diff --git a/routes/threads.js b/routes/threads.js index bf2d9b7..694795f 100644 --- a/routes/threads.js +++ b/routes/threads.js @@ -10,7 +10,7 @@ app.get("/", async (req, res) => { const user = req.user; - const threads = await ThreadModel.find({}).limit(10); + const threads = await ThreadModel.find(user?.admin ? {} : { deleted: false }).limit(10); return res.render("threads", { threads, user }); }); @@ -29,12 +29,12 @@ app.get("/:id", async (req, res) => { const thread = await ThreadModel.get(id); - if (thread) { + if (thread && !thread.deleted) { const user = req.user; const messages = await Promise.all(thread.messages.map(async id => { const message = await MessageModel.get(id) - return (user.admin || !message?.deleted) ? message : null; + return user?.admin || !message?.deleted ? message : null; })); res.render("thread", { thread, messages, user }) @@ -49,7 +49,7 @@ app.use(require("../middlewares/login")); app.post("/", rateLimit({ - windowMs: 10*60_000, max: 1, standardHeaders: true, legacyHeaders: false + windowMs: 10 * 60_000, max: 1, standardHeaders: true, legacyHeaders: false }), async (req, res) => { const { title = null, content = null } = req.body; @@ -67,5 +67,19 @@ app.post("/", rateLimit({ res.redirect('/threads/' + thread.id); }) +app.post("/:id/delete", async (req, res) => { + const thread = await ThreadModel.get(req.params.id); + if (!thread || thread.deleted) return error(res, 404, "We have not got any thread declared as this id."); + const user = req.user; + if (user.id != thread.authorID && !user.admin) + return error(res, 403, "You have not got permission for this."); + + thread.deleted = true; + await thread.save(); + + + res.status(200).redirect("/threads/"); + +}) module.exports = app; \ No newline at end of file diff --git a/routes/users.js b/routes/users.js index 254ffa7..db0b193 100644 --- a/routes/users.js +++ b/routes/users.js @@ -5,7 +5,7 @@ const error = require("../errors/error"); const { UserModel, MessageModel, ThreadModel } = require("../models"); app.get("/", async ({ user }, res) => { - const users = await UserModel.find(user.admin ? {} : { deleted: false }); + const users = await UserModel.find(user?.admin ? {} : { deleted: false }); return res.render("users", { users, user }) }); diff --git a/views/thread.ejs b/views/thread.ejs index 0c1d80c..b932d4b 100644 --- a/views/thread.ejs +++ b/views/thread.ejs @@ -11,10 +11,19 @@

<%= thread.title %>

- -

By > <%= thread.author.name %> + +

By > <%= thread.author.name %> alt=<%= thread.author.name %>>

+ + <% if (user){ %> + +
+ +
+ + <% }; %> +
<% messages.forEach(message=>{ %> <% if (message){ %>