Stage 5

src/core/core_calendar.erl

@@ -82,4 +82,6 @@ set_field(tags, Value, C) -> C#calendar{tags = Value};
 set_field(type, Value, C) -> C#calendar{type = Value};
 set_field(confirmation, Value, C) -> C#calendar{confirmation = Value};
 set_field(status, Value, C) -> C#calendar{status = Value};
+set_field(rating_avg, Value, C) -> C#calendar{rating_avg = Value};
+set_field(rating_count, Value, C) -> C#calendar{rating_count = Value};
 set_field(_, _, C) -> C.

src/core/core_event.erl

@@ -187,4 +187,6 @@ set_field(tags, Value, E) -> E#event{tags = Value};
 set_field(capacity, Value, E) -> E#event{capacity = Value};
 set_field(online_link, Value, E) -> E#event{online_link = Value};
 set_field(status, Value, E) -> E#event{status = Value};
+set_field(rating_avg, Value, E) -> E#event{rating_avg = Value};
+set_field(rating_count, Value, E) -> E#event{rating_count = Value};
 set_field(_, _, E) -> E.

src/core/core_review.erl

@@ -0,0 +1,129 @@
+-module(core_review).
+-include("records.hrl").
+
+-export([create/5, get_by_id/1, list_by_target/2, list_by_user/1,
+  update/2, delete/1, hide/1, unhide/1]).
+-export([get_average_rating/2, has_user_reviewed/3]).
+-export([generate_id/0]).
+
+%% Создание отзыва
+create(UserId, TargetType, TargetId, Rating, Comment) ->
+  Id = generate_id(),
+  Review = #review{
+    id = Id,
+    user_id = UserId,
+    target_type = TargetType,
+    target_id = TargetId,
+    rating = Rating,
+    comment = Comment,
+    status = visible,
+    created_at = calendar:universal_time(),
+    updated_at = calendar:universal_time()
+  },
+
+  F = fun() ->
+    mnesia:write(Review),
+    {ok, Review}
+      end,
+
+  case mnesia:transaction(F) of
+    {atomic, Result} -> Result;
+    {aborted, Reason} -> {error, Reason}
+  end.
+
+%% Получение отзыва по ID
+get_by_id(Id) ->
+  case mnesia:dirty_read(review, Id) of
+    [] -> {error, not_found};
+    [Review] -> {ok, Review}
+  end.
+
+%% Список отзывов для цели (событие или календарь)
+list_by_target(TargetType, TargetId) ->
+  Match = #review{target_type = TargetType, target_id = TargetId, status = visible, _ = '_'},
+  Reviews = mnesia:dirty_match_object(Match),
+  {ok, lists:sort(fun(A, B) -> A#review.created_at >= B#review.created_at end, Reviews)}.
+
+%% Список отзывов пользователя
+list_by_user(UserId) ->
+  Match = #review{user_id = UserId, _ = '_'},
+  Reviews = mnesia:dirty_match_object(Match),
+  {ok, Reviews}.
+
+%% Обновление отзыва
+update(Id, Updates) ->
+  F = fun() ->
+    case mnesia:read(review, Id) of
+      [] ->
+        {error, not_found};
+      [Review] ->
+        UpdatedReview = apply_updates(Review, Updates),
+        mnesia:write(UpdatedReview),
+        {ok, UpdatedReview}
+    end
+      end,
+
+  case mnesia:transaction(F) of
+    {atomic, Result} -> Result;
+    {aborted, Reason} -> {error, Reason}
+  end.
+
+%% Удаление отзыва (hard delete)
+delete(Id) ->
+  F = fun() ->
+    case mnesia:read(review, Id) of
+      [] ->
+        {error, not_found};
+      [Review] ->
+        mnesia:delete_object(Review),
+        {ok, deleted}
+    end
+      end,
+
+  case mnesia:transaction(F) of
+    {atomic, Result} -> Result;
+    {aborted, Reason} -> {error, Reason}
+  end.
+
+%% Скрытие отзыва (модерация)
+hide(Id) ->
+  update(Id, [{status, hidden}]).
+
+%% Раскрытие отзыва
+unhide(Id) ->
+  update(Id, [{status, visible}]).
+
+%% Получение среднего рейтинга цели
+get_average_rating(TargetType, TargetId) ->
+  Match = #review{target_type = TargetType, target_id = TargetId, status = visible, _ = '_'},
+  Reviews = mnesia:dirty_match_object(Match),
+
+  case length(Reviews) of
+    0 -> {0.0, 0};
+    Count ->
+      Total = lists:sum([R#review.rating || R <- Reviews]),
+      {Total / Count, Count}
+  end.
+
+%% Проверка, оставлял ли пользователь отзыв
+has_user_reviewed(UserId, TargetType, TargetId) ->
+  Match = #review{user_id = UserId, target_type = TargetType, target_id = TargetId, _ = '_'},
+  case mnesia:dirty_match_object(Match) of
+    [] -> false;
+    _ -> true
+  end.
+
+%% Внутренние функции
+generate_id() ->
+  base64:encode(crypto:strong_rand_bytes(16), #{mode => urlsafe, padding => false}).
+
+apply_updates(Review, Updates) ->
+  Updated = lists:foldl(fun({Field, Value}, R) ->
+    set_field(Field, Value, R)
+                        end, Review, Updates),
+  Updated#review{updated_at = calendar:universal_time()}.
+
+set_field(rating, Value, R) when Value >= 1, Value =< 5 -> R#review{rating = Value};
+set_field(comment, Value, R) -> R#review{comment = Value};
+set_field(status, Value, R) when Value =:= visible; Value =:= hidden -> R#review{status = Value};
+set_field(_, _, R) -> R.

