Soziales Netz im Spiel: Feed, Werbung, Markt, Kalender und Gewerbe
Jeder Spieler waehlt sich ein Handle mit @, Unternehmen und Behoerden bekommen
eigene Profile, fuer die sie Mitarbeiter freigeben.
Verwaltet wird ueber dieselbe Anmeldung wie das Webhosting: wer am IC-Computer
als Anbieter angemeldet ist, richtet Unternehmensprofile ein. Damit gibt es
genau eine Stelle, an der Verwaltungsrechte haengen - ein zweites Rechtesystem
daneben waere eine zweite Stelle, an der man jemanden zu entziehen vergisst.
Bewusst getrennt: wer fuer ein Unternehmen schreiben darf, kann sich nicht
selbst zum Verwalter machen.
Behoben gegenueber dem Ausgangsstand:
- Die Resource startete nicht. Eine harte Abhaengigkeit zeigte auf eine
Resource, die es nicht gibt - das verhindert den Start vollstaendig.
- Das Schema war gegenueber dem Code stehengeblieben: eine Tabelle fehlte
ganz, sechs Spalten fehlten. Jede Registrierung eines Handles scheiterte
deshalb mit einem SQL-Fehler. Zwei Migrationen ziehen das nach.
- Die Identitaet kommt jetzt von ESX statt von einem Charaktersystem, das
hier nicht laeuft. Ohne das findet das Mailsystem die Postfaecher nicht.
- Das Fenster hatte keinen Schliessknopf, nur ESC. Im Computerfenster ist
diese Taste aber schon vergeben.
- Bilder laden mit referrerpolicy="no-referrer": Bilderdienste sperren
Hotlinks anhand der Herkunft, und die eines NUI kennen sie nicht.
- Der Schluessel fuer den Bilder-Upload steht nicht mehr im Code, sondern in
der server.cfg (set bleeter_imgbb_key). Er gehoert nicht in ein oeffentlich
einsehbares Repository.
Neu: Unternehmensprofile und Mitarbeiterfreigabe, ueber Netzwerkereignisse und
Konsolenbefehle. Dazu eine Oberflaeche im IC-Computer, die dieselbe Gestaltung
benutzt - die Stildatei wird dafuer mechanisch gekapselt, statt sie nachzubauen.
Enthaelt README.md mit Einrichtung, Rechten und den Fallstricken.
This commit is contained in:
commit
20076b0aee
41 changed files with 8652 additions and 0 deletions
174
web-backend/routes/profiles.js
Normal file
174
web-backend/routes/profiles.js
Normal file
|
|
@ -0,0 +1,174 @@
|
|||
const express = require('express');
|
||||
const db = require('../db');
|
||||
const { requireAuth } = require('../auth');
|
||||
const { resolveActingProfile, findTargetProfile, mapProfile, getAccessibleProfiles } = require('../lib/account');
|
||||
const { loadProfileDirectory, loadSocial } = require('../lib/queries');
|
||||
const { canProfileBeBlocked, decodeBool } = require('../lib/permissions');
|
||||
|
||||
const router = express.Router();
|
||||
router.use(requireAuth);
|
||||
|
||||
const HANDLE_RE = /^[a-z0-9._-]+$/;
|
||||
|
||||
async function acting(req) {
|
||||
const profileId = (req.body && req.body.profileId) || req.query.profileId;
|
||||
return resolveActingProfile(req.account, profileId);
|
||||
}
|
||||
|
||||
// GET /api/directory?profileId=
|
||||
router.get('/directory', async (req, res) => {
|
||||
const { profile } = await acting(req);
|
||||
const profiles = await loadProfileDirectory(profile ? profile.id : 0, false);
|
||||
res.json({ profiles });
|
||||
});
|
||||
|
||||
// GET /api/social?profileId=
|
||||
router.get('/social', async (req, res) => {
|
||||
const { profile } = await acting(req);
|
||||
if (!profile) return res.json({ following: [], followers: [], blocked: [] });
|
||||
res.json(await loadSocial(profile.id));
|
||||
});
|
||||
|
||||
// GET /api/profiles/:handle?profileId= -> Profil + eigene Posts
|
||||
router.get('/profiles/:handle', async (req, res) => {
|
||||
const { profile: viewer } = await acting(req);
|
||||
const viewerId = viewer ? viewer.id : 0;
|
||||
const handle = String(req.params.handle || '').toLowerCase();
|
||||
const row = await db.q1(
