Files
calendar/packages/lib/server/avatar.ts
T
5acdb208f5 feat: enhance image upload validation across the application (#22766)
* feat: enhance image upload validation across the application

* Patch improvements.

* refactor: streamline avatar upload error handling in updateProfile handler

* refactor: extract image validation logic into a separate module for reuse in BannerUploader and ImageUploader

* fix: reset file input value on validation failure in image uploaders

* fix: update localization key for image file upload error message

* fix: update HTML content validation in image uploader to check for additional byte

* Code Quality improvements

* add : unit tests.

* fix : fixing some more issues.

* fix : some import fixes

* fix : fixing type-check issues

* fix : some more import fixes.

* fix : removing Duplicate max-file-size constant

* refactor: enhance base64 validation with regex pattern

* refactor: centralize MAX_IMAGE_FILE_SIZE and fix SVG checks.

* fix : some toast fixes.

* fixing the size of the banner.

* fix: update accepted image formats in BannerUploader and ImageUploader components

* fix

* coderabbit suggestions addressed.

* addressed coderrabit comment

* refactor: implement generic i18n error messages with interpolation

- Add generic 'unsupported_file_type' translation key with {{type}} interpolation
- Replace hardcoded file type error messages with reusable i18n pattern
- Update imageValidation interfaces to support errorKey and errorParams
- Refactor server-side and client-side validation to use new pattern
- Remove individual translation keys for each file type (PDF, HTML, Script, ZIP, Executable)
- Add new translation keys for other validation errors (SVG, base64, empty data, etc.)
- Type-safe error handling with proper interpolation support

Benefits:
- Single reusable translation pattern reduces duplication
- Easier to maintain and localize
- Consistent error messaging across file types

* feat: add MAX_BANNER_SIZE constant and update file size validation

- Add MAX_BANNER_SIZE constant (5MB) to shared constants file
- Update BannerUploader to use shared constant instead of inline value
- Update ImageUploader to handle new errorKey/errorParams pattern
- Maintain backward compatibility with existing error handling

Note: Pre-existing linting warnings in constants.ts and BannerUploader.tsx
are unrelated to these changes and were present before this refactor.

* adressed volnei's suggestions.

* test: update image validation tests for new errorKey/errorParams pattern

- Update all dangerous file type tests to expect errorKey and errorParams instead of hardcoded error messages
- Add comprehensive tests for new error format validation pattern
- Add tests for backward compatibility with error field
- Add tests for MAX_BANNER_SIZE constant integration
- Verify that unsupported file types now return generic 'unsupported_file_type' key with type interpolation
- Ensure all existing functionality continues to work with enhanced error handling

All 42 tests passing 

* test: update server-side image validation tests for new error format

- Update all dangerous file type tests to expect errorKey and errorParams
- Change hardcoded error messages to i18n keys (unsupported_file_type, svg_contains_dangerous_content, etc.)
- Update edge case tests to use new error keys (empty_image_data, invalid_base64_format, unrecognized_image_format)
- Add comprehensive tests for new error format validation pattern
- Add tests for backward compatibility with error field
- Verify that unsupported file types return generic 'unsupported_file_type' key with type interpolation

All 26 server-side tests passing 
Complements client-side test updates for complete test coverage

---------

Co-authored-by: Anik Dhabal Babu <81948346+anikdhabal@users.noreply.github.com>
Co-authored-by: Udit Takkar <53316345+Udit-takkar@users.noreply.github.com>
Co-authored-by: unknown <adhabal2002@gmail.com>
2025-09-04 18:22:36 +05:30

79 lines
1.6 KiB
TypeScript

import { v4 as uuidv4 } from "uuid";
import { prisma } from "@calcom/prisma";
import { convertSvgToPng } from "./imageUtils";
import { validateBase64Image } from "./imageValidation";
export const uploadAvatar = async ({ userId, avatar: data }: { userId: number; avatar: string }) => {
const validation = validateBase64Image(data);
if (!validation.isValid) {
throw new Error(`Invalid image data: ${validation.error}`);
}
const objectKey = uuidv4();
const processedData = await convertSvgToPng(data);
await prisma.avatar.upsert({
where: {
teamId_userId_isBanner: {
teamId: 0,
userId,
isBanner: false,
},
},
create: {
userId: userId,
data: processedData,
objectKey,
isBanner: false,
},
update: {
data: processedData,
objectKey,
},
});
return `/api/avatar/${objectKey}.png`;
};
export const uploadLogo = async ({
teamId,
logo: data,
isBanner = false,
}: {
teamId: number;
logo: string;
isBanner?: boolean;
}): Promise<string> => {
const validation = validateBase64Image(data);
if (!validation.isValid) {
throw new Error(`Invalid image data: ${validation.error}`);
}
const objectKey = uuidv4();
const processedData = await convertSvgToPng(data);
await prisma.avatar.upsert({
where: {
teamId_userId_isBanner: {
teamId,
userId: 0,
isBanner,
},
},
create: {
teamId,
data: processedData,
objectKey,
isBanner,
},
update: {
data: processedData,
objectKey,
},
});
return `/api/avatar/${objectKey}.png`;
};