src/eventhub_app.erl

@@ -31,6 +31,7 @@ start_http() ->
       {"/v1/refresh", handler_refresh, []},
       {"/v1/user/me", handler_user_me, []},
       {"/v1/user/bookings", handler_user_bookings, []},
+      {"/v1/user/reviews", handler_user_reviews, []},
       {"/v1/search", handler_search, []},
       {"/v1/calendars", handler_calendars, []},
       {"/v1/calendars/:id", handler_calendar_by_id, []},
@@ -39,7 +40,10 @@ start_http() ->
       {"/v1/events/:id/occurrences", handler_event_occurrences, []},
       {"/v1/events/:id/occurrences/:start_time", handler_event_occurrences, []},
       {"/v1/events/:id/bookings", handler_bookings, []},
-      {"/v1/bookings/:id", handler_booking_by_id, []}
+      {"/v1/bookings/:id", handler_booking_by_id, []},
+      {"/v1/reviews", handler_reviews, []},
+      {"/v1/reviews/:id", handler_review_by_id, []},
+      {"/v1/admin/reviews/:id", handler_admin_reviews, []}
     ]}
   ]),
 

src/handlers/handler_admin_reviews.erl

@@ -0,0 +1,91 @@
+-module(handler_admin_reviews).
+-include("records.hrl").
+
+-export([init/2]).
+
+init(Req, Opts) ->
+  handle(Req, Opts).
+
+handle(Req, _Opts) ->
+  case cowboy_req:method(Req) of
+    <<"PUT">> -> moderate_review(Req);
+    _ -> send_error(Req, 405, <<"Method not allowed">>)
+  end.
+
+%% PUT /v1/admin/reviews/:id - скрыть/раскрыть отзыв
+moderate_review(Req) ->
+  case handler_auth:authenticate(Req) of
+    {ok, AdminId, Req1} ->
+      % Проверим роль
+      case core_user:get_by_id(AdminId) of
+        {ok, User} ->
+          io:format("User ~p role: ~p~n", [AdminId, User#user.role]);
+        _ -> ok
+      end,
+      ReviewId = cowboy_req:binding(id, Req1),
+      {ok, Body, Req2} = cowboy_req:read_body(Req1),
+      try jsx:decode(Body, [return_maps]) of
+        #{<<"action">> := Action} ->
+          case Action of
+            <<"hide">> ->
+              case logic_review:hide_review(AdminId, ReviewId) of
+                {ok, Review} ->
+                  Response = review_to_json(Review),
+                  send_json(Req2, 200, Response);
+                {error, access_denied} ->
+                  send_error(Req2, 403, <<"Admin access required">>);
+                {error, not_found} ->
+                  send_error(Req2, 404, <<"Review not found">>);
+                {error, _} ->
+                  send_error(Req2, 500, <<"Internal server error">>)
+              end;
+            <<"unhide">> ->
+              case logic_review:unhide_review(AdminId, ReviewId) of
+                {ok, Review} ->
+                  Response = review_to_json(Review),
+                  send_json(Req2, 200, Response);
+                {error, access_denied} ->
+                  send_error(Req2, 403, <<"Admin access required">>);
+                {error, not_found} ->
+                  send_error(Req2, 404, <<"Review not found">>);
+                {error, _} ->
+                  send_error(Req2, 500, <<"Internal server error">>)
+              end;
+            _ ->
+              send_error(Req2, 400, <<"Invalid action. Use 'hide' or 'unhide'">>)
+          end;
+        _ ->
+          send_error(Req2, 400, <<"Missing action field">>)
+      catch
+        _:_ ->
+          send_error(Req2, 400, <<"Invalid JSON format">>)
+      end;
+    {error, Code, Message, Req1} ->
+      send_error(Req1, Code, Message)
+  end.
+
+%% Вспомогательные функции
+review_to_json(Review) ->
+  #{
+    id => Review#review.id,
+    user_id => Review#review.user_id,
+    target_type => Review#review.target_type,
+    target_id => Review#review.target_id,
+    rating => Review#review.rating,
+    comment => Review#review.comment,
+    status => Review#review.status,
+    created_at => datetime_to_iso8601(Review#review.created_at),
+    updated_at => datetime_to_iso8601(Review#review.updated_at)
+  }.
+
+datetime_to_iso8601({{Year, Month, Day}, {Hour, Minute, Second}}) ->
+  iolist_to_binary(io_lib:format("~4..0B-~2..0B-~2..0BT~2..0B:~2..0B:~2..0BZ",
+    [Year, Month, Day, Hour, Minute, Second])).
+
+send_json(Req, Status, Data) ->
+  Body = jsx:encode(Data),
+  cowboy_req:reply(Status, #{<<"content-type">> => <<"application/json">>}, Body, Req).
+
+send_error(Req, Status, Message) ->
+  Body = jsx:encode(#{error => Message}),
+  cowboy_req:reply(Status, #{<<"content-type">> => <<"application/json">>}, Body, Req).

