Added reading profile endpoint

2026-07-24 23:50:33 +02:00
parent 9e56f00c1e
commit eaeb0a29bc
7 changed files with 45 additions and 5 deletions
@@ -35,6 +35,8 @@ Login returns `{ id, token, expires_at }`. The token is HS256-signed and contain

 The compact endpoint contract is in [API.md](API.md). Unknown body/query fields are rejected with `400`; clients must send only documented fields.

+Authenticated clients can read profiles through `GET /profiles/me` or `GET /profiles/:id`. Post responses include the public author username as `author_username` and the database creation timestamp as `created_at`.
+
 ## Security and ownership

 - The API is the authoritative validator; client validation is only UX.
@@ -42,6 +44,7 @@ The compact endpoint contract is in [API.md](API.md). Unknown body/query fields
 - Post creation always uses `author_id` from the verified JWT; clients must not send `author_id`.
 - Post edit/delete require that the JWT user owns the post.
 - `/posts` is visible to any authenticated user; `/posts/me` filters by JWT `user_id`.
+- Post listings include `author_username` and `created_at`; profile responses expose only `id`, `name`, and `username`.
 - Relationship creation requires `me` to equal the JWT user ID.
 - Uploads accept only JPEG, PNG, GIF, and WebP, one file named `image`, up to `MAX_UPLOAD_SIZE_BYTES` (default 5 MiB). Files receive random names and are stored under `UPLOAD_DIR`.
 - Registration rejects disposable email addresses and weak/reused-pattern passwords. Login failures use the generic `Invalid email or password` response.