feat: user profile customization: username, password, and avatar (#315)

backend/routes/users/updateAvatar.js

@@ -0,0 +1,140 @@
+import fs from 'fs';
+import path from 'path';
+import { fileURLToPath } from 'url';
+import multer from 'multer';
+import express from 'express';
+import { DataTypes } from 'sequelize';
+import defineUser from '../../models/users.js';
+import authMiddleware from '../../middleware/auth.js';
+const router = express.Router();
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+export default function (sequelize) {
+  const { verifySignedIn } = authMiddleware(sequelize);
+  const User = defineUser(sequelize, DataTypes);
+
+  // Create avatars folder if it does not exist
+  const avatarDir = path.join(__dirname, '../../public/uploads/avatars');
+  if (!fs.existsSync(avatarDir)) {
+    fs.mkdirSync(avatarDir, { recursive: true });
+  }
+
+  const storage = multer.diskStorage({
+    destination: (req, file, cb) => {
+      cb(null, avatarDir);
+    },
+    filename: (req, file, cb) => {
+      const ext = path.extname(file.originalname);
+      const fileName = `avatar_${req.userId}_${Date.now()}${ext}`;
+      cb(null, fileName);
+    },
+  });
+
+  const fileFilter = (req, file, cb) => {
+    // Accept images only
+    if (file.mimetype.startsWith('image/')) {
+      cb(null, true);
+    } else {
+      cb(new Error('Only image files are allowed'), false);
+    }
+  };
+
+  const upload = multer({
+    storage,
+    fileFilter,
+    limits: {
+      fileSize: 5 * 1024 * 1024, // 5MB limit
+    },
+  });
+
+  // Upload avatar
+  router.post('/avatar', verifySignedIn, upload.single('avatar'), async (req, res) => {
+    try {
+      const userId = req.userId;
+      const file = req.file;
+
+      if (!file) {
+        return res.status(400).json({ error: 'No file uploaded' });
+      }
+
+      const user = await User.findByPk(userId);
+      if (!user) {
+        // Delete uploaded file if user not found
+        fs.unlinkSync(file.path);
+        return res.status(404).send('User not found');
+      }
+
+      // Delete old avatar if exists
+      if (user.avatarPath) {
+        // Validate that avatarPath is within expected directory
+        const oldAvatarPath = path.join(__dirname, '../../public', user.avatarPath);
+        const avatarDirResolved = path.resolve(__dirname, '../../public/uploads/avatars');
+        const oldAvatarResolved = path.resolve(oldAvatarPath);
+
+        // Ensure the path is within the avatars directory (prevent path traversal)
+        if (oldAvatarResolved.startsWith(avatarDirResolved) && fs.existsSync(oldAvatarPath)) {
+          fs.unlinkSync(oldAvatarPath);
+        }
+      }
+
+      // Update user with new avatar path
+      const avatarPath = `/uploads/avatars/${file.filename}`;
+      await user.update({ avatarPath });
+
+      // Return updated user without password
+      const updatedUser = await User.findByPk(userId, {
+        attributes: ['id', 'email', 'username', 'role', 'avatarPath'],
+      });
+
+      res.json({ user: updatedUser });
+    } catch (error) {
+      console.error(error);
+      // Clean up uploaded file on error
+      if (req.file) {
+        fs.unlinkSync(req.file.path);
+      }
+      res.status(500).json({ error: 'Internal server error' });
+    }
+  });
+
+  // Delete avatar
+  router.delete('/avatar', verifySignedIn, async (req, res) => {
+    try {
+      const userId = req.userId;
+
+      const user = await User.findByPk(userId);
+      if (!user) {
+        return res.status(404).send('User not found');
+      }
+
+      // Delete avatar file if exists
+      if (user.avatarPath) {
+        // Validate that avatarPath is within expected directory
+        const avatarPath = path.join(__dirname, '../../public', user.avatarPath);
+        const avatarDirResolved = path.resolve(__dirname, '../../public/uploads/avatars');
+        const avatarPathResolved = path.resolve(avatarPath);
+
+        // Ensure the path is within the avatars directory (prevent path traversal)
+        if (avatarPathResolved.startsWith(avatarDirResolved) && fs.existsSync(avatarPath)) {
+          fs.unlinkSync(avatarPath);
+        }
+      }
+
+      // Update user to remove avatar path
+      await user.update({ avatarPath: null });
+
+      // Return updated user without password
+      const updatedUser = await User.findByPk(userId, {
+        attributes: ['id', 'email', 'username', 'role', 'avatarPath'],
+      });
+
+      res.json({ user: updatedUser });
+    } catch (error) {
+      console.error(error);
+      res.status(500).json({ error: 'Internal server error' });
+    }
+  });
+
+  return router;
+}

