Skip to content

Improve authorization, error handling, and post data aggregation #21

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hussein-m-kandil merged 7 commits into from
Feb 28, 2026
Merged

Improve authorization, error handling, and post data aggregation #21

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
1eda068
Aggregate user/author data with post comment/vote
hussein-m-kandil Feb 18, 2026
cc19adf
Support getting posts of current user's following
hussein-m-kandil Feb 16, 2026
d0668aa
Return info about upvotes/downvotes with post data
hussein-m-kandil Feb 16, 2026
a7f933d
Add `followed` flag to post/comment/vote author
hussein-m-kandil Feb 26, 2026
2a3d0dd
Respond with 404 on GET post by an invalid id
hussein-m-kandil Feb 28, 2026
d9a2388
Respond with 404 on GET profile by an invalid id
hussein-m-kandil Feb 28, 2026
20867fc
Respond with 403 on non-owner/admin mutation
hussein-m-kandil Feb 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
184 changes: 59 additions & 125 deletions src/api/v1/posts/posts.router.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,15 +9,9 @@ import { Router, Request, Response } from 'express';

export const postsRouter = Router();

const getPostAuthorIdAndInjectPostInResLocals = async (
req: Request,
res: Response
) => {
const getPostAuthorIdAndInjectPostInResLocals = async (req: Request, res: Response) => {
const userId = Utils.getCurrentUserIdFromReq(req);
const post = await Service._findPostWithAggregationOrThrow(
req.params.id,
userId
);
const post = await Service._findPostWithAggregationOrThrow(req.params.id, userId);
res.locals.post = post;
return post.authorId;
};
Expand All @@ -27,13 +21,13 @@ const getCommentAuthorId = async (req: Request) => {
const comment = await Service.findPostCommentByCompoundIdOrThrow(
req.params.pId,
req.params.cId,
userId
userId,
);
return comment.authorId;
};

const createHandlersForGettingPrivatePostData = (
postService: (postId: string, authorId?: string) => unknown
postService: (postId: string, authorId?: string) => unknown,
) => {
return [
Middlewares.optionalAuthValidator,
Expand All @@ -46,79 +40,53 @@ const createHandlersForGettingPrivatePostData = (

postsRouter.get('/', Middlewares.optionalAuthValidator, async (req, res) => {
const filters = Utils.getPostFiltersFromReqQuery(req);
const posts = await Service.findFilteredPosts(filters);
const posts = await Service.findFilteredPosts(filters, 'findMany');
res.json(posts);
});

postsRouter.get(
'/count',
Middlewares.optionalAuthValidator,
async (req, res) => {
const filters = Utils.getPostFiltersFromReqQuery(req);
res.json(await Service.findFilteredPosts(filters, 'count'));
}
);
postsRouter.get('/count', Middlewares.optionalAuthValidator, async (req, res) => {
const filters = Utils.getPostFiltersFromReqQuery(req);
res.json(await Service.findFilteredPosts(filters, 'count'));
});

postsRouter.get('/tags', async (req, res) => {
const tagsFilter = Utils.getTagsFilterFromReqQuery(req);
res.json(await Service.getTags(tagsFilter));
});

postsRouter.get(
'/comments',
Middlewares.optionalAuthValidator,
async (req, res) => {
const commentsFilter = Utils.getCommentFiltersFromReqQuery(req);
res.json(await Service.findFilteredComments(commentsFilter));
}
);
postsRouter.get('/comments', Middlewares.optionalAuthValidator, async (req, res) => {
const commentsFilter = Utils.getCommentFiltersFromReqQuery(req);
res.json(await Service.findFilteredComments(commentsFilter));
});

postsRouter.get(
'/votes',
Middlewares.optionalAuthValidator,
async (req, res) => {
const votesFilter = Utils.getVoteFiltersFromReqQuery(req);
res.json(await Service.findFilteredVotes(votesFilter));
}
);
postsRouter.get('/votes', Middlewares.optionalAuthValidator, async (req, res) => {
const votesFilter = Utils.getVoteFiltersFromReqQuery(req);
res.json(await Service.findFilteredVotes(votesFilter));
});

