Added liking and security measures

features/posts/GET_posts.js

@@ -4,16 +4,80 @@ const pool = require("../../db");
 const { strictInput } = require("../../middleware/strict_input");
 const { authenticateToken } = require("../../middleware/authenticate_token");
 const { uploadDirectory } = require("../../middleware/post_upload");
+const { getFriendIdsAmong, areFriends } = require("../relations/friend_graph");
+const { likeDataForPosts } = require("./post_graph");
 const path = require("path");
 
+function parsePagination(req) {
+  const { limit: limitRaw, offset: offsetRaw } = req.query;
+  if (limitRaw === undefined && offsetRaw === undefined) {
+    return { limit: 20, offset: 0 };
+  }
+  const limit = limitRaw === undefined ? 20 : Number(limitRaw);
+  const offset = offsetRaw === undefined ? 0 : Number(offsetRaw);
+  if (!Number.isInteger(limit) || limit < 1 || limit > 100) {
+    return { error: "limit must be an integer between 1 and 100" };
+  }
+  if (!Number.isInteger(offset) || offset < 0) {
+    return { error: "offset must be a non-negative integer" };
+  }
+  return { limit, offset };
+}
+
 async function getPosts(req, res, ownOnly) {
+  const pagination = parsePagination(req);
+  if (pagination.error) return res.status(400).send(pagination.error);
+
   try {
-    const query = ownOnly
-      ? "SELECT p.id, p.title, p.text, p.author_id, people.username AS author_username, p.image_link, p.created_at FROM posts p LEFT JOIN people ON people.id = p.author_id WHERE p.author_id = $1"
-      : "SELECT p.id, p.title, p.text, p.author_id, people.username AS author_username, p.image_link, p.created_at FROM posts p LEFT JOIN people ON people.id = p.author_id";
-    const values = ownOnly ? [req.user.id] : [];
+    const values = [];
+    const conditions = ["p.active = true"];
+
+    if (ownOnly) {
+      conditions.push(`p.author_id = $${values.length + 1}`);
+      values.push(req.user.id);
+    } else {
+      const visible = [`people.private = false`, `p.author_id = $${values.length + 1}`];
+      values.push(req.user.id);
+
+      const { rows } = await pool.query(
+        `SELECT DISTINCT p.author_id FROM posts p
+         JOIN people ON people.id = p.author_id
+         WHERE p.active = true AND people.private = true`,
+      );
+      const privateAuthorIds = rows.map((row) => Number(row.author_id));
+      if (privateAuthorIds.length > 0) {
+        const friendIds = await getFriendIdsAmong(req.user.id, privateAuthorIds);
+        if (friendIds.size > 0) {
+          visible.push(`p.author_id = ANY($${values.length + 1})`);
+          values.push([...friendIds]);
+        }
+      }
+
+      conditions.push(`(${visible.join(" OR ")})`);
+    }
+
+    const where = conditions.join(" AND ");
+    const query = `SELECT p.id, p.title, p.text, p.author_id, people.username AS author_username, p.image_link, p.created_at
+     FROM posts p
+     LEFT JOIN people ON people.id = p.author_id
+     WHERE ${where}
+     ORDER BY p.created_at DESC
+     LIMIT $${values.length + 1} OFFSET $${values.length + 2}`;
+    values.push(pagination.limit, pagination.offset);
+
     const { rows } = await pool.query(query, values);
-    res.status(200).json(rows);
+
+    const likeData = await likeDataForPosts(
+      req.user.id,
+      rows.map((row) => row.id),
+    );
+    const posts = rows.map((row) => ({
+      ...row,
+      like_count: likeData.get(Number(row.id))?.like_count ?? 0,
+      liked_by_me: likeData.get(Number(row.id))?.liked_by_me ?? false,
+    }));
+
+    res.status(200).json(posts);
   } catch (err) {
     console.error("database query failed", {
       message: err.message,
@@ -30,26 +94,53 @@ router.get(
   "/image/:filename",
   authenticateToken,
   strictInput(),
-  (req, res) => {
+  async (req, res) => {
     const filename = path.basename(req.params.filename);
     if (filename !== req.params.filename) return res.status(404).end();
-    res.sendFile(filename, { root: uploadDirectory }, (err) => {
-      if (err && !res.headersSent) res.status(err.statusCode === 404 ? 404 : 500).end();
-    });
+    try {
+      const { rows } = await pool.query(
+        `SELECT p.author_id, people.private AS author_private
+         FROM posts p
+         LEFT JOIN people ON people.id = p.author_id
+         WHERE p.image_link = $1 AND p.active = true`,
+        [`/posts/image/${filename}`],
+      );
+      if (rows.length === 0) return res.status(404).send("Image not found");
+      const post = rows[0];
+      if (
+        post.author_private &&
+        Number(post.author_id) !== req.user.id &&
+        !(await areFriends(req.user.id, post.author_id))
+      ) {
+        return res.status(404).send("Image not found");
+      }
+      res.set("Cache-Control", "private, no-store");
+      res.sendFile(filename, { root: uploadDirectory }, (err) => {
+        if (err && !res.headersSent) res.status(err.statusCode === 404 ? 404 : 500).end();
+      });
+    } catch (err) {
+      console.error("post image query failed", {
+        message: err.message,
+        code: err.code,
+        detail: err.detail,
+        hint: err.hint,
+      });
+      return res.status(500).send("Image could not be retrieved, request failed");
+    }
   },
 );
 
 router.get(
   "/me",
   authenticateToken,
-  strictInput(),
+  strictInput({ query: ["limit", "offset"] }),
   (req, res) => getPosts(req, res, true),
 );
 
 router.get(
   "/",
   authenticateToken,
-  strictInput(),
+  strictInput({ query: ["limit", "offset"] }),
   (req, res) => getPosts(req, res, false),
 );