1437 lines
68 KiB
JavaScript
1437 lines
68 KiB
JavaScript
import db from "../sql.mjs";
|
|
import f0cklib from "../routeinc/f0cklib.mjs";
|
|
import cfg from "../config.mjs";
|
|
import lib from "../lib.mjs";
|
|
import audit from "../audit.mjs";
|
|
import { promises as fs } from "fs";
|
|
import { applyWordFilter } from "../wordfilter.mjs";
|
|
import path from "path";
|
|
|
|
export default (router, tpl) => {
|
|
|
|
|
|
|
|
// Get comments for an item
|
|
router.get(/\/api\/comments\/(?<itemid>\d+)/, async (req, res) => {
|
|
const itemId = req.params.itemid;
|
|
const sort = req.url.qs?.sort || 'new'; // 'new' or 'old'
|
|
|
|
// Require login unless comments are public
|
|
if (!req.session && cfg.main.hide_comments_from_public) {
|
|
return res.reply({
|
|
headers: { 'Content-Type': 'application/json; charset=utf-8' },
|
|
body: JSON.stringify({
|
|
success: true,
|
|
comments: [],
|
|
require_login: true,
|
|
user_id: null,
|
|
is_admin: false
|
|
})
|
|
});
|
|
}
|
|
|
|
try {
|
|
// Check locked status
|
|
const item = await db`SELECT is_comments_locked FROM items WHERE id = ${itemId}`;
|
|
const is_locked = item.length > 0 ? item[0].is_comments_locked : false;
|
|
|
|
const comments = await f0cklib.getComments(itemId, sort, false);
|
|
|
|
let is_subscribed = false;
|
|
if (req.session) {
|
|
const sub = await db`SELECT 1 FROM comment_subscriptions WHERE user_id = ${req.session.id} AND item_id = ${itemId} AND is_subscribed = true`;
|
|
if (sub.length > 0) is_subscribed = true;
|
|
}
|
|
|
|
// Fill in per-user poll votes
|
|
if (req.session && cfg.websrv.enable_comment_polls) {
|
|
const pollComments = comments.filter(c => c.poll);
|
|
if (pollComments.length > 0) {
|
|
const pollIds = pollComments.map(c => c.poll.id);
|
|
try {
|
|
const votes = await db`
|
|
SELECT poll_id, option_id FROM comment_poll_votes
|
|
WHERE poll_id = ANY(${pollIds}::int[]) AND user_id = ${req.session.id}
|
|
`;
|
|
const voteMap = new Map(votes.map(v => [v.poll_id, v.option_id]));
|
|
for (const c of pollComments) {
|
|
if (c.poll) c.poll.user_vote_option_id = voteMap.get(c.poll.id) || null;
|
|
}
|
|
} catch (e) { /* graceful */ }
|
|
}
|
|
}
|
|
|
|
// Transform for frontend if needed, or send as is
|
|
return res.reply({
|
|
headers: { 'Content-Type': 'application/json; charset=utf-8' },
|
|
body: JSON.stringify({
|
|
success: true,
|
|
comments,
|
|
is_subscribed,
|
|
is_locked,
|
|
user_id: req.session ? req.session.user : null,
|
|
is_admin: req.session ? (req.session.admin || req.session.is_moderator) : false
|
|
})
|
|
})
|
|
} catch (err) {
|
|
console.error(err);
|
|
return res.reply({
|
|
code: 500,
|
|
body: JSON.stringify({ success: false, message: "Database error" })
|
|
});
|
|
}
|
|
});
|
|
|
|
// Get a single comment by ID
|
|
router.get(/\/api\/comment\/(?<id>\d+)/, async (req, res) => {
|
|
const id = req.params.id;
|
|
|
|
// Require login unless comments are public
|
|
if (!req.session && cfg.main.hide_comments_from_public) {
|
|
return res.reply({
|
|
code: 401,
|
|
headers: { 'Content-Type': 'application/json; charset=utf-8' },
|
|
body: JSON.stringify({ success: false, message: "Unauthorized" })
|
|
});
|
|
}
|
|
|
|
try {
|
|
const comment = await f0cklib.getComment(id);
|
|
if (!comment) {
|
|
return res.reply({
|
|
code: 404,
|
|
headers: { 'Content-Type': 'application/json; charset=utf-8' },
|
|
body: JSON.stringify({ success: false, message: "Comment not found" })
|
|
});
|
|
}
|
|
|
|
return res.reply({
|
|
headers: { 'Content-Type': 'application/json; charset=utf-8' },
|
|
body: JSON.stringify({ success: true, comment })
|
|
});
|
|
} catch (err) {
|
|
console.error(err);
|
|
return res.reply({
|
|
code: 500,
|
|
headers: { 'Content-Type': 'application/json; charset=utf-8' },
|
|
body: JSON.stringify({ success: false, message: "Database error" })
|
|
});
|
|
}
|
|
});
|
|
|
|
// Browse User Comments
|
|
router.get(/\/user\/(?<user>[^\/]+)\/comments/, async (req, res) => {
|
|
const user = decodeURIComponent(req.params.user);
|
|
|
|
try {
|
|
// Check if user exists and get ID + avatar
|
|
const u = await db`
|
|
SELECT "user".id, "user".user, user_options.avatar, user_options.avatar_file, user_options.username_color
|
|
FROM "user"
|
|
LEFT JOIN user_options ON "user".id = user_options.user_id
|
|
WHERE "user".user ILIKE ${user}
|
|
`;
|
|
if (!u.length) {
|
|
return res.reply({ code: 404, body: "User not found" });
|
|
}
|
|
const userId = u[0].id;
|
|
const sort = req.url.qs?.sort || 'new';
|
|
const page = +(req.url.qs?.page || 1);
|
|
const limit = 20;
|
|
const offset = (page - 1) * limit;
|
|
const isJson = req.url.qs?.json === 'true';
|
|
|
|
if (!req.session || !req.session.user) {
|
|
if (cfg.main.hide_comments_from_public) {
|
|
if (isJson) {
|
|
return res.reply({
|
|
headers: { 'Content-Type': 'application/json; charset=utf-8' },
|
|
body: JSON.stringify({ success: false, require_login: true })
|
|
});
|
|
} else {
|
|
return res.redirect('/login');
|
|
}
|
|
}
|
|
}
|
|
|
|
|
|
const globalfilter = cfg.nsfp.map(n => `tag_id = ${n}`).join(' or ');
|
|
const excludedTags = req.session ? (req.session.excluded_tags || []) : [];
|
|
/* <mode-override> */
|
|
// prioritize query mode (from AJAX) over session default
|
|
let mode = req.mode;
|
|
if (req.url.qs && req.url.qs.mode && (req.url.qs.mode === '0' || req.url.qs.mode === '1' || req.url.qs.mode === '2' || req.url.qs.mode === '3')) {
|
|
mode = parseInt(req.url.qs.mode);
|
|
}
|
|
/* </mode-override> */
|
|
|
|
// Multi-rating cookie support (same logic as other routes)
|
|
const ratingsRaw = req.cookies.ratings;
|
|
const ratingsArr = ratingsRaw ? decodeURIComponent(ratingsRaw).split(/[|,]/).filter(r => ['sfw','nsfw','nsfl','untagged'].includes(r)) : null;
|
|
const multiRatingSQL = (ratingsArr && ratingsArr.length > 0) ? lib.getMultiRatingMode(ratingsArr) : null;
|
|
|
|
// Build mode SQL — replace items.id alias with i.id used in the activity query
|
|
const modequery = (multiRatingSQL ?? lib.getMode(mode)).replace(/items\.id/g, 'i.id');
|
|
|
|
const comments = await db`
|
|
SELECT c.*, i.mime, i.id as item_id, i.slug as item_slug
|
|
FROM comments c
|
|
LEFT JOIN items i ON c.item_id = i.id
|
|
WHERE c.user_id = ${userId} AND c.is_deleted = false
|
|
AND i.active = true AND i.is_deleted = false
|
|
AND ${db.unsafe(modequery)}
|
|
${!req.session && globalfilter ? db`and not exists (select 1 from tags_assign where item_id = i.id and (${db.unsafe(globalfilter)}))` : db``}
|
|
${excludedTags.length > 0 ? db`and not exists (select 1 from tags_assign where item_id = i.id and tag_id = any(${excludedTags}::int[]))` : db``}
|
|
ORDER BY c.created_at DESC
|
|
LIMIT ${limit} OFFSET ${offset}
|
|
`;
|
|
|
|
// Process mentions for user comments page too
|
|
// Note: Since we need to modify 'comments', we do it before any map/HTML escaping
|
|
// However, f0cklib.processMentions returns a new array with modified content.
|
|
// But we actually need to do this BEFORE the existing 'processedComments' map which does HTML escaping.
