API endpoints
-------------
+ **[/auth/](#auth)**
+ **[/api/user/](#user)**
+ **[/api/media/](#media)**
+ **[/api/discover/](#discover)**
+ **[/api/message/](#message)**
+ **[/api/notification/](#notification)**

Common Data Structure
------------------------
__{profile}__ user's public profile
* _id
* name
* username
* avatar
    * small:  url string, used in most places
    * large: url string, used in user's home page
* details
    * slogan
    * intro
    * hashtags
    * organization
    * region
    * email (default is private, user can choose to public it, may not same as account email)
    * phone (default is private, user can choose to public it)
    * address (default is private, user can choose to public it)
* stats

user stats:
* images: number
* videos: number
* models: number (unused currently)
* albums: number
* followers: number
* followings: number

__{profileSelf}__ user's self profile, including all necessary fields, only him/herself can see
* _id
* name
* username
* email
* avatar
    * small:  url string, used in most places
    * large: url string, used in user's home page
* details
    * slogan
    * intro
    * hashtags
    * organization
    * region
    * email
    * phone
    * address
    * location
* stats
* role

__{profileBasic}__ user's basic profile, displayed in name card (like the ones in feeds page), or search results etc.
* _id
* name
* username
* avatar
    * small:  url string, used in most places
    * large: url string, used in user's home page

__{media}__ media info
* _id
* author: {profileBasic}
* description: string
* hashtags: array, like ['#aaa', '#bbb', '#ccc']
* stats
* status: one of 'normal', 'pending', 'error', 'deleted'
* type: one of 'image', 'video', 'model'
* thumbnail
    * small: url string, used on mobile device; for video, this is an url array
    * large: url string, used on big screen device; for video, this is an url array
* url
    * small: url string, used on mobile device and desktop
    * large: url string, for desktop fullscreen

media stats:
* likes: number
* favors: number
* shares: number
* comments: number
* views: number

for media status:
* 'normal' means everything is ok
* 'pending' means media is under processing, thumbnail is available, url is not
* 'error' means something wrong happens, thumbnail and url may not available, should delete it
* 'deleted' means media been deleted, client side should never receive such media

Pagination
----------
All GET apis that return array will be paginated.

Pagination Parameter:
* from: number or an id, next page will start from here (exclusive), optional
* limit: number, maximal results returned, optional

Return Format
--------------
All APIs return JSON data with status 200, or empty with status 204, or error

error format:
* status: status code
* msg: a msg explains the error, can be displayed directly


/auth/
------

__POST__ /auth/local
auth local user, after successful auth, token will be set in cookie, also returned. following api calls can be authed by Authorization header or access_token query parameter

Body Parameter
* email
* password

Response
* token: access token for following api calls
* config: config for firebase(or wilddog), including token, url

__GET__ /auth/facebook/
auth user with facebook login

__GET__ /auth/facebook/callback
set token cookie

Query Parameter
* code

__GET__ /auth/twitter/
auth user with twitter login

__GET__ /auth/twitter/callback
set token cookie

Query Parameter
* oauth_token
* oauth_verifier

__GET__ /auth/google/
auth user with google login

__GET__ /auth/google/callback
set token cookie

Query Parameter
* oauth_token?
* oauth_verifier?

/user/
------

__POST__ /api/user/
create user account

Body Parameter
* name
* email
* password
* hashtags
* intro (optional)
* hashtags (optional)
* address (optional)
* phone (optional)

Response
* token: token string

__DELETE__ /api/user/
delete user account

Body Parameter
* id: user id

Response
* null


__GET__ /api/user/profile
get user profile

Query parameter
* id: user id, optional, default is current user (req.user._id)

Response
* {profile} or {profileSelf}

__POST__ /api/user/profile
update user profile

Body Parameter
* {profile}: partial fields, only those changed

Response
* {profile}: new profile


__POST__ /api/user/follow
follow a user

Body Parameter
* id: user id of the other user

Response
* null

__POST__ /api/user/unfollow
unfollow a user

Body Parameter
* id: user id of the other user

Response
* null

__POST__ /api/user/block
block a user

Body Parameter
* id: user id of the other user

Response
* null

__POST__ /api/user/unblock
unblock a user

Body Parameter
* id: user id of the other user

Response
* null

__GET__ /api/user/followers
get user's followers

Body Parameter
* id: user id, optional, default is current user
* from: user id or number
* limit: number

Response
* [{profileBasic}]: array of users

__GET__ /api/user/followings
get users that a user is following

Body Parameter
* id: user id, optional, default is current user
* from: user id or number
* limit: number

