Added reading profile endpoint

API.md

@@ -6,14 +6,18 @@ Base URL: `http://localhost:${PORT}`. Use `Authorization: Bearer <token>` on eve
 |---|---:|---|---|
 | `POST /auth/register` | no | JSON: `name`, `username`, `email`, `password` | `201 {id}`; strict fields; see password policy below |
 | `POST /auth/login` | no | JSON: `email`, `password` | `200 {id,token,expires_at}`; `401` is generic |
+| `GET /profiles/me` | yes | no body/query | `200 {id,name,username}` for the token user |
+| `GET /profiles/:id` | yes | no body/query | `200 {id,name,username}`; email/password are never exposed |
 | `GET /posts` | yes | no body/query | `200` all posts; ownership does not limit viewing |
-| `GET /posts/me` | yes | no body/query | `200` only posts with `author_id = token.user_id` |
+| `GET /posts/me` | yes | no body/query | `200` only posts with `author_id = token.user_id`; each includes `author_username` |
 | `GET /posts/image/:filename` | yes | no body/query | Authenticated image download |
 | `POST /posts/create` | yes | multipart fields: `title`, `text`; optional file `image` | `201` post; `author_id` always comes from token |
 | `PUT /posts/edit?id=<id>` | yes + owner | multipart: optional `title`, `text`, `image`, `remove_image=true\|false` | `200` updated post; upload replaces image; `remove_image=true` clears it; image + remove is invalid |
 | `DELETE /posts/delete?id=<id>` | yes + owner | query: `id` only | `200`; deletes only matching `id AND author_id` and removes stored image |
 | `POST /create_relationship?me=<id>&them=<id>` | yes | query: `me`, `them` only | `200`; `me` must equal token user ID |
 
+Post objects include `author_username` and `created_at` (the database creation timestamp), joined from `people.username`; the join is left-sided so an orphaned post is not silently omitted.
+
 ## Input rules
 
 - Any undocumented body or query field returns `400`; do not send `author_id` to create posts.

README.md

@@ -35,6 +35,8 @@ Login returns `{ id, token, expires_at }`. The token is HS256-signed and contain
 
 The compact endpoint contract is in [API.md](API.md). Unknown body/query fields are rejected with `400`; clients must send only documented fields.
 
+Authenticated clients can read profiles through `GET /profiles/me` or `GET /profiles/:id`. Post responses include the public author username as `author_username` and the database creation timestamp as `created_at`.
+
 ## Security and ownership
 
 - The API is the authoritative validator; client validation is only UX.
@@ -42,6 +44,7 @@ The compact endpoint contract is in [API.md](API.md). Unknown body/query fields
 - Post creation always uses `author_id` from the verified JWT; clients must not send `author_id`.
 - Post edit/delete require that the JWT user owns the post.
 - `/posts` is visible to any authenticated user; `/posts/me` filters by JWT `user_id`.
+- Post listings include `author_username` and `created_at`; profile responses expose only `id`, `name`, and `username`.
 - Relationship creation requires `me` to equal the JWT user ID.
 - Uploads accept only JPEG, PNG, GIF, and WebP, one file named `image`, up to `MAX_UPLOAD_SIZE_BYTES` (default 5 MiB). Files receive random names and are stored under `UPLOAD_DIR`.
 - Registration rejects disposable email addresses and weak/reused-pattern passwords. Login failures use the generic `Invalid email or password` response.

app.js

@@ -34,11 +34,13 @@ const CreatePostRoute = require("./features/posts/CREATE_post");
 const DeletePostRoute = require("./features/posts/DELETE_post");
 const GetPostsRoute = require("./features/posts/GET_posts");
 const EditPostRoute = require("./features/posts/EDIT_post");
+const GetProfileRoute = require("./features/people/GET_profile");
 
 app.use("/posts", GetPostsRoute);
 app.use("/posts/create", CreatePostRoute);
 app.use("/posts/delete", DeletePostRoute);
 app.use("/posts/edit", EditPostRoute);
+app.use("/profiles", GetProfileRoute);
 
 app.listen(process.env.PORT, () => {
   console.log(`Server draait op port ${process.env.PORT}`);

features/people/GET_profile.js

@@ -0,0 +1,31 @@
+const express = require("express");
+const router = express.Router();
+const pool = require("../../db");
+const { strictInput } = require("../../middleware/strict_input");
+const { authenticateToken } = require("../../middleware/authenticate_token");
+
+async function getProfile(req, res) {
+  const id = req.params.id === "me" ? req.user.id : req.params.id;
+
+  try {
+    const { rows } = await pool.query(
+      "SELECT id, name, username FROM people WHERE id = $1",
+      [id],
+    );
+    if (rows.length === 0) return res.status(404).send("Profile not found");
+    return res.status(200).json(rows[0]);
+  } catch (err) {
+    console.error("profile query failed", {
+      message: err.message,
+      code: err.code,
+      detail: err.detail,
+      hint: err.hint,
+    });
+    return res.status(500).send("Profile could not be retrieved, request failed");
+  }
+}
+
+router.get("/me", authenticateToken, strictInput(), getProfile);
+router.get("/:id", authenticateToken, strictInput(), getProfile);
+
+module.exports = router;

features/posts/CREATE_post.js

@@ -20,7 +20,7 @@ async function create_post(req, res) {
       const imageLink = imageLinkForFile(req.file);
       try {
         const { rows } = await pool.query(
-          "INSERT INTO posts (title, text, author_id, image_link) VALUES ($1, $2, $3, $4) RETURNING id, title, text, author_id, image_link",
+          "WITH created AS (INSERT INTO posts (title, text, author_id, image_link) VALUES ($1, $2, $3, $4) RETURNING id, title, text, author_id, image_link, created_at) SELECT created.*, people.username AS author_username FROM created LEFT JOIN people ON people.id = created.author_id",
           [title, text, author_id, imageLink],
         );
         res.status(201).json(rows[0]);

features/posts/EDIT_post.js

@@ -58,7 +58,7 @@ async function editPost(req, res) {
     let updated;
     try {
       updated = await pool.query(
-        `UPDATE posts SET ${fields.join(", ")} WHERE id = $${values.length - 1} AND author_id = $${values.length} RETURNING id, title, text, author_id, image_link`,
+        `WITH updated AS (UPDATE posts SET ${fields.join(", ")} WHERE id = $${values.length - 1} AND author_id = $${values.length} RETURNING id, title, text, author_id, image_link, created_at) SELECT updated.*, people.username AS author_username FROM updated LEFT JOIN people ON people.id = updated.author_id`,
         values,
       );
     } catch (err) {

features/posts/GET_posts.js

@@ -9,8 +9,8 @@ const path = require("path");
 async function getPosts(req, res, ownOnly) {
   try {
     const query = ownOnly
-      ? "SELECT id, title, text, author_id, image_link FROM posts WHERE author_id = $1"
-      : "SELECT id, title, text, author_id, image_link FROM posts";
+      ? "SELECT p.id, p.title, p.text, p.author_id, people.username AS author_username, p.image_link, p.created_at FROM posts p LEFT JOIN people ON people.id = p.author_id WHERE p.author_id = $1"
+      : "SELECT p.id, p.title, p.text, p.author_id, people.username AS author_username, p.image_link, p.created_at FROM posts p LEFT JOIN people ON people.id = p.author_id";
     const values = ownOnly ? [req.user.id] : [];
     const { rows } = await pool.query(query, values);
     res.status(200).json(rows);