src/handlers/handler_review_by_id.erl

@@ -0,0 +1,116 @@
+-module(handler_review_by_id).
+-include("records.hrl").
+
+-export([init/2]).
+
+init(Req, Opts) ->
+  handle(Req, Opts).
+
+handle(Req, _Opts) ->
+  case cowboy_req:method(Req) of
+    <<"GET">> -> get_review(Req);
+    <<"PUT">> -> update_review(Req);
+    <<"DELETE">> -> delete_review(Req);
+    _ -> send_error(Req, 405, <<"Method not allowed">>)
+  end.
+
+%% GET /v1/reviews/:id - получение отзыва
+get_review(Req) ->
+  case handler_auth:authenticate(Req) of
+    {ok, UserId, Req1} ->
+      ReviewId = cowboy_req:binding(id, Req1),
+      case logic_review:get_review(UserId, ReviewId) of
+        {ok, Review} ->
+          Response = review_to_json(Review),
+          send_json(Req1, 200, Response);
+        {error, access_denied} ->
+          send_error(Req1, 403, <<"Access denied">>);
+        {error, not_found} ->
+          send_error(Req1, 404, <<"Review not found">>);
+        {error, _} ->
+          send_error(Req1, 500, <<"Internal server error">>)
+      end;
+    {error, Code, Message, Req1} ->
+      send_error(Req1, Code, Message)
+  end.
+
+%% PUT /v1/reviews/:id - обновление отзыва
+update_review(Req) ->
+  case handler_auth:authenticate(Req) of
+    {ok, UserId, Req1} ->
+      ReviewId = cowboy_req:binding(id, Req1),
+      {ok, Body, Req2} = cowboy_req:read_body(Req1),
+      try jsx:decode(Body, [return_maps]) of
+        UpdatesMap when is_map(UpdatesMap) ->
+          Updates = maps:to_list(UpdatesMap),
+          case logic_review:update_review(UserId, ReviewId, Updates) of
+            {ok, _} ->
+              % Получаем обновлённый отзыв из базы
+              case core_review:get_by_id(ReviewId) of
+                {ok, Updated} ->
+                  Response = review_to_json(Updated),
+                  send_json(Req2, 200, Response);
+                _ ->
+                  send_error(Req2, 500, <<"Failed to retrieve updated review">>)
+              end;
+            {error, access_denied} ->
+              send_error(Req2, 403, <<"Access denied">>);
+            {error, not_found} ->
+              send_error(Req2, 404, <<"Review not found">>);
+            {error, _} ->
+              send_error(Req2, 500, <<"Internal server error">>)
+          end;
+        _ ->
+          send_error(Req2, 400, <<"Invalid JSON">>)
+      catch
+        _:_ ->
+          send_error(Req2, 400, <<"Invalid JSON format">>)
+      end;
+    {error, Code, Message, Req1} ->
+      send_error(Req1, Code, Message)
+  end.
+
+%% DELETE /v1/reviews/:id - удаление отзыва
+delete_review(Req) ->
+  case handler_auth:authenticate(Req) of
+    {ok, UserId, Req1} ->
+      ReviewId = cowboy_req:binding(id, Req1),
+      case logic_review:delete_review(UserId, ReviewId) of
+        {ok, deleted} ->
+          send_json(Req1, 200, #{status => <<"deleted">>});
+        {error, access_denied} ->
+          send_error(Req1, 403, <<"Access denied">>);
+        {error, not_found} ->
+          send_error(Req1, 404, <<"Review not found">>);
+        {error, _} ->
+          send_error(Req1, 500, <<"Internal server error">>)
+      end;
+    {error, Code, Message, Req1} ->
+      send_error(Req1, Code, Message)
+  end.
+
+%% Вспомогательные функции
+review_to_json(Review) ->
+  #{
+    id => Review#review.id,
+    user_id => Review#review.user_id,
+    target_type => Review#review.target_type,
+    target_id => Review#review.target_id,
+    rating => Review#review.rating,
+    comment => Review#review.comment,
+    status => Review#review.status,
+    created_at => datetime_to_iso8601(Review#review.created_at),
+    updated_at => datetime_to_iso8601(Review#review.updated_at)
+  }.
+
+datetime_to_iso8601({{Year, Month, Day}, {Hour, Minute, Second}}) ->
+  iolist_to_binary(io_lib:format("~4..0B-~2..0B-~2..0BT~2..0B:~2..0B:~2..0BZ",
+    [Year, Month, Day, Hour, Minute, Second])).
+
+send_json(Req, Status, Data) ->
+  Body = jsx:encode(Data),
+  cowboy_req:reply(Status, #{<<"content-type">> => <<"application/json">>}, Body, Req).
+
+send_error(Req, Status, Message) ->
+  Body = jsx:encode(#{error => Message}),
+  cowboy_req:reply(Status, #{<<"content-type">> => <<"application/json">>}, Body, Req).

