diff --git a/packages/backend/models/user.js b/packages/backend/models/user.js
index bdf3585..bb6a2ed 100644
--- a/packages/backend/models/user.js
+++ b/packages/backend/models/user.js
@@ -19,6 +19,7 @@ const dayNames = [
"saturday",
"sunday",
];
+
//user's weekly availability, including days, start time, end time, and timezone
const scheduleSchema = new mongoose.Schema(
{
@@ -95,7 +96,6 @@ const userSchema = new mongoose.Schema(
default: null,
},
- // From the diagram
firstName: {
type: String,
default: "",
@@ -142,9 +142,22 @@ const userSchema = new mongoose.Schema(
},
interests: {
- type: String,
- default: "",
- trim: true,
+ type: [
+ {
+ type: String,
+ trim: true,
+ maxlength: [24, "Each interest must be 24 characters or less"],
+ match: [
+ /^[a-zA-Z0-9 '&-]+$/,
+ "Interests can only contain letters, numbers, spaces, apostrophes, ampersands, and hyphens",
+ ],
+ },
+ ],
+ default: [],
+ validate: {
+ validator: (interests) => interests.length <= 10,
+ message: "You can only add up to 10 interests",
+ },
},
profileVisibility: {
@@ -152,6 +165,18 @@ const userSchema = new mongoose.Schema(
enum: ["public", "groups", "private"],
default: "private",
},
+
+ featureSettings: {
+ groupsEnabled: {
+ type: Boolean,
+ default: true,
+ },
+
+ leaderboardEnabled: {
+ type: Boolean,
+ default: true,
+ },
+ },
},
{
timestamps: true,
diff --git a/packages/backend/routes/leaderboard.js b/packages/backend/routes/leaderboard.js
index 1962124..bdd38cc 100644
--- a/packages/backend/routes/leaderboard.js
+++ b/packages/backend/routes/leaderboard.js
@@ -7,7 +7,7 @@ import Group from "../models/group.js";
const DEFAULT_LIMIT = 5;
const MAX_LIMIT = 50;
-//parse and cap leaderboard limit
+//parses and caps leaderboard limit, falling back to default if invalid
export function getLeaderboardLimit(rawLimit) {
const parsedLimit = Number.parseInt(rawLimit, 10);
@@ -17,10 +17,12 @@ export function getLeaderboardLimit(rawLimit) {
return Math.min(parsedLimit, MAX_LIMIT);
}
+
//gets user id as a string from either a user object or raw id
function getUserId(user) {
return user?._id?.toString?.() || user?.toString?.() || String(user || "");
}
+
//converts users into ranked leaderboard entries and marks the current user
export function mapUsersToLeaderboardEntries(users, currentUserId) {
return users.map((user, index) => {
@@ -50,16 +52,15 @@ export async function leaderboardHandler(req, res) {
let users;
if (scope === "group" && groupId) {
- // Validate groupId format
if (!mongoose.Types.ObjectId.isValid(groupId)) {
return res.status(400).json({ error: "Invalid group ID" });
}
- // Fetch the group and get its users
const group = await Group.findById(groupId)
.populate({
path: "users",
- select: "name email totalHours",
+ match: { profileVisibility: { $in: ["public", "groups"] } },
+ select: "name email totalHours profileVisibility",
options: { sort: { totalHours: -1, name: 1 }, limit },
})
.lean();
@@ -70,11 +71,13 @@ export async function leaderboardHandler(req, res) {
users = group.users || [];
} else {
- // Global leaderboard
- users = await User.find()
+ //global leaderboard only shows public users
+ users = await User.find({
+ profileVisibility: "public",
+ })
.sort({ totalHours: -1, name: 1 })
.limit(limit)
- .select("name email totalHours")
+ .select("name email totalHours profileVisibility")
.lean();
}
diff --git a/packages/backend/routes/users.js b/packages/backend/routes/users.js
index 77f612d..649caa8 100644
--- a/packages/backend/routes/users.js
+++ b/packages/backend/routes/users.js
@@ -17,12 +17,12 @@ const allowedUserUpdateFields = [
"schedule",
"commitmentLevel",
"age",
+ "interests",
+ "profileVisibility",
+ "featureSettings",
"totalHours",
"weeklyHours",
"todayHours",
- "interests",
- "isProfilePublic",
- "profileVisibility",
];
const commitmentGoals = {
@@ -170,25 +170,42 @@ router.get("/:userParam/groups", async (req, res) => {
}
});
-//get public profile for one user
+//get profile viewer data for one user
router.get("/:userParam/public", requireAuth, async (req, res) => {
try {
- const user = await User.findOne(getUserFilter(req.params.userParam)).select(
- "name age interests isProfilePublic totalHours",
- );
+ const profileUser = await User.findOne(
+ getUserFilter(req.params.userParam),
+ ).select("name age interests profileVisibility totalHours groups");
- if (!user) {
+ if (!profileUser) {
return res.status(404).json({ error: "User not found" });
}
+ const viewer = await User.findById(req.auth.userId).select("groups");
+
+ const visibility = profileUser.profileVisibility || "private";
+ const isSelf = profileUser._id.toString() === req.auth.userId;