|
|
// Wait, f0cklib.processMentions adds Markdown links: [@user](/user/user).
|
|
// HTML escaping later will break this: ["@user...
|
|
// So we need to ensure formatting happens appropriately.
|
|
|
|
// Actually, let's use processMentions here.
|
|
// But notice below 'processedComments' logic manually escapes HTML and handles emojis.
|
|
// If we add Markdown links now, 'escapeHtml' will destroy them.
|
|
// We should probably rely on marked.js on the client side?
|
|
// The client 'user_comments.js' uses marked.js!
|
|
// So if we inject Markdown links, they will be rendered as links by marked.js.
|
|
// BUT 'processedComments' escapes HTML.
|
|
// Ideally, we should let marked handle everything or be careful.
|
|
|
|
// Let's modify comments content in-place (or new array) before mapping
|
|
const mentionsProcessed = await f0cklib.processMentions(comments);
|
|
let processedComments = mentionsProcessed.map(c => {
|
|
return {
|
|
...c,
|
|
content: c.content
|
|
};
|
|
});
|
|
|
|
// Fetch file attachments for all fetched comments
|
|
if (processedComments.length > 0) {
|
|
const commentIds = processedComments.map(c => c.id);
|
|
try {
|
|
const files = await db`
|
|
SELECT id, comment_id, dest, mime, size, original_filename
|
|
FROM comment_files
|
|
WHERE comment_id = ANY(${commentIds}::int[])
|
|
ORDER BY id ASC
|
|
`;
|
|
const filesMap = new Map();
|
|
for (const f of files) {
|
|
if (!filesMap.has(f.comment_id)) filesMap.set(f.comment_id, []);
|
|
filesMap.get(f.comment_id).push(f);
|
|
}
|
|
for (const c of processedComments) {
|
|
c.files = filesMap.get(c.id) || [];
|
|
}
|
|
} catch (e) {
|
|
for (const c of processedComments) c.files = [];
|
|
}
|
|
|
|
// Fetch poll data for comments
|
|
if (cfg.websrv.enable_comment_polls) {
|
|
try {
|
|
const commentIds = processedComments.map(c => c.id);
|
|
const pollRows = await db`
|
|
SELECT
|
|
cp.id as poll_id,
|
|
cp.comment_id,
|
|
cp.question,
|
|
cp.expires_at,
|
|
COALESCE(cp.is_anonymous, true) as is_anonymous,
|
|
json_agg(
|
|
json_build_object(
|
|
'id', cpo.id,
|
|
'text', cpo.text,
|
|
'sort_order', cpo.sort_order,
|
|
'vote_count', COALESCE(vote_counts.cnt, 0)
|
|
) ORDER BY cpo.sort_order ASC, cpo.id ASC
|
|
) AS options,
|
|
COALESCE(SUM(vote_counts.cnt), 0)::int AS total_votes
|
|
FROM comment_polls cp
|
|
JOIN comment_poll_options cpo ON cpo.poll_id = cp.id
|
|
LEFT JOIN (
|
|
SELECT option_id, COUNT(*) AS cnt
|
|
FROM comment_poll_votes
|
|
GROUP BY option_id
|
|
) vote_counts ON vote_counts.option_id = cpo.id
|
|
WHERE cp.comment_id = ANY(${commentIds}::int[])
|
|
GROUP BY cp.id, cp.comment_id, cp.question, cp.expires_at, cp.is_anonymous
|
|
`;
|
|
// For non-anonymous polls, fetch voter names
|
|
const nonAnonIds = pollRows.filter(p => !p.is_anonymous).map(p => p.poll_id);
|
|
let votersByOption = new Map();
|
|
if (nonAnonIds.length > 0) {
|
|
const voterRows = await db`
|
|
SELECT cpv.option_id, u."user" as username, uo.avatar, uo.avatar_file
|
|
FROM comment_poll_votes cpv
|
|
JOIN public."user" u ON u.id = cpv.user_id
|
|
LEFT JOIN public.user_options uo ON uo.user_id = cpv.user_id
|
|
WHERE cpv.poll_id = ANY(${nonAnonIds}::int[])
|
|
`;
|
|
for (const v of voterRows) {
|
|
if (!votersByOption.has(v.option_id)) votersByOption.set(v.option_id, []);
|
|
votersByOption.get(v.option_id).push({ username: v.username, avatar: v.avatar, avatar_file: v.avatar_file });
|
|
}
|
|
}
|
|
const pollMap = new Map();
|
|
for (const p of pollRows) {
|
|
const options = p.is_anonymous
|
|
? p.options
|
|
: p.options.map(o => ({ ...o, voters: votersByOption.get(o.id) || [] }));
|
|
pollMap.set(p.comment_id, {
|
|
id: p.poll_id,
|
|
question: p.question,
|
|
expires_at: p.expires_at,
|
|
is_anonymous: p.is_anonymous,
|
|
options,
|
|
total_votes: parseInt(p.total_votes) || 0,
|
|
user_vote_option_id: null
|
|
});
|
|
}
|
|
// Fill in per-user poll votes if logged in
|
|
if (req.session && pollRows.length > 0) {
|
|
const pollIds = pollRows.map(p => p.poll_id);
|
|
try {
|
|
const votes = await db`
|
|
SELECT poll_id, option_id FROM comment_poll_votes
|
|
WHERE poll_id = ANY(${pollIds}::int[]) AND user_id = ${req.session.id}
|
|
`;
|
|
const voteMap = new Map(votes.map(v => [v.poll_id, v.option_id]));
|
|
for (const [comment_id, poll] of pollMap.entries()) {
|
|
poll.user_vote_option_id = voteMap.get(poll.id) || null;
|
|
}
|
|
} catch (e) { /* graceful */ }
|
|
}
|
|
for (const c of processedComments) {
|
|
c.poll = pollMap.get(c.id) || null;
|
|
}
|
|
} catch (e) {
|
|
console.error('[USER_COMMENTS] Poll fetch error:', e.message);
|
|
for (const c of processedComments) c.poll = null;
|
|
}
|
|
} else {
|
|
for (const c of processedComments) c.poll = null;
|
|
}
|
|
}
|
|
|
|
if (isJson) {
|
|
return res.reply({
|
|
headers: { 'Content-Type': 'application/json; charset=utf-8' },
|
|
body: JSON.stringify({ success: true, comments: processedComments, user: u[0] })
|
|
});
|
|
}
|
|
|
|
const data = {
|
|
user: u[0],
|
|
comments: processedComments,
|
|
hidePagination: true,
|
|
tmp: null // for header/footer
|
|
};
|
|
|
|
if (req.headers['x-requested-with'] === 'XMLHttpRequest') {
|
|
return res.reply({ body: tpl.render('comments_user-partial', data, req) });
|
|
}
|
|
|
|
return res.reply({ body: tpl.render('comments_user', data, req) });
|
|
} catch (e) {
|
|
console.error(e);
|
|
return res.reply({ code: 500, body: "Error" });
|
|
}
|
|
});
|
|
|
|
// In-memory rate limiter for comment posting.
|
|
// Tracks timestamps of recent posts per user_id in a sliding window.
