Arnaud
d7e0d7eada
New users get a Gravatar-backed avatar automatically (computed from email at signup); users can upload a custom photo instead via Settings, or revert to the Gravatar/initials fallback. avatarUrl stays the single resolved value (custom photo, OAuth photo, or precomputed Gravatar URL) so every existing avatar-rendering spot across the app needs zero changes. - users.hasCustomAvatar tracks whether avatarUrl is a real upload vs a computed Gravatar fallback, so "remove photo" knows what to revert to. - New /api/v1/upload/avatar-presign route (session-scoped, generic — the existing recipe-photo presign route required a recipeId). - CSP img-src needed www.gravatar.com added, or every browser blocks the fallback avatar outright. - Settings page now reads avatarUrl from a fresh DB query instead of Better Auth's session object — the session cookie cache (5 min TTL) was serving a stale image right after upload, showing the initials fallback until the cache happened to expire. Verified locally: signup auto-sets a Gravatar URL, upload persists across reload, remove correctly reverts to Gravatar/initials.
46 lines
1.7 KiB
TypeScript
46 lines
1.7 KiB
TypeScript
import { NextRequest, NextResponse } from "next/server";
|
|
import { z } from "zod";
|
|
import { requireSession } from "@/lib/api-auth";
|
|
import { createPresignedUploadUrl } from "@/lib/storage";
|
|
import { checkAndIncrementTierLimit, TierLimitError } from "@/lib/tiers";
|
|
|
|
const ALLOWED_TYPES = ["image/jpeg", "image/png", "image/webp", "image/avif"] as const;
|
|
type AllowedType = (typeof ALLOWED_TYPES)[number];
|
|
const MAX_FILE_SIZE = 5 * 1024 * 1024;
|
|
|
|
const Schema = z.object({
|
|
contentType: z.string().refine((t): t is AllowedType => (ALLOWED_TYPES as readonly string[]).includes(t), {
|
|
message: "Content type must be jpeg, png, webp, or avif",
|
|
}),
|
|
fileSize: z.number().int().positive().max(MAX_FILE_SIZE, "File exceeds 5MB limit"),
|
|
});
|
|
|
|
export async function POST(req: NextRequest) {
|
|
const { session, response } = await requireSession();
|
|
if (response) return response;
|
|
|
|
const body = await req.json() as unknown;
|
|
const parsed = Schema.safeParse(body);
|
|
if (!parsed.success) {
|
|
return NextResponse.json({ error: "Validation error", issues: parsed.error.issues }, { status: 400 });
|
|
}
|
|
|
|
const { contentType, fileSize } = parsed.data;
|
|
|
|
try {
|
|
const sizeMb = Math.ceil(fileSize / (1024 * 1024));
|
|
await checkAndIncrementTierLimit(session!.user.id, session!.user.tier as "free" | "pro", "storage", sizeMb);
|
|
} catch (err) {
|
|
if (err instanceof TierLimitError) {
|
|
return NextResponse.json({ error: "Storage limit reached for your tier" }, { status: 403 });
|
|
}
|
|
throw err;
|
|
}
|
|
|
|
const ext = contentType.split("/")[1] ?? "jpg";
|
|
const key = `user-avatars/${session!.user.id}/${crypto.randomUUID()}.${ext}`;
|
|
const url = await createPresignedUploadUrl(key, contentType);
|
|
|
|
return NextResponse.json({ url, key });
|
|
}
|