postsRouter.get('/tags/count', async (req, res) => {
const postAuthorId = Utils.getAuthorIdFilterFromReqQuery(req);
res.json(await Service.countTagsOnPosts(postAuthorId));
});

postsRouter.get(
'/comments/count',
Middlewares.optionalAuthValidator,
async (req, res) => {
const commentsFilter = Utils.getCommentFiltersFromReqQuery(req);
res.json(await Service.findFilteredComments(commentsFilter, 'count'));
}
);
postsRouter.get('/comments/count', Middlewares.optionalAuthValidator, async (req, res) => {
const commentsFilter = Utils.getCommentFiltersFromReqQuery(req);
res.json(await Service.findFilteredComments(commentsFilter, 'count'));
});

postsRouter.get(
'/votes/count',
Middlewares.optionalAuthValidator,
async (req, res) => {
const votesFilter = Utils.getVoteFiltersFromReqQuery(req);
res.json(await Service.findFilteredVotes(votesFilter, 'count'));
}
);
postsRouter.get('/votes/count', Middlewares.optionalAuthValidator, async (req, res) => {
const votesFilter = Utils.getVoteFiltersFromReqQuery(req);
res.json(await Service.findFilteredVotes(votesFilter, 'count'));
});

postsRouter.get(
'/:id',
createHandlersForGettingPrivatePostData(Service.findPostByIdOrThrow)
);
postsRouter.get('/:id', createHandlersForGettingPrivatePostData(Service.findPostByIdOrThrow));

postsRouter.get(
'/:id/votes/count',
createHandlersForGettingPrivatePostData(Service.countPostVotes)
createHandlersForGettingPrivatePostData(Service.countPostVotes),
);

postsRouter.get(
'/:id/tags',
createHandlersForGettingPrivatePostData(Service.findPostTags)
);
postsRouter.get('/:id/tags', createHandlersForGettingPrivatePostData(Service.findPostTags));

postsRouter.get(
'/:id/comments',
Expand All @@ -127,7 +95,7 @@ postsRouter.get(
const postId = req.params.id;
const filters = { ...Utils.getCommentFiltersFromReqQuery(req), postId };
res.json(await Service.findFilteredComments(filters));
}
},
);

postsRouter.get(
Expand All @@ -139,33 +107,22 @@ postsRouter.get(
postId: req.params.id,
};
res.json(await Service.findFilteredVotes(filters));
}
},
);

postsRouter.get(
'/:id/tags/count',
createHandlersForGettingPrivatePostData(Service.countPostTags)
);
postsRouter.get('/:id/tags/count', createHandlersForGettingPrivatePostData(Service.countPostTags));

postsRouter.get(
'/:id/comments/count',
createHandlersForGettingPrivatePostData(Service.countPostComments)
createHandlersForGettingPrivatePostData(Service.countPostComments),
);

postsRouter.get(
'/:pId/comments/:cId',
Middlewares.optionalAuthValidator,
async (req, res) => {
const userId = Utils.getCurrentUserIdFromReq(req);
res.json(
await Service.findPostCommentByCompoundIdOrThrow(
req.params.pId,
req.params.cId,
userId
)
);
}
);
postsRouter.get('/:pId/comments/:cId', Middlewares.optionalAuthValidator, async (req, res) => {
const userId = Utils.getCurrentUserIdFromReq(req);
res.json(
await Service.findPostCommentByCompoundIdOrThrow(req.params.pId, req.params.cId, userId),
);
});

postsRouter.post(
'/',
Expand All @@ -182,17 +139,12 @@ postsRouter.post(
...Image.getImageMetadata(file),
};
const uploadedImage = await Storage.uploadImage(file, user);
createdPost = await Service.createPostWithImage(
postData,
user,
imageData,
uploadedImage
);
createdPost = await Service.createPostWithImage(postData, user, imageData, uploadedImage);
} else {
createdPost = await Service.createPost(postData, user);
}
res.status(201).json(createdPost);
}
},
);