|
||||
`SELECT p.*,
|
||||
(SELECT COUNT(*) FROM bleeter_follows f WHERE f.followed_profile_id=p.id) AS followers_count,
|
||||
(SELECT COUNT(*) FROM bleeter_follows f WHERE f.follower_profile_id=p.id) AS following_count
|
||||
FROM bleeter_profiles p WHERE p.handle = ? AND p.is_active = 1`,
|
||||
[handle]
|
||||
);
|
||||
if (!row) return res.status(404).json({ error: 'not_found' });
|
||||
const target = mapProfile(row);
|
||||
|
||||
const isFollowing = viewerId ? !!(await db.q1(
|
||||
'SELECT 1 FROM bleeter_follows WHERE follower_profile_id = ? AND followed_profile_id = ? LIMIT 1',
|
||||
[viewerId, target.id]
|
||||
)) : false;
|
||||
const isBlocked = viewerId ? !!(await db.q1(
|
||||
'SELECT 1 FROM bleeter_blocks WHERE blocker_profile_id = ? AND blocked_profile_id = ? LIMIT 1',
|
||||
[viewerId, target.id]
|
||||
)) : false;
|
||||
|
||||
const posts = await db.q(
|
||||
`SELECT posts.id, posts.feed_type, posts.body, posts.created_at, media.url AS media_url,
|
||||
(SELECT COUNT(*) FROM bleeter_likes l WHERE l.target_type='post' AND l.target_id=posts.id) AS likes,
|
||||
(SELECT COUNT(*) FROM bleeter_comments c WHERE c.post_id=posts.id AND c.self_deleted_at IS NULL AND c.hidden_at IS NULL AND c.deleted_at IS NULL) AS comments
|
||||
FROM bleeter_posts posts
|
||||
LEFT JOIN bleeter_media media ON media.id = posts.media_id
|
||||
WHERE posts.author_profile_id = ? AND posts.self_deleted_at IS NULL AND posts.hidden_at IS NULL AND posts.deleted_at IS NULL
|
||||
ORDER BY posts.created_at DESC LIMIT 50`,
|
||||
[target.id]
|
||||
);
|
||||
|
||||
res.json({
|
||||
profile: target,
|
||||
is_following: isFollowing,
|
||||
is_blocked: isBlocked,
|
||||
posts: posts.map(p => ({
|
||||
id: p.id, feed_type: p.feed_type, body: p.body || '', media_url: p.media_url,
|
||||
created_at: String(p.created_at || ''), likes: Number(p.likes) || 0, comments: Number(p.comments) || 0,
|
||||
})),
|
||||
});
|
||||
});
|
||||
|
||||
// POST /api/profiles/:id/follow {profileId}
|
||||
router.post('/profiles/:id/follow', async (req, res) => {
|
||||
const { profile } = await acting(req);
|
||||
const target = await findTargetProfile({ targetId: req.params.id });
|
||||
if (!profile || !target) return res.status(400).json({ error: 'invalid' });
|
||||
if (Number(profile.id) === Number(target.id)) return res.status(400).json({ error: 'self_follow' });
|
||||
await db.exec('INSERT IGNORE INTO bleeter_follows (follower_profile_id, followed_profile_id) VALUES (?, ?)', [profile.id, target.id]);
|
||||
res.json({ ok: true });
|
||||
});
|
||||
|
||||
// POST /api/profiles/:id/unfollow {profileId}
|
||||
router.post('/profiles/:id/unfollow', async (req, res) => {
|
||||
const { profile } = await acting(req);
|
||||
const target = await findTargetProfile({ targetId: req.params.id });
|
||||
if (!profile || !target) return res.status(400).json({ error: 'invalid' });
|
||||
await db.exec('DELETE FROM bleeter_follows WHERE follower_profile_id = ? AND followed_profile_id = ?', [profile.id, target.id]);
|
||||
res.json({ ok: true });
|
||||
});
|
||||
|
||||
// POST /api/profiles/:id/block {profileId}
|
||||
router.post('/profiles/:id/block', async (req, res) => {
|
||||
const { profile } = await acting(req);
|
||||
const target = await findTargetProfile({ targetId: req.params.id });
|
||||
if (!profile || !target) return res.status(400).json({ error: 'invalid' });
|
||||
if (Number(profile.id) === Number(target.id)) return res.status(400).json({ error: 'self_block' });
|
||||
if (!canProfileBeBlocked(target.profile_type, target.is_lifeinvader_staff)) return res.status(403).json({ error: 'cannot_block' });
|
||||
