fix: the avatar and logo URL fallback follows the configured public path

When the thumbnail fails, AvatarURL and OrganisationLogoURL answered
"/" + the blob key, which skips storage.uploads.public_path_prefix and
public_url (a 404 with the WinterCMS layout). They now answer the
original's attach.File.URL.

README.md

@@ -24,7 +24,7 @@ It owns the `users` table extensions, `user_throttle`, `jwt_blacklist`, `user_ap
 - **Rate limiting.** Every route runs behind the `user-api` bucket: 120 requests a minute per authenticated user, or per client IP for anonymous calls.
 - **Profile.** `POST /update`, `POST /marketing-consent`, `POST /avatar` and `POST /avatar/remove` (the avatar is stored through the framework's attachment storage).
 - **Deactivation and bans.** Deactivation is self-service and reversible: a password login or a `golem15.sociallogin` sign-in restores a deactivated account and sends the reactivate mail, and an administrator can restore it too. It ends every earlier session JWT and personal API token of the user (`RevokeUserAccess` stamps `tokens_valid_after` and revokes the `user_api_tokens` rows), so the user signs in again and gets a fresh token, while the old API tokens stay revoked. A ban is the lock: password login, social sign-in and `POST /refresh` refuse a banned user, and banning revokes the user's sessions and API tokens. A banned user's account link answers no administrator (`LinkedBackendUser`). Neither unban nor restore revives a token. Activation gates login, deactivation does not: while `require_activation` is on, an account that is both deactivated and not activated is refused and stays deactivated, with no reactivate mail. Upgrade note: accounts deactivated or banned before this version keep their API tokens until they are deactivated or banned again (both actions are idempotent) or `RevokeUserAccess` runs for them.
-- **Organisations.** The `Organisation` model and the `organisation_id` and `organisation_role` user columns, as a foreign-key target for other plugins. An organisation has a name, a slug (filled from the name by `Slugify` when it is left empty), a description, an avatar, a logo and its members: the users whose `organisation_id` points at it. The logo is a second public image attachment (`logo`, `models.OrganisationLogoField`), kept in `system_files` like the avatar. The plugin serves no frontend organisation payload, so applications that build one add the logo with `classes.OrganisationLogoFields(ctx, app, org)`, which answers `has_logo` (bool), `logo` (the attachment's disk name, or null) and `logo_url` (a 256 px thumbnail URL, `classes.OrganisationLogoSize`, or null), the keys the user payload uses for its avatar; `classes.OrganisationLogoURL(ctx, app, org, size)` answers the URL at any size and false when there is no logo or no file bucket. `organisation_role` belongs to that membership: the admin clears it whenever a user's organisation changes (see the Organisations screen), and an application that sets `organisation_id` itself sets or clears the role with it.
+- **Organisations.** The `Organisation` model and the `organisation_id` and `organisation_role` user columns, as a foreign-key target for other plugins. An organisation has a name, a slug (filled from the name by `Slugify` when it is left empty), a description, an avatar, a logo and its members: the users whose `organisation_id` points at it. The logo is a second public image attachment (`logo`, `models.OrganisationLogoField`), kept in `system_files` like the avatar. The plugin serves no frontend organisation payload, so applications that build one add the logo with `classes.OrganisationLogoFields(ctx, app, org)`, which answers `has_logo` (bool), `logo` (the attachment's disk name, or null) and `logo_url` (a 256 px thumbnail URL, `classes.OrganisationLogoSize`, or null), the keys the user payload uses for its avatar; `classes.OrganisationLogoURL(ctx, app, org, size)` answers the URL at any size (the thumbnail, or the original file's public URL when the thumbnail fails, as `AvatarURL` does) and false when there is no logo or no file bucket. `organisation_role` belongs to that membership: the admin clears it whenever a user's organisation changes (see the Organisations screen), and an application that sets `organisation_id` itself sets or clears the role with it.
 - **User groups.** The `user_groups` table (seeded with the `guest` and `registered` groups, as in PHP) and the `users_groups` membership pivot, the `UserGroup` model and the `User.Groups` relation, which is never serialized. `UserGroupCodes` and `HasGroupCode` let other plugins check membership server-side, for example a site-admin check on the group code `admin`. No user API route reads or writes groups, and the user payload still answers `"groups":[]`. Membership is written in one place only: the `groups` field of the admin user form. Apart from that, rows leave `users_groups` only when a user or a group is deleted for good. The admin Users list can filter by group.