postsRouter.post('/:id/upvote', Middlewares.authValidator, async (req, res) => {
Expand All @@ -201,15 +153,11 @@ postsRouter.post('/:id/upvote', Middlewares.authValidator, async (req, res) => {
res.json(upvotedPost);
});

postsRouter.post(
'/:id/downvote',
Middlewares.authValidator,
async (req, res) => {
const user = req.user as Types.PublicUser;
const downvotedPost = await Service.downvotePost(req.params.id, user.id);
res.json(downvotedPost);
}
);
postsRouter.post('/:id/downvote', Middlewares.authValidator, async (req, res) => {
const user = req.user as Types.PublicUser;
const downvotedPost = await Service.downvotePost(req.params.id, user.id);
res.json(downvotedPost);
});

postsRouter.post('/:id/unvote', Middlewares.authValidator, async (req, res) => {
const user = req.user as Types.PublicUser;
Expand All @@ -226,23 +174,18 @@ postsRouter.post(
const newComment = await Service.findPostByIdAndCreateComment(
req.params.id,
user.id,
commentData
commentData,
);
res.status(200).json(newComment);
}
},
);

postsRouter.put(
'/:id',
Middlewares.authValidator,
Middlewares.createAdminOrOwnerValidator(
getPostAuthorIdAndInjectPostInResLocals
),
Middlewares.createAdminOrOwnerValidator(getPostAuthorIdAndInjectPostInResLocals),
Middlewares.createFileProcessor('image'),
async (
req: Request,
res: Response<unknown, { post: Service._PostFullData }>
) => {
async (req: Request, res: Response<unknown, { post: Service._PostFullData }>) => {
const user = req.user as Types.PublicUser;
const { post } = res.locals;
const { imagedata, ...postData } = Schema.postSchema.parse(req.body);
Expand All @@ -259,13 +202,13 @@ postsRouter.put(
user,
postData,
imageData,
uploadedImage
uploadedImage,
);
} else {
updatedPost = await Service.updatePost(post, postData, imagedata);
updatedPost = await Service.updatePost(post, user, postData, imagedata);
}
res.json(updatedPost);
}
},
);

postsRouter.put(
Expand All @@ -275,26 +218,22 @@ postsRouter.put(
async (req, res) => {
const user = req.user as Types.PublicUser;
const commentData = Schema.commentSchema.parse(req.body);
const updatedComment = await Service.findCommentAndUpdate(
req.params.cId,
user.id,
commentData
);
const updatedComment = await Service.findCommentAndUpdate(req.params.cId, user.id, commentData);
res.json(updatedComment);
}
},
);

postsRouter.delete(
'/:id',
Middlewares.authValidator,
Middlewares.createAdminOrOwnerValidator(
async (req, res) => await getPostAuthorIdAndInjectPostInResLocals(req, res)
async (req, res) => await getPostAuthorIdAndInjectPostInResLocals(req, res),
),
async (req, res: Response<unknown, { post: Service._PostFullData }>) => {
const userId = Utils.getCurrentUserIdFromReq(req);
await Service.deletePost(res.locals.post, userId);
res.status(204).end();
}
},
);

postsRouter.delete(
Expand All @@ -303,17 +242,12 @@ postsRouter.delete(
Middlewares.createAdminOrOwnerValidator(async (req, res) => {
const userId = Utils.getCurrentUserIdFromReq(req);
req.params.id = req.params.pId; // For `getPostAuthorId(req)`
const postAuthorId = await getPostAuthorIdAndInjectPostInResLocals(
req,
res
);
return postAuthorId === userId
? postAuthorId
: await getCommentAuthorId(req);
const postAuthorId = await getPostAuthorIdAndInjectPostInResLocals(req, res);
return postAuthorId === userId ? postAuthorId : await getCommentAuthorId(req);
}),
async (req, res) => {
const userId = Utils.getCurrentUserIdFromReq(req);
await Service.findCommentAndDelete(req.params.cId, userId);
res.status(204).end();
}
},
);
Loading