|
|
// Map: userId -> number[] (unix ms timestamps)
|
|
const commentRateLimiter = new Map();
|
|
const COMMENT_RATE_LIMIT = 25; // max comments
|
|
const COMMENT_RATE_WINDOW = 60_000; // per 60 seconds
|
|
|
|
const isCommentRateLimited = (userId) => {
|
|
const now = Date.now();
|
|
const windowStart = now - COMMENT_RATE_WINDOW;
|
|
const timestamps = (commentRateLimiter.get(userId) || []).filter(t => t > windowStart);
|
|
if (timestamps.length >= COMMENT_RATE_LIMIT) return true;
|
|
timestamps.push(now);
|
|
commentRateLimiter.set(userId, timestamps);
|
|
// Prune entries for users inactive for > 5 minutes to avoid unbounded growth
|
|
if (commentRateLimiter.size > 5000) {
|
|
const pruneWindow = now - 300_000;
|
|
for (const [uid, ts] of commentRateLimiter) {
|
|
if (!ts.some(t => t > pruneWindow)) commentRateLimiter.delete(uid);
|
|
}
|
|
}
|
|
return false;
|
|
};
|
|
|
|
// Post a comment
|
|
router.post('/api/comments', async (req, res) => {
|
|
if (!req.session) return res.reply({ code: 401, body: JSON.stringify({ success: false, message: "Unauthorized" }) });
|
|
|
|
// Rate limit regular users (admins and mods are exempt)
|
|
if (!req.session.admin && !req.session.is_moderator) {
|
|
if (isCommentRateLimited(req.session.id)) {
|
|
return res.reply({ code: 429, body: JSON.stringify({ success: false, message: "You're posting too fast. Please slow down." }) });
|
|
}
|
|
}
|
|
|
|
if (cfg.main.development) console.log("DEBUG: POST /api/comments");
|
|
|
|
// Use standard framework parsing
|
|
const body = req.post || {};
|
|
const item_id = parseInt(body.item_id, 10);
|
|
const parent_id = body.parent_id ? parseInt(body.parent_id, 10) : null;
|
|
let content = body.content || '';
|
|
content = await applyWordFilter(content);
|
|
const video_time = (body.video_time !== undefined && body.video_time !== '' && !isNaN(parseFloat(body.video_time)))
|
|
? parseFloat(body.video_time)
|
|
: null;
|
|
|
|
if (cfg.main.development) console.log("DEBUG: Posting comment:", { item_id, parent_id, content: content?.substring(0, 20) });
|
|
|
|
const fileIdsRaw = body.file_ids || '';
|
|
const fileIds = fileIdsRaw ? fileIdsRaw.split(',').map(id => parseInt(id, 10)).filter(id => !isNaN(id) && id > 0) : [];
|
|
|
|
const hasPoll = body.has_poll === '1' || body.has_poll === 'true';
|
|
|
|
if ((!content || !content.trim()) && fileIds.length === 0 && !hasPoll) {
|
|
return res.reply({ body: JSON.stringify({ success: false, message: "Empty comment" }) });
|
|
}
|
|
|
|
const maxLen = cfg.main.comment_max_length;
|
|
if (maxLen !== null && maxLen !== undefined && content.length > maxLen) {
|
|
return res.reply({ code: 400, body: JSON.stringify({ success: false, message: `Comment too long (max ${maxLen} characters)` }) });
|
|
}
|
|
|
|
try {
|
|
// Check if thread is locked (admins and mods can still post)
|
|
if (!req.session.admin && !req.session.is_moderator) {
|
|
const lockCheck = await db`SELECT COALESCE(is_comments_locked, false) as is_locked FROM items WHERE id = ${item_id}`;
|
|
if (lockCheck.length > 0 && lockCheck[0].is_locked) {
|
|
return res.reply({ code: 403, body: JSON.stringify({ success: false, message: "This thread is locked" }) });
|
|
}
|
|
}
|
|
|
|
const insertData = {
|
|
item_id,
|
|
user_id: req.session.id,
|
|
parent_id: parent_id || null,
|
|
content: content || ''
|
|
};
|
|
if (video_time !== null) insertData.video_time = video_time;
|
|
|
|
const newComment = await db`
|
|
INSERT INTO comments ${db(insertData)}
|
|
RETURNING id, created_at, video_time
|
|
`;
|
|
|
|
const commentId = parseInt(newComment[0].id, 10);
|
|
|
|
// Link uploaded files to this comment (if any)
|
|
let activityFiles = [];
|
|
const fileIdsRaw = body.file_ids || '';
|
|
if (fileIdsRaw) {
|
|
const fileIds = fileIdsRaw.split(',').map(id => parseInt(id, 10)).filter(id => !isNaN(id) && id > 0);
|
|
if (fileIds.length > 0) {
|
|
try {
|
|
// Only link files that belong to this user and aren't already linked
|
|
await db`
|
|
UPDATE comment_files
|
|
SET comment_id = ${commentId}
|
|
WHERE id = ANY(${fileIds}::int[])
|
|
AND user_id = ${req.session.id}
|
|
AND comment_id IS NULL
|
|
`;
|
|
// Fetch the linked files to send with live notification and post response
|
|
activityFiles = await db`
|
|
SELECT id, comment_id, dest, mime, size, original_filename
|
|
FROM comment_files
|
|
WHERE comment_id = ${commentId}
|
|
ORDER BY id ASC
|
|
`;
|
|
} catch (err) {
|
|
console.error('[COMMENTS] Failed to link files to comment:', err);
|
|
}
|
|
}
|
|
}
|
|
|
|
// Notify Subscribers (excluding the author)
|
|
// 1. Get subscribers (active only)
|
|
const subscribers = await db`SELECT user_id FROM comment_subscriptions WHERE item_id = ${item_id} AND is_subscribed = true`;
|
|
|
|
// Mentions Logic: Parse content for @username and [@User Name] (space-containing names).
|
|
// Strip spoiler wrappers first so mentions inside [spoiler]...[/spoiler] are visible.
|
|
const strippedContent = content.replace(/\[spoiler\]/gi, '').replace(/\[\/spoiler\]/gi, '');
|
|
const mentionRegex = /(?<!\[)@([a-zA-Z0-9_\-\.]+)|\[@([^\]]+)\]/g;
|
|
const matches = [...strippedContent.matchAll(mentionRegex)];
|
|
const mentionedNames = [...new Set(matches.map(m => (m[1] || m[2]).trim()))];
|
|
const lowerNames = mentionedNames.map(n => n.toLowerCase());
|
|
|
|
let mentionedUsers = [];
|
|
if (lowerNames.length > 0) {
|
|
// Fetch IDs via login column (lowercase)
|
|
mentionedUsers = await db`SELECT id, user FROM "user" WHERE login IN ${db(lowerNames)}`;
|
|
}
|
|
|
|
// 2. Get parent author
|
|
let parentAuthor = [];
|
|
if (parent_id) {
|
|
parentAuthor = await db`SELECT user_id FROM comments WHERE id = ${parent_id}`;
|
|
}
|
|
|
|
// 3. Prepare notifications with priority: Mention > Reply > Subscription
|
|
// Use a Map to ensure one notification per user
|
|
const notificationsMap = new Map(); // UserId -> { type, ... }
|
|
|
|
// A. Mentions
|
|
mentionedUsers.forEach(u => {
|
|
if (u.id !== req.session.id) {
|
|
notificationsMap.set(u.id, 'mention');
|
|
}
|
|
});
|
|
|
|
// B. Reply (Parent Author)
|
|
if (parentAuthor.length > 0) {
|
|
const pid = parentAuthor[0].user_id;
|
|
// Only if not already mentioned
|
|
if (pid !== req.session.id && !notificationsMap.has(pid)) {
|
|
notificationsMap.set(pid, 'comment_reply');
|
|
}
|
|
}
|
|
|
|
// C. Subscribers
|
|
const parentUserId = parentAuthor.length > 0 ? parentAuthor[0].user_id : -1;
|
|
|
|
// Get uploader ID to distinguish notification type
|
|
const itemInfo = await db`
|
|
SELECT u.id as uploader_id
|
|
FROM items i
|
|
JOIN "user" u ON (i.username ILIKE u.login OR i.username ILIKE u.user)
|
|
WHERE i.id = ${item_id}
|
|
LIMIT 1
|
|
`;
|
|
const uploaderId = itemInfo.length > 0 ? itemInfo[0].uploader_id : null;
|
|
|
|
subscribers.forEach(s => {
|
|
// If not self, and not already notified (as mention or reply)
|
|
if (s.user_id !== req.session.id && !notificationsMap.has(s.user_id)) {
|
|
// Use specialized type for uploader
|
|
const type = (uploaderId && s.user_id === uploaderId) ? 'upload_comment' : 'subscription';
|
|
notificationsMap.set(s.user_id, type);
|
|
}
|
|
});
|
|
|
|
// 4. Batch insert non-bundleable, handle bundleable separately
|
|
const bundleable = [];
|
|
const nonBundleable = [];
|
|
|
|
for (const [uid, type] of notificationsMap.entries()) {
|
|
const notif = {
|
|
user_id: uid,
|
|
type: type,
|
|
item_id: item_id,
|
|
reference_id: commentId
|
|
};
|
|
if (type === 'upload_comment') {
|
|
bundleable.push(notif);
|
|
} else {
|
|
nonBundleable.push(notif);
|
|
}
|
|
}
|
|
|
|
if (nonBundleable.length > 0) {
|
|
await db`INSERT INTO notifications ${db(nonBundleable)}`;
|
|
}
|
|
|
|
for (const n of bundleable) {
|
|
// Try to update existing unread notification for this item/user/type
|
|
const updated = await db`
|
|
UPDATE notifications
|
|
SET created_at = NOW(), reference_id = ${n.reference_id}
|
|
WHERE user_id = ${n.user_id}
|
|
AND item_id = ${n.item_id}
|
|
AND type = 'upload_comment'
|
|
AND is_read = false
|
|
RETURNING id
|
|
`;
|
|
|
|
if (updated.length === 0) {
|
|
await db`INSERT INTO notifications ${db(n)}`;
|
|
}
|
|
}
|
|
|
|
// Notify for live updates
|
|
// Fetch the trigger-updated xd_score and the item rating tag from the DB (trigger runs synchronously before we get here)
|
|
const itemQuery = await db`
|
|
SELECT
|
|
i.slug,
|
|
i.xd_score,
|
|
(SELECT ta.tag_id FROM tags_assign ta
|
|
WHERE ta.item_id = i.id AND ta.tag_id = ANY(${[1, 2, cfg.nsfl_tag_id || 3]}::int[])
|
|
ORDER BY ta.tag_id LIMIT 1) AS rating_tag_id
|
|
FROM items i WHERE i.id = ${item_id}
|
|
`;
|
|
const xdRow = itemQuery[0];
|
|
const ratingTagId = itemQuery[0]?.rating_tag_id;
|
|
let ratingLabel = '?';
|
|
let ratingClass = 'untagged';
|
|
if (ratingTagId == 1) { ratingLabel = 'SFW'; ratingClass = 'sfw'; }
|
|
else if (ratingTagId == 2) { ratingLabel = 'NSFW'; ratingClass = 'nsfw'; }
|
|
else if (ratingTagId == (cfg.nsfl_tag_id || 3)) { ratingLabel = 'NSFL'; ratingClass = 'nsfl'; }
|
|
|
|
// Truncate body to 500 chars: PostgreSQL NOTIFY has an 8000-byte hard limit.
