---
# quotesdb-a0q1
title: Implement PUT /api/quotes — create quote, generate UUID v4 ID, generate auth_code if not provided, return 201 with auth_code
status: completed
type: task
priority: normal
created_at: 2026-03-10T23:32:05Z
updated_at: 2026-03-10T23:32:12Z
blocked_by:
    - quotesdb-6ng5
    - quotesdb-fagr
    - quotesdb-wmvy
    - quotesdb-qf7x
    - quotesdb-6lh5
---

<context>
The `quotesdb` API is built with Axum + Tokio, targeting Cloudflare Workers via `workers-rs`. It serves JSON at `/api/*` endpoints and persists data to Cloudflare D1 (production) or a local SQLite file via Turso (development). Source lives in `src/bin/api/`.

Shared types and utilities are in `src/lib.rs` — code placed there must compile for both the host target and `wasm32-unknown-unknown`.

`PUT /api/quotes` creates a new quote. The request body is JSON; `auth_code` is optional — if omitted, one is generated. The response is 201 with the full quote object and the `auth_code` (always returned so the user can save it).

Request body: `{ text, author, source?, tags?, date?, auth_code? }`
Response 201: `{ quote: {...}, auth_code: "word-word-word-word" }`
</context>

<goal>
Implement the `PUT /api/quotes` handler:
1. Deserialise and validate the request body (text and author are required)
2. Generate a UUID v4 ID for the quote by calling `generate_id()` from `src/lib.rs`
3. Generate an auth_code if not provided in the request
4. INSERT the quote into the `quotes` table
5. INSERT any tags into `quote_tags`
6. Return 201 with the created quote and auth_code
</goal>

<constraints>
- Return 422 if `text` or `author` is missing or empty.
- Use `generate_id()` from `src/lib.rs` for the quote ID — returns a UUID v4 string (36 chars). TRIAGE 6f2e18 resolved this: nanoid is not WASM-safe; uuid v4 is used instead. See ticket 7a0d9f.
- Use the shared `generate_auth_code()` function from `src/lib.rs`.
- Tag insertion must use the shared `replace_tags_for_quote()` logic (ticket 175382).
</constraints>

<skills>
Use `superpowers:test-driven-development` — write tests for: auto-generated auth_code, custom auth_code, missing required fields 422.
Use `superpowers:verification-before-completion` before closing.
</skills>

<validation>
Run in order from the `quotesdb/` directory:

```sh
cargo fmt
cargo check
cargo clippy
cargo test
```
</validation>

<commit>
`feat(quotesdb): implement PUT /api/quotes — create quote with UUID v4 and auth_code`
</commit>