在Express中创建用户表及社交类用户内容发布功能实现咨询

Hey there! Since you're new to Express/Node.js and already have a basic Passport auth setup with token-based login going, let's break down exactly how to add those Instagram/Facebook-style user profiles and post functionality step by step. I'll keep this straightforward for beginners!

First, let's expand your existing Mongoose Schema to include user profile fields like name, birthday, and any extras you want. We'll also make sure password handling stays secure (no plaintext passwords allowed!).

const mongoose = require('mongoose');
const bcrypt = require('bcrypt');

const accountSchema = new mongoose.Schema({
  // Existing auth fields
  username: {
    type: String,
    required: true,
    unique: true,
    trim: true
  },
  passwordHash: { // Store hashed passwords, NOT plaintext
    type: String,
    required: true
  },
  // New profile fields
  fullName: {
    type: String,
    required: true,
    trim: true
  },
  birthday: {
    type: Date,
    required: true
  },
  // Optional: Add a bio or profile picture URL if you want
  bio: {
    type: String,
    default: '',
    maxlength: 500
  },
  profilePicUrl: {
    type: String,
    default: ''
  }
}, { timestamps: true }); // Automatically adds createdAt/updatedAt timestamps

// Hash password before saving to DB (for registration)
accountSchema.pre('save', async function(next) {
  if (!this.isModified('passwordHash')) return next();
  this.passwordHash = await bcrypt.hash(this.passwordHash, 10);
  next();
});

// Method to validate password during login
accountSchema.methods.validatePassword = async function(password) {
  return await bcrypt.compare(password, this.passwordHash);
};

module.exports = mongoose.model('Account', accountSchema);

Key Notes Here: #

• Renamed password to passwordHash to make it clear we're storing hashed values (never store plaintext passwords!).
• Added fullName and birthday as required fields, plus optional extras like bio.
• The timestamps option auto-tracks when accounts are created/updated.
• The pre-save hook handles password hashing automatically when a new user is registered.

Next, we need a separate Schema for user posts (like Instagram/Facebook text posts). This will link back to the user who created it.

Create a new file Model/Post.js:

const mongoose = require('mongoose');

const postSchema = new mongoose.Schema({
  content: {
    type: String,
    required: true,
    trim: true,
    maxlength: 1000 // Limit post length like social platforms do
  },
  // Link the post to its author (reference the Account model)
  author: {
    type: mongoose.Schema.Types.ObjectId,
    ref: 'Account',
    required: true
  }
}, { timestamps: true });

module.exports = mongoose.model('Post', postSchema);

Key Notes Here: #

• The author field uses ObjectId to reference an Account document, so we can later fetch the post author's details using Mongoose's populate method.
• timestamps tracks when posts are created/updated.

Now let's tie this to your existing Passport auth setup. We'll create routes to fetch a user's profile, and create new posts (both protected by your JWT token auth).

Example routes (add these to your API routes file, e.g., routes/api.js):

const express = require('express');
const router = express.Router();
const passport = require('passport');
const Account = require('../models/Account');
const Post = require('../models/Post');

// Get current user's profile (protected by JWT)
router.get('/profile', passport.authenticate('jwt', { session: false }), async (req, res) => {
  try {
    // Exclude passwordHash from the response for security
    const userProfile = await Account.findById(req.user._id).select('-passwordHash');
    res.json(userProfile);
  } catch (err) {
    res.status(500).json({ error: 'Failed to load profile' });
  }
});

// Create a new post (protected by JWT)
router.post('/posts', passport.authenticate('jwt', { session: false }), async (req, res) => {
  try {
    const { content } = req.body;

    // Validate input
    if (!content.trim()) {
      return res.status(400).json({ error: 'Post content cannot be empty' });
    }

    // Create post linked to the authenticated user
    const newPost = new Post({
      content,
      author: req.user._id // req.user comes from Passport's JWT auth
    });

    await newPost.save();

    // Optional: Return the post with author details (instead of just ID)
    const populatedPost = await newPost.populate('author', 'fullName username');
    res.status(201).json(populatedPost);
  } catch (err) {
    res.status(500).json({ error: 'Failed to create post' });
  }
});

// Get all posts (or filter by user if needed)
router.get('/posts', async (req, res) => {
  try {
    // Fetch posts with author details included
    const posts = await Post.find().populate('author', 'fullName username').sort({ createdAt: -1 });
    res.json(posts);
  } catch (err) {
    res.status(500).json({ error: 'Failed to load posts' });
  }
});

• Always validate input: Use a library like express-validator to add stricter checks (e.g., valid email format for username, minimum password length).
• Secure your routes: All routes that require user identity must use passport.authenticate('jwt', { session: false }) to ensure only logged-in users can access them.
• Avoid over-exposing data: When fetching user profiles, use .select('-passwordHash') to exclude sensitive fields from responses.
• Test with tools: Use Postman or Thunder Client to test your API endpoints—send a POST request to /posts with a valid JWT token in the headers to create a post.

内容的提问来源于stack exchange，提问作者Abed Naseri