|
|
// Large comments would silently drop the notification. The client fetches
|
|
// the full content via _silentSync; the NOTIFY only needs to trigger the update.
|
|
const notifyBody = content.length > 500 ? content.substring(0, 500) + '…' : content;
|
|
const livePayload = {
|
|
type: 'comment',
|
|
id: commentId,
|
|
item_id: item_id,
|
|
item_slug: itemQuery[0]?.slug || null,
|
|
parent_id: parent_id || null,
|
|
body: notifyBody,
|
|
username: req.session.user,
|
|
user_id: req.session.id,
|
|
avatar: req.session.avatar,
|
|
avatar_file: req.session.avatar_file,
|
|
created_at: new Date().toISOString(),
|
|
username_color: req.session.username_color,
|
|
display_name: req.session.display_name || null,
|
|
xd_score: xdRow?.xd_score ?? null,
|
|
video_time: newComment[0]?.video_time ?? null,
|
|
files: activityFiles
|
|
};
|
|
|
|
// 1. Thread live update
|
|
db.notify('comments', JSON.stringify(livePayload));
|
|
|
|
// 2. Sidebar activity update
|
|
// Compute is_long using the full content (not the truncated notifyBody) so the
|
|
// sidebar renders the correct clamped state immediately on first paint.
|
|
const activityIsLong = content.length > 120
|
|
|| content.split('\n').length > 2
|
|
|| activityFiles.length > 0
|
|
|| /\[(video|audio|youtube|img)\]|!\[|https?:\/\//i.test(content);
|
|
db.notify('activity', JSON.stringify({
|
|
user_id: req.session.id,
|
|
item_id: item_id,
|
|
type: 'comment',
|
|
body: notifyBody,
|
|
id: commentId,
|
|
item_rating_class: ratingClass,
|
|
item_rating_label: ratingLabel,
|
|
avatar: req.session.avatar,
|
|
avatar_file: req.session.avatar_file,
|
|
username: req.session.user,
|
|
username_color: req.session.username_color,
|
|
display_name: req.session.display_name || null,
|
|
files: activityFiles,
|
|
is_long: activityIsLong
|
|
}));
|
|
|
|
// Automatically subscribe user to the thread
|
|
const subResult = await db`
|
|
INSERT INTO comment_subscriptions (user_id, item_id)
|
|
VALUES (${req.session.id}, ${item_id})
|
|
ON CONFLICT (user_id, item_id) DO NOTHING
|
|
RETURNING 1
|
|
`;
|
|
const is_new_subscription = subResult.length > 0;
|
|
|
|
return res.reply({
|
|
headers: { 'Content-Type': 'application/json; charset=utf-8' },
|
|
body: JSON.stringify({
|
|
success: true,
|
|
comment: {
|
|
...newComment[0],
|
|
content,
|
|
files: activityFiles
|
|
},
|
|
xd_score: xdRow?.xd_score ?? null,
|
|
is_new_subscription
|
|
})
|
|
});
|
|
} catch (err) {
|
|
console.error(err);
|
|
return res.reply({
|
|
code: 500,
|
|
body: JSON.stringify({ success: false, message: "Database error" })
|
|
});
|
|
}
|
|
});
|
|
|
|
// Subscribe toggle
|
|
router.post(/\/api\/subscribe\/(?<itemid>\d+)/, async (req, res) => {
|
|
if (!req.session) return res.reply({ code: 401, body: JSON.stringify({ success: false }) });
|
|
const itemId = req.params.itemid;
|
|
|
|
try {
|
|
const existing = await db`
|
|
SELECT is_subscribed FROM comment_subscriptions
|
|
WHERE user_id = ${req.session.id} AND item_id = ${itemId}
|
|
`;
|
|
|
|
let subscribed = false;
|
|
if (existing.length > 0) {
|
|
subscribed = !existing[0].is_subscribed;
|
|
await db`UPDATE comment_subscriptions SET is_subscribed = ${subscribed} WHERE user_id = ${req.session.id} AND item_id = ${itemId}`;
|
|
} else {
|
|
await db`INSERT INTO comment_subscriptions (user_id, item_id, is_subscribed) VALUES (${req.session.id}, ${itemId}, true)`;
|
|
subscribed = true;
|
|
}
|
|
|
|
return res.reply({
|
|
headers: { 'Content-Type': 'application/json; charset=utf-8' },
|
|
body: JSON.stringify({ success: true, subscribed })
|
|
});
|
|
} catch (e) {
|
|
return res.reply({ code: 500, body: JSON.stringify({ success: false }) });
|
|
}
|
|
});
|
|
|
|
// Delete comment
|
|
router.post(/\/api\/comments\/(?<id>\d+)\/delete/, async (req, res) => {
|
|
if (!req.session) return res.reply({ code: 401, body: JSON.stringify({ success: false }) });
|
|
const commentId = req.params.id;
|
|
if (cfg.main.development) console.log(`[DEBUG] Attempting to delete comment ${commentId} by user ${req.session.id} (mod: ${req.session.is_moderator})`);
|
|
|
|
try {
|
|
const comment = await db`SELECT content, item_id, user_id FROM comments WHERE id = ${commentId}`;
|
|
if (!comment.length) return res.reply({ code: 404, body: JSON.stringify({ success: false, message: "Not found" }) });
|
|
|
|
const { getAllowCommentDeletion } = await import("../settings.mjs");
|
|
const canDeleteOwn = getAllowCommentDeletion();
|
|
const isOwner = comment[0].user_id === req.session.id;
|
|
|
|
if (!req.session.admin && !req.session.is_moderator) {
|
|
if (!canDeleteOwn || !isOwner) {
|
|
return res.reply({ code: 403, body: JSON.stringify({ success: false, message: "Forbidden" }) });
|
|
}
|
|
}
|
|
|
|
// Log all deletions in audit log
|
|
const reason = (req.post && req.post.reason) ? req.post.reason : (req.url.qs?.reason || 'No reason provided');
|
|
await audit.log(req.session.id, 'delete_comment', 'comment', commentId, {
|
|
item_id: comment[0].item_id,
|
|
reason: reason,
|
|
old_content: comment[0].content
|
|
});
|
|
|
|
// Handle attachments cleanup
|
|
const files = await db`SELECT id, dest, checksum FROM comment_files WHERE comment_id = ${commentId}`;
|
|
for (const f of files) {
|
|
const otherRefs = await db`SELECT id FROM comment_files WHERE checksum = ${f.checksum} AND id != ${f.id}`;
|
|
const textRefs = await db`SELECT id FROM comments WHERE content LIKE ${'%' + f.dest + '%'} AND id != ${commentId}`;
|
|
|
|
const hasRefs = otherRefs.length > 0 || textRefs.length > 0;
|
|
|
|
const filePath = path.join(cfg.paths.c, f.dest);
|
|
const thumbPath = path.join(cfg.paths.t, `cf_${f.dest.split('.')[0]}.webp`);
|
|
|
|
if (!hasRefs) {
|
|
// Safe to delete from disk (last reference)
|
|
await fs.unlink(filePath).catch(() => {});
|
|
await fs.unlink(thumbPath).catch(() => {});
|
|
} else {
|
|
// There are other references. Only delete if it's a symlink AND not referenced by text!