src/handlers/handler_reviews.erl

@@ -0,0 +1,107 @@
+-module(handler_reviews).
+-include("records.hrl").
+
+-export([init/2]).
+
+init(Req, Opts) ->
+  handle(Req, Opts).
+
+handle(Req, _Opts) ->
+  case cowboy_req:method(Req) of
+    <<"POST">> -> create_review(Req);
+    <<"GET">> -> list_reviews(Req);
+    _ -> send_error(Req, 405, <<"Method not allowed">>)
+  end.
+
+%% POST /v1/reviews - создание отзыва
+create_review(Req) ->
+  case handler_auth:authenticate(Req) of
+    {ok, UserId, Req1} ->
+      {ok, Body, Req2} = cowboy_req:read_body(Req1),
+      try jsx:decode(Body, [return_maps]) of
+        Decoded when is_map(Decoded) ->
+          case Decoded of
+            #{<<"target_type">> := TargetTypeBin,
+              <<"target_id">> := TargetId,
+              <<"rating">> := Rating,
+              <<"comment">> := Comment} ->
+              TargetType = parse_target_type(TargetTypeBin),
+              case logic_review:create_review(UserId, TargetType, TargetId, Rating, Comment) of
+                {ok, Review} ->
+                  Response = review_to_json(Review),
+                  send_json(Req2, 201, Response);
+                {error, already_reviewed} ->
+                  send_error(Req2, 409, <<"Already reviewed">>);
+                {error, cannot_review} ->
+                  send_error(Req2, 403, <<"Cannot review this target">>);
+                {error, target_not_found} ->
+                  send_error(Req2, 404, <<"Target not found">>);
+                {error, _} ->
+                  send_error(Req2, 500, <<"Internal server error">>)
+              end;
+            _ ->
+              send_error(Req2, 400, <<"Missing required fields">>)
+          end;
+        _ ->
+          send_error(Req2, 400, <<"Invalid JSON">>)
+      catch
+        _:_ ->
+          send_error(Req2, 400, <<"Invalid JSON format">>)
+      end;
+    {error, Code, Message, Req1} ->
+      send_error(Req1, Code, Message)
+  end.
+
+%% GET /v1/reviews - список отзывов для цели
+list_reviews(Req) ->
+  case handler_auth:authenticate(Req) of
+    {ok, UserId, Req1} ->
+      Qs = cowboy_req:parse_qs(Req1),
+      case {proplists:get_value(<<"target_type">>, Qs), proplists:get_value(<<"target_id">>, Qs)} of
+        {undefined, _} ->
+          send_error(Req1, 400, <<"Missing target_type">>);
+        {_, undefined} ->
+          send_error(Req1, 400, <<"Missing target_id">>);
+        {TargetTypeBin, TargetId} ->
+          TargetType = parse_target_type(TargetTypeBin),
+          case logic_review:list_reviews(UserId, TargetType, TargetId) of
+            {ok, Reviews} ->
+              Response = [review_to_json(R) || R <- Reviews],
+              send_json(Req1, 200, Response);
+            {error, _} ->
+              send_error(Req1, 500, <<"Internal server error">>)
+          end
+      end;
+    {error, Code, Message, Req1} ->
+      send_error(Req1, Code, Message)
+  end.
+
+%% Вспомогательные функции
