Added liking and security measures

README.md

@@ -1,6 +1,6 @@
 # Filing Cabinet API
 
-Node.js/Express API for accounts, JWT-authenticated actions, relationships, and posts.
+Node.js/Express API for accounts, JWT-authenticated actions, friendships, and posts.
 
 ## Run
 
@@ -49,9 +49,9 @@ Authenticated clients can read profiles through `GET /profiles/me` or `GET /prof
 - Registration/login validation and password rules are defined in [AUTH_INPUT_POLICY.md](AUTH_INPUT_POLICY.md).
 - Post creation always uses `author_id` from the verified JWT; clients must not send `author_id`.
 - Post edit/delete require that the JWT user owns the post.
-- `/posts` is visible to any authenticated user; `/posts/me` filters by JWT `user_id`.
-- Post listings include `author_username` and `created_at`; profile responses expose `id`, `name`, `username`, and `profile_link` (nullable).
-- Relationship creation requires `me` to equal the JWT user ID.
+- `/posts` is visible to any authenticated user; `/posts/me` filters by JWT `user_id`. Posts from private accounts appear only to the owner and their friends.
+- Post listings include `author_username` and `created_at`; profile responses expose `id`, `name`, `username`, `profile_link` (nullable), and `private`.
+- Friendships live in the graph database: send a request with `POST /friends/request`, accept with `POST /friends/accept`, manage via `GET /friends` and `DELETE /friends/remove`.
 - Uploads accept only JPEG, PNG, GIF, and WebP, one file named `image`, up to `MAX_UPLOAD_SIZE_BYTES` (default 5 MiB). Files receive random names and are stored under `UPLOAD_DIR`.
 - Registration rejects disposable email addresses and weak/reused-pattern passwords. Login failures use the generic `Invalid email or password` response.
 - Do not expose database errors or stack traces to clients.