backend/routes/users/updatePassword.js

@@ -0,0 +1,49 @@
+import express from 'express';
+import bcrypt from 'bcrypt';
+import { DataTypes } from 'sequelize';
+import defineUser from '../../models/users.js';
+import authMiddleware from '../../middleware/auth.js';
+const router = express.Router();
+
+export default function (sequelize) {
+  const { verifySignedIn } = authMiddleware(sequelize);
+  const User = defineUser(sequelize, DataTypes);
+
+  // Change user password
+  router.put('/password', verifySignedIn, async (req, res) => {
+    try {
+      const userId = req.userId;
+      const { currentPassword, newPassword } = req.body;
+
+      if (!currentPassword || !newPassword) {
+        return res.status(400).send('Current password and new password are required');
+      }
+
+      if (newPassword.length < 8) {
+        return res.status(400).send('New password must be at least 8 characters');
+      }
+
+      const user = await User.findByPk(userId);
+      if (!user) {
+        return res.status(404).send('User not found');
+      }
+
+      // Verify current password
+      const passwordMatch = await bcrypt.compare(currentPassword, user.password);
+      if (!passwordMatch) {
+        return res.status(401).send('Current password is incorrect');
+      }
+
+      // Hash new password
+      const hashedPassword = await bcrypt.hash(newPassword, 10);
+      await user.update({ password: hashedPassword });
+
+      res.json({ message: 'Password updated successfully' });
+    } catch (error) {
+      console.error(error);
+      res.status(500).send('Internal Server Error');
+    }
+  });
+
+  return router;
+}

backend/routes/users/updatePassword.test.js

@@ -0,0 +1,113 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import request from 'supertest';
+import express from 'express';
+import { Sequelize } from 'sequelize';
+import updatePasswordRoute from './updatePassword.js';
+
+// mock of authentication middleware
+let mockUserId = 1;
+vi.mock('../../middleware/auth.js', () => ({
+  default: () => ({
+    verifySignedIn: vi.fn((req, res, next) => {
+      req.userId = mockUserId; // Mock user ID
+      next();
+    }),
+  }),
+}));
+
+// mock defineUser
+const mockUsers = new Map();
+const mockUser = {
+  findByPk: vi.fn((id) => {
+    const user = mockUsers.get(id);
+    if (!user) return null;
+    return {
+      ...user,
+      update: vi.fn(async (data) => {
+        Object.assign(user, data);
+        return user;
+      }),
+    };
+  }),
+};
+
+vi.mock('../../models/users.js', () => ({
+  default: () => mockUser,
+}));
+
+// mock bcrypt (just add 'hashed_' prefix)
+vi.mock('bcrypt', () => ({
+  default: {
+    hashSync: (pw) => `hashed_${pw}`,
+    compareSync: (pw, hashed) => hashed === `hashed_${pw}`,
+    hash: async (pw) => `hashed_${pw}`,
+    compare: async (pw, hashed) => hashed === `hashed_${pw}`,
+  },
+}));
+
+describe('User Profile Routes', () => {
+  let app;
+  const sequelize = new Sequelize({
+    dialect: 'sqlite',
+    logging: false,
+  });
+
+  beforeEach(() => {
+    app = express();
+    app.use(express.json());
+    app.use('/users', updatePasswordRoute(sequelize));
+
+    // Reset mock users
+    mockUsers.clear();
+    mockUserId = 1;
+
+    // Create a test user
+    mockUsers.set(1, {
+      id: 1,
+      email: 'test@example.com',
+      username: 'testuser',
+      password: 'hashed_testpassword123',
+      role: 1,
+      avatarPath: null,
+    });
+
+    vi.clearAllMocks();
+  });
+
+  it('should update password', async () => {
+    const newPassword = 'newpassword123';
+    const response = await request(app).put('/users/password').send({
+      currentPassword: 'testpassword123',
+      newPassword: newPassword,
+    });
+
+    expect(response.status).toBe(200);
+    expect(response.body.message).toContain('successfully');
+  });
+
+  it('should reject incorrect current password', async () => {
+    const response = await request(app).put('/users/password').send({
+      currentPassword: 'wrongpassword',
+      newPassword: 'newpassword456',
+    });
+
+    expect(response.status).toBe(401);
+  });
+
+  it('should reject password shorter than 8 characters', async () => {
+    const response = await request(app).put('/users/password').send({
+      currentPassword: 'testpassword123',
+      newPassword: 'short',
+    });
+
+    expect(response.status).toBe(400);
+  });
+
+  it('should reject missing current password', async () => {
+    const response = await request(app).put('/users/password').send({
+      newPassword: 'newpassword123',
+    });
+
+    expect(response.status).toBe(400);
+  });
+});

