Added security policies to all endpoints and implemented file upload feature on posts

features/posts/GET_posts.js

@@ -0,0 +1,56 @@
+const express = require("express");
+const router = express.Router();
+const pool = require("../../db");
+const { strictInput } = require("../../middleware/strict_input");
+const { authenticateToken } = require("../../middleware/authenticate_token");
+const { uploadDirectory } = require("../../middleware/post_upload");
+const path = require("path");
+
+async function getPosts(req, res, ownOnly) {
+  try {
+    const query = ownOnly
+      ? "SELECT id, title, text, author_id, image_link FROM posts WHERE author_id = $1"
+      : "SELECT id, title, text, author_id, image_link FROM posts";
+    const values = ownOnly ? [req.user.id] : [];
+    const { rows } = await pool.query(query, values);
+    res.status(200).json(rows);
+  } catch (err) {
+    console.error("database query failed", {
+      message: err.message,
+      code: err.code,
+      detail: err.detail,
+      hint: err.hint,
+      stack: err.stack,
+    });
+    res.status(500).send("Posts could not be retrieved, request failed");
+  }
+}
+
+router.get(
+  "/image/:filename",
+  authenticateToken,
+  strictInput(),
+  (req, res) => {
+    const filename = path.basename(req.params.filename);
+    if (filename !== req.params.filename) return res.status(404).end();
+    res.sendFile(filename, { root: uploadDirectory }, (err) => {
+      if (err && !res.headersSent) res.status(err.statusCode === 404 ? 404 : 500).end();
+    });
+  },
+);
+
+router.get(
+  "/me",
+  authenticateToken,
+  strictInput(),
+  (req, res) => getPosts(req, res, true),
+);
+
+router.get(
+  "/",
+  authenticateToken,
+  strictInput(),
+  (req, res) => getPosts(req, res, false),
+);
+
+module.exports = router;