|
|
try {
|
|
const stats = await fs.lstat(filePath);
|
|
if (stats.isSymbolicLink() && textRefs.length === 0) {
|
|
await fs.unlink(filePath).catch(() => {});
|
|
await fs.unlink(thumbPath).catch(() => {});
|
|
}
|
|
} catch (e) {
|
|
console.error(`[DELETE_COMMENT] Failed to check stats for ${f.dest}:`, e.message);
|
|
}
|
|
}
|
|
// Delete record from DB
|
|
await db`DELETE FROM comment_files WHERE id = ${f.id}`;
|
|
}
|
|
|
|
await db`UPDATE comments SET is_deleted = true, content = '[deleted]' WHERE id = ${commentId}`;
|
|
|
|
// Notify for live update
|
|
db.notify('comments', JSON.stringify({
|
|
type: 'delete',
|
|
item_id: comment[0].item_id,
|
|
comment_id: commentId
|
|
}));
|
|
|
|
return res.reply({
|
|
headers: { 'Content-Type': 'application/json; charset=utf-8' },
|
|
body: JSON.stringify({ success: true })
|
|
});
|
|
} catch (e) {
|
|
return res.reply({ code: 500, body: JSON.stringify({ success: false }) });
|
|
}
|
|
});
|
|
|
|
// Delete comment attachment (admin/mod only)
|
|
router.post('/api/comments/attachment/delete', async (req, res) => {
|
|
if (!req.session) return res.reply({ code: 401, body: JSON.stringify({ success: false }) });
|
|
if (!req.session.admin && !req.session.is_moderator) return res.reply({ code: 403, body: JSON.stringify({ success: false, message: "Forbidden" }) });
|
|
|
|
const body = req.post || {};
|
|
const filename = body.filename;
|
|
|
|
if (!filename) {
|
|
return res.reply({ body: JSON.stringify({ success: false, message: "Missing filename" }) });
|
|
}
|
|
|
|
try {
|
|
const cleanFilename = filename.split('#')[0];
|
|
const file = await db`SELECT id, comment_id, dest FROM comment_files WHERE dest = ${cleanFilename}`;
|
|
if (!file.length) return res.reply({ code: 404, body: JSON.stringify({ success: false, message: "Attachment not found" }) });
|
|
|
|
let commentId = file[0].comment_id;
|
|
let comment;
|
|
|
|
if (!commentId) {
|
|
// Try to find the comment by content search if not linked
|
|
const commentsFound = await db`SELECT id, content, item_id FROM comments WHERE content LIKE ${'%' + cleanFilename + '%'}`;
|
|
if (commentsFound.length > 0) {
|
|
commentId = commentsFound[0].id;
|
|
comment = commentsFound;
|
|
}
|
|
} else {
|
|
comment = await db`SELECT id, content, item_id FROM comments WHERE id = ${commentId}`;
|
|
}
|
|
|
|
if (!commentId || !comment.length) {
|
|
// File uploaded but not linked and not found in any comment content
|
|
await db`DELETE FROM comment_files WHERE id = ${file[0].id}`;
|
|
const filePath = path.join(cfg.paths.c, file[0].dest);
|
|
await fs.unlink(filePath).catch(() => {});
|
|
return res.reply({ body: JSON.stringify({ success: true, message: "Orphaned attachment deleted" }) });
|
|
}
|
|
|
|
const escapedFilename = cleanFilename.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
|
|
|
|
// Find ALL comments containing this filename and update them
|
|
const commentsToUpdate = await db`SELECT id, content FROM comments WHERE content LIKE ${'%' + cleanFilename + '%'}`;
|
|
|
|
let finalContent = comment[0].content;
|
|
for (const c of commentsToUpdate) {
|
|
const originalContent = c.content;
|
|
const domainRegex = `(?:https?:\\/\\/[^\\/\\s]+)?`;
|
|
const updatedContent = originalContent
|
|
.replace(new RegExp(`!?\\[[^\\]]*\\]\\(${domainRegex}/c/${escapedFilename}(?:#gif)?\\)`, 'g'), '[attachment removed]')
|
|
.replace(new RegExp(`${domainRegex}/c/${escapedFilename}(?:#gif)?`, 'g'), '[attachment removed]');
|
|
|
|
if (updatedContent !== originalContent) {
|
|
await db`UPDATE comments SET content = ${updatedContent}, updated_at = NOW() WHERE id = ${c.id}`;
|
|
|
|
if (c.id === commentId) {
|
|
finalContent = updatedContent;
|
|
}
|
|
|
|
// Notify for live update for each updated comment
|
|
db.notify('comments', JSON.stringify({
|
|
type: 'edit',
|
|
comment_id: c.id,
|
|
content: updatedContent
|
|
}));
|
|
}
|
|
}
|
|
|
|
// Delete file record
|
|
await db`DELETE FROM comment_files WHERE id = ${file[0].id}`;
|
|
|
|
// Delete file from disk
|
|
const filePath = path.join(cfg.paths.c, file[0].dest);
|
|
await fs.unlink(filePath).catch(() => {});
|
|
|
|
// Also delete thumbnail if exists
|
|
const thumbPath = path.join(cfg.paths.t, `cf_${filename.split('.')[0]}.webp`);
|
|
await fs.unlink(thumbPath).catch(() => {});
|
|
|
|
// Log in audit log
|
|
await audit.log(req.session.id, 'delete_attachment', 'comment', commentId, {
|
|
filename: filename,
|
|
old_content: comment[0].content,
|
|
new_content: finalContent
|
|
});
|
|
|
|
// Notify for live update
|
|
db.notify('comments', JSON.stringify({
|
|
type: 'edit',
|
|
item_id: comment[0].item_id,
|
|
comment_id: commentId,
|
|
content: finalContent
|
|
}));
|
|
|
|
return res.reply({
|
|
headers: { 'Content-Type': 'application/json; charset=utf-8' },
|
|
body: JSON.stringify({ success: true })
|
|
});
|
|
} catch (e) {
|
|
console.error(e);
|
|
return res.reply({ code: 500, body: JSON.stringify({ success: false }) });
|
|
}
|
|
});
|
|
|
|
// Edit comment (admin/mod only)
|
|
router.post(/\/api\/comments\/(?<id>\d+)\/edit/, async (req, res) => {
|
|
if (!req.session) return res.reply({ code: 401, body: JSON.stringify({ success: false }) });
|
|
if (!req.session.admin && !req.session.is_moderator) return res.reply({ code: 403, body: JSON.stringify({ success: false, message: "Forbidden" }) });
|
|
|
|
const commentId = req.params.id;
|
|
const body = req.post || {};
|
|
let content = body.content;
|
|
content = await applyWordFilter(content);
|
|
|
|
if (!content || !content.trim()) {
|
|
return res.reply({ body: JSON.stringify({ success: false, message: "Empty content" }) });
|
|
}
|
|
|
|
try {
|
|
const comment = await db`SELECT id, user_id, item_id, content FROM comments WHERE id = ${commentId}`;
|
|
if (!comment.length) return res.reply({ code: 404, body: JSON.stringify({ success: false, message: "Not found" }) });
|
|
|
|
const oldContent = comment[0].content;
|
|
|
|
await audit.log(req.session.id, 'edit_comment', 'comment', commentId, {
|
|
item_id: comment[0].item_id,
|
|
old_content: oldContent.substring(0, 2000),
|
|
new_content: content.substring(0, 2000)
|
|
});
|
|
|
|
await db`UPDATE comments SET content = ${content}, updated_at = NOW() WHERE id = ${commentId}`;
|
|
|
|
// Notify for live update
|
|
db.notify('comments', JSON.stringify({
|
|
type: 'edit',
|
|
item_id: comment[0].item_id,
|
|
comment_id: commentId,
|
|
content: content
|
|
}));
|
|
|
|
return res.reply({
|
|
headers: { 'Content-Type': 'application/json; charset=utf-8' },
|
|
body: JSON.stringify({ success: true })
|
|
});
|
|
} catch (e) {
|
|
console.error(e);
|
|
return res.reply({ code: 500, body: JSON.stringify({ success: false }) });
|
|
}
|
|
});
|
|
// Toggle pin comment (admin/mod only)
|
|
router.post(/\/api\/comments\/(?<id>\d+)\/pin/, async (req, res) => {
|
|
if (!req.session) return res.reply({ code: 401, body: JSON.stringify({ success: false }) });
|
|
if (!req.session.admin && !req.session.is_moderator) return res.reply({ code: 403, body: JSON.stringify({ success: false, message: "Forbidden" }) });
|
|
|
|
const commentId = req.params.id;
