How to add users to friends arrays in user mode

This article aims to guide developers how to add their information to the other party's user-mode friends array after they accept a friend request. The article will discuss measures to avoid front-end tampering with user IDs, and query the friend list through the FriendRequest model. It will also introduce how to update the user mode when accepting friend requests, and emphasize the importance of using transactions to ensure data consistency.

Ensure the security of user ID

When processing friend requests, there is a security risk to directly obtain the sender ID from the front end. Malicious users can forge the sender ID by modifying HTML, resulting in data inconsistency or potential security issues. To avoid this, the current user's ID should be obtained from the server-side session or authentication middleware.

For example, a front-end form can contain only the receiver's ID:

In the backend routing handler, use the current user ID provided by the authentication middleware as the sender:

 router.post("/requests", (req, res) => {
  const { receiver } = req.body;

  FriendRequest.create({
    sender: req.user._id, // Get the current user ID from the authentication middleware
    Receiver
  }).then(() => {
    res.status(204).send();
  }).catch((error) => {
    res.status(500).send("Error sending friend request");
  });
});

It is assumed here that req.user._id contains the ID of the authenticated user. You need to adjust this part of the code according to the authentication method you are using.

Query friend list through FriendRequest model

A more elegant way is to avoid explicitly maintaining friends arrays in the User model. Instead, you can get a list of friends by querying the FriendRequest model. This approach takes advantage of the sender and status fields that already exist in the FriendRequest model.

For example, to get all accepted friends of the current user, you can use the following query:

 FriendRequest
  .find({sender: req.user._id, status: 'accepted'})
  .then((listOfFriends)=>{
    console.log(listOfFriends);
  })
  .catch((e)=>{
    // handle error
  })

The advantage of this approach is that it avoids data redundancy and only needs to update the FriendRequest model when the friend relationship changes.

Update friends array in user mode (use with caution)

If you still need to explicitly maintain the friends array in the User model, you need to update the friends array for both users when accepting a friend request.

 router.post("/requests/:id/accept", async (req, res) => {
  try {
    const request = await FriendRequest.findById(req.params.id);
    request.status = "accepted";
    await request.save();

    const currentUser = await User.findById(req.user._id); // Get the current user const otherUser = await User.findById(request.receiver); // Get the receiver user currentUser.friends.push(request.receiver);
    otherUser.friends.push(req.user._id);

    await currentUser.save();
    await otherUser.save();

    res.redirect("/requests");
  } catch (error) {
    // Handle error console.error("Error accepting friend request:", error);
    res.status(500).send("Error accepting friend request");
  }
});

Notes: Use transactions

When updating multiple collections, be sure to use database transactions to ensure data consistency. If the update of the User model fails after updating the FriendRequest model, data may be inconsistent.

Here is an example of how to use Mongoose transactions:

 const mongoose = require('mongoose');

router.post("/requests/:id/accept", async (req, res) => {
  const session = await mongoose.startSession();
  session.startTransaction();
  try {
    const request = await FriendRequest.findById(req.params.id).session(session);
    request.status = "accepted";
    await request.save({ session });

    const currentUser = await User.findById(req.user._id).session(session); // Get the current user const otherUser = await User.findById(request.receiver).session(session); // Get the recipient user currentUser.friends.push(request.receiver);
    otherUser.friends.push(req.user._id);

    await currentUser.save({ session });
    await otherUser.save({ session });

    await session.commitTransaction();
    session.endSession();

    res.redirect("/requests");
  } catch (error) {
    await session.abortTransaction();
    session.endSession();
    // Handle error console.error("Error accepting friend request:", error);
    res.status(500).send("Error accepting friend request");
  }
});

In this example, mongoose.startSession() creates a new session and session.startTransaction() starts the transaction. All database operations pass session objects through .session(session). If all operations are successful, session.commitTransaction() commits the transaction; otherwise, session.abortTransaction() rolls back the transaction and revokes all changes.

Summarize

When processing friend requests, be sure to pay attention to the security of user ID and consider using the FriendRequest model to query the friend list to avoid data redundancy. If you need to explicitly maintain the friends array in the User model, be sure to use database transactions to ensure data consistency. Which method to choose depends on your specific needs and requirements for data consistency.

The above is the detailed content of How to add users to friends arrays in user mode. For more information, please follow other related articles on the PHP Chinese website!