Sanitize more
[vchess.git] / server / routes / games.js
1 let router = require("express").Router();
2 const UserModel = require("../models/User");
3 const ChallengeModel = require('../models/Challenge');
4 const GameModel = require('../models/Game');
5 const VariantModel = require('../models/Variant');
6 const access = require("../utils/access");
7 const params = require("../config/parameters");
8
9 // From main hall, start game between players 0 and 1
10 router.post("/games", access.logged, access.ajax, (req,res) => {
11 const gameInfo = req.body.gameInfo;
12 if (!Array.isArray(gameInfo.players) ||
13 gameInfo.players.every(p => p.id != req.userId))
14 {
15 return res.json({errmsg: "Cannot start someone else's game"});
16 }
17 const cid = req.body.cid;
18 // Check all entries of gameInfo + cid:
19 let error = GameModel.checkGameInfo(gameInfo);
20 if (!error)
21 {
22 if (!cid.toString().match(/^[0-9]+$/))
23 error = "Wrong challenge ID";
24 }
25 if (!!error)
26 return res.json({errmsg:error});
27 ChallengeModel.remove(cid);
28 GameModel.create(
29 gameInfo.vid, gameInfo.fen, gameInfo.timeControl, gameInfo.players,
30 (err,ret) => {
31 access.checkRequest(res, err, ret, "Cannot create game", () => {
32 const oppIdx = (gameInfo.players[0].id == req.userId ? 1 : 0);
33 const oppId = gameInfo.players[oppIdx].id;
34 UserModel.tryNotify(oppId,
35 "New game: " + params.siteURL + "/game/" + ret.gid);
36 res.json({gameId: ret.gid});
37 });
38 }
39 );
40 });
41
42 router.get("/games", access.ajax, (req,res) => {
43 const gameId = req.query["gid"];
44 if (!!gameId)
45 {
46 if (!gameId.match(/^[0-9]+$/))
47 return res.json({errmsg: "Wrong game ID"});
48 GameModel.getOne(gameId, (err,game) => {
49 access.checkRequest(res, err, game, "Game not found", () => {
50 res.json({game: game});
51 });
52 });
53 }
54 else
55 {
56 // Get by (non-)user ID:
57 const userId = req.query["uid"];
58 if (!userId.match(/^[0-9]+$/))
59 return res.json({errmsg: "Wrong user ID"});
60 const excluded = !!req.query["excluded"];
61 GameModel.getByUser(userId, excluded, (err,games) => {
62 if (!!err)
63 return res.json({errmsg: err.errmsg || err.toString()});
64 res.json({games: games});
65 });
66 }
67 });
68
69 // New move + fen update + score, potentially
70 // TODO: if newmove fail, takeback in GUI
71 router.put("/games", access.logged, access.ajax, (req,res) => {
72 const gid = req.body.gid;
73 let error = "";
74 if (!gid.toString().match(/^[0-9]+$/))
75 error = "Wrong game ID";
76 const obj = req.body.newObj;
77 error = GameModel.checkGameUpdate(obj);
78 if (!!error)
79 return res.json({errmsg: error});
80 GameModel.update(gid, obj, (err) => {
81 if (!!err)
82 return res.json(err);
83 if (!!obj.move || !!obj.score)
84 {
85 // Notify opponent if he enabled notifications:
86 GameModel.getPlayers(gid, (err2,players) => {
87 if (!err2)
88 {
89 const oppid = (players[0].id == req.userId
90 ? players[1].id
91 : players[0].id);
92 const messagePrefix = (!!obj.move
93 ? "New move in game: "
94 : "Game ended: ");
95 UserModel.tryNotify(oppid,
96 messagePrefix + params.siteURL + "/game/" + gid);
97 }
98 });
99 }
100 res.json({});
101 });
102 });
103
104 module.exports = router;