diff --git a/API.md b/API.md index 6cbfe5f..7a0e36d 100644 --- a/API.md +++ b/API.md @@ -6,14 +6,18 @@ Base URL: `http://localhost:${PORT}`. Use `Authorization: Bearer ` on eve |---|---:|---|---| | `POST /auth/register` | no | JSON: `name`, `username`, `email`, `password` | `201 {id}`; strict fields; see password policy below | | `POST /auth/login` | no | JSON: `email`, `password` | `200 {id,token,expires_at}`; `401` is generic | +| `GET /profiles/me` | yes | no body/query | `200 {id,name,username}` for the token user | +| `GET /profiles/:id` | yes | no body/query | `200 {id,name,username}`; email/password are never exposed | | `GET /posts` | yes | no body/query | `200` all posts; ownership does not limit viewing | -| `GET /posts/me` | yes | no body/query | `200` only posts with `author_id = token.user_id` | +| `GET /posts/me` | yes | no body/query | `200` only posts with `author_id = token.user_id`; each includes `author_username` | | `GET /posts/image/:filename` | yes | no body/query | Authenticated image download | | `POST /posts/create` | yes | multipart fields: `title`, `text`; optional file `image` | `201` post; `author_id` always comes from token | | `PUT /posts/edit?id=` | yes + owner | multipart: optional `title`, `text`, `image`, `remove_image=true\|false` | `200` updated post; upload replaces image; `remove_image=true` clears it; image + remove is invalid | | `DELETE /posts/delete?id=` | yes + owner | query: `id` only | `200`; deletes only matching `id AND author_id` and removes stored image | | `POST /create_relationship?me=&them=` | yes | query: `me`, `them` only | `200`; `me` must equal token user ID | +Post objects include `author_username` and `created_at` (the database creation timestamp), joined from `people.username`; the join is left-sided so an orphaned post is not silently omitted. + ## Input rules - Any undocumented body or query field returns `400`; do not send `author_id` to create posts. diff --git a/README.md b/README.md index 9519227..e259e6e 100644 --- a/README.md +++ b/README.md @@ -35,6 +35,8 @@ Login returns `{ id, token, expires_at }`. The token is HS256-signed and contain The compact endpoint contract is in [API.md](API.md). Unknown body/query fields are rejected with `400`; clients must send only documented fields. +Authenticated clients can read profiles through `GET /profiles/me` or `GET /profiles/:id`. Post responses include the public author username as `author_username` and the database creation timestamp as `created_at`. + ## Security and ownership - The API is the authoritative validator; client validation is only UX. @@ -42,6 +44,7 @@ The compact endpoint contract is in [API.md](API.md). Unknown body/query fields - Post creation always uses `author_id` from the verified JWT; clients must not send `author_id`. - Post edit/delete require that the JWT user owns the post. - `/posts` is visible to any authenticated user; `/posts/me` filters by JWT `user_id`. +- Post listings include `author_username` and `created_at`; profile responses expose only `id`, `name`, and `username`. - Relationship creation requires `me` to equal the JWT user ID. - Uploads accept only JPEG, PNG, GIF, and WebP, one file named `image`, up to `MAX_UPLOAD_SIZE_BYTES` (default 5 MiB). Files receive random names and are stored under `UPLOAD_DIR`. - Registration rejects disposable email addresses and weak/reused-pattern passwords. Login failures use the generic `Invalid email or password` response. diff --git a/app.js b/app.js index 3d23e01..21a65fb 100644 --- a/app.js +++ b/app.js @@ -34,11 +34,13 @@ const CreatePostRoute = require("./features/posts/CREATE_post"); const DeletePostRoute = require("./features/posts/DELETE_post"); const GetPostsRoute = require("./features/posts/GET_posts"); const EditPostRoute = require("./features/posts/EDIT_post"); +const GetProfileRoute = require("./features/people/GET_profile"); app.use("/posts", GetPostsRoute); app.use("/posts/create", CreatePostRoute); app.use("/posts/delete", DeletePostRoute); app.use("/posts/edit", EditPostRoute); +app.use("/profiles", GetProfileRoute); app.listen(process.env.PORT, () => { console.log(`Server draait op port ${process.env.PORT}`); diff --git a/features/people/GET_profile.js b/features/people/GET_profile.js new file mode 100644 index 0000000..2a12864 --- /dev/null +++ b/features/people/GET_profile.js @@ -0,0 +1,31 @@ +const express = require("express"); +const router = express.Router(); +const pool = require("../../db"); +const { strictInput } = require("../../middleware/strict_input"); +const { authenticateToken } = require("../../middleware/authenticate_token"); + +async function getProfile(req, res) { + const id = req.params.id === "me" ? req.user.id : req.params.id; + + try { + const { rows } = await pool.query( + "SELECT id, name, username FROM people WHERE id = $1", + [id], + ); + if (rows.length === 0) return res.status(404).send("Profile not found"); + return res.status(200).json(rows[0]); + } catch (err) { + console.error("profile query failed", { + message: err.message, + code: err.code, + detail: err.detail, + hint: err.hint, + }); + return res.status(500).send("Profile could not be retrieved, request failed"); + } +} + +router.get("/me", authenticateToken, strictInput(), getProfile); +router.get("/:id", authenticateToken, strictInput(), getProfile); + +module.exports = router; diff --git a/features/posts/CREATE_post.js b/features/posts/CREATE_post.js index ce37ed8..e8e0972 100644 --- a/features/posts/CREATE_post.js +++ b/features/posts/CREATE_post.js @@ -20,7 +20,7 @@ async function create_post(req, res) { const imageLink = imageLinkForFile(req.file); try { const { rows } = await pool.query( - "INSERT INTO posts (title, text, author_id, image_link) VALUES ($1, $2, $3, $4) RETURNING id, title, text, author_id, image_link", + "WITH created AS (INSERT INTO posts (title, text, author_id, image_link) VALUES ($1, $2, $3, $4) RETURNING id, title, text, author_id, image_link, created_at) SELECT created.*, people.username AS author_username FROM created LEFT JOIN people ON people.id = created.author_id", [title, text, author_id, imageLink], ); res.status(201).json(rows[0]); diff --git a/features/posts/EDIT_post.js b/features/posts/EDIT_post.js index 379d959..9cbdc1f 100644 --- a/features/posts/EDIT_post.js +++ b/features/posts/EDIT_post.js @@ -58,7 +58,7 @@ async function editPost(req, res) { let updated; try { updated = await pool.query( - `UPDATE posts SET ${fields.join(", ")} WHERE id = $${values.length - 1} AND author_id = $${values.length} RETURNING id, title, text, author_id, image_link`, + `WITH updated AS (UPDATE posts SET ${fields.join(", ")} WHERE id = $${values.length - 1} AND author_id = $${values.length} RETURNING id, title, text, author_id, image_link, created_at) SELECT updated.*, people.username AS author_username FROM updated LEFT JOIN people ON people.id = updated.author_id`, values, ); } catch (err) { diff --git a/features/posts/GET_posts.js b/features/posts/GET_posts.js index 7c71a6a..641a573 100644 --- a/features/posts/GET_posts.js +++ b/features/posts/GET_posts.js @@ -9,8 +9,8 @@ const path = require("path"); async function getPosts(req, res, ownOnly) { try { const query = ownOnly - ? "SELECT id, title, text, author_id, image_link FROM posts WHERE author_id = $1" - : "SELECT id, title, text, author_id, image_link FROM posts"; + ? "SELECT p.id, p.title, p.text, p.author_id, people.username AS author_username, p.image_link, p.created_at FROM posts p LEFT JOIN people ON people.id = p.author_id WHERE p.author_id = $1" + : "SELECT p.id, p.title, p.text, p.author_id, people.username AS author_username, p.image_link, p.created_at FROM posts p LEFT JOIN people ON people.id = p.author_id"; const values = ownOnly ? [req.user.id] : []; const { rows } = await pool.query(query, values); res.status(200).json(rows);