Arnaud
a08588cf85
Previously every account without a custom avatar automatically got its email MD5-hashed and sent to gravatar.com at signup, with no way to turn it off. Adds users.useGravatar (default false): removed the automatic signup-time lookup entirely, and "remove photo" now falls back to the initials placeholder instead of silently re-deriving a Gravatar URL. New toggle in Settings -> Profile, off by default, description explains the MD5-hash-to-third-party tradeoff. Existing accounts' current avatarUrl is left untouched either way — no retroactive avatar changes for anyone already using one. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
72 lines
3.1 KiB
TypeScript
72 lines
3.1 KiB
TypeScript
import { NextResponse } from "next/server";
|
|
import { headers } from "next/headers";
|
|
import { auth } from "@/lib/auth/server";
|
|
import { db, users, eq } from "@epicure/db";
|
|
import { z } from "zod";
|
|
import { gravatarUrl } from "@/lib/gravatar";
|
|
import { USERNAME_PATTERN, isUsernameTaken } from "@/lib/username";
|
|
|
|
const PatchSchema = z.object({
|
|
name: z.string().min(1).max(100).optional(),
|
|
locale: z.string().max(10).optional(),
|
|
bio: z.string().max(500).optional().nullable(),
|
|
privateBio: z.string().max(2000).optional().nullable(),
|
|
isPrivate: z.boolean().optional(),
|
|
username: z.string().trim().toLowerCase().regex(USERNAME_PATTERN, "3-20 characters, lowercase letters, numbers, and underscores only").optional(),
|
|
// A custom-uploaded avatar URL, or null to revert to the initials fallback
|
|
// (or Gravatar, if useGravatar is on — see below).
|
|
avatarUrl: z.string().url().max(2048).optional().nullable(),
|
|
// Off by default (Settings → Profile) — Gravatar is looked up by an MD5
|
|
// hash of the user's email, sent to a third party.
|
|
useGravatar: z.boolean().optional(),
|
|
});
|
|
|
|
export async function PATCH(req: Request) {
|
|
const session = await auth.api.getSession({ headers: await headers() });
|
|
if (!session) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
|
|
|
|
const body = PatchSchema.safeParse(await req.json());
|
|
if (!body.success) return NextResponse.json({ error: body.error.flatten() }, { status: 400 });
|
|
|
|
if (body.data.username !== undefined && (await isUsernameTaken(body.data.username, session.user.id))) {
|
|
return NextResponse.json({ error: "Username already taken" }, { status: 409 });
|
|
}
|
|
|
|
const { avatarUrl, useGravatar, ...rest } = body.data;
|
|
const updates: Partial<typeof users.$inferInsert> = { ...rest };
|
|
|
|
// useGravatar is only ever toggled from the settings form, never alongside
|
|
// an avatar upload/removal in the same request — so it's fine for these
|
|
// two branches to each independently decide the resulting avatarUrl below.
|
|
if (useGravatar !== undefined) {
|
|
updates.useGravatar = useGravatar;
|
|
if (!(await hasCustomAvatar(session.user.id))) {
|
|
updates.avatarUrl = useGravatar ? gravatarUrl(session.user.email) : null;
|
|
}
|
|
}
|
|
|
|
if (avatarUrl !== undefined) {
|
|
if (avatarUrl === null) {
|
|
const gravatarOptedIn = useGravatar ?? (await getUseGravatar(session.user.id));
|
|
updates.avatarUrl = gravatarOptedIn ? gravatarUrl(session.user.email) : null;
|
|
updates.hasCustomAvatar = false;
|
|
} else {
|
|
updates.avatarUrl = avatarUrl;
|
|
updates.hasCustomAvatar = true;
|
|
}
|
|
}
|
|
|
|
await db.update(users).set(updates).where(eq(users.id, session.user.id));
|
|
return NextResponse.json({ ok: true, avatarUrl: updates.avatarUrl });
|
|
}
|
|
|
|
async function hasCustomAvatar(userId: string): Promise<boolean> {
|
|
const row = await db.query.users.findFirst({ where: eq(users.id, userId), columns: { hasCustomAvatar: true } });
|
|
return row?.hasCustomAvatar ?? false;
|
|
}
|
|
|
|
async function getUseGravatar(userId: string): Promise<boolean> {
|
|
const row = await db.query.users.findFirst({ where: eq(users.id, userId), columns: { useGravatar: true } });
|
|
return row?.useGravatar ?? false;
|
|
}
|