601 lines
20 KiB
JavaScript
601 lines
20 KiB
JavaScript
import express from 'express';
|
||
import * as db from '../../db/article.js';
|
||
|
||
const AVIF_BODY_LIMIT = '20mb';
|
||
const FULL_HASH_RE = /^[a-fA-F0-9]{64}$/;
|
||
|
||
function parsePositiveInt(value, field) {
|
||
const id = Number(value);
|
||
if (!Number.isInteger(id) || id <= 0) {
|
||
return { error: `${field} is required` };
|
||
}
|
||
return { id };
|
||
}
|
||
|
||
function parseSku(value) {
|
||
const sku = typeof value === 'string' ? value.trim() : '';
|
||
if (!sku) return { error: 'sku is required' };
|
||
return { sku: decodeURIComponent(sku) };
|
||
}
|
||
|
||
function parseFullHash(value) {
|
||
const fullHash = typeof value === 'string' ? value.trim() : '';
|
||
if (!FULL_HASH_RE.test(fullHash)) {
|
||
return { error: 'fullHash must be a 64-char hex SHA-256' };
|
||
}
|
||
return { fullHash: fullHash.toLowerCase() };
|
||
}
|
||
|
||
function articleErrorStatus(error) {
|
||
if (error.message === 'Not authorized') return 403;
|
||
if (error.message === 'Parent not found') return 404;
|
||
if (error.message === 'Article not found') return 404;
|
||
if (error.message === 'Image not found') return 404;
|
||
if (error.message === 'Name required') return 400;
|
||
if (error.message === 'Invalid image order') return 400;
|
||
if (error.message === 'Article has children') return 400;
|
||
return 500;
|
||
}
|
||
|
||
/**
|
||
* Registers article routes (requires auth middleware).
|
||
* @param {import('express').Application} app - Express app
|
||
* @param {string} [basePath=''] - Optional URL prefix for all routes in this module
|
||
*/
|
||
export function register(app, basePath = '') {
|
||
/**
|
||
* @openapi
|
||
* /article:
|
||
* post:
|
||
* tags: [Article]
|
||
* summary: Create article
|
||
* description: Creates an article under an authorized category (`parentId`).
|
||
* security:
|
||
* - cookieAuth: []
|
||
* x-markdown: article/create.md
|
||
* requestBody:
|
||
* required: true
|
||
* content:
|
||
* application/json:
|
||
* schema:
|
||
* type: object
|
||
* required: [parentId, name]
|
||
* properties:
|
||
* parentId:
|
||
* type: integer
|
||
* description: Category id
|
||
* name:
|
||
* type: string
|
||
* example:
|
||
* parentId: 10
|
||
* name: New article
|
||
* responses:
|
||
* 201:
|
||
* description: Created
|
||
* content:
|
||
* application/json:
|
||
* schema:
|
||
* type: object
|
||
* properties:
|
||
* article:
|
||
* $ref: '#/components/schemas/ArticleSummary'
|
||
* 400:
|
||
* description: Validation error
|
||
* content:
|
||
* application/json:
|
||
* schema:
|
||
* $ref: '#/components/schemas/Error'
|
||
* 401:
|
||
* description: Unauthorized
|
||
* content:
|
||
* application/json:
|
||
* schema:
|
||
* $ref: '#/components/schemas/Error'
|
||
* 403:
|
||
* description: Not authorized for parent category
|
||
* content:
|
||
* application/json:
|
||
* schema:
|
||
* $ref: '#/components/schemas/Error'
|
||
* 404:
|
||
* description: Parent not found
|
||
* content:
|
||
* application/json:
|
||
* schema:
|
||
* $ref: '#/components/schemas/Error'
|
||
*/
|
||
app.post(`${basePath}/article`, async (req, res) => {
|
||
const parent = parsePositiveInt(req.body?.parentId, 'parentId');
|
||
if (parent.error) {
|
||
return res.status(400).json({ error: parent.error });
|
||
}
|
||
|
||
const name = typeof req.body?.name === 'string' ? req.body.name.trim() : '';
|
||
if (!name) {
|
||
return res.status(400).json({ error: 'name is required' });
|
||
}
|
||
|
||
try {
|
||
const article = await db.createUnderParent({
|
||
googleAuthId: req.user.id,
|
||
parentId: parent.id,
|
||
name,
|
||
});
|
||
res.status(201).json({ article });
|
||
} catch (error) {
|
||
const status = articleErrorStatus(error);
|
||
if (status === 500) console.error('Create article failed:', error);
|
||
res.status(status).json({ error: error.message });
|
||
}
|
||
});
|
||
|
||
/**
|
||
* @openapi
|
||
* /article/{sku}:
|
||
* get:
|
||
* tags: [Article]
|
||
* summary: Get article by SKU
|
||
* description: Returns article detail by SKU if the user may access its category.
