feat: implement Instagram clone SocialPhoto API

- FastAPI backend with SQLite database - JWT authentication (register, login) - User profiles with follow/unfollow - Posts with image upload and likes/dislikes - Comments with likes - Global and personalized feed - Comprehensive pytest test suite (37 tests) TASK-ID: 758f4029-702
2026-04-16 03:20:48 +00:00
parent 8cbc4000ac
commit a3eca3b7da
95 changed files with 2767 additions and 1 deletions
--- a/app/routes/posts.py
+++ b/app/routes/posts.py
@@ -0,0 +1,400 @@
+"""Post routes for SocialPhoto."""
+import os
+import sqlite3
+import uuid
+from pathlib import Path
+from typing import List, Optional
+
+from fastapi import APIRouter, Depends, File, Form, HTTPException, UploadFile, status
+from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
+from fastapi.staticfiles import StaticFiles
+from fastapi.responses import FileResponse
+
+from app.auth import get_current_user_id
+from app.database import get_db, row_to_dict
+from app.models import CommentCreate, CommentResponse, PostResponse
+
+router = APIRouter(prefix="/posts", tags=["Posts"])
+security = HTTPBearer()
+
+# Configuration
+UPLOAD_DIR = Path(__file__).parent.parent.parent / "uploads"
+MAX_FILE_SIZE = 10 * 1024 * 1024  # 10MB
+ALLOWED_EXTENSIONS = {".jpg", ".jpeg", ".png", ".gif", ".webp"}
+
+# Ensure upload directory exists
+UPLOAD_DIR.mkdir(parents=True, exist_ok=True)
+
+
+def _get_post_with_counts(conn: sqlite3.Connection, post_id: int) -> Optional[dict]:
+    """Get post data with like/dislike/comment counts."""
+    cursor = conn.cursor()
+    cursor.execute(
+        """
+        SELECT
+            p.id, p.user_id, u.username, p.image_path, p.caption, p.created_at,
+            (SELECT COUNT(*) FROM likes WHERE post_id = p.id) as likes_count,
+            (SELECT COUNT(*) FROM dislikes WHERE post_id = p.id) as dislikes_count,
+            (SELECT COUNT(*) FROM comments WHERE post_id = p.id) as comments_count
+        FROM posts p
+        JOIN users u ON p.user_id = u.id
+        WHERE p.id = ?
+        """,
+        (post_id,),
+    )
+    row = cursor.fetchone()
+    if not row:
+        return None
+    post = row_to_dict(row)
+    post["image_url"] = f"/uploads/{post['image_path'].split('/')[-1]}"
+    return post
+
+
+@router.post("", response_model=PostResponse, status_code=status.HTTP_201_CREATED)
+async def create_post(
+    caption: str = Form(""),
+    image: UploadFile = File(...),
+    credentials: HTTPAuthorizationCredentials = Depends(security),
+    conn: sqlite3.Connection = Depends(get_db),
+) -> PostResponse:
+    """Create a new post with image."""
+    user_id = await get_current_user_id(credentials)
+
+    # Validate file type
+    file_ext = Path(image.filename).suffix.lower()
+    if file_ext not in ALLOWED_EXTENSIONS:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail=f"File type not allowed. Allowed: {', '.join(ALLOWED_EXTENSIONS)}",
+        )
+
+    # Generate unique filename
+    unique_filename = f"{uuid.uuid4()}{file_ext}"
+    file_path = UPLOAD_DIR / unique_filename
+
+    # Save file
+    contents = await image.read()
+    if len(contents) > MAX_FILE_SIZE:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="File too large. Maximum size is 10MB",
+        )
+
+    with open(file_path, "wb") as f:
+        f.write(contents)
+
+    # Insert into database
+    cursor = conn.cursor()
+    cursor.execute(
+        "INSERT INTO posts (user_id, image_path, caption) VALUES (?, ?, ?)",
+        (user_id, str(file_path), caption),
+    )
+    conn.commit()
+    post_id = cursor.lastrowid
+
+    # Get the created post
+    post = _get_post_with_counts(conn, post_id)
+    return PostResponse(**post)
+
+
+@router.get("", response_model=List[PostResponse])
+async def get_posts(
+    limit: int = 20,
+    offset: int = 0,
+    conn: sqlite3.Connection = Depends(get_db),
+) -> List[PostResponse]:
+    """Get global feed of posts."""