 - **Admin screens.** The plugin registers the Users screen with the framework's admin (`pact.HasAdminControllers`, controller ID `golem15.user.users`), the port of the WinterCMS `Users` controller: a list with search, the group, registration date and activated filters and row states (deactivated, banned, not activated); a read-only preview with a status hint; and a form with name, email, a password with confirmation, an optional invitation mail, the user's groups, the organisation, the avatar and the user's frontend permissions. Bulk actions activate, deactivate, restore, ban and unban users; the preview offers activate, unban and unsuspend while they apply. Deactivating is the soft delete, and deactivate and ban both end the user's earlier sessions and personal API tokens (see Deactivation and bans); the delete button and the bulk delete remove a user for good, together with the throttle rows, group memberships and attachments. A user created in the admin starts not activated. There is no impersonation and no guest account.
 - **User Groups screen.** Controller ID `golem15.user.usergroups`, the port of the WinterCMS `UserGroups` controller, behind `golem15.users.access_groups`: a list with the name, code, creation date and number of members, and a form with the name, the code (letters, digits, underscore and hyphen; unique), a description and the group's frontend permissions as checkboxes, stored in `user_groups.permissions` as a JSON object of code to `1`. A group can be deleted from its form; its memberships go with it and its members stay. The screen never changes who is in a group.
@@ -229,7 +229,7 @@ Packages:
   - `SessionToken(r)`, the session JWT the `jwt` guard reads from a request (bearer header, then the `token` and `auth_token` cookies; `""` when there is none); `SessionTokenCookie(r)`, the name of the session cookie that supplied that token (`""` when the bearer header did or there is none), which `POST /refresh` uses to rewrite the `auth.cookie` cookie; and `SessionCookieNames()`, a copy of that cookie list to pass to `bouncer.NewJWTGuard`, so a handler's own guard reads the same token.
   - `RequestUser(ctx, app, r)` and `EndRequestSession(ctx, app, w, r)`, for handlers that serve signed-in and anonymous browsers on one route (an OAuth provider's authorize page). `RequestUser` reads and checks the session JWT exactly as the `jwt` guard does (bearer header, then the `token` and `auth_token` cookies, the blacklist, `tokens_valid_after`) and returns the user, or `nil` for an anonymous, invalid, expired or blacklisted request and for a soft-deleted user; only an infrastructure failure is an error. `EndRequestSession` is the best-effort `EndSession`: it revokes and forgets the same way (the forget cookie of `bouncer.LoadCookieConfig`), but a blacklist failure is logged, never returned.
   - `OrganisationLogoURL(ctx, app, org, size)`, `OrganisationLogoFields(ctx, app, org)` and `OrganisationLogoSize`, the organisation logo for an application's organisation payloads (see Organisations).
-  - `AvatarURL(ctx, app, user, size)`, the display picture rule of the user payload at any size: the avatar thumbnail (size by size, mode auto) when the user has an avatar and a file bucket is published, the file path when the thumbnail fails, otherwise the gravatar URL. The URL may be protocol-relative or relative. The payload's `avatar_url` comes from it at 128.
+  - `AvatarURL(ctx, app, user, size)`, the display picture rule of the user payload at any size: the avatar thumbnail (size by size, mode auto) when the user has an avatar and a file bucket is published, the original file's public URL (`attach.File.URL`, which follows `storage.uploads.public_path_prefix` and `public_url`) when the thumbnail fails, otherwise the gravatar URL. The URL may be protocol-relative or relative. The payload's `avatar_url` comes from it at 128.
   - `BackendLinks` (`CreateLinkRequest`, `LinkRequestByCode`, `ConfirmLinkRequest`, `SetLink`, `RemoveLink`, `LinkFor`, `LinkOf`, `LinkedBackendUser`, `RegisterBackendLinkListeners`), its errors `ErrLinkRequestNotFound`, `ErrLinkRequestUsed`, `ErrLinkRequestExpired`, `ErrStaleSession`, `ErrAlreadyLinked`, `ErrBackendUserUnavailable` and `ErrFrontendUserUnavailable`, the events `BackendLinkedEvent` / `BackendLinkedEventName` and `BackendUnlinkedEvent` / `BackendUnlinkedEventName`, `BackendLinkRequestTTL(app)`, `DefaultBackendLinkRequestTTL`, `FrontendURL(app)`, `BackendLinkPagePath(app)`, `DefaultBackendLinkPagePath`, `BackendLinksFor(app)` (the published service, or one over the app) and `BackendDisplayName(admin)`.
   - `PermissionManageBackendLinks`, `FrontendPermissionCatalog(ctx, app, db)`, `MCPUserGuard`, `FireSubjectChanged(ctx, app, guard, userID, kind)` and `FireSubjectChangedAfterCommit(ctx, app, tx, guard, userID, kind)` with the guard names `SubjectGuardUser` and `SubjectGuardBackend`, and `FireSubjectEvent(ctx, app, ev)` and `FireSubjectEventAfterCommit(ctx, app, tx, ev)`, which fire a whole `pact.MCPSubjectChanged` (with `TokenID` or `ClientID` to end only one token's or one client's sessions).
   - `AccessRevokedEvent` / `AccessRevokedEventName` and `FireAccessRevoked(ctx, app, tx, userIDs, before, reason)` (see Access revocation).

