push

pushy

Signed-off-by: Kenneth Obsequio <k80308392@gmail.com>

middleware/auth.middleware.js

@@ -33,9 +33,21 @@ const authenticate = async (req, res, next) => {
       attributes: { exclude: ['password', 'otp_code', 'otp_expires_at'] },
     });
 
-    if (!user)          return R.error(res, 'User not found.',        401);
+    if (!user)           return R.error(res, 'User not found.',        401);
     if (!user.is_active) return R.error(res, 'Account is deactivated.', 403);
 
+    if (user.is_banned) {
+      const stillBanned = !user.ban_expires_at || new Date() < new Date(user.ban_expires_at);
+      if (stillBanned) {
+        return R.error(res, 'Your account has been suspended.', 403, {
+          banned:         true,
+          ban_expires_at: user.ban_expires_at ?? null,
+        });
+      }
+      // Expired temporary ban — auto-lift so the user can log in again
+      await user.update({ is_banned: false, ban_expires_at: null });
+    }
+
     req.user = user;
     next();
   } catch (err) {
@@ -74,7 +86,21 @@ const softAuthenticate = async (req, res, next) => {
       attributes: { exclude: ['password', 'otp_code', 'otp_expires_at'] },
     });
 
-    req.user = (user && user.is_active) ? user : null;
+    if (!user || !user.is_active) {
+      req.user = null;
+      return next();
+    }
+
+    if (user.is_banned) {
+      const stillBanned = !user.ban_expires_at || new Date() < new Date(user.ban_expires_at);
+      if (stillBanned) {
+        req.user = null;
+        return next();
+      }
+      await user.update({ is_banned: false, ban_expires_at: null });
+    }
+
+    req.user = user;
     next();
   } catch (err) {
     if (err.name === 'TokenExpiredError')

middleware/badge_upload.middleware.js

@@ -0,0 +1,32 @@
+'use strict';
+
+const multer = require('multer');
+
+const ALLOWED_MIME = new Set([
+  'image/jpeg', 'image/png', 'image/webp', 'image/gif', 'image/svg+xml',
+]);
+
+const upload = multer({
+  storage: multer.memoryStorage(),
+  limits: { fileSize: 5 * 1024 * 1024 }, // 5 MB
+  fileFilter(req, file, cb) {
+    if (ALLOWED_MIME.has(file.mimetype)) return cb(null, true);
+    cb(Object.assign(new Error('Only JPEG, PNG, WebP, GIF, or SVG images are allowed.'), { code: 'INVALID_TYPE' }));
+  },
+});
+
+const badgeSingle = upload.single('badge');
+
+const handleBadgeUpload = (req, res, next) => {
+  badgeSingle(req, res, (err) => {
+    if (!err) return next();
+    if (err.code === 'LIMIT_FILE_SIZE')
+      return res.status(400).json({ status: 'error', message: 'Badge image must be under 5 MB.' });
+    if (err.code === 'INVALID_TYPE')
+      return res.status(400).json({ status: 'error', message: err.message });
+    console.error('[MULTER BADGE]', err);
+    return res.status(400).json({ status: 'error', message: err.message ?? 'Upload failed.' });
+  });
+};
+
+module.exports = { handleBadgeUpload };