Arnaud
d7e0d7eada
New users get a Gravatar-backed avatar automatically (computed from email at signup); users can upload a custom photo instead via Settings, or revert to the Gravatar/initials fallback. avatarUrl stays the single resolved value (custom photo, OAuth photo, or precomputed Gravatar URL) so every existing avatar-rendering spot across the app needs zero changes. - users.hasCustomAvatar tracks whether avatarUrl is a real upload vs a computed Gravatar fallback, so "remove photo" knows what to revert to. - New /api/v1/upload/avatar-presign route (session-scoped, generic — the existing recipe-photo presign route required a recipeId). - CSP img-src needed www.gravatar.com added, or every browser blocks the fallback avatar outright. - Settings page now reads avatarUrl from a fresh DB query instead of Better Auth's session object — the session cookie cache (5 min TTL) was serving a stale image right after upload, showing the initials fallback until the cache happened to expire. Verified locally: signup auto-sets a Gravatar URL, upload persists across reload, remove correctly reverts to Gravatar/initials.
40 lines
1.5 KiB
TypeScript
40 lines
1.5 KiB
TypeScript
import { NextResponse } from "next/server";
|
|
import { headers } from "next/headers";
|
|
import { auth } from "@/lib/auth/server";
|
|
import { db, users, eq } from "@epicure/db";
|
|
import { z } from "zod";
|
|
import { gravatarUrl } from "@/lib/gravatar";
|
|
|
|
const PatchSchema = z.object({
|
|
name: z.string().min(1).max(100).optional(),
|
|
locale: z.string().max(10).optional(),
|
|
bio: z.string().max(500).optional().nullable(),
|
|
privateBio: z.string().max(2000).optional().nullable(),
|
|
isPrivate: z.boolean().optional(),
|
|
// A custom-uploaded avatar URL, or null to revert to the Gravatar fallback.
|
|
avatarUrl: z.string().url().max(2048).optional().nullable(),
|
|
});
|
|
|
|
export async function PATCH(req: Request) {
|
|
const session = await auth.api.getSession({ headers: await headers() });
|
|
if (!session) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
|
|
|
|
const body = PatchSchema.safeParse(await req.json());
|
|
if (!body.success) return NextResponse.json({ error: body.error.flatten() }, { status: 400 });
|
|
|
|
const { avatarUrl, ...rest } = body.data;
|
|
const updates: Partial<typeof users.$inferInsert> = { ...rest };
|
|
if (avatarUrl !== undefined) {
|
|
if (avatarUrl === null) {
|
|
updates.avatarUrl = gravatarUrl(session.user.email);
|
|
updates.hasCustomAvatar = false;
|
|
} else {
|
|
updates.avatarUrl = avatarUrl;
|
|
updates.hasCustomAvatar = true;
|
|
}
|
|
}
|
|
|
|
await db.update(users).set(updates).where(eq(users.id, session.user.id));
|
|
return NextResponse.json({ ok: true, avatarUrl: updates.avatarUrl });
|
|
}
|