MongoDB + NodeJS + Express - 用戶可以將朋友請求發送給已經是他們的朋友的人

Question

我目前有一個用戶系統，用戶可以將其他朋友添加爲朋友。這是我的路線：

app.post("/addFriend", function(req, res) { 
var conditions = { 
    $or: [ 
     {$and: [ 
      {username: req.body.globalUserName}, 
      {$or: [ 
       {'pendingFriends._id': {$ne: req.user._id}}, 
       {'friends._id': {$ne: req.user._id}} 
      ]} 
     ]}, 
     {$and: [ 
      {username: req.user.username}, 
      {$or: [ 
       {'pendingFriends._id': {$ne: req.body.globalUserId}}, 
       {'friends._id': {$ne: req.body.globalUserId}} 
      ]} 
     ]} 
    ] 
} 
var update = { 
    $addToSet: {pendingFriends: { _id: req.user._id, username: req.user.username, language: req.user.language, profilePicture: req.user.profilePicture}} 
} 

User.findOneAndUpdate(conditions, update, function(error, doc) { 
     if(error) { 
      console.log(currentTime + " - FRIEND_REQUEST_SEND_ERROR: '" + req.user.username + "' TRIED TO SEND A FRIEND REQUEST TO '" + req.body.globalUserName + "'"); 
     } 
     else { 
      console.log(currentTime + " - FRIEND_REQUEST_SENT: '" + req.user.username + "' SENT A FRIEND REQUEST TO '" + req.body.globalUserName + "'"); 
     } 
     res.redirect("/talk"); 
    }); 
}); 

所以這就是它的工作原理。

U1向U2發送好友請求。

U1被添加到U2的pendingFriends中。

如果U2接受，U1轉到U2的朋友，U2轉到U1的朋友。

但是，我現在有兩個錯誤，我知道。如果U1向U2發送好友請求，而U1在U2的pendingFriends中，則U2可以向U1發送好友請求。另外，如果U1向U2發送好友請求，U2接受後，U1和U2仍然可以向對方發送好友請求。

我該如何解決這個問題？順便說一下，req.user是執行操作的用戶（發送表單等）。 req.body.globalUserId是執行操作的用戶試圖添加的用戶的ID。

EDIT（用戶通過用戶請求模式）：

UserSchema = new mongoose.Schema({ 
    username: String, 
    email: String, 
    password: String, 
    language: { type: String, default: "English" }, 
    profilePicture: { type: String, default: "/images/talk/blank-profile-picture.png" }, 
    status: String, 
    pendingFriends: [this], 
    friends: [this] 
}) 

Answer 1

U1 =與用戶名用戶=> req.body.globalUserName

U2 =登錄用戶

查詢查找：

U1 IF U2 is not a pending friend OR U2 is not a friend 

OR

U2 IF U1 is not a pending friend OR U1 is not a friend 

更新會發現只有那些用戶之一，並添加U1他們pendingFriends 例如，如果U2發送到U1的請求，而U1不存在於系統中，U2將自理給自己加pendingfriends

我們實際上不想找到U2，我們只是想確保U1不是U2的朋友/未成年人。

正確的查詢是沿

let U2PendingFriendIds = array of all U2's pending friends ids 
let U2FriendIds = array of all U2's friends ids 

var conditions = { 
    $or: [ 
     {$and: [ 
      {_id: {$nin: U2PendingFriendIds}, // not a pending friend of U2 
      {_id: {$nin: U2FriendIds},  // not a friend of U2 
      {username: req.body.globalUserName}, 
      {'pendingFriends._id': {$ne: req.user._id}}, // U2 is not a pending friend 
      {'friends._id': {$ne: req.user._id}}   // U2 is not a friend 
     ]} 
    ] 
} 

Answer 2

線終於定了！這裏是我的代碼：

app.post("/addFriend", function(req, res) { 
    var pendingIds, friendIds; 
    if (req.user.pendingFriends.length > 0) { 
     pendingIds = new Array(req.user.pendingFriends.length - 1); 
     req.user.pendingFriends.forEach(function (pendingFriend) { 
      pendingIds.push(pendingFriend._id); 
      console.log("Pending friend id: " + pendingFriend._id); 
     }) 
    } 
    if (req.user.friends.length > 0) { 
     friendIds = new Array(req.user.friends.length - 1); 
     req.user.friends.forEach(function (friend) { 
      friendIds.push(friend._id); 
      console.log("Friend id: " + friend._id); 
     }) 
    } 
    var conditions = { 
     $or: [ 
      {$and: [ 
       {_id: {$nin: pendingIds}}, // not a pending friend of U2 
       {_id: {$nin: friendIds}},  // not a friend of U2 
       {username: req.body.globalUserName}, 
       {'pendingFriends._id.toString()': {$ne: req.user._id.toString()}}, // U2 is not a pending friend 
       {'friends._id.toString()': {$ne: req.user._id.toString()}}   // U2 is not a friend 
      ]} 
     ] 
    } 
    var update = { 
     $addToSet: {pendingFriends: { _id: req.user._id.toString(), username: req.user.username, language: req.user.language, profilePicture: req.user.profilePicture}} 
    } 

    User.findOneAndUpdate(conditions, update, function(error, doc) { 
     if(error) { 
      console.log(currentTime + " - FRIEND_REQUEST_SEND_ERROR: '" + req.user.username + "' TRIED TO SEND A FRIEND REQUEST TO '" + req.body.globalUserName + "'"); 
     } 
     else { 
      console.log(currentTime + " - FRIEND_REQUEST_SENT: '" + req.user.username + "' SENT A FRIEND REQUEST TO '" + req.body.globalUserName + "'"); 
     } 
     res.redirect("/talk"); 
    }); 
}); 

Answer 3

我剛剛發現的一個資源是一個npm模塊，它有利於所有友誼功能。你可以在這裏找到它：https://www.npmjs.com/package/mongoose-friends

我意識到你已經有了你的代碼設置來添加朋友，但是這個模塊可能是一種替代的攻擊方法，可以幫助你減少處理代碼和簡化閱讀的麻煩。只有當你感興趣的時候。