|
||
* security:
|
||
* - cookieAuth: []
|
||
* x-markdown: article/get.md
|
||
* parameters:
|
||
* - in: path
|
||
* name: sku
|
||
* required: true
|
||
* schema:
|
||
* type: string
|
||
* description: Article SKU
|
||
* responses:
|
||
* 200:
|
||
* description: Article detail
|
||
* content:
|
||
* application/json:
|
||
* schema:
|
||
* type: object
|
||
* properties:
|
||
* article:
|
||
* $ref: '#/components/schemas/ArticleDetail'
|
||
* 400:
|
||
* description: Missing sku
|
||
* content:
|
||
* application/json:
|
||
* schema:
|
||
* $ref: '#/components/schemas/Error'
|
||
* 401:
|
||
* description: Unauthorized
|
||
* content:
|
||
* application/json:
|
||
* schema:
|
||
* $ref: '#/components/schemas/Error'
|
||
* 403:
|
||
* description: Not authorized
|
||
* content:
|
||
* application/json:
|
||
* schema:
|
||
* $ref: '#/components/schemas/Error'
|
||
* 404:
|
||
* description: Article not found
|
||
* content:
|
||
* application/json:
|
||
* schema:
|
||
* $ref: '#/components/schemas/Error'
|
||
* patch:
|
||
* tags: [Article]
|
||
* summary: Update article by SKU
|
||
* description: Updates an article name by SKU; returns the same detail shape as GET.
|
||
* security:
|
||
* - cookieAuth: []
|
||
* x-markdown: article/update.md
|
||
* parameters:
|
||
* - in: path
|
||
* name: sku
|
||
* required: true
|
||
* schema:
|
||
* type: string
|
||
* description: Article SKU
|
||
* requestBody:
|
||
* required: true
|
||
* content:
|
||
* application/json:
|
||
* schema:
|
||
* type: object
|
||
* required: [name]
|
||
* properties:
|
||
* name:
|
||
* type: string
|
||
* example:
|
||
* name: Updated name
|
||
* responses:
|
||
* 200:
|
||
* description: Updated article detail
|
||
* content:
|
||
* application/json:
|
||
* schema:
|
||
* type: object
|
||
* properties:
|
||
* article:
|
||
* $ref: '#/components/schemas/ArticleDetail'
|
||
* 400:
|
||
* description: Validation error
|
||
* content:
|
||
* application/json:
|
||
* schema:
|
||
* $ref: '#/components/schemas/Error'
|
||
* 401:
|
||
* description: Unauthorized
|
||
* content:
|
||
* application/json:
|
||
* schema:
|
||
* $ref: '#/components/schemas/Error'
|
||
* 403:
|
||
* description: Not authorized
|
||
* content:
|
||
* application/json:
|
||
* schema:
|
||
* $ref: '#/components/schemas/Error'
|
||
* 404:
|
||
* description: Article not found
|
||
* content:
|
||
* application/json:
|
||
* schema:
|
||
* $ref: '#/components/schemas/Error'
|
||
* delete:
|
||
* tags: [Article]
|
||
* summary: Delete article by SKU
|
||
* description: |
|
||
* Deletes the article when it has no child articles. Cascades related rows;
|
||
* nulls `manifestarticle.article_id` and appends a delete comment.