+
+ const viewerGroups = new Set((viewer?.groups || []).map(String));
+ const profileUserGroups = (profileUser.groups || []).map(String);
+
+ const sharesGroup = profileUserGroups.some((groupId) =>
+ viewerGroups.has(groupId),
+ );
+
+ const canViewDetails =
+ isSelf ||
+ visibility === "public" ||
+ (visibility === "groups" && sharesGroup);
+
return res.json({
user: {
- _id: user._id,
- name: user.name,
- totalHours: user.totalHours || 0,
- isProfilePublic: user.isProfilePublic,
- age: user.isProfilePublic ? user.age || null : null,
- interests: user.isProfilePublic ? user.interests || "" : "",
+ _id: profileUser._id,
+ name: profileUser.name,
+ totalHours: profileUser.totalHours || 0,
+ profileVisibility: visibility,
+ age: canViewDetails ? profileUser.age || null : null,
+ interests: canViewDetails ? profileUser.interests || [] : [],
},
});
} catch (error) {
@@ -214,8 +231,19 @@ router.get("/:userParam", async (req, res) => {
});
//update user by id or email
-router.put("/:userParam", async (req, res) => {
+router.put("/:userParam", requireAuth, async (req, res) => {
try {
+ const filter = getUserFilter(req.params.userParam);
+ const targetUser = await User.findOne(filter).select("_id");
+
+ if (!targetUser) {
+ return res.status(404).json({ error: "User not found" });
+ }
+
+ if (targetUser._id.toString() !== req.auth.userId) {
+ return res.status(403).json({ error: "You can only update yourself" });
+ }
+
const updates = getAllowedUpdates(req.body, allowedUserUpdateFields);
if (Object.keys(updates).length === 0) {
@@ -224,18 +252,10 @@ router.put("/:userParam", async (req, res) => {
});
}
- const user = await User.findOneAndUpdate(
- getUserFilter(req.params.userParam),
- updates,
- {
- new: true,
- runValidators: true,
- },
- ).populate("groups");
-
- if (!user) {
- return res.status(404).json({ error: "User not found" });
- }
+ const user = await User.findByIdAndUpdate(targetUser._id, updates, {
+ new: true,
+ runValidators: true,
+ }).populate("groups");
return res.json(user);
} catch (error) {
diff --git a/packages/frontend/src/components/CreateGroup.jsx b/packages/frontend/src/components/CreateGroup.jsx
index edc59f5..000d514 100644
--- a/packages/frontend/src/components/CreateGroup.jsx
+++ b/packages/frontend/src/components/CreateGroup.jsx
@@ -42,7 +42,14 @@ function CreateGroup() {
if (!res.ok) throw new Error("Not logged in");
return res.json();
})
- .then((data) => setUser(data.user))
+ .then((data) => {
+ if (data.user?.featureSettings?.groupsEnabled === false) {
+ navigate("/dashboard");
+ return;
+ }
+
+ setUser(data.user);
+ })
.catch(() => navigate("/login"));
}, [navigate]);
diff --git a/packages/frontend/src/components/Dashboard.jsx b/packages/frontend/src/components/Dashboard.jsx
index e724117..3808410 100644
--- a/packages/frontend/src/components/Dashboard.jsx
+++ b/packages/frontend/src/components/Dashboard.jsx
@@ -91,9 +91,11 @@ const Dashboard = () => {
{dateString}
-
- Groups
-
+ {user?.featureSettings?.groupsEnabled !== false && (
+
+ Groups
+
+ )}
Profile
@@ -136,7 +138,9 @@ const Dashboard = () => {
-
-
- setForm((current) => ({
- ...current,
- interests: e.target.value,
- }))
- }
- />
-
-
-
- #{user._id ? user._id.slice(-4) : "—"}
-
+
{user._id || "—"}
@@ -224,6 +297,109 @@ function Profile() {
+
+
Feature Controls
+
+ Enable or disable features for your account.
+
+
+
+
+
+
+
+
+
Interests
+
+
+ setInterestInput(e.target.value)}
+ onKeyDown={(e) => {
+ if (e.key === "Enter") {
+ e.preventDefault();
+ handleAddInterest();
+ }
+ }}
+ />
+
+
+
+
+
+ {form.interests.length === 0 ? (
+
No interests added yet.
+ ) : (
+ form.interests.map((interest) => (
+
+ {interest}
+
+
+ ))
+ )}
+
+
{message}
}
{error && {error}
}
diff --git a/packages/tests/backend/leaderboard.test.js b/packages/tests/backend/leaderboard.test.js
index 5f10d99..17b3815 100644
--- a/packages/tests/backend/leaderboard.test.js
+++ b/packages/tests/backend/leaderboard.test.js
@@ -60,10 +60,14 @@ describe("leaderboard route handler", () => {
res,
);
- expect(User.find).toHaveBeenCalledOnce();
- expect(userQuery.sort).toHaveBeenCalledWith({ totalHours: -1, name: 1 });
- expect(userQuery.limit).toHaveBeenCalledWith(2);
- expect(userQuery.select).toHaveBeenCalledWith("name email totalHours");
+ expect(User.find).toHaveBeenCalledWith({
+ profileVisibility: "public",
+ });
+ expect(userQuery.sort).toHaveBeenCalledWith({ totalHours: -1, name: 1 });
+ expect(userQuery.limit).toHaveBeenCalledWith(2);
+ expect(userQuery.select).toHaveBeenCalledWith(
+ "name email totalHours profileVisibility",
+ );
expect(res.json).toHaveBeenCalledWith({
scope: "global",
entries: [