avatar_url_test.go

@@ -104,8 +104,13 @@ func TestAvatarURL(t *testing.T) {
 	if err := attach.Publish(failing, closed); err != nil {
 		t.Fatal(err)
 	}
-	if got, err := classes.AvatarURL(ctx, failing, withFile, 128); err != nil || got != "/"+attach.BlobKey(row.DiskName) {
-		t.Fatalf("failing thumbnail = %q %v, want /%s", got, err, attach.BlobKey(row.DiskName))
+	// The file's public URL follows storage.uploads.public_path_prefix
+	// (RC-IN-03), never a bare /<key>.
+	if want := attach.PublicURL(attach.BlobKey(row.DiskName)); want == "/"+attach.BlobKey(row.DiskName) {
+		t.Fatalf("the public path prefix is empty (%q): the fallback is not observable", attach.PublicPathPrefix())
+	}
+	if got, err := classes.AvatarURL(ctx, failing, withFile, 128); err != nil || got != attach.PublicURL(attach.BlobKey(row.DiskName)) {
+		t.Fatalf("failing thumbnail = %q %v, want %s", got, err, attach.PublicURL(attach.BlobKey(row.DiskName)))
 	}
 
 	// A failing lookup is the only error.

classes/avatar.go

@@ -18,8 +18,9 @@ import (
 // AvatarURL returns the display picture URL of user at size pixels, the
 // rule the user API payload follows: the thumbnail (size by size, mode
 // auto) of the user's avatar attachment when there is one and a file
-// bucket is published, the attachment's file path when the thumbnail
-// fails (logged), and otherwise the gravatar URL
+// bucket is published, the original file's public URL (attach.File.URL,
+// following storage.uploads.public_path_prefix and public_url) when the
+// thumbnail fails (logged), and otherwise the gravatar URL
 // //www.gravatar.com/avatar/{md5 of the email}?s={size}&d=mm. The URL may
 // be protocol-relative or relative; a caller that needs an absolute URL
 // resolves it. Only a failing database lookup is an error.
@@ -52,7 +53,7 @@ func AvatarURL(ctx context.Context, app *backpack.App, user *models.User, size i
 	url, err := f.Thumb(ctx, bucket, size, size, "auto")
 	if err != nil {
 		pluginLog.Error("golem15.user: avatar thumb", "err", err)
-		return "/" + attach.BlobKey(f.DiskName), nil
+		return f.URL(), nil
 	}
 	return url, nil
 }

classes/organisation_logo.go

@@ -40,8 +40,9 @@ func organisationLogo(ctx context.Context, app *backpack.App, org *models.Organi
 
 // OrganisationLogoURL returns the URL of the organisation's logo at size
 // pixels, the way AvatarURL serves a user's picture: the thumbnail (size by
-// size, mode auto) of the logo attachment, or the attachment's file path
-// when the thumbnail fails (logged). It answers false when the organisation
+// size, mode auto) of the logo attachment, or the original file's public
+// URL (attach.File.URL, which follows storage.uploads.public_path_prefix and
+// public_url) when the thumbnail fails (logged). It answers false when the organisation
 // has no logo or no file bucket is published. The URL may be relative; a
 // caller that needs an absolute URL resolves it. Only a failing database
 // lookup is an error.
@@ -57,7 +58,7 @@ func OrganisationLogoURL(ctx context.Context, app *backpack.App, org *models.Org
 	url, err := f.Thumb(ctx, bucket, size, size, "auto")
 	if err != nil {
 		pluginLog.Error("golem15.user: organisation logo thumb", "err", err)
-		return "/" + attach.BlobKey(f.DiskName), true, nil
+		return f.URL(), true, nil
 	}
 	return url, true, nil
 }

organisation_logo_test.go

@@ -13,6 +13,8 @@ import (
 	"git.golem15.com/golem15/sm-user-plugin/classes"
 	"git.golem15.com/golem15/sm-user-plugin/models"
 	"git.golem15.com/golem15/summercms/modules/cabana"
+	"git.golem15.com/golem15/summercms/modules/lagoon/attach"
+	"gocloud.dev/blob/memblob"
 )
 
 // uploadOrganisationFile posts an image to an organisation form's file
@@ -51,7 +53,8 @@ func (e *adminEnv) organisationFiles(t *testing.T, id uint, field