wip

7 files changed, 63 insertions, 108 deletions

diff --git a/src/api/endpoints/posts/context.ts b/src/api/endpoints/posts/context.ts
index 53fc4737e5..5b0a56f356 100644
--- a/src/api/endpoints/posts/context.ts
+++ b/src/api/endpoints/posts/context.ts
@@ -19,15 +19,15 @@ module.exports = (params, user) =>
 {
 	// Get 'post_id' parameter
 	const [postId, postIdErr] = it(params.post_id, 'id', true);
-	if (postIdErr) return rej('invalid post_id');
+	if (postIdErr) return rej('invalid post_id param');
 
 	// Get 'limit' parameter
 	const [limit, limitErr] = it(params.limit).expect.number().range(1, 100).default(10).qed();
-	if (limitErr) return rej('invalid limit');
+	if (limitErr) return rej('invalid limit param');
 
 	// Get 'offset' parameter
 	const [offset, offsetErr] = it(params.offset).expect.number().min(0).default(0).qed();
-	if (offsetErr) return rej('invalid offset');
+	if (offsetErr) return rej('invalid offset param');
 
 	// Lookup post
 	const post = await Post.findOne({
diff --git a/src/api/endpoints/posts/likes.ts b/src/api/endpoints/posts/likes.ts
index e44013c246..f299de7492 100644
--- a/src/api/endpoints/posts/likes.ts
+++ b/src/api/endpoints/posts/likes.ts
@@ -20,19 +20,19 @@ module.exports = (params, user) =>
 {
 	// Get 'post_id' parameter
 	const [postId, postIdErr] = it(params.post_id, 'id', true);
-	if (postIdErr) return rej('invalid post_id');
+	if (postIdErr) return rej('invalid post_id param');
 
 	// Get 'limit' parameter
 	const [limit, limitErr] = it(params.limit).expect.number().range(1, 100).default(10).qed();
-	if (limitErr) return rej('invalid limit');
+	if (limitErr) return rej('invalid limit param');
 
 	// Get 'offset' parameter
 	const [offset, offsetErr] = it(params.offset).expect.number().min(0).default(0).qed();
-	if (offsetErr) return rej('invalid offset');
+	if (offsetErr) return rej('invalid offset param');
 
 	// Get 'sort' parameter
 	const [sort, sortError] = it(params.sort).expect.string().or('desc asc').default('desc').qed();
-	if (sortError) return rej('invalid sort');
+	if (sortError) return rej('invalid sort param');
 
 	// Lookup post
 	const post = await Post.findOne({
diff --git a/src/api/endpoints/posts/replies.js b/src/api/endpoints/posts/replies.ts
index cbbb5dc312..3f448d1632 100644
--- a/src/api/endpoints/posts/replies.js
+++ b/src/api/endpoints/posts/replies.ts
@@ -3,7 +3,7 @@
 /**
  * Module dependencies
  */
-import * as mongo from 'mongodb';
+import it from '../../it';
 import Post from '../../models/post';
 import serialize from '../../serializers/post';
 
@@ -18,42 +18,28 @@ module.exports = (params, user) =>
 	new Promise(async (res, rej) =>
 {
 	// Get 'post_id' parameter
-	const postId = params.post_id;
-	if (postId === undefined || postId === null) {
-		return rej('post_id is required');
-	}
+	const [postId, postIdErr] = it(params.post_id, 'id', true);
+	if (postIdErr) return rej('invalid post_id param');
 
 	// Get 'limit' parameter
-	let limit = params.limit;
-	if (limit !== undefined && limit !== null) {
-		limit = parseInt(limit, 10);
-
-		// From 1 to 100
-		if (!(1 <= limit && limit <= 100)) {
-			return rej('invalid limit range');
-		}
-	} else {
-		limit = 10;
-	}
+	const [limit, limitErr] = it(params.limit).expect.number().range(1, 100).default(10).qed();
+	if (limitErr) return rej('invalid limit param');
 
 	// Get 'offset' parameter
-	let offset = params.offset;
-	if (offset !== undefined && offset !== null) {
-		offset = parseInt(offset, 10);
-	} else {
-		offset = 0;
-	}
+	const [offset, offsetErr] = it(params.offset).expect.number().min(0).default(0).qed();
+	if (offsetErr) return rej('invalid offset param');
 