+parse_target_type(<<"event">>) -> event;
+parse_target_type(<<"calendar">>) -> calendar;
+parse_target_type(_) -> undefined.
+
+review_to_json(Review) ->
+  #{
+    id => Review#review.id,
+    user_id => Review#review.user_id,
+    target_type => Review#review.target_type,
+    target_id => Review#review.target_id,
+    rating => Review#review.rating,
+    comment => Review#review.comment,
+    status => Review#review.status,
+    created_at => datetime_to_iso8601(Review#review.created_at),
+    updated_at => datetime_to_iso8601(Review#review.updated_at)
+  }.
+
+datetime_to_iso8601({{Year, Month, Day}, {Hour, Minute, Second}}) ->
+  iolist_to_binary(io_lib:format("~4..0B-~2..0B-~2..0BT~2..0B:~2..0B:~2..0BZ",
+    [Year, Month, Day, Hour, Minute, Second])).
+
+send_json(Req, Status, Data) ->
+  Body = jsx:encode(Data),
+  cowboy_req:reply(Status, #{<<"content-type">> => <<"application/json">>}, Body, Req).
+
+send_error(Req, Status, Message) ->
+  Body = jsx:encode(#{error => Message}),
+  cowboy_req:reply(Status, #{<<"content-type">> => <<"application/json">>}, Body, Req).

src/handlers/handler_user_reviews.erl

@@ -0,0 +1,54 @@
+-module(handler_user_reviews).
+-include("records.hrl").
+
+-export([init/2]).
+
+init(Req, Opts) ->
+  handle(Req, Opts).
+
+handle(Req, _Opts) ->
+  case cowboy_req:method(Req) of
+    <<"GET">> -> list_user_reviews(Req);
+    _ -> send_error(Req, 405, <<"Method not allowed">>)
+  end.
+
+%% GET /v1/user/reviews - список отзывов текущего пользователя
+list_user_reviews(Req) ->
+  case handler_auth:authenticate(Req) of
+    {ok, UserId, Req1} ->
+      case logic_review:list_user_reviews(UserId) of
+        {ok, Reviews} ->
+          Response = [review_to_json(R) || R <- Reviews],
+          send_json(Req1, 200, Response);
+        {error, _} ->
+          send_error(Req1, 500, <<"Internal server error">>)
+      end;
+    {error, Code, Message, Req1} ->
+      send_error(Req1, Code, Message)
+  end.
+
+%% Вспомогательные функции
+review_to_json(Review) ->
+  #{
+    id => Review#review.id,
+    user_id => Review#review.user_id,
+    target_type => Review#review.target_type,
+    target_id => Review#review.target_id,
+    rating => Review#review.rating,
+    comment => Review#review.comment,
+    status => Review#review.status,
+    created_at => datetime_to_iso8601(Review#review.created_at),
+    updated_at => datetime_to_iso8601(Review#review.updated_at)
+  }.
+
+datetime_to_iso8601({{Year, Month, Day}, {Hour, Minute, Second}}) ->
+  iolist_to_binary(io_lib:format("~4..0B-~2..0B-~2..0BT~2..0B:~2..0B:~2..0BZ",
+    [Year, Month, Day, Hour, Minute, Second])).
+
+send_json(Req, Status, Data) ->
+  Body = jsx:encode(Data),
+  cowboy_req:reply(Status, #{<<"content-type">> => <<"application/json">>}, Body, Req).
+
+send_error(Req, Status, Message) ->
+  Body = jsx:encode(#{error => Message}),
+  cowboy_req:reply(Status, #{<<"content-type">> => <<"application/json">>}, Body, Req).