|
|
|
|
try {
|
|
const comment = await db`SELECT id, COALESCE(is_pinned, false) as is_pinned, item_id FROM comments WHERE id = ${commentId}`;
|
|
if (!comment.length) return res.reply({ code: 404, body: JSON.stringify({ success: false, message: "Not found" }) });
|
|
|
|
const newPinned = !comment[0].is_pinned;
|
|
await db`UPDATE comments SET is_pinned = ${newPinned} WHERE id = ${commentId}`;
|
|
|
|
await audit.log(req.session.id, 'pin_comment', 'comment', commentId, { item_id: comment[0].item_id, is_pinned: newPinned });
|
|
|
|
return res.reply({
|
|
headers: { 'Content-Type': 'application/json; charset=utf-8' },
|
|
body: JSON.stringify({ success: true, is_pinned: newPinned })
|
|
});
|
|
} catch (e) {
|
|
console.error(e);
|
|
return res.reply({ code: 500, body: JSON.stringify({ success: false }) });
|
|
}
|
|
});
|
|
// Toggle lock thread (admin/mod only)
|
|
router.post(/\/api\/comments\/(?<itemid>\d+)\/lock/, async (req, res) => {
|
|
if (!req.session) return res.reply({ code: 401, body: JSON.stringify({ success: false }) });
|
|
if (!req.session.admin && !req.session.is_moderator) return res.reply({ code: 403, body: JSON.stringify({ success: false, message: "Forbidden" }) });
|
|
|
|
const itemId = req.params.itemid;
|
|
|
|
try {
|
|
const item = await db`SELECT id, COALESCE(is_comments_locked, false) as is_locked FROM items WHERE id = ${itemId}`;
|
|
if (!item.length) return res.reply({ code: 404, body: JSON.stringify({ success: false, message: "Not found" }) });
|
|
|
|
const newLocked = !item[0].is_locked;
|
|
await db`UPDATE items SET is_comments_locked = ${newLocked} WHERE id = ${itemId}`;
|
|
|
|
await audit.log(req.session.id, newLocked ? 'lock_thread' : 'unlock_thread', 'item', itemId);
|
|
|
|
return res.reply({
|
|
headers: { 'Content-Type': 'application/json; charset=utf-8' },
|
|
body: JSON.stringify({ success: true, is_locked: newLocked })
|
|
});
|
|
} catch (e) {
|
|
console.error(e);
|
|
return res.reply({ code: 500, body: JSON.stringify({ success: false }) });
|
|
}
|
|
});
|
|
|
|
// Recent Activity Page
|
|
router.get(/\/activity\/?/, async (req, res) => {
|
|
try {
|
|
const page = +(req.url.qs?.page || 1);
|
|
const limit = Math.min(+(req.url.qs?.limit || 50), 50);
|
|
// Support explicit offset (used by sidebar infinite-scroll after a non-standard initial limit)
|
|
const offset = req.url.qs?.offset !== undefined
|
|
? Math.max(0, +(req.url.qs.offset))
|
|
: (page - 1) * limit;
|
|
|
|
/* <mode-override> */
|
|
// prioritize query mode (from AJAX) over session default
|
|
let mode = req.mode;
|
|
if (req.url.qs && req.url.qs.mode && (req.url.qs.mode === '0' || req.url.qs.mode === '1' || req.url.qs.mode === '2' || req.url.qs.mode === '3')) {
|
|
mode = parseInt(req.url.qs.mode);
|
|
}
|
|
/* </mode-override> */
|
|
|
|
// Multi-rating cookie support (same logic as other routes)
|
|
const ratingsRaw = req.cookies.ratings;
|
|
const ratingsArr = ratingsRaw ? decodeURIComponent(ratingsRaw).split(/[|,]/).filter(r => ['sfw','nsfw','nsfl','untagged'].includes(r)) : null;
|
|
const multiRatingSQL = (ratingsArr && ratingsArr.length > 0) ? lib.getMultiRatingMode(ratingsArr) : null;
|
|
|
|
// Build mode SQL — replace items.id alias with i.id used in the activity query
|
|
const modequery = (multiRatingSQL ?? lib.getMode(mode)).replace(/items\.id/g, 'i.id');
|
|
const globalfilter = cfg.nsfp.map(n => `tag_id = ${n}`).join(' or ');
|
|
const excludedTags = req.session ? (req.session.excluded_tags || []) : [];
|
|
|
|
const comments = await db`
|
|
SELECT
|
|
c.*,
|
|
i.mime,
|
|
i.id as item_id,
|
|
i.slug as item_slug,
|
|
i.dest as item_dest,
|
|
(SELECT ta.tag_id FROM tags_assign ta
|
|
WHERE ta.item_id = i.id AND ta.tag_id = ANY(${[1, 2, cfg.nsfl_tag_id || 3]}::int[])
|
|
ORDER BY ta.tag_id LIMIT 1) AS rating_tag_id,
|
|
u.user as username,
|
|
uo.avatar,
|
|
uo.avatar_file,
|
|
uo.username_color,
|
|
uo.display_name
|
|
FROM comments c
|
|
LEFT JOIN items i ON c.item_id = i.id
|
|
LEFT JOIN "user" u ON c.user_id = u.id
|
|
LEFT JOIN user_options uo ON u.id = uo.user_id
|
|
WHERE c.is_deleted = false
|
|
AND i.active = true
|
|
AND i.is_deleted = false
|
|
AND ${db.unsafe(modequery)}
|
|
${!req.session && globalfilter ? db`and not exists (select 1 from tags_assign where item_id = i.id and (${db.unsafe(globalfilter)}))` : db``}
|
|
${excludedTags.length > 0 ? db`and not exists (select 1 from tags_assign where item_id = i.id and tag_id = any(${excludedTags}::int[]))` : db``}
|
|
|
|
ORDER BY c.created_at DESC
|
|
LIMIT ${limit} OFFSET ${offset}
|
|
`;
|
|
|
|
// Fetch comment file attachments
|
|
const filesMap = new Map();
|
|
if (comments.length > 0) {
|
|
const commentIds = comments.map(c => c.id);
|
|
try {
|
|
const files = await db`
|
|
SELECT id, comment_id, dest, mime, size, original_filename
|
|
FROM comment_files
|
|
WHERE comment_id = ANY(${commentIds}::int[])
|
|
ORDER BY id ASC
|
|
`;
|
|
for (const f of files) {
|
|
if (!filesMap.has(f.comment_id)) filesMap.set(f.comment_id, []);
|
|
filesMap.get(f.comment_id).push(f);
|
|
}
|
|
} catch (e) {
|
|
console.error('[ACTIVITY] Failed to fetch comment files:', e);
|
|
}
|
|
}
|
|
|
|
// Fetch poll data for these comments
|
|
const pollMap = new Map();
|
|
if (comments.length > 0 && cfg.websrv.enable_comment_polls) {
|
|
try {
|
|
const commentIds = comments.map(c => c.id);
|
|
const pollRows = await db`
|
|
SELECT
|
|
cp.id as poll_id,
|
|
cp.comment_id,
|
|
cp.question,
|
|
cp.expires_at,
|
|
COALESCE(cp.is_anonymous, true) as is_anonymous,
|
|
json_agg(
|
|
json_build_object(
|
|
'id', cpo.id,
|
|
'text', cpo.text,
|
|
'sort_order', cpo.sort_order,
|
|
'vote_count', COALESCE(vc.cnt, 0)
|
|
) ORDER BY cpo.sort_order ASC, cpo.id ASC
|
|
) AS options,
|
|
COALESCE(SUM(vc.cnt), 0)::int AS total_votes
|
|
FROM comment_polls cp
|
|
JOIN comment_poll_options cpo ON cpo.poll_id = cp.id
|
|
LEFT JOIN (SELECT option_id, COUNT(*) AS cnt FROM comment_poll_votes GROUP BY option_id) vc ON vc.option_id = cpo.id
|
|
WHERE cp.comment_id = ANY(${commentIds}::int[])
|
|
GROUP BY cp.id, cp.comment_id, cp.question, cp.expires_at, cp.is_anonymous
|
|
`;
|
|
for (const p of pollRows) {
|
|
pollMap.set(p.comment_id, {
|
|
id: p.poll_id,
|
|
question: p.question,
|
|
expires_at: p.expires_at,
|
|
is_anonymous: p.is_anonymous,
|
|
options: p.options,
|
|
total_votes: parseInt(p.total_votes) || 0,
|
|
user_vote_option_id: null
|
|
});
|
|
}
|
|
} catch (e) {
|
|
console.error('[ACTIVITY] Failed to fetch polls:', e.message);
|
|
}
|
|
}
|
|
|
|
const processedComments = comments.map(c => {
|
|
let ratingLabel = '?';
|
|
let ratingClass = 'untagged';
|
|
if (c.rating_tag_id == 1) { ratingLabel = 'SFW'; ratingClass = 'sfw'; }
|
|
else if (c.rating_tag_id == 2) { ratingLabel = 'NSFW'; ratingClass = 'nsfw'; }
|
|
else if (c.rating_tag_id == (cfg.nsfl_tag_id || 3)) { ratingLabel = 'NSFL'; ratingClass = 'nsfl'; }
|
|
|
|
const commentContent = (c.content || '').trim();
|
|
const commentFiles = filesMap.get(c.id) || [];
|
|
// Compute overflow hint: true if content is likely taller than the 80px clamp.