|
||
* Auth like GET by SKU.
|
||
* security:
|
||
* - cookieAuth: []
|
||
* x-markdown: article/delete.md
|
||
* parameters:
|
||
* - in: path
|
||
* name: sku
|
||
* required: true
|
||
* schema:
|
||
* type: string
|
||
* description: Article SKU
|
||
* responses:
|
||
* 204:
|
||
* description: Deleted
|
||
* 400:
|
||
* description: Article has children
|
||
* content:
|
||
* application/json:
|
||
* schema:
|
||
* $ref: '#/components/schemas/Error'
|
||
* 401:
|
||
* description: Unauthorized
|
||
* content:
|
||
* application/json:
|
||
* schema:
|
||
* $ref: '#/components/schemas/Error'
|
||
* 403:
|
||
* description: Not authorized
|
||
* content:
|
||
* application/json:
|
||
* schema:
|
||
* $ref: '#/components/schemas/Error'
|
||
* 404:
|
||
* description: Article not found
|
||
* content:
|
||
* application/json:
|
||
* schema:
|
||
* $ref: '#/components/schemas/Error'
|
||
*/
|
||
app.get(`${basePath}/article/:sku`, async (req, res) => {
|
||
const sku = typeof req.params.sku === 'string' ? req.params.sku.trim() : '';
|
||
if (!sku) {
|
||
return res.status(400).json({ error: 'sku is required' });
|
||
}
|
||
|
||
try {
|
||
const article = await db.getBySku(req.user.id, decodeURIComponent(sku));
|
||
res.status(200).json({ article });
|
||
} catch (error) {
|
||
const status = articleErrorStatus(error);
|
||
if (status === 500) console.error('Get article by sku failed:', error);
|
||
res.status(status).json({ error: error.message });
|
||
}
|
||
});
|
||
|
||
app.patch(`${basePath}/article/:sku`, async (req, res) => {
|
||
const sku = typeof req.params.sku === 'string' ? req.params.sku.trim() : '';
|
||
if (!sku) {
|
||
return res.status(400).json({ error: 'sku is required' });
|
||
}
|
||
|
||
const name = typeof req.body?.name === 'string' ? req.body.name.trim() : '';
|
||
if (!name) {
|
||
return res.status(400).json({ error: 'name is required' });
|
||
}
|
||
|
||
try {
|
||
const article = await db.updateBySku(req.user.id, decodeURIComponent(sku), { name });
|
||
res.status(200).json({ article });
|
||
} catch (error) {
|
||
const status = articleErrorStatus(error);
|
||
if (status === 500) console.error('Update article by sku failed:', error);
|
||
res.status(status).json({ error: error.message });
|
||
}
|
||
});
|
||
|
||
app.delete(`${basePath}/article/:sku`, async (req, res) => {
|
||
const parsed = parseSku(req.params.sku);
|
||
if (parsed.error) {
|
||
return res.status(400).json({ error: parsed.error });
|
||
}
|
||
|
||
try {
|
||
await db.remove(req.user.id, parsed.sku);
|
||
res.sendStatus(204);
|
||
} catch (error) {
|
||
const status = articleErrorStatus(error);
|
||
if (status === 500) console.error('Delete article failed:', error);
|
||
res.status(status).json({ error: error.message });
|
||
}
|
||
});
|
||
|
||
/**
|
||
* @openapi
|
||
* /article/{sku}/image:
|
||
* post:
|
||
* tags: [Article]
|
||
* summary: Add article image
|
||
* description: |
|
||
* Accepts a full-size AVIF body (`Content-Type: image/avif`).
|
||
* Full: stored as-is when already AVIF and ≤1000×1000; otherwise scaled to max 1000×1000.
|
||
* Thumb always scaled to max 200×200. Stores hash/thumbhash, links `articlepic`.
|
||
* Auth like GET by SKU.