 	// Get 'sort' parameter
-	let sort = params.sort || 'desc';
+	const [sort, sortError] = it(params.sort).expect.string().or('desc asc').default('desc').qed();
+	if (sortError) return rej('invalid sort param');
 
 	// Lookup post
 	const post = await Post.findOne({
-		_id: new mongo.ObjectID(postId)
+		_id: postId
 	});
 
 	if (post === null) {
-		return rej('post not found', 'POST_NOT_FOUND');
+		return rej('post not found');
 	}
 
 	// Issue query
diff --git a/src/api/endpoints/posts/reposts.js b/src/api/endpoints/posts/reposts.ts
index 0ffe44cb16..d8410b322b 100644
--- a/src/api/endpoints/posts/reposts.js
+++ b/src/api/endpoints/posts/reposts.ts
@@ -3,7 +3,7 @@
 /**
  * Module dependencies
  */
-import * as mongo from 'mongodb';
+import it from '../../it';
 import Post from '../../models/post';
 import serialize from '../../serializers/post';
 
@@ -18,39 +18,33 @@ module.exports = (params, user) =>
 	new Promise(async (res, rej) =>
 {
 	// Get 'post_id' parameter
-	const postId = params.post_id;
-	if (postId === undefined || postId === null) {
-		return rej('post_id is required');
-	}
+	const [postId, postIdErr] = it(params.post_id, 'id', true);
+	if (postIdErr) return rej('invalid post_id param');
 
 	// Get 'limit' parameter
-	let limit = params.limit;
-	if (limit !== undefined && limit !== null) {
-		limit = parseInt(limit, 10);
+	const [limit, limitErr] = it(params.limit).expect.number().range(1, 100).default(10).qed();
+	if (limitErr) return rej('invalid limit param');
 
-		// From 1 to 100
-		if (!(1 <= limit && limit <= 100)) {
-			return rej('invalid limit range');
-		}
-	} else {
-		limit = 10;
-	}
+	// Get 'since_id' parameter
+	const [sinceId, sinceIdErr] = it(params.since_id).expect.id().qed();
+	if (sinceIdErr) return rej('invalid since_id param');
 
-	const since = params.since_id || null;
-	const max = params.max_id || null;
+	// Get 'max_id' parameter
+	const [maxId, maxIdErr] = it(params.max_id).expect.id().qed();
+	if (maxIdErr) return rej('invalid max_id param');
 
 	// Check if both of since_id and max_id is specified
-	if (since !== null && max !== null) {
+	if (sinceId !== null && maxId !== null) {
 		return rej('cannot set since_id and max_id');
 	}
 
 	// Lookup post
 	const post = await Post.findOne({
-		_id: new mongo.ObjectID(postId)
+		_id: postId
 	});
 
 	if (post === null) {
-		return rej('post not found', 'POST_NOT_FOUND');
+		return rej('post not found');
 	}
 
 	// Construct query
@@ -59,15 +53,15 @@ module.exports = (params, user) =>
 	};
 	const query = {
 		repost_id: post._id
-	};
-	if (since !== null) {
+	} as any;
+	if (sinceId) {
 		sort._id = 1;
 		query._id = {
-			$gt: new mongo.ObjectID(since)
+			$gt: sinceId
 		};
-	} else if (max !== null) {
+	} else if (maxId) {
 		query._id = {
-			$lt: new mongo.ObjectID(max)
+			$lt: maxId
 		};
 	}
 
diff --git a/src/api/endpoints/posts/search.js b/src/api/endpoints/posts/search.ts
index bc06340fda..1d02f6775d 100644
--- a/src/api/endpoints/posts/search.js
+++ b/src/api/endpoints/posts/search.ts
@@ -4,6 +4,7 @@
  * Module dependencies
  */
 import * as mongo from 'mongodb';
+import it from '../../it';
 const escapeRegexp = require('escape-regexp');
 import Post from '../../models/post';
 import serialize from '../../serializers/post';
@@ -20,31 +21,16 @@ module.exports = (params, me) =>
 	new Promise(async (res, rej) =>
 {
 	// Get 'query' parameter
-	let query = params.query;
-	if (query === undefined || query === null || query.trim() === '') {
-		return rej('query is required');
-	}
+	const [query, queryError] = it(params.query).expect.string().required().trim().validate(x => x != '').qed();
+	if (queryError) return rej('invalid query param');
 