|
|
// ~120 chars ≈ 2-3 wrapped lines in the sidebar; any newlines > 2 or file
|
|
// attachments (images/video) will also push height above the limit.
|
|
const isLong = commentContent.length > 120
|
|
|| commentContent.split('\n').length > 2
|
|
|| commentFiles.length > 0
|
|
|| /\[(video|audio|youtube|img)\]|!\[|https?:\/\//i.test(commentContent);
|
|
|
|
return {
|
|
...c,
|
|
content: commentContent,
|
|
username_color: c.username_color,
|
|
item_rating_class: ratingClass,
|
|
item_rating_label: ratingLabel,
|
|
files: commentFiles,
|
|
poll: pollMap.get(c.id) || null,
|
|
is_long: isLong
|
|
// created_at stays as the raw ISO timestamp so the frontend f0ckTimeAgo can localize it
|
|
};
|
|
});
|
|
|
|
if (req.url.qs?.json === 'true' || req.headers['x-requested-with'] === 'XMLHttpRequest') {
|
|
return res.reply({
|
|
headers: {
|
|
'Content-Type': 'application/json; charset=utf-8',
|
|
'Cache-Control': 'no-store, no-cache, must-revalidate, proxy-revalidate',
|
|
'Pragma': 'no-cache',
|
|
'Expires': '0'
|
|
},
|
|
body: JSON.stringify({
|
|
success: true,
|
|
comments: processedComments,
|
|
page,
|
|
hasMore: processedComments.length === limit
|
|
})
|
|
});
|
|
}
|
|
|
|
// Standalone page no longer exists
|
|
return res.reply({ code: 404, body: "Page not found" });
|
|
} catch (e) {
|
|
console.error(e);
|
|
return res.reply({ code: 500, body: "Error loading activity data" });
|
|
}
|
|
});
|
|
|
|
// Subscribe to all own uploads
|
|
router.post('/api/v2/user/subscribe-all-uploads', async (req, res) => {
|
|
if (!req.session) return res.reply({ code: 401, body: JSON.stringify({ success: false, message: "Unauthorized" }) });
|
|
|
|
try {
|
|
const result = await db`
|
|
INSERT INTO comment_subscriptions (user_id, item_id)
|
|
SELECT ${req.session.id}, i.id
|
|
FROM items i
|
|
WHERE i.username ILIKE ${req.session.login} OR i.username ILIKE ${req.session.user}
|
|
ON CONFLICT DO NOTHING
|
|
`;
|
|
|
|
res.reply({
|
|
headers: { 'Content-Type': 'application/json' },
|
|
body: JSON.stringify({
|
|
success: true,
|
|
message: `Successfully subscribed to your uploads`
|
|
})
|
|
});
|
|
} catch (err) {
|
|
console.error('[API] Failed to subscribe to all uploads:', err);
|
|
res.reply({
|
|
code: 500,
|
|
headers: { 'Content-Type': 'application/json' },
|
|
body: JSON.stringify({ success: false, message: "Internal server error" })
|
|
});
|
|
}
|
|
});
|
|
|
|
// ──────────────────────────────────────────────────────────────────────────
|
|
// Poll creation — called after a comment is inserted (internal helper)
|
|
// ──────────────────────────────────────────────────────────────────────────
|
|
const createPollForComment = async (commentId, pollData) => {
|
|
if (!cfg.websrv.enable_comment_polls) return null;
|
|
const { question, options, is_anonymous } = pollData || {};
|
|
if (!question || !question.trim()) return null;
|
|
if (!Array.isArray(options) || options.length < 2) return null;
|
|
const cleanOptions = options.map(o => (typeof o === 'string' ? o : String(o)).trim()).filter(Boolean);
|
|
if (cleanOptions.length < 2 || cleanOptions.length > 10) return null;
|
|
const anonymous = is_anonymous !== false; // default true
|
|
|
|
const [poll] = await db`
|
|
INSERT INTO comment_polls (comment_id, question, is_anonymous)
|
|
VALUES (${commentId}, ${question.trim()}, ${anonymous})
|
|
RETURNING id, is_anonymous
|
|
`;
|
|
const pollId = poll.id;
|
|
for (let i = 0; i < cleanOptions.length; i++) {
|
|
await db`
|
|
INSERT INTO comment_poll_options (poll_id, text, sort_order)
|
|
VALUES (${pollId}, ${cleanOptions[i]}, ${i})
|
|
`;
|
|
}
|
|
const optRows = await db`SELECT id, text, sort_order FROM comment_poll_options WHERE poll_id = ${pollId} ORDER BY sort_order ASC`;
|
|
return {
|
|
id: pollId,
|
|
question: question.trim(),
|
|
is_anonymous: poll.is_anonymous,
|
|
options: optRows.map(o => ({ id: o.id, text: o.text, sort_order: o.sort_order, vote_count: 0, voters: [] })),
|
|
total_votes: 0,
|
|
user_vote_option_id: null
|
|
};
|
|
};
|
|
|
|
// Patch POST /api/comments to support optional poll payload
|
|
// We cannot re-define the same route, so we intercept via a pre-middleware trick.
|
|
// Instead we add a dedicated endpoint that the frontend always uses for polls.
|
|
|
|
// POST /api/polls/:commentId — attach a poll to an existing just-created comment
|
|
// (frontend calls this immediately after posting the comment)
|
|
router.post(/\/api\/polls\/attach\/(?<commentId>\d+)/, async (req, res) => {
|
|
if (!req.session) return res.reply({ code: 401, body: JSON.stringify({ success: false }) });
|
|
if (!cfg.websrv.enable_comment_polls) return res.reply({ code: 403, body: JSON.stringify({ success: false, message: 'Polls disabled' }) });
|
|
|
|
const commentId = req.params.commentId;
|
|
const body = req.post || {};
|
|
|
|
// Verify this comment belongs to the logged-in user and has no poll yet
|
|
const comment = await db`SELECT id, user_id FROM comments WHERE id = ${commentId} AND is_deleted = false LIMIT 1`;
|
|
if (!comment.length) return res.reply({ code: 404, body: JSON.stringify({ success: false, message: 'Comment not found' }) });
|
|
if (comment[0].user_id !== req.session.id && !req.session.admin && !req.session.is_moderator) {
|
|
return res.reply({ code: 403, body: JSON.stringify({ success: false, message: 'Forbidden' }) });
|
|
}
|
|
const existing = await db`SELECT id FROM comment_polls WHERE comment_id = ${commentId} LIMIT 1`;
|
|
if (existing.length) return res.reply({ code: 409, body: JSON.stringify({ success: false, message: 'Poll already exists' }) });
|
|
|
|
let pollData;
|
|
try {
|
|
pollData = typeof body.poll === 'string' ? JSON.parse(body.poll) : body.poll;
|
|
} catch (e) {
|
|
return res.reply({ code: 400, body: JSON.stringify({ success: false, message: 'Invalid poll JSON' }) });
|
|
}
|
|
|
|
try {
|
|
const poll = await createPollForComment(parseInt(commentId, 10), pollData);
|
|
if (!poll) return res.reply({ code: 400, body: JSON.stringify({ success: false, message: 'Invalid poll data (need question + 2-10 options)' }) });
|
|
return res.reply({ headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ success: true, poll }) });
|
|
} catch (err) {
|
|
console.error('[POLLS] createPollForComment error:', err);
|
|
return res.reply({ code: 500, body: JSON.stringify({ success: false, message: 'Database error' }) });
|
|
}
|
|
});
|
|
|
|
// GET /api/polls/:pollId — fetch poll with current user's vote
|
|
router.get(/\/api\/polls\/(?<pollId>\d+)/, async (req, res) => {
|
|
if (!cfg.websrv.enable_comment_polls) return res.reply({ code: 403, body: JSON.stringify({ success: false }) });
|
|
const pollId = req.params.pollId;
|
|
|
|
try {
|
|
const pollRows = await db`
|
|
SELECT
|
|
cp.id as poll_id, cp.comment_id, cp.question, cp.expires_at, COALESCE(cp.is_anonymous, true) as is_anonymous,
|
|
json_agg(
|
|
json_build_object(
|
|
'id', cpo.id, 'text', cpo.text, 'sort_order', cpo.sort_order,
|
|
'vote_count', COALESCE(vc.cnt, 0)
|
|
) ORDER BY cpo.sort_order ASC, cpo.id ASC
|
|
) AS options,
|
|
