Avatar api

[Qoder-Undefined]

All tasks complete. Here's a summary of the implementation:

---

Avatar Upload and Processing API — Implementation Summary

Files created/modified

New files (8):

• src/types/avatar.types.ts — Statuses, records, DTOs, storage provider interface, configuration constants
• src/services/storage/in-memory-storage.ts — In-memory dev-fake storage provider + MIME sniffing + dimension extraction (PNG/JPEG/GIF/WebP)
• src/services/asset-validation.service.ts — Server-side validation: size bounds, magic-byte MIME sniffing, spoofing detection, dimension extraction
• src/services/avatar.service.ts — Orchestrates upload intent, validation, variant production, atomic promotion, replacement/retirement, and deletion
• src/controllers/avatar.controller.ts — REST endpoints with Zod validation, auth checks, error mapping
• src/routes/v1/avatar.routes.ts — Route definitions under /users/me/avatar
• tests/asset-validation.service.test.ts — 18 tests: MIME spoofing, oversize, undersize, dimension extraction, type normalisation
• tests/in-memory-storage.test.ts — 22 tests: CRUD, signed URLs, credential leakage, MIME sniffing, dimension extraction
• tests/avatar.service.test.ts — 20 tests: intent, finalize, cross-user access, double-finalize, SHA-256, replacement, deletion
• tests/avatar.controller.test.ts — 20 tests: auth, validation, error mapping, success paths

Modified files (4):

• prisma/schema.prisma — Added Avatar and AvatarVariant models with proper relations
• src/types/index.ts — Added avatar type exports
• src/routes/v1/users.routes.ts — Mounted avatar routes at /me/avatar
• src/routes/index.ts — No change needed (avatar routes are nested under users)

API Endpoints

Method | Path | Description -- | -- | -- POST | /api/v1/users/me/avatar/upload-intent | Issue a short-lived upload intent POST | /api/v1/users/me/avatar/finalize | Validate, process variants, promote to active GET | /api/v1/users/me/avatar | Get current avatar with variant URLs DELETE | /api/v1/users/me/avatar | Delete current avatar and all variants

Acceptance criteria coverage

• ✅ Users cannot finalize/delete another user's object — ownership verified via userId on the avatar record
• ✅ Invalid files never become active avatars — magic-byte MIME sniffing + allowlist + spoofing detection + size bounds
• ✅ Storage credentials are never returned — tested explicitly
• ✅ Replacement/deletion follows policy — old avatars retired atomically, storage objects cleaned up, profile URL nulled
• ✅ 80 tests pass covering MIME spoofing, oversize, cross-user access, failures, replace, and delete

Note

closes #134

[3m1n3nc3]

CI is failing, please resolve.

[Qoder-Undefined]

@3m1n3nc3 ci fixed kindly review