backend/routes/users/updateRole.js

@@ -9,7 +9,7 @@ export default function (sequelize) {
   const { verifySignedIn, verifyAdmin } = authMiddleware(sequelize);
   const User = defineUser(sequelize, DataTypes);
 
-  router.put('/:userId', verifySignedIn, verifyAdmin, async (req, res) => {
+  router.put('/:userId/role', verifySignedIn, verifyAdmin, async (req, res) => {
     // param check
     const userId = req.params.userId;
     if (!userId) {

backend/routes/users/updateRole.test.js

@@ -2,7 +2,7 @@ import { describe, it, expect, vi, beforeEach } from 'vitest';
 import request from 'supertest';
 import express from 'express';
 import { Sequelize } from 'sequelize';
-import updateRoute from './update';
+import updateRoleRoute from './updateRole';
 import { roles } from './authSettings.js';
 
 const adminRoleIndex = roles.findIndex((entry) => entry.uid === 'administrator');
@@ -44,11 +44,11 @@ describe('updateUserRole', () => {
     app.use(express.json());
 
     // Mount the update route
-    app.use('/users', updateRoute(sequelize));
+    app.use('/users', updateRoleRoute(sequelize));
   });
 
   it('call update API without new role', async () => {
-    const response = await request(app).put('/users/2').send();
+    const response = await request(app).put('/users/2/role').send();
 
     expect(response.status).toBe(400);
     expect(response.text).toBe('newRole is required');
@@ -56,7 +56,7 @@ describe('updateUserRole', () => {
 
   it('promote not existing user to admin will return 404', async () => {
     mockUser.findByPk.mockResolvedValue(null); // No user found
-    const response = await request(app).put('/users/2').send({
+    const response = await request(app).put('/users/2/role').send({
       newRole: 0,
     });
 
@@ -68,7 +68,7 @@ describe('updateUserRole', () => {
     const targetUser = { id: 2, role: userRoleIndex, update: vi.fn() }; // Normal user
     mockUser.findByPk.mockResolvedValue(targetUser);
 
-    const response = await request(app).put('/users/2').send({
+    const response = await request(app).put('/users/2/role').send({
       newRole: 0,
     });
 
@@ -81,7 +81,7 @@ describe('updateUserRole', () => {
     mockUser.findByPk.mockResolvedValue(targetUser);
     mockUser.count.mockResolvedValue(1); // Only one admin
 