await db.exec('INSERT IGNORE INTO bleeter_blocks (blocker_profile_id, blocked_profile_id) VALUES (?, ?)', [profile.id, target.id]);
|
||||
await db.exec(
|
||||
`DELETE FROM bleeter_follows
|
||||
WHERE (follower_profile_id=? AND followed_profile_id=?) OR (follower_profile_id=? AND followed_profile_id=?)`,
|
||||
[profile.id, target.id, target.id, profile.id]
|
||||
);
|
||||
res.json({ ok: true });
|
||||
});
|
||||
|
||||
// POST /api/profiles/:id/unblock {profileId}
|
||||
router.post('/profiles/:id/unblock', async (req, res) => {
|
||||
const { profile } = await acting(req);
|
||||
const target = await findTargetProfile({ targetId: req.params.id });
|
||||
if (!profile || !target) return res.status(400).json({ error: 'invalid' });
|
||||
await db.exec('DELETE FROM bleeter_blocks WHERE blocker_profile_id = ? AND blocked_profile_id = ?', [profile.id, target.id]);
|
||||
res.json({ ok: true });
|
||||
});
|
||||
|
||||
// PATCH /api/profile {profileId, displayName, avatarUrl, bannerUrl, bio} -> aktives Profil bearbeiten
|
||||
router.patch('/profile', async (req, res) => {
|
||||
const { profile } = await acting(req);
|
||||
if (!profile) return res.status(400).json({ error: 'no_profile' });
|
||||
if (!profile.can_edit_profile) return res.status(403).json({ error: 'not_allowed' });
|
||||
|
||||
const displayName = String(req.body.displayName || '').trim().slice(0, 80);
|
||||
const avatarUrl = String(req.body.avatarUrl || '').trim().slice(0, 255);
|
||||
const bannerUrl = String(req.body.bannerUrl || '').trim().slice(0, 255);
|
||||
const bioMax = profile.profile_type === 'private' ? 200 : 500;
|
||||
const bio = String(req.body.bio || '').trim().slice(0, bioMax);
|
||||
if (!displayName) return res.status(400).json({ error: 'name_required' });
|
||||
|
||||
await db.exec(
|
||||
'UPDATE bleeter_profiles SET display_name = ?, avatar_url = ?, banner_url = ?, bio = ? WHERE id = ?',
|
||||
[displayName, avatarUrl || null, bannerUrl || null, bio, profile.id]
|
||||
);
|
||||
res.json({ ok: true });
|
||||
});
|
||||
|
||||
// POST /api/register {handle, displayName} -> privates Profil anlegen (falls noch keins)
|
||||
router.post('/register', async (req, res) => {
|
||||
const account = req.account;
|
||||
let handle = String(req.body.handle || '').trim().toLowerCase();
|
||||
let displayName = String(req.body.displayName || '').trim().slice(0, 80);
|
||||
|
||||
if (handle.length < 2 || handle.length > 32) return res.status(400).json({ error: 'invalid_handle_length' });
|
||||
if (!HANDLE_RE.test(handle)) return res.status(400).json({ error: 'invalid_handle_chars' });
|
||||
if (!displayName) displayName = handle;
|
||||
|
||||
const existingPrivate = await db.q1(
|
||||
"SELECT id FROM bleeter_profiles WHERE account_id = ? AND profile_type = 'private' LIMIT 1",
|
||||
[account.id]
|
||||
);
|
||||
if (existingPrivate) return res.status(409).json({ error: 'already_registered' });
|
||||
|
||||
const reserved = await db.q1('SELECT 1 FROM bleeter_reserved_handles WHERE handle = ? LIMIT 1', [handle]);
|
||||
if (reserved) return res.status(409).json({ error: 'reserved' });
|
||||
|
||||
const taken = await db.q1('SELECT 1 FROM bleeter_profiles WHERE handle = ? LIMIT 1', [handle]);
|
||||
if (taken) return res.status(409).json({ error: 'handle_taken' });
|
||||
|
||||
await db.insert(
|
||||
`INSERT INTO bleeter_profiles (account_id, profile_type, handle, display_name, email_contact, bio)
|
||||
VALUES (?, 'private', ?, ?, ?, '')`,
|
||||
[account.id, handle, displayName, account.mail_address]
|
||||
);
|
||||
|
||||
const profiles = await getAccessibleProfiles(account);
|
||||
res.json({ ok: true, profiles });
|
||||
});
|
||||
|
||||
module.exports = router;
|
||||
Loading…
Add table
Add a link
Reference in a new issue