sven/filing-cabinet-api
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Added security policies to all endpoints and implemented file upload feature on posts

Browse Source
This commit is contained in:
Sven laptop
2026-07-24 23:25:31 +02:00
parent 9519a01ca0
commit 9e56f00c1e
19 changed files with 718 additions and 134 deletions
Download Patch File Download Diff File Expand all files Collapse all files
features/data/DELETE_data.js
-29
View File
@@ -1,29 +0,0 @@
const express = require('express');
const router = express.Router();
const pool = require('../../db');
async function delete_data(req, res) {
try {
const name = req.query.name;
const result = await pool.query('DELETE FROM data WHERE name = $1', [name]);
res.status(200).json({
message: 'Data Deleted',
deleted: result.rows
})
}
catch (err) {
console.error('database query failed', {
message: err.message,
code: err.code,
detail: err.detail,
hint: err.hint,
stack: err.stack,
});
res.status(500).send('Data has not been deleted, request failed');
}
};
router.delete('/', delete_data);
module.exports = router;
features/data/GET_data.js
-26
View File
@@ -1,26 +0,0 @@
const express = require('express');
const router = express.Router();
const pool = require('../../db');
async function get_data(req, res) {
try {
const result = await pool.query('SELECT id, name, created_at FROM data');
console.log(result.rows);
res.json(result.rows);
}
catch (err) {
console.error('[get_data] database query failed', {
message: err.message,
code: err.code,
detail: err.detail,
hint: err.hint,
stack: err.stack,
});
res.status(500).send('No data available, request failed');
}
};
router.get('/', get_data);
module.exports = router;
features/data/POST_data.js
-27
View File
@@ -1,27 +0,0 @@
const express = require('express');
const router = express.Router();
const pool = require('../../db');
async function post_data(req, res) {
try {
const { name } = req.body;
const { rows } = await pool.query('INSERT INTO data (name) VALUES ($1)', [name]);
console.log(rows[0]);
res.json(rows[0]);
}
catch (err) {
console.error('database query failed', {
message: err.message,
code: err.code,
detail: err.detail,
hint: err.hint,
stack: err.stack,
});
res.status(500).send('Data was not pushed, request failed');
}
};
router.post('/', post_data);
module.exports = router;
features/people/LOGIN_people.js
+5 -2
View File
@@ -4,6 +4,8 @@ const pool = require('../../db');
const crypto = require('crypto');
const { promisify } = require('util');
const { sanitizeLoginInput } = require('../../middleware/sanitize_person_input');
const { strictInput } = require('../../middleware/strict_input');
const { signToken } = require('../../middleware/authenticate_token');
const scrypt = promisify(crypto.scrypt);
@@ -32,7 +34,8 @@ async function login(req, res) {
return;
}
res.status(200).json({ id: rows[0].id });
const { token, expiresAt } = signToken(rows[0].id);
res.status(200).json({ id: rows[0].id, token, expires_at: expiresAt });
}
catch (err) {
console.error('login failed', { message: err.message, code: err.code });
@@ -40,5 +43,5 @@ async function login(req, res) {
}
};
router.post('/', sanitizeLoginInput, login);
router.post('/', strictInput({ body: ['email', 'password'] }), sanitizeLoginInput, login);
module.exports = router;
features/people/REGISTER_people.js
+2 -1
View File
@@ -5,6 +5,7 @@ const pool = require('../../db');
var crypto = require('crypto');
const { promisify } = require('util');
const { sanitizePersonInput } = require('../../middleware/sanitize_person_input');
const { strictInput } = require('../../middleware/strict_input');
const scrypt = promisify(crypto.scrypt);
@@ -84,5 +85,5 @@ async function create_people(req, res) {
};
router.post('/', sanitizePersonInput, create_people);
router.post('/', strictInput({ body: ['name', 'username', 'email', 'password'] }), sanitizePersonInput, create_people);
module.exports = router;
features/posts/CREATE_post.js
+51
View File
@@ -0,0 +1,51 @@
const express = require("express");
const router = express.Router();
const pool = require("../../db");
const { strictInput } = require("../../middleware/strict_input");
const { authenticateToken } = require("../../middleware/authenticate_token");
const {
handlePostUpload,