COALESCE(SUM(vc.cnt), 0)::int AS total_votes
|
|
FROM comment_polls cp
|
|
JOIN comment_poll_options cpo ON cpo.poll_id = cp.id
|
|
LEFT JOIN (SELECT option_id, COUNT(*) AS cnt FROM comment_poll_votes GROUP BY option_id) vc ON vc.option_id = cpo.id
|
|
WHERE cp.id = ${pollId}
|
|
GROUP BY cp.id, cp.comment_id, cp.question, cp.expires_at, cp.is_anonymous
|
|
`;
|
|
if (!pollRows.length) return res.reply({ code: 404, body: JSON.stringify({ success: false }) });
|
|
const p = pollRows[0];
|
|
|
|
let userVoteOptionId = null;
|
|
if (req.session) {
|
|
const vote = await db`SELECT option_id FROM comment_poll_votes WHERE poll_id = ${pollId} AND user_id = ${req.session.id} LIMIT 1`;
|
|
if (vote.length) userVoteOptionId = vote[0].option_id;
|
|
}
|
|
|
|
// If not anonymous, attach voter usernames to each option
|
|
let options = p.options;
|
|
if (!p.is_anonymous) {
|
|
const voterRows = await db`
|
|
SELECT cpv.option_id, u."user" as username, uo.avatar, uo.avatar_file
|
|
FROM comment_poll_votes cpv
|
|
JOIN public."user" u ON u.id = cpv.user_id
|
|
LEFT JOIN public.user_options uo ON uo.user_id = cpv.user_id
|
|
WHERE cpv.poll_id = ${pollId}
|
|
`;
|
|
const voterMap = new Map();
|
|
for (const v of voterRows) {
|
|
if (!voterMap.has(v.option_id)) voterMap.set(v.option_id, []);
|
|
voterMap.get(v.option_id).push({ username: v.username, avatar: v.avatar, avatar_file: v.avatar_file });
|
|
}
|
|
options = options.map(o => ({ ...o, voters: voterMap.get(o.id) || [] }));
|
|
}
|
|
|
|
return res.reply({
|
|
headers: { 'Content-Type': 'application/json' },
|
|
body: JSON.stringify({
|
|
success: true,
|
|
poll: {
|
|
id: p.poll_id,
|
|
comment_id: p.comment_id,
|
|
question: p.question,
|
|
expires_at: p.expires_at,
|
|
is_anonymous: p.is_anonymous,
|
|
options,
|
|
total_votes: parseInt(p.total_votes) || 0,
|
|
user_vote_option_id: userVoteOptionId
|
|
}
|
|
})
|
|
});
|
|
} catch (err) {
|
|
console.error('[POLLS] GET error:', err);
|
|
return res.reply({ code: 500, body: JSON.stringify({ success: false }) });
|
|
}
|
|
});
|
|
|
|
// POST /api/polls/:pollId/vote — cast or change vote
|
|
router.post(/\/api\/polls\/(?<pollId>\d+)\/vote/, async (req, res) => {
|
|
if (!req.session) return res.reply({ code: 401, body: JSON.stringify({ success: false }) });
|
|
if (!cfg.websrv.enable_comment_polls) return res.reply({ code: 403, body: JSON.stringify({ success: false }) });
|
|
|
|
const pollId = req.params.pollId;
|
|
const body = req.post || {};
|
|
const optionId = parseInt(body.option_id, 10);
|
|
if (!optionId) return res.reply({ code: 400, body: JSON.stringify({ success: false, message: 'Missing option_id' }) });
|
|
|
|
try {
|
|
// Verify option belongs to poll
|
|
const opt = await db`SELECT id FROM comment_poll_options WHERE id = ${optionId} AND poll_id = ${pollId} LIMIT 1`;
|
|
if (!opt.length) return res.reply({ code: 400, body: JSON.stringify({ success: false, message: 'Invalid option' }) });
|
|
|
|
// Check expiry
|
|
const poll = await db`SELECT expires_at FROM comment_polls WHERE id = ${pollId} LIMIT 1`;
|
|
if (!poll.length) return res.reply({ code: 404, body: JSON.stringify({ success: false }) });
|
|
if (poll[0].expires_at && new Date(poll[0].expires_at) < new Date()) {
|
|
return res.reply({ code: 403, body: JSON.stringify({ success: false, message: 'Poll has expired' }) });
|
|
}
|
|
|
|
// Upsert vote (change allowed) — manual check avoids needing a unique constraint
|
|
const existing = await db`
|
|
SELECT poll_id FROM comment_poll_votes
|
|
WHERE poll_id = ${pollId} AND user_id = ${req.session.id}
|
|
LIMIT 1
|
|
`;
|
|
if (existing.length) {
|
|
await db`
|
|
UPDATE comment_poll_votes
|
|
SET option_id = ${optionId}, created_at = now()
|
|
WHERE poll_id = ${pollId} AND user_id = ${req.session.id}
|
|
`;
|
|
} else {
|
|
await db`
|
|
INSERT INTO comment_poll_votes (poll_id, option_id, user_id)
|
|
VALUES (${pollId}, ${optionId}, ${req.session.id})
|
|
`;
|
|
}
|
|
|
|
// Return updated tally
|
|
const pollMeta = await db`SELECT COALESCE(is_anonymous, true) as is_anonymous FROM comment_polls WHERE id = ${pollId} LIMIT 1`;
|
|
const isAnon = pollMeta.length ? pollMeta[0].is_anonymous : true;
|
|
|
|
const rows = await db`
|
|
SELECT cpo.id, cpo.text, cpo.sort_order, COALESCE(vc.cnt, 0)::int AS vote_count
|
|
FROM comment_poll_options cpo
|
|
LEFT JOIN (SELECT option_id, COUNT(*) AS cnt FROM comment_poll_votes WHERE poll_id = ${pollId} GROUP BY option_id) vc ON vc.option_id = cpo.id
|
|
WHERE cpo.poll_id = ${pollId}
|
|
ORDER BY cpo.sort_order ASC
|
|
`;
|
|
const totalVotes = rows.reduce((s, r) => s + r.vote_count, 0);
|
|
|
|
let options = rows;
|
|
if (!isAnon) {
|
|
const voterRows = await db`
|
|
SELECT cpv.option_id, u."user" as username, uo.avatar, uo.avatar_file
|
|
FROM comment_poll_votes cpv
|
|
JOIN public."user" u ON u.id = cpv.user_id
|
|
LEFT JOIN public.user_options uo ON uo.user_id = cpv.user_id
|
|
WHERE cpv.poll_id = ${pollId}
|
|
`;
|
|
const voterMap = new Map();
|
|
for (const v of voterRows) {
|
|
if (!voterMap.has(v.option_id)) voterMap.set(v.option_id, []);
|
|
voterMap.get(v.option_id).push({ username: v.username, avatar: v.avatar, avatar_file: v.avatar_file });
|
|
}
|
|
options = rows.map(o => ({ ...o, voters: voterMap.get(o.id) || [] }));
|
|
}
|
|
|
|
return res.reply({
|
|
headers: { 'Content-Type': 'application/json' },
|
|
body: JSON.stringify({ success: true, is_anonymous: isAnon, options, total_votes: totalVotes, user_vote_option_id: optionId })
|
|
});
|
|
} catch (err) {
|
|
console.error('[POLLS] vote error:', err);
|
|
return res.reply({ code: 500, body: JSON.stringify({ success: false }) });
|
|
}
|
|
});
|
|
|
|
// DELETE /api/polls/:pollId — admin/mod or creator can delete
|
|
router.post(/\/api\/polls\/(?<pollId>\d+)\/delete/, async (req, res) => {
|
|
if (!req.session) return res.reply({ code: 401, body: JSON.stringify({ success: false }) });
|
|
if (!cfg.websrv.enable_comment_polls) return res.reply({ code: 403, body: JSON.stringify({ success: false }) });
|
|
|
|
const pollId = req.params.pollId;
|
|
try {
|
|
const poll = await db`
|
|
SELECT cp.id, cp.comment_id, c.user_id
|
|
FROM comment_polls cp
|
|
JOIN comments c ON c.id = cp.comment_id
|
|
WHERE cp.id = ${pollId} LIMIT 1
|
|
`;
|
|
if (!poll.length) return res.reply({ code: 404, body: JSON.stringify({ success: false }) });
|
|
const isCreator = poll[0].user_id === req.session.id;
|
|
if (!isCreator && !req.session.admin && !req.session.is_moderator) {
|
|
return res.reply({ code: 403, body: JSON.stringify({ success: false, message: 'Forbidden' }) });
|
|
}
|
|
await db`DELETE FROM comment_polls WHERE id = ${pollId}`;
|
|
// Notify live update
|
|
db.notify('comments', JSON.stringify({ type: 'poll_deleted', poll_id: pollId, comment_id: poll[0].comment_id }));
|
|
return res.reply({ headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ success: true }) });
|
|
} catch (err) {
|
|
console.error('[POLLS] delete error:', err);
|
|
return res.reply({ code: 500, body: JSON.stringify({ success: false }) });
|
|
}
|
|
});
|
|
|
|
return router;
|
|
};
|