Merge branch 'main' into session-cleanup

Author: indrasuthar07

backend/package-lock.json

@@ -20,7 +20,8 @@
     "express-rate-limit": "^8.2.1",
     "jsonwebtoken": "^9.0.2",
     "mongodb": "^6.20.0",
-    "mongoose": "^8.19.2",
+    "mongoose": "^8.19.4",
+    "multer": "^2.0.2",
     "node-cron": "^4.2.1",
     "passport": "^0.7.0",
     "passport-github2": "^0.1.12",
@@ -32,8 +33,10 @@
   "devDependencies": {
     "@types/bcryptjs": "^2.4.6",
     "@types/cookie-parser": "^1.4.10",
-    "@types/express": "^5.0.3",
+    "@types/cors": "^2.8.19",
+    "@types/express": "^5.0.5",
     "@types/jsonwebtoken": "^9.0.10",
+    "@types/multer": "^2.0.0",
     "@types/node": "^24.9.1",
     "@types/passport": "^1.0.17",
     "@types/passport-github2": "^1.2.9",

backend/package.json

@@ -6,35 +6,60 @@ import { errorHandler, notFoundHandler } from "./middleware/errorHandler.js";
 import { requestLogger } from "./middleware/requestLogger.js";
 import roomRoutes from "./routes/roomRoutes.js";
 import passport from "passport";
-import "./utils/passport.js"
-import cookieParser from 'cookie-parser';
+import "./utils/passport.js";
+import cookieParser from "cookie-parser";
 import cors from "cors";
+import path from "path";
+
 dotenv.config();
 const app = express();
 
 if (process.env.TRUST_PROXY === "true") {
   app.set("trust proxy", true);
 }
+// Required for __dirname in ES modules / TS
+// (TS compiles to CJS so this works fine)
+const __dirnameLocal = path.resolve();
+
 app.use(requestLogger);
 app.use(express.json());
-app.use(cookieParser()); // <-- Add this middleware HERE
+app.use(cookieParser());
+
+// CORS
 app.use(
   cors({
     origin: process.env.FRONTEND_URL || "http://localhost:5174",
     credentials: true,
     methods: ["GET", "POST", "PUT", "DELETE", "OPTIONS"],
   })
 );
-//initialize passport
+
+// Passport
 app.use(passport.initialize());
-// Routes
+
+// Uploaded avatars: stored in /uploads/avatars
+app.use(
+  "/avatars",
+  express.static(path.join(__dirnameLocal, "uploads", "avatars"))
+);
+
+// Default avatars: stored in /public/default-avatars
+app.use(
+  "/default-avatars",
+  express.static(path.join(__dirnameLocal, "public", "default-avatars"))
+);
+
+// -------------------------
+// API Routes
+// -------------------------
 app.use("/api/auth", authRoutes);
 app.use("/api/health", healthRoutes);
 app.use("/api/rooms", roomRoutes);
 
 // 404 handler
 app.use(notFoundHandler);
-// Error Handler
+
+// Error handler
 app.use(errorHandler);
 
 export default app;