not flask.session["user"]:
        flask.flash("You need to be logged in")
        return flask.redirect(flask.url_for("index"))

    
    if flask.session["user"] != int(userId):
         flask.flash("Forbidden")
         return flask.redirect(flask.url_for("index"))
         
    theQry = f"SELECT * FROM purchase WHERE productID = {itemId} and userID = {userId};"

    item = query_db(theQry, one=True)    
    if item is None:
        flask.flash("Forbidden,You don't buy the book.")
        return flask.redirect(flask.url_for("index"))
       
    #Handle input
    if flask.request.method == "POST":
        reviewStars = escape(flask.request.form.get("rating"))
        reviewComment = escape(flask.request.form.get("review"))

        #Clean up review whitespace
        reviewComment = reviewComment.strip()
        reviewId = flask.request.form.get("reviewId")

        app.logger.info("Review Made %s", reviewId)
        app.logger.info("Rating %s  Text %s", reviewStars, reviewComment)

        if reviewId:
            #Update an existing oe
            app.logger.info("Update Existing")

            theSQL = f"""
            UPDATE review
            SET stars = ?,
                review = ?
            WHERE
                id = ?"""

            print(theSQL)
            app.logger.debug("%s", theSQL)
            write_db(theSQL, (reviewStars, reviewComment ,reviewId))

            flask.flash("Review Updated")
            
        else:
            app.logger.info("New Review")

            theSQL = f"""
            INSERT INTO review (userId, productId, stars, review)
            VALUES (?, ?, ?, ?);
            """

            print(theSQL)
            app.logger.info("%s", theSQL)
            write_db(theSQL, (userId,itemId,reviewStars,reviewComment))

            flask.flash("Review Made")

    #Otherwise get the review
    theQry = f"SELECT * FROM product WHERE id = {itemId};"
    item = query_db(theQry, one=True)
    
    theQry = f"SELECT * FROM review WHERE userID = {userId} AND productID = {itemId};"
    review = query_db(theQry, one=True)
    app.logger.debug("Review Exists %s", review)

    return flask.render_template("reviewItem.html",
                                 item = item,
                                 review = review,
                                 )