 	// Get 'offset' parameter
-	let offset = params.offset;
-	if (offset !== undefined && offset !== null) {
-		offset = parseInt(offset, 10);
-	} else {
-		offset = 0;
-	}
+	const [offset, offsetErr] = it(params.offset).expect.number().min(0).default(0).qed();
+	if (offsetErr) return rej('invalid offset param');
 
 	// Get 'max' parameter
-	let max = params.max;
-	if (max !== undefined && max !== null) {
-		max = parseInt(max, 10);
-
-		// From 1 to 30
-		if (!(1 <= max && max <= 30)) {
-			return rej('invalid max range');
-		}
-	} else {
-		max = 10;
-	}
+	const [max, maxErr] = it(params.max).expect.number().range(1, 30).default(10).qed();
+	if (maxErr) return rej('invalid max param');
 
 	// If Elasticsearch is available, search by it
 	// If not, search by MongoDB
diff --git a/src/api/endpoints/posts/show.js b/src/api/endpoints/posts/show.ts
index 4938199cdb..712ef1e160 100644
--- a/src/api/endpoints/posts/show.js
+++ b/src/api/endpoints/posts/show.ts
@@ -3,7 +3,7 @@
 /**
  * Module dependencies
  */
-import * as mongo from 'mongodb';
+import it from '../../it';
 import Post from '../../models/post';
 import serialize from '../../serializers/post';
 
@@ -18,19 +18,12 @@ module.exports = (params, user) =>
 	new Promise(async (res, rej) =>
 {
 	// Get 'post_id' parameter
-	const postId = params.post_id;
-	if (postId === undefined || postId === null) {
-		return rej('post_id is required');
-	}
-
-	// Validate id
-	if (!mongo.ObjectID.isValid(postId)) {
-		return rej('incorrect post_id');
-	}
+	const [postId, postIdErr] = it(params.post_id, 'id', true);
+	if (postIdErr) return rej('invalid post_id param');
 
 	// Get post
 	const post = await Post.findOne({
-		_id: new mongo.ObjectID(postId)
+		_id: postId
 	});
 
 	if (post === null) {
diff --git a/src/api/endpoints/posts/timeline.js b/src/api/endpoints/posts/timeline.ts
index 48f7c26940..5744084932 100644
--- a/src/api/endpoints/posts/timeline.js
+++ b/src/api/endpoints/posts/timeline.ts
@@ -3,7 +3,7 @@
 /**
  * Module dependencies
  */
-import * as mongo from 'mongodb';
+import it from '../../it';
 import Post from '../../models/post';
 import getFriends from '../../common/get-friends';
 import serialize from '../../serializers/post';
@@ -20,23 +20,19 @@ module.exports = (params, user, app) =>
 	new Promise(async (res, rej) =>
 {
 	// Get 'limit' parameter
-	let limit = params.limit;
-	if (limit !== undefined && limit !== null) {
-		limit = parseInt(limit, 10);
+	const [limit, limitErr] = it(params.limit).expect.number().range(1, 100).default(10).qed();
+	if (limitErr) return rej('invalid limit param');
 
-		// From 1 to 100
-		if (!(1 <= limit && limit <= 100)) {
-			return rej('invalid limit range');
-		}
-	} else {
-		limit = 10;
-	}
+	// Get 'since_id' parameter
+	const [sinceId, sinceIdErr] = it(params.since_id).expect.id().qed();
+	if (sinceIdErr) return rej('invalid since_id param');
 
-	const since = params.since_id || null;
-	const max = params.max_id || null;
+	// Get 'max_id' parameter
+	const [maxId, maxIdErr] = it(params.max_id).expect.id().qed();
+	if (maxIdErr) return rej('invalid max_id param');
 
 	// Check if both of since_id and max_id is specified
-	if (since !== null && max !== null) {
+	if (sinceId !== null && maxId !== null) {
 		return rej('cannot set since_id and max_id');
 	}
 
@@ -51,15 +47,15 @@ module.exports = (params, user, app) =>
 		user_id: {
 			$in: followingIds
 		}
-	};
-	if (since !== null) {
+	} as any;
+	if (sinceId) {
 		sort._id = 1;
 		query._id = {
-			$gt: new mongo.ObjectID(since)
+			$gt: sinceId
 		};
-	} else if (max !== null) {
+	} else if (maxId) {
 		query._id = {
-			$lt: new mongo.ObjectID(max)
+			$lt: maxId
 		};
 	}