|
||
* security:
|
||
* - cookieAuth: []
|
||
* x-markdown: article/add-image.md
|
||
* parameters:
|
||
* - in: path
|
||
* name: sku
|
||
* required: true
|
||
* schema:
|
||
* type: string
|
||
* description: Article SKU
|
||
* requestBody:
|
||
* required: true
|
||
* content:
|
||
* image/avif:
|
||
* schema:
|
||
* type: string
|
||
* format: binary
|
||
* responses:
|
||
* 201:
|
||
* description: Image stored and linked
|
||
* content:
|
||
* application/json:
|
||
* schema:
|
||
* type: object
|
||
* properties:
|
||
* image:
|
||
* $ref: '#/components/schemas/ArticleImage'
|
||
* 400:
|
||
* description: Missing body or invalid image
|
||
* content:
|
||
* application/json:
|
||
* schema:
|
||
* $ref: '#/components/schemas/Error'
|
||
* 401:
|
||
* description: Unauthorized
|
||
* content:
|
||
* application/json:
|
||
* schema:
|
||
* $ref: '#/components/schemas/Error'
|
||
* 403:
|
||
* description: Not authorized
|
||
* content:
|
||
* application/json:
|
||
* schema:
|
||
* $ref: '#/components/schemas/Error'
|
||
* 404:
|
||
* description: Article not found
|
||
* content:
|
||
* application/json:
|
||
* schema:
|
||
* $ref: '#/components/schemas/Error'
|
||
*/
|
||
app.post(
|
||
`${basePath}/article/:sku/image`,
|
||
express.raw({ type: ['image/avif', 'application/octet-stream'], limit: AVIF_BODY_LIMIT }),
|
||
async (req, res) => {
|
||
const sku = typeof req.params.sku === 'string' ? req.params.sku.trim() : '';
|
||
if (!sku) {
|
||
return res.status(400).json({ error: 'sku is required' });
|
||
}
|
||
|
||
const imageBuffer = Buffer.isBuffer(req.body) ? req.body : null;
|
||
if (!imageBuffer?.length) {
|
||
return res.status(400).json({ error: 'AVIF image body is required' });
|
||
}
|
||
|
||
try {
|
||
const image = await db.addImage(req.user.id, decodeURIComponent(sku), imageBuffer);
|
||
res.status(201).json({ image });
|
||
} catch (error) {
|
||
const status = articleErrorStatus(error);
|
||
if (status === 500) console.error('Add article image failed:', error);
|
||
res.status(status).json({ error: error.message });
|
||
}
|
||
},
|
||
);
|
||
|
||
/**
|
||
* @openapi
|
||
* /article/{sku}/image/{fullHash}:
|
||
* delete:
|
||
* tags: [Article]
|
||
* summary: Delete article image
|
||
* description: Removes `articlepic` and the `pic` row for this article (`fullHash`). Auth like GET by SKU.
|
||
* security:
|
||
* - cookieAuth: []
|
||
* x-markdown: article/delete-image.md
|
||
* parameters:
|
||
* - in: path
|
||
* name: sku
|
||
* required: true
|
||
* schema:
|
||
* type: string
|
||
* - in: path
|
||
* name: fullHash
|
||
* required: true
|
||
* schema:
|
||
* type: string
|
||
* pattern: '^[a-fA-F0-9]{64}$'
|
||
* responses:
|
||
* 204:
|
||
* description: Deleted
|
||
* 400:
|
||
* description: Invalid hash
|
||
* content:
|
||
* application/json:
|
||
* schema:
|
||
* $ref: '#/components/schemas/Error'
|
||
* 401:
|
||
* description: Unauthorized
|
||
* content:
|
||
* application/json:
|
||
* schema:
|
||
* $ref: '#/components/schemas/Error'
|
||
* 403:
|
||
* description: Not authorized
|
||
* content:
|
||
* application/json:
|
||
* schema:
|
||
* $ref: '#/components/schemas/Error'
|
||
* 404:
|
||
* description: Article or image not found
|
||
* content:
|
||
* application/json:
|
||
* schema:
|
||
* $ref: '#/components/schemas/Error'
|
||
*/
|
||
app.delete(`${basePath}/article/:sku/image/:fullHash`, async (req, res) => {
|
||
const skuParsed = parseSku(req.params.sku);
|
||
if (skuParsed.error) {
|
||
return res.status(400).json({ error: skuParsed.error });
|
||
}
|
||
const hashParsed = parseFullHash(req.params.fullHash);
|
||
if (hashParsed.error) {
|
||
return res.status(400).json({ error: hashParsed.error });
|
||
}
|
||
|
||
try {
|
||
await db.deleteImage(req.user.id, skuParsed.sku, hashParsed.fullHash);
|
||
res.sendStatus(204);
|
||
} catch (error) {
|
||
const status = articleErrorStatus(error);
|
||
if (status === 500) console.error('Delete article image failed:', error);
|
||
res.status(status).json({ error: error.message });
|
||
}
|
||
});
|
||
|
||
/**
|
||
* @openapi
|
||
* /article/{sku}/images/order:
|
||
* put:
|
||
* tags: [Article]
|
||
* summary: Reorder article images
|
||
* description: |
|
||
* Sets `articlepic.sort` to `0..n-1` in the given order.