+    cursor = conn.cursor()
+    cursor.execute(
+        """
+        SELECT
+            p.id, p.user_id, u.username, p.image_path, p.caption, p.created_at,
+            (SELECT COUNT(*) FROM likes WHERE post_id = p.id) as likes_count,
+            (SELECT COUNT(*) FROM dislikes WHERE post_id = p.id) as dislikes_count,
+            (SELECT COUNT(*) FROM comments WHERE post_id = p.id) as comments_count
+        FROM posts p
+        JOIN users u ON p.user_id = u.id
+        ORDER BY p.created_at DESC
+        LIMIT ? OFFSET ?
+        """,
+        (limit, offset),
+    )
+
+    posts = []
+    for row in cursor.fetchall():
+        post = row_to_dict(row)
+        posts.append(
+            PostResponse(
+                id=post["id"],
+                user_id=post["user_id"],
+                username=post["username"],
+                image_url=f"/uploads/{post['image_path'].split('/')[-1]}",
+                caption=post["caption"],
+                likes_count=post["likes_count"],
+                dislikes_count=post["dislikes_count"],
+                comments_count=post["comments_count"],
+                created_at=post["created_at"],
+            )
+        )
+
+    return posts
+
+
+@router.get("/{post_id}", response_model=PostResponse)
+async def get_post(
+    post_id: int,
+    conn: sqlite3.Connection = Depends(get_db),
+) -> PostResponse:
+    """Get a specific post."""
+    post = _get_post_with_counts(conn, post_id)
+    if not post:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="Post not found",
+        )
+    return PostResponse(**post)
+
+
+@router.delete("/{post_id}", status_code=status.HTTP_204_NO_CONTENT)
+async def delete_post(
+    post_id: int,
+    credentials: HTTPAuthorizationCredentials = Depends(security),
+    conn: sqlite3.Connection = Depends(get_db),
+) -> None:
+    """Delete a post (only by owner)."""
+    user_id = await get_current_user_id(credentials)
+    cursor = conn.cursor()
+
+    # Check post exists and belongs to user
+    cursor.execute("SELECT user_id, image_path FROM posts WHERE id = ?", (post_id,))
+    row = cursor.fetchone()
+    if not row:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="Post not found",
+        )
+
+    post = row_to_dict(row)
+    if post["user_id"] != user_id:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="You can only delete your own posts",
+        )
+
+    # Delete image file
+    image_path = Path(post["image_path"])
+    if image_path.exists():
+        image_path.unlink()
+
+    # Delete post (cascade deletes comments, likes, dislikes)
+    cursor.execute("DELETE FROM posts WHERE id = ?", (post_id,))
+    conn.commit()
+
+
+@router.post("/{post_id}/like", status_code=status.HTTP_201_CREATED)
+async def like_post(
+    post_id: int,
+    credentials: HTTPAuthorizationCredentials = Depends(security),
+    conn: sqlite3.Connection = Depends(get_db),
+) -> dict:
+    """Like a post."""
+    user_id = await get_current_user_id(credentials)
+    cursor = conn.cursor()
+
+    # Check post exists
+    cursor.execute("SELECT id FROM posts WHERE id = ?", (post_id,))
+    if not cursor.fetchone():
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="Post not found",
+        )
+
+    # Remove any existing dislike first
+    cursor.execute(
+        "DELETE FROM dislikes WHERE post_id = ? AND user_id = ?",
+        (post_id, user_id),
+    )
+
+    # Add like
+    try:
+        cursor.execute(
+            "INSERT INTO likes (post_id, user_id) VALUES (?, ?)",
+            (post_id, user_id),
+        )
+        conn.commit()
+    except sqlite3.IntegrityError:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="You already liked this post",
+        )
+
+    return {"message": "Post liked"}
+
+
+@router.delete("/{post_id}/like", status_code=status.HTTP_200_OK)
+async def unlike_post(
+    post_id: int,
+    credentials: HTTPAuthorizationCredentials = Depends(security),
+    conn: sqlite3.Connection = Depends(get_db),
+) -> dict:
+    """Remove like from a post."""
+    user_id = await get_current_user_id(credentials)
+    cursor = conn.cursor()
+
+    cursor.execute(
+        "DELETE FROM likes WHERE post_id = ? AND user_id = ?",
+        (post_id, user_id),
+    )
+    if cursor.rowcount == 0:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="You haven't liked this post",
+        )
+    conn.commit()
+
+    return {"message": "Like removed"}
+
+
+@router.post("/{post_id}/dislike", status_code=status.HTTP_201_CREATED)
+async def dislike_post(
+    post_id: int,
+    credentials: HTTPAuthorizationCredentials = Depends(security),
+    conn: sqlite3.Connection = Depends(get_db),
+) -> dict:
+    """Dislike a post."""