Response
* [{profileBasic}]: array of users

__POST__ /api/user/password
set user's new password

Body Parameter
* oldPassword: old password
* newPassword: new password

Response
* null

__POST__ /api/user/setting
update user setting

Body Parameter
* {setting}: partial fields, only those changed

Response
* {setting}: new setting

/media/
-------
__GET__ /api/media/
get media. if id specified, all other parameters will be discarded, return a single media with that id; if userId specified, return medias of that user

Query Parameter
* id: media id, if specified, omit all other parameters
* userId: user id
* from: media id or number
* limit: number

Response
* {media} or [{media}]

__DELETE__ /api/media/
delete a media

Body Parameter
* id: media id

Response:
* null

__POST__ /api/media/upload
upload media

Body Parameter
* type: upload type, must be one of "image", "video", "model"
* description: description of the media
* hashtags: hashtags, auto detected tags or user input
* location: media location, obtained from media exif info or user input

Response
* {media}: newly created media

__POST__ /api/media/update
update media

Body Parameter
* {media}: partial fields, only those changed

Response
* {media}: updated media

__POST__ /api/media/like
like a media

Body Parameter
* id: media id

Response
* null

__POST__ /api/media/unlike
unlike a media

Body Parameter
* id: media id

Response
* null

__POST__ /api/media/favor
favor a media

Body Parameter
* id: media id

Response
* null

__POST__ /api/media/unfavor
unfavor a media

Body Parameter
* id: media id

Response
* null

__GET__ /api/media/comments
get comments of a media

Query Parameter
* id: media id
* from: comment id or number
* limit: number

Response
* [{comment}]: array of comments on the media

__POST__ /api/media/comment
comment on a media

Body Parameter
* content: comment content

Response
* {comment}: the new comment


__DELETE__ /api/media/comment
delete a comment on a media, only user self can

Body Parameter
* id: comment id

Response
* null

__POST__ /api/media/tagging
auto detect tags from media, works only for image

Body Parameter
* data: dataURI in base64 form

Response
* [{autotag}]

media autotag
* name: string
* confidence: number, how sure image qualifies this tag

/discover/
----------
__GET__ /api/discover
discover (search/recommend) user and/or media

Query Parameter
* type: 'user' or 'media', return both if not specified or not these two values
* q: query string, optional, if specified, return search results; otherwise return recommended results
* name: name of user
* hashtags: hashtags of user/media
* description: description of media
* author: name of media author
* from: id (not user id or media id, it's the id generated by elasticsearch)
* limit: number

user may do fields search by typing 'restaurant #newyork description:Japanese' in search input, which specifies a search of 'restaurant' that has '#newyork' hashtag and 'Japanese' in description. this is equivalent to q=restaurant&hashtags=#newyork&description=Japanese

Response
* [{profileBasic|media}]

NOT FINISHED
-------------------------
__GET /api/discover/feed
get feed for current user

Query Parameter
* type: 'timeline', 'user', 'notification'
* from: id (not user id or media id, generated by stream)
* limit: number

Response
* [{activity}]

__{activity}__ feed activity
* actor: user that triggered this activity
* id: id of this activity, for paging use
* verb: 'post', 'like', 'share', 'comment', 'follow', etc.
* media: {media}
* user: {profile}

/message/
----------
When user logged in, a firebase access token is returned, messages can be retrieved directly from firebase using this token. New messages are automatically sent from firebase via web socket.
Two users can send messages to each other in a chat room. Group chat is not supported. User will receive new msg alert if he/she is not in the chat room.

__POST__ /api/message/
create or reuse a chat room for current user and user with userId

Body Parameter
* userId: id of the other user

Response
* roomId: chat room id

__DELETE__ /api/message/
user indicates to delete a chat room. Chat room will be deleted only if both users have indicated to do so. If one user did so, a marker will be stored in firebase database, he/she will no long see message history with same the other user even if he/she or the other user continues the conversation, but the other user is not affected.

Body Parameter
* roomId: chat room id


/notification/
-------------
When user logged in, a firebase access token is returned, notifications can be retrieved directly from firebase using this token. New notifications are automatically sent from firebase via web socket.

__POST__ /api/notification/mute
mute a notification

Body Parameter
* id: notification id

Response
* null

__POST__ /api/notification/markRead
mark a notification read

Body Parameter
* id: notification id

Response
* null

__DELETE__ /api/notification/
delete a notification

Body Parameter
* id: notification id

Response
* null