|
||
* `fullHashes` must list every image of the article exactly once.
|
||
* security:
|
||
* - cookieAuth: []
|
||
* x-markdown: article/order-images.md
|
||
* parameters:
|
||
* - in: path
|
||
* name: sku
|
||
* required: true
|
||
* schema:
|
||
* type: string
|
||
* requestBody:
|
||
* required: true
|
||
* content:
|
||
* application/json:
|
||
* schema:
|
||
* type: object
|
||
* required: [fullHashes]
|
||
* properties:
|
||
* fullHashes:
|
||
* type: array
|
||
* items:
|
||
* type: string
|
||
* pattern: '^[a-fA-F0-9]{64}$'
|
||
* example:
|
||
* fullHashes:
|
||
* - "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||
* - "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
|
||
* responses:
|
||
* 200:
|
||
* description: New order
|
||
* content:
|
||
* application/json:
|
||
* schema:
|
||
* type: object
|
||
* properties:
|
||
* fullHashes:
|
||
* type: array
|
||
* items:
|
||
* type: string
|
||
* 400:
|
||
* description: Invalid image order
|
||
* content:
|
||
* application/json:
|
||
* schema:
|
||
* $ref: '#/components/schemas/Error'
|
||
* 401:
|
||
* description: Unauthorized
|
||
* content:
|
||
* application/json:
|
||
* schema:
|
||
* $ref: '#/components/schemas/Error'
|
||
* 403:
|
||
* description: Not authorized
|
||
* content:
|
||
* application/json:
|
||
* schema:
|
||
* $ref: '#/components/schemas/Error'
|
||
* 404:
|
||
* description: Article not found
|
||
* content:
|
||
* application/json:
|
||
* schema:
|
||
* $ref: '#/components/schemas/Error'
|
||
*/
|
||
app.put(`${basePath}/article/:sku/images/order`, async (req, res) => {
|
||
const skuParsed = parseSku(req.params.sku);
|
||
if (skuParsed.error) {
|
||
return res.status(400).json({ error: skuParsed.error });
|
||
}
|
||
|
||
const rawHashes = req.body?.fullHashes;
|
||
if (!Array.isArray(rawHashes)) {
|
||
return res.status(400).json({ error: 'fullHashes is required' });
|
||
}
|
||
|
||
const fullHashes = [];
|
||
for (const value of rawHashes) {
|
||
const parsed = parseFullHash(value);
|
||
if (parsed.error) {
|
||
return res.status(400).json({ error: parsed.error });
|
||
}
|
||
fullHashes.push(parsed.fullHash);
|
||
}
|
||
|
||
try {
|
||
const result = await db.orderImages(req.user.id, skuParsed.sku, { fullHashes });
|
||
res.status(200).json(result);
|
||
} catch (error) {
|
||
const status = articleErrorStatus(error);
|
||
if (status === 500) console.error('Order article images failed:', error);
|
||
res.status(status).json({ error: error.message });
|
||
}
|
||
});
|
||
}
|