+    user_id = await get_current_user_id(credentials)
+    cursor = conn.cursor()
+
+    # Check post exists
+    cursor.execute("SELECT id FROM posts WHERE id = ?", (post_id,))
+    if not cursor.fetchone():
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="Post not found",
+        )
+
+    # Remove any existing like first
+    cursor.execute(
+        "DELETE FROM likes WHERE post_id = ? AND user_id = ?",
+        (post_id, user_id),
+    )
+
+    # Add dislike
+    try:
+        cursor.execute(
+            "INSERT INTO dislikes (post_id, user_id) VALUES (?, ?)",
+            (post_id, user_id),
+        )
+        conn.commit()
+    except sqlite3.IntegrityError:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="You already disliked this post",
+        )
+
+    return {"message": "Post disliked"}
+
+
+@router.delete("/{post_id}/dislike", status_code=status.HTTP_200_OK)
+async def undislike_post(
+    post_id: int,
+    credentials: HTTPAuthorizationCredentials = Depends(security),
+    conn: sqlite3.Connection = Depends(get_db),
+) -> dict:
+    """Remove dislike from a post."""
+    user_id = await get_current_user_id(credentials)
+    cursor = conn.cursor()
+
+    cursor.execute(
+        "DELETE FROM dislikes WHERE post_id = ? AND user_id = ?",
+        (post_id, user_id),
+    )
+    if cursor.rowcount == 0:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="You haven't disliked this post",
+        )
+    conn.commit()
+
+    return {"message": "Dislike removed"}
+
+
+@router.get("/{post_id}/comments", response_model=list[CommentResponse])
+async def get_post_comments(
+    post_id: int,
+    conn: sqlite3.Connection = Depends(get_db),
+) -> list[CommentResponse]:
+    """Get all comments for a post."""
+    cursor = conn.cursor()
+
+    # Check post exists
+    cursor.execute("SELECT id FROM posts WHERE id = ?", (post_id,))
+    if not cursor.fetchone():
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="Post not found",
+        )
+
+    cursor.execute(
+        """
+        SELECT
+            c.id, c.post_id, c.user_id, u.username, c.content, c.created_at,
+            (SELECT COUNT(*) FROM comment_likes WHERE comment_id = c.id) as likes_count
+        FROM comments c
+        JOIN users u ON c.user_id = u.id
+        WHERE c.post_id = ?
+        ORDER BY c.created_at ASC
+        """,
+        (post_id,),
+    )
+
+    comments = []
+    for row in cursor.fetchall():
+        comment = row_to_dict(row)
+        comments.append(CommentResponse(**comment))
+
+    return comments
+
+
+@router.post("/{post_id}/comments", response_model=CommentResponse, status_code=status.HTTP_201_CREATED)
+async def create_comment(
+    post_id: int,
+    comment_data: CommentCreate,
+    credentials: HTTPAuthorizationCredentials = Depends(security),
+    conn: sqlite3.Connection = Depends(get_db),
+) -> CommentResponse:
+    """Create a comment on a post."""
+    user_id = await get_current_user_id(credentials)
+    cursor = conn.cursor()
+
+    # Check post exists
+    cursor.execute("SELECT id FROM posts WHERE id = ?", (post_id,))
+    if not cursor.fetchone():
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="Post not found",
+        )
+
+    # Create comment
+    cursor.execute(
+        "INSERT INTO comments (post_id, user_id, content) VALUES (?, ?, ?)",
+        (post_id, user_id, comment_data.content),
+    )
+    conn.commit()
+    comment_id = cursor.lastrowid
+
+    # Get the created comment with user info
+    cursor.execute(
+        """
+        SELECT
+            c.id, c.post_id, c.user_id, u.username, c.content, c.created_at,
+            (SELECT COUNT(*) FROM comment_likes WHERE comment_id = c.id) as likes_count
+        FROM comments c
+        JOIN users u ON c.user_id = u.id
+        WHERE c.id = ?
+        """,
+        (comment_id,),
+    )
+    row = cursor.fetchone()
+    comment = row_to_dict(row)
+    return CommentResponse(**comment)