imageLinkForFile,
removeUploadedFile,
} = require("../../middleware/post_upload");
async function create_post(req, res) {
try {
const { title, text } = req.body;
const author_id = req.user.id;
if (!title || !text) {
await removeUploadedFile(req.file);
return res.status(400).send("Title or text was not provided");
} else {
const imageLink = imageLinkForFile(req.file);
try {
const { rows } = await pool.query(
"INSERT INTO posts (title, text, author_id, image_link) VALUES ($1, $2, $3, $4) RETURNING id, title, text, author_id, image_link",
[title, text, author_id, imageLink],
);
res.status(201).json(rows[0]);
} catch (err) {
await removeUploadedFile(req.file);
throw err;
}
}
} catch (err) {
console.error("database query failed", {
message: err.message,
code: err.code,
detail: err.detail,
hint: err.hint,
stack: err.stack,
});
res.status(500).send("Data was not pushed, request failed");
}
}
router.post(
"/",
authenticateToken,
handlePostUpload,
strictInput({ body: ["title", "text"], cleanupUploadedFile: true }),
create_post,
);
module.exports = router;
features/posts/DELETE_post.js
+40
View File
@@ -0,0 +1,40 @@
const express = require("express");
const router = express.Router();
const pool = require("../../db");
const { strictInput } = require("../../middleware/strict_input");
const { authenticateToken } = require("../../middleware/authenticate_token");
const { removeImageLink } = require("../../middleware/post_upload");
async function delete_post(req, res) {
try {
const id = req.query.id;
const result = await pool.query(
"DELETE FROM posts WHERE id = $1 AND author_id = $2 RETURNING id, image_link",
[id, req.user.id],
);
if (result.rowCount === 0) {
return res.status(404).send("Post not found or does not belong to you");
}
await removeImageLink(result.rows[0].image_link);
res.status(200).json({
message: "Post Deleted",
});
} catch (err) {
console.error("database query failed", {
message: err.message,
code: err.code,
detail: err.detail,
hint: err.hint,
stack: err.stack,
});
res.status(500).send("Data has not been deleted, request failed");
}
}
router.delete(
"/",
authenticateToken,
strictInput({ query: ["id"] }),
delete_post,
);
module.exports = router;
features/posts/EDIT_post.js
+100
View File
@@ -0,0 +1,100 @@
const express = require("express");
const router = express.Router();
const pool = require("../../db");
const { strictInput } = require("../../middleware/strict_input");
const { authenticateToken } = require("../../middleware/authenticate_token");
const {
handlePostUpload,
imageLinkForFile,
removeImageLink,
removeUploadedFile,
} = require("../../middleware/post_upload");
async function editPost(req, res) {
const id = req.query.id;
const { title, text, remove_image: removeImageValue } = req.body;
const removeImage = removeImageValue === "true";
if (removeImageValue !== undefined && !["true", "false"].includes(removeImageValue)) {
await removeUploadedFile(req.file);
return res.status(400).send("remove_image must be true or false");
}
if (req.file && removeImage) {
await removeUploadedFile(req.file);
return res.status(400).send("Choose either an image or remove_image=true");
}
if (title === "" || text === "") {
await removeUploadedFile(req.file);
return res.status(400).send("title and text cannot be empty");
}
if (title === undefined && text === undefined && !req.file && !removeImage) {
return res.status(400).send("At least one post field must be changed");
}
try {
const existing = await pool.query(
"SELECT id, image_link FROM posts WHERE id = $1 AND author_id = $2",
[id, req.user.id],
);
if (existing.rowCount === 0) {
await removeUploadedFile(req.file);
return res.status(404).send("Post not found or does not belong to you");
}
const oldImageLink = existing.rows[0].image_link;
const fields = [];
const values = [];
const addField = (field, value) => {
fields.push(`${field} = $${values.length + 1}`);
values.push(value);
};
if (title !== undefined) addField("title", title);
if (text !== undefined) addField("text", text);
if (req.file) addField("image_link", imageLinkForFile(req.file));
if (removeImage) addField("image_link", null);
values.push(id, req.user.id);
let updated;
try {
updated = await pool.query(