src/logic/logic_review.erl

@@ -0,0 +1,216 @@
+-module(logic_review).
+-include("records.hrl").
+
+-export([create_review/5, get_review/2, list_reviews/3, list_user_reviews/1,
+  update_review/3, delete_review/2, hide_review/2, unhide_review/2]).
+-export([can_review/3, update_target_rating/2, can_moderate_review/2]).
+
+%% Создание отзыва
+create_review(UserId, TargetType, TargetId, Rating, Comment) ->
+  case target_exists(TargetType, TargetId) of
+    true ->
+      case can_review(UserId, TargetType, TargetId) of
+        {ok, true} ->
+          case core_review:has_user_reviewed(UserId, TargetType, TargetId) of
+            false ->
+              case core_review:create(UserId, TargetType, TargetId, Rating, Comment) of
+                {ok, Review} ->
+                  update_target_rating(TargetType, TargetId),
+                  {ok, Review};
+                Error ->
+                  Error
+              end;
+            true ->
+              {error, already_reviewed}
+          end;
+        {ok, false} ->
+          {error, cannot_review};
+        {error, _} = Error ->
+          Error
+      end;
+    false ->
+      {error, target_not_found}
+  end.
+
+%% Получение отзыва
+get_review(UserId, ReviewId) ->
+  case core_review:get_by_id(ReviewId) of
+    {ok, Review} ->
+      case is_admin(UserId) orelse Review#review.status =:= visible of
+        true -> {ok, Review};
+        false -> {error, access_denied}
+      end;
+    Error ->
+      Error
+  end.
+
+%% Список отзывов для цели
+list_reviews(UserId, TargetType, TargetId) ->
+  case core_review:list_by_target(TargetType, TargetId) of
+    {ok, Reviews} ->
+      case is_admin(UserId) of
+        true -> {ok, Reviews};
+        false -> {ok, [R || R <- Reviews, R#review.status =:= visible]}
+      end;
+    Error ->
+      Error
+  end.
+
+%% Список отзывов пользователя
+list_user_reviews(UserId) ->
+  core_review:list_by_user(UserId).
+
+%% Обновление отзыва (только автор)
+update_review(UserId, ReviewId, Updates) ->
+  io:format("Updating review ~p with ~p~n", [ReviewId, Updates]),
+  case core_review:get_by_id(ReviewId) of
+    {ok, Review} ->
+      case Review#review.user_id =:= UserId of
+        true ->
+          % Преобразуем бинарные ключи в атомы
+          ValidUpdates = lists:filtermap(fun
+                                           ({<<"rating">>, V}) when is_integer(V), V >= 1, V =< 5 -> {true, {rating, V}};
+                                           ({rating, V}) when is_integer(V), V >= 1, V =< 5 -> {true, {rating, V}};
+                                           ({<<"comment">>, V}) when is_binary(V) -> {true, {comment, V}};
+                                           ({comment, V}) when is_binary(V) -> {true, {comment, V}};
+                                           (_) -> false
+                                         end, Updates),
+          io:format("Valid updates: ~p~n", [ValidUpdates]),
+          case ValidUpdates of
+            [] -> {error, no_valid_updates};
+            _ ->
+              case core_review:update(ReviewId, ValidUpdates) of
+                {ok, Updated} ->
+                  update_target_rating(Review#review.target_type, Review#review.target_id),
+                  {ok, Updated};
+                Error -> Error
+              end
+          end;
+        false -> {error, access_denied}
+      end;
+    Error -> Error
+  end.
+
+%% Удаление отзыва (автор или админ)
+delete_review(UserId, ReviewId) ->
+  case core_review:get_by_id(ReviewId) of
+    {ok, Review} ->
+      case Review#review.user_id =:= UserId orelse is_admin(UserId) of
