Added liking and security measures

features/people/MANAGE_sessions.js

@@ -0,0 +1,79 @@
+const express = require("express");
+const router = express.Router();
+const pool = require("../../db");
+const { strictInput } = require("../../middleware/strict_input");
+
+async function listSessions(req, res) {
+  try {
+    const { rows } = await pool.query(
+      `SELECT id, device_name, created_at, last_used_at
+       FROM sessions
+       WHERE user_id = $1
+       ORDER BY last_used_at DESC`,
+      [req.user.id],
+    );
+    const sessions = rows.map((s) => ({
+      ...s,
+      current: s.id === req.user.session_id,
+    }));
+    return res.status(200).json(sessions);
+  } catch (err) {
+    console.error("list sessions failed", {
+      message: err.message,
+      code: err.code,
+    });
+    return res.status(500).send("Sessions could not be retrieved, request failed");
+  }
+}
+
+async function deleteSession(req, res) {
+  try {
+    const { id } = req.params;
+    const uuidPattern =
+      /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+    if (!uuidPattern.test(id)) {
+      return res.status(400).send("Invalid session id");
+    }
+    const result = await pool.query(
+      "DELETE FROM sessions WHERE id = $1 AND user_id = $2 RETURNING id",
+      [id, req.user.id],
+    );
+    if (result.rowCount === 0) {
+      return res.status(404).send("Session not found or does not belong to you");
+    }
+    return res.status(200).json({ message: "Session deleted" });
+  } catch (err) {
+    console.error("delete session failed", {
+      message: err.message,
+      code: err.code,
+    });
+    return res.status(500).send("Session could not be deleted, request failed");
+  }
+}
+
+async function deleteOtherSessions(req, res) {
+  if (!req.user.session_id) {
+    return res
+      .status(400)
+      .send("Current session could not be identified, please log in again");
+  }
+  try {
+    await pool.query(
+      "DELETE FROM sessions WHERE user_id = $1 AND id != $2",
+      [req.user.id, req.user.session_id],
+    );
+    return res.status(200).json({ message: "Other sessions deleted" });
+  } catch (err) {
+    console.error("delete other sessions failed", {
+      message: err.message,
+      code: err.code,
+    });
+    return res.status(500).send("Sessions could not be deleted, request failed");
+  }
+}
+
+router.get("/", strictInput(), listSessions);
+router.delete("/", strictInput(), deleteOtherSessions);
+router.delete("/:id", strictInput(), deleteSession);
+
+module.exports = router;