s3 image file validation

backend/routes/forum.js

@@ -6,6 +6,8 @@ const logger = require('../utils/logger');
 const emailServices = require('../services/email');
 const googleMapsService = require('../services/googleMapsService');
 const locationService = require('../services/locationService');
+const { validateS3Keys } = require('../utils/s3KeyValidator');
+const { IMAGE_LIMITS } = require('../config/imageLimits');
 const router = express.Router();
 
 // Helper function to build nested comment tree
@@ -239,10 +241,20 @@ router.get('/posts/:id', optionalAuth, async (req, res, next) => {
 // POST /api/forum/posts - Create new post
 router.post('/posts', authenticateToken, async (req, res, next) => {
   try {
-    let { title, content, category, tags, zipCode, latitude: providedLat, longitude: providedLng, imageFilenames } = req.body;
+    let { title, content, category, tags, zipCode, latitude: providedLat, longitude: providedLng, imageFilenames: rawImageFilenames } = req.body;
 
-    // Ensure imageFilenames is an array
-    imageFilenames = Array.isArray(imageFilenames) ? imageFilenames : [];
+    // Ensure imageFilenames is an array and validate S3 keys
+    const imageFilenamesArray = Array.isArray(rawImageFilenames) ? rawImageFilenames : [];
+
+    const keyValidation = validateS3Keys(imageFilenamesArray, 'forum', { maxKeys: IMAGE_LIMITS.forum });
+    if (!keyValidation.valid) {
+      return res.status(400).json({
+        error: keyValidation.error,
+        details: keyValidation.invalidKeys
+      });
+    }
+
+    const imageFilenames = imageFilenamesArray;
 
     // Initialize location fields
     let latitude = null;
@@ -488,9 +500,26 @@ router.put('/posts/:id', authenticateToken, async (req, res, next) => {
       return res.status(403).json({ error: 'Unauthorized' });
     }
 
-    const { title, content, category, tags } = req.body;
+    const { title, content, category, tags, imageFilenames: rawImageFilenames } = req.body;
 
-    await post.update({ title, content, category });
+    // Build update object
+    const updateData = { title, content, category };
+
+    // Handle imageFilenames if provided
+    if (rawImageFilenames !== undefined) {
+      const imageFilenamesArray = Array.isArray(rawImageFilenames) ? rawImageFilenames : [];
+
+      const keyValidation = validateS3Keys(imageFilenamesArray, 'forum', { maxKeys: IMAGE_LIMITS.forum });
+      if (!keyValidation.valid) {
+        return res.status(400).json({
+          error: keyValidation.error,
+          details: keyValidation.invalidKeys
+        });
+      }
+      updateData.imageFilenames = imageFilenamesArray;
+    }
+
+    await post.update(updateData);
 
     // Update tags if provided
     if (tags !== undefined) {
@@ -927,8 +956,18 @@ router.post('/posts/:id/comments', authenticateToken, async (req, res, next) =>
       }
     }
 
-    // Ensure imageFilenames is an array
-    const imageFilenames = Array.isArray(rawImageFilenames) ? rawImageFilenames : [];
+    // Ensure imageFilenames is an array and validate S3 keys
+    const imageFilenamesArray = Array.isArray(rawImageFilenames) ? rawImageFilenames : [];
+
+    const keyValidation = validateS3Keys(imageFilenamesArray, 'forum', { maxKeys: IMAGE_LIMITS.forum });
+    if (!keyValidation.valid) {
+      return res.status(400).json({
+        error: keyValidation.error,
+        details: keyValidation.invalidKeys
+      });
+    }
+
+    const imageFilenames = imageFilenamesArray;
 
     const comment = await ForumComment.create({
       postId: req.params.id,