+        true ->
+          TargetType = Review#review.target_type,
+          TargetId = Review#review.target_id,
+          case core_review:delete(ReviewId) of
+            {ok, deleted} ->
+              update_target_rating(TargetType, TargetId),
+              {ok, deleted};
+            Error ->
+              Error
+          end;
+        false ->
+          {error, access_denied}
+      end;
+    Error ->
+      Error
+  end.
+
+hide_review(UserId, ReviewId) ->
+  case can_moderate_review(UserId, ReviewId) of
+    true ->
+      case core_review:hide(ReviewId) of
+        {ok, Review} ->
+          update_target_rating(Review#review.target_type, Review#review.target_id),
+          {ok, Review};
+        Error ->
+          Error
+      end;
+    false ->
+      {error, access_denied}
+  end.
+
+unhide_review(UserId, ReviewId) ->
+  case can_moderate_review(UserId, ReviewId) of
+    true ->
+      case core_review:unhide(ReviewId) of
+        {ok, Review} ->
+          update_target_rating(Review#review.target_type, Review#review.target_id),
+          {ok, Review};
+        Error ->
+          Error
+      end;
+    false ->
+      {error, access_denied}
+  end.
+
+%% Проверка, может ли пользователь оставить отзыв
+can_review(UserId, TargetType, TargetId) ->
+  case TargetType of
+    event ->
+      case core_booking:get_by_event_and_user(TargetId, UserId) of
+        {ok, Booking} ->
+          {ok, Booking#booking.status =:= confirmed};
+        {error, not_found} ->
+          {ok, false}
+      end;
+    calendar ->
+      {ok, true};
+    _ ->
+      {ok, false}
+  end.
+
+%% Проверка, может ли пользователь модерировать отзыв (скрыть/раскрыть)
+can_moderate_review(UserId, ReviewId) ->
+  case is_admin(UserId) of
+    true ->
+      true;
+    false ->
+      % Проверяем, является ли пользователь владельцем календаря/события
+      case core_review:get_by_id(ReviewId) of
+        {ok, Review} ->
+          case Review#review.target_type of
+            event ->
+              case core_event:get_by_id(Review#review.target_id) of
+                {ok, Event} ->
+                  case core_calendar:get_by_id(Event#event.calendar_id) of
+                    {ok, Calendar} -> Calendar#calendar.owner_id =:= UserId;
+                    _ -> false
+                  end;
+                _ -> false
+              end;
+            calendar ->
+              case core_calendar:get_by_id(Review#review.target_id) of
+                {ok, Calendar} -> Calendar#calendar.owner_id =:= UserId;
+                _ -> false
+              end;
+            _ -> false
+          end;
+        _ -> false
+      end
+  end.
+
+%% Внутренние функции
+target_exists(event, EventId) ->
+  case core_event:get_by_id(EventId) of
+    {ok, _} -> true;
+    _ -> false
+  end;
+target_exists(calendar, CalendarId) ->
+  case core_calendar:get_by_id(CalendarId) of
+    {ok, _} -> true;
+    _ -> false
+  end;
+target_exists(_, _) -> false.
+
+is_admin(UserId) ->
+  case core_user:get_by_id(UserId) of
+    {ok, User} -> User#user.role =:= admin;
+    _ -> false
+  end.
+
+update_target_rating(event, EventId) ->
+  {Avg, Count} = core_review:get_average_rating(event, EventId),
+  io:format("Updating event ~p rating: avg=~p, count=~p~n", [EventId, Avg, Count]),
+  core_event:update(EventId, [{rating_avg, Avg}, {rating_count, Count}]);
+update_target_rating(calendar, CalendarId) ->
+  {Avg, Count} = core_review:get_average_rating(calendar, CalendarId),
+  core_calendar:update(CalendarId, [{rating_avg, Avg}, {rating_count, Count}]);
+update_target_rating(_, _) -> ok.