add avatars

apps/users.lua

@@ -3,12 +3,15 @@ local app = require("lapis").Application()
 local db = require("lapis.db")
 local constants = require("constants")
 
+local util = require("util")
+
 local bcrypt = require("bcrypt")
 local rand = require("openssl.rand")
 
 local models = require("models")
 local Users = models.Users
 local Sessions = models.Sessions
+local Avatars = models.Avatars
 
 local TransientUser = {
   is_admin = function (self)
@@ -76,6 +79,10 @@ local function validate_username(username)
   return username:match("^[%w_-]+$") and true
 end
 
+local function validate_url(url)
+  return url:match('^https?://.+$') and true
+end
+
 app:get("user", "/:username", function(self)
   local user = Users:find({username = self.params.username})
   if not user then
@@ -101,6 +108,107 @@ app:get("user", "/:username", function(self)
   return {render = "user.user"}
 end)
 
+app:post("user_clear_avatar", "/:username/clear_avatar", function(self)
+  local me = validate_session(self.session.session_key)
+  if me == nil then
+    self.session.flash = {error = "You must be logged in to perform this action."}
+    return {redirect_to = self:url_for("user_login")}
+  end
+  local target_user = Users:find({username = self.params.username})
+  if me.id ~= target_user.id then
+    return {redirect_to = self:url_for("user", {username = self.params.username})}
+  end
+  target_user:update({
+    avatar_id = db.NULL,
+  })
+  self.session.flash = {success = true, msg = "Avatar cleared."}
+  return {redirect_to = self:url_for("user_settings", {username = self.params.username})}
+end)
+
+app:post("user_set_avatar", "/:username/set_avatar", function(self)
+  local me = validate_session(self.session.session_key)
+  if me == nil then
+    self.session.flash = {error = "You must be logged in to perform this action."}
+    return {redirect_to = self:url_for("user_login")}
+  end
+  local target_user = Users:find({username = self.params.username})
+  if me.id ~= target_user.id then
+    return {redirect_to = self:url_for("user", {username = self.params.username})}
+  end
+  local file = self.params.avatar
+  if not file then
+    self.session.flash = {error = "Something went wrong. Try again later."}
+    return {redirect_to = self:url_for("user_settings", {username = self.params.username})}
+  end
+  local time = os.time()
+  local filename = "u" .. target_user.id .. "d" .. time .. ".webp"
+  local proxied_filename = "/avatars/" .. filename
+  local save_path = "static" .. proxied_filename
+  local res = util.validate_and_create_image(file.content, save_path)
+  if not res then
+    self.session.flash = {error = "Something went wrong. Try again later."}
+    return {redirect_to = self:url_for("user_settings", {username = self.params.username})}
+  end
+
+  self.session.flash = {success = true, msg = "Avatar updated."}
+  local avatar = Avatars:create({
+    file_path = proxied_filename,
+    uploaded_at = time,
+  })
+
+  target_user:update({
+    avatar_id = avatar.id
+  })
+
+  return {redirect_to = self:url_for("user_settings", {username = self.params.username})}
+end)
+
+app:get("user_settings", "/:username/settings", function(self)
+  local me = validate_session(self.session.session_key)
+  if me == nil then
+    self.session.flash = {error = "You must be logged in to perform this action."}
+    return {redirect_to = self:url_for("user_login")}
+  end
+  local target_user = Users:find({username = self.params.username})
+  if me.id ~= target_user.id then
+    return {redirect_to = self:url_for("user", {username = self.params.username})}
+  end
+  if self.session.flash then
+    local flash = self.session.flash
+    self.session.flash = nil
+    if flash.success then
+      self.flash_msg = flash.msg
+    elseif flash.error then
+      self.flash_msg = flash.error
+    end
+  end
+  self.user = target_user
+  return {render = "user.settings"}
+end)
+
+app:post("user_settings", "/:username/settings", function(self)
+  local me = validate_session(self.session.session_key)
+  if me == nil then
+    self.session.flash = {error = "You must be logged in to perform this action."}
+    return {redirect_to = self:url_for("user_login")}
+  end
+  local target_user = Users:find({username = self.params.username})
+  if me.id ~= target_user.id then
+    return {redirect_to = self:url_for("user", {username = self.params.username})}
+  end
+
+  local status = self.params.status:sub(1, 100)
+
+  target_user:update({
+    status = status,
+  })
+  self.session.flash = {
+    success = true,
+    msg = "Settings updated."
+  }
+  return {redirect_to = self:url_for("user_settings", {username = self.params.username})}
+end)
+
 app:get("user_login", "/login", function(self)
   if self.session.session_key then
     local user = validate_session(self.session.session_key)