🌟 feat: Implement user management (CRUD, avatar upload), authentication routes, and API rate limiting with accompanying documentation.

Author: pphatdev

src/server/controllers/users.controller.ts

@@ -1,9 +1,11 @@
 import { Request, Response } from 'express';
+import multer from 'multer';
 import bcrypt from 'bcrypt';
-import { sendBadRequest, sendSuccess } from '../utils/response.js';
+import { sendBadRequest, sendSuccess, sendUnauthorized } from '../utils/response.js';
 import { query, queryOne, getSqliteClient } from '../utils/db.js';
 import { User } from '../types/user.js';
 import { getAuthConfig, logAuditEvent } from '../utils/auth.js';
+import { UploadController } from './upload.controller.js';
 
 export class UsersController {
     /**
@@ -262,4 +264,65 @@ export class UsersController {
             sendBadRequest(res, error.message || 'Failed to delete user.');
         }
     }
+
+    /**
+     * Upload user avatar
+     */
+    static async uploadAvatar(req: Request, res: Response): Promise<void> {
+        try {
+            const user = (req as any).user;
+            if (!user) {
+                sendUnauthorized(res, 'Authentication required.');
+                return;
+            }
+
+            const storage = 'avatars';
+            const upload = multer({
+                storage: UploadController.storage(storage),
+                limits: {
+                    fileSize: 5 * 1024 * 1024 // 5MB limit
+                },
+                fileFilter: (req, file, cb) => {
+                    const allowedTypes = ['image/jpeg', 'image/png', 'image/webp'];
+                    if (allowedTypes.includes(file.mimetype)) {
+                        cb(null, true);
+                    } else {
+                        cb(new Error('Invalid file type. Only JPG, PNG and WebP are allowed.'));
+                    }
+                }
+            }).single('avatar');
+
+            upload(req, res, async (err: any) => {
+                if (err instanceof multer.MulterError) {
+                    sendBadRequest(res, `Upload error: ${err.message}`);
+                    return;
+                } else if (err) {
+                    sendBadRequest(res, err.message);
+                    return;
+                }
+
+                if (!req.file) {
+                    sendBadRequest(res, 'No file uploaded.');
+                    return;
+                }
+
+                const avatarUrl = `/api/image/${req.file.filename}`;
+
+                // Update user avatar in database
+                const sqlite = getSqliteClient();
+                const stmt = sqlite.prepare('UPDATE users SET avatar = ?, updated_at = datetime(\'now\') WHERE id = ?');
+                stmt.run(avatarUrl, user.id);
+
+                await logAuditEvent(user.id, 'USER_AVATAR_UPLOADED', req, {
+                    avatarUrl
+                });
+
+                sendSuccess(res, { avatarUrl }, 'Avatar uploaded successfully');
+            });
+
+        } catch (error: any) {
+            console.error('Upload avatar error:', error);
+            sendBadRequest(res, error.message || 'Failed to upload avatar.');
+        }
+    }
 }

src/server/middlewares/rate-limit.ts

@@ -71,7 +71,7 @@ export const fileUploadRateLimiter = rateLimit({
  */
 export const loginRateLimiter = rateLimit({
     windowMs: limitedMins, // 15 minutes
-    max: 5, // 5 login attempts per window
+    max: 10, // 10 login attempts per window
     message: {
         status: 429,
         message: 'Too many login attempts. Please try again in 15 minutes.'

src/server/routes/auth.ts

@@ -15,8 +15,8 @@ const router = express.Router();
  * @returns { accessToken, refreshToken, expiresAt, refreshExpiresAt, user }
  * 
  * @security
- * - Rate limited to 5 attempts per 15 minutes
- * - Account lockout after 5 failed attempts
+ * - Rate limited to 10 attempts per 15 minutes
+ * - Account lockout after 10 failed attempts
  * - Bcrypt password hashing (12 rounds)
  * - JWT tokens with expiration
  */
@@ -122,4 +122,13 @@ router.put('/users/:userId', jwtAuthMiddleware, adminOnlyMiddleware, UsersContro
  */
 router.delete('/users/:userId', jwtAuthMiddleware, adminOnlyMiddleware, UsersController.deleteUser);
 
+/**
+ * Upload current user avatar
+ * 
+ * @method POST /api/auth/me/avatar
+ * @header Authorization: Bearer <accessToken>
+ * @body { avatar: File }
+ */
+router.post('/me/avatar', jwtAuthMiddleware, UsersController.uploadAvatar);
+
 export default router;