`UPDATE posts SET ${fields.join(", ")} WHERE id = $${values.length - 1} AND author_id = $${values.length} RETURNING id, title, text, author_id, image_link`,
values,
);
} catch (err) {
await removeUploadedFile(req.file);
throw err;
}
if (req.file || removeImage) {
await removeImageLink(oldImageLink).catch((err) => {
console.error("old post image could not be removed", { message: err.message });
});
}
return res.status(200).json(updated.rows[0]);
} catch (err) {
await removeUploadedFile(req.file);
console.error("database query failed", {
message: err.message,
code: err.code,
detail: err.detail,
hint: err.hint,
stack: err.stack,
});
return res.status(500).send("Post was not updated, request failed");
}
}
router.put(
"/",
authenticateToken,
handlePostUpload,
strictInput({
query: ["id"],
body: ["title", "text", "remove_image"],
cleanupUploadedFile: true,
}),
editPost,
);
module.exports = router;
features/posts/GET_posts.js
+56
View File
@@ -0,0 +1,56 @@
const express = require("express");
const router = express.Router();
const pool = require("../../db");
const { strictInput } = require("../../middleware/strict_input");
const { authenticateToken } = require("../../middleware/authenticate_token");
const { uploadDirectory } = require("../../middleware/post_upload");
const path = require("path");
async function getPosts(req, res, ownOnly) {
try {
const query = ownOnly
? "SELECT id, title, text, author_id, image_link FROM posts WHERE author_id = $1"
: "SELECT id, title, text, author_id, image_link FROM posts";
const values = ownOnly ? [req.user.id] : [];
const { rows } = await pool.query(query, values);
res.status(200).json(rows);
} catch (err) {
console.error("database query failed", {
message: err.message,
code: err.code,
detail: err.detail,
hint: err.hint,
stack: err.stack,
});
res.status(500).send("Posts could not be retrieved, request failed");
}
}
router.get(
"/image/:filename",
authenticateToken,
strictInput(),
(req, res) => {
const filename = path.basename(req.params.filename);
if (filename !== req.params.filename) return res.status(404).end();
res.sendFile(filename, { root: uploadDirectory }, (err) => {
if (err && !res.headersSent) res.status(err.statusCode === 404 ? 404 : 500).end();
});
},
);
router.get(
"/me",
authenticateToken,
strictInput(),
(req, res) => getPosts(req, res, true),
);
router.get(
"/",
authenticateToken,
strictInput(),
(req, res) => getPosts(req, res, false),
);
module.exports = router;
features/relations/CREATE_friendship.js
+27 -23
View File
@@ -1,28 +1,32 @@
const express = require('express');
const express = require("express");
const router = express.Router();
var driver = require('../../graph_db');
var driver = require("../../graph_db");
const { strictInput } = require('../../middleware/strict_input');
async function create_friendship(req, res) {
try {
const me = req.query.me;
const them = req.query.them;
const { records } = await driver.executeQuery('MATCH (m:Person {name: $me}) MATCH (t:Person {name: $them}) CREATE (m)-[:FRIENDS_WITH]-> (t) CREATE (t)-[:FRIENDS_WITH]-> (m)', { me: me, them: them }, { database: process.env.GRAPH_DB_NAME});
res.status(200).send('Relationship has been created');
try {
const me = req.query.me;
const them = req.query.them;
if (String(req.user.id) !== String(me)) {
return res.status(403).send("You can only create relationships as yourself");
}
catch (err) {
console.error('database query failed', {
message: err.message,
code: err.code,
detail: err.detail,
hint: err.hint,
stack: err.stack,
});
res.status(500).send('Relationship was not created, request failed');
}
};
const { records } = await driver.executeQuery(
"MATCH (m:Person {db_id: $me}) MATCH (t:Person {db_id: $them}) CREATE (m)-[:FRIENDS_WITH]-> (t) CREATE (t)-[:FRIENDS_WITH]-> (m)",
{ me: me, them: them },
{ database: process.env.GRAPH_DB_NAME },
);
res.status(200).send("Relationship has been created");
} catch (err) {
console.error("database query failed", {
message: err.message,
code: err.code,
detail: err.detail,
hint: err.hint,
stack: err.stack,
});
res.status(500).send("Relationship was not created, request failed");
}
}
router.post('/', create_friendship);
module.exports = router;
router.post("/", strictInput({ query: ['me', 'them'] }), create_friendship);
module.exports = router;