-    const response = await request(app).put('/users/1').send({
+    const response = await request(app).put('/users/1/role').send({
       newRole: 1,
     }); // Downgrading admin to user
 
@@ -96,7 +96,7 @@ describe('updateUserRole', () => {
     // Simulate DB error
     mockUser.findByPk.mockRejectedValue(new Error('Database error'));
 
-    const response = await request(app).put('/users/1').send({
+    const response = await request(app).put('/users/1/role').send({
       newRole: 0,
     });
 

backend/routes/users/updateUsername.js

@@ -0,0 +1,40 @@
+import express from 'express';
+import { DataTypes } from 'sequelize';
+import defineUser from '../../models/users.js';
+import authMiddleware from '../../middleware/auth.js';
+const router = express.Router();
+
+export default function (sequelize) {
+  const { verifySignedIn } = authMiddleware(sequelize);
+  const User = defineUser(sequelize, DataTypes);
+
+  router.put('/username', verifySignedIn, async (req, res) => {
+    try {
+      const userId = req.userId;
+      const { username } = req.body;
+
+      if (!username || username.trim().length === 0) {
+        return res.status(400).send('Username is required');
+      }
+
+      const user = await User.findByPk(userId);
+      if (!user) {
+        return res.status(404).send('User not found');
+      }
+
+      await user.update({ username: username.trim() });
+
+      // Return updated user without password
+      const updatedUser = await User.findByPk(userId, {
+        attributes: ['id', 'email', 'username', 'role', 'avatarPath'],
+      });
+
+      res.json({ user: updatedUser });
+    } catch (error) {
+      console.error(error);
+      res.status(500).send('Internal Server Error');
+    }
+  });
+
+  return router;
+}

backend/routes/users/updateUsername.test.js

@@ -0,0 +1,86 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import request from 'supertest';
+import express from 'express';
+import { Sequelize } from 'sequelize';
+import updateUsernameRoute from './updateUsername.js';
+
+// mock of authentication middleware
+let mockUserId = 1;
+vi.mock('../../middleware/auth.js', () => ({
+  default: () => ({
+    verifySignedIn: vi.fn((req, res, next) => {
+      req.userId = mockUserId; // Mock user ID
+      next();
+    }),
+  }),
+}));
+
+// mock defineUser
+const mockUsers = new Map();
+const mockUser = {
+  findByPk: vi.fn((id) => {
+    const user = mockUsers.get(id);
+    if (!user) return null;
+    return {
+      ...user,
+      update: vi.fn(async (data) => {
+        Object.assign(user, data);
+        return user;
+      }),
+    };
+  }),
+};
+
+vi.mock('../../models/users.js', () => ({
+  default: () => mockUser,
+}));
+
+describe('User Profile Routes', () => {
+  let app;
+  const sequelize = new Sequelize({
+    dialect: 'sqlite',
+    logging: false,
+  });
+
+  beforeEach(() => {
+    app = express();
+    app.use(express.json());
+    app.use('/users', updateUsernameRoute(sequelize));
+
+    // Reset mock users
+    mockUsers.clear();
+    mockUserId = 1;
+
+    // Create a test user
+    mockUsers.set(1, {
+      id: 1,
+      email: 'test@example.com',
+      username: 'testuser',
+      password: '',
+      role: 1,
+      avatarPath: null,
+    });
+
+    vi.clearAllMocks();
+  });
+
+  it('should update username', async () => {
+    const newUsername = 'updatedusername';
+    const response = await request(app).put('/users/username').send({ username: newUsername });
+
+    expect(response.status).toBe(200);
+    expect(response.body.user.username).toBe(newUsername);
+  });
+
+  it('should reject empty username', async () => {
+    const response = await request(app).put('/users/username').send({ username: '' });
+
+    expect(response.status).toBe(400);
+  });
+
+  it('should reject whitespace-only username', async () => {
+    const response = await request(app).put('/users/username').send({ username: '   ' });
+
+    expect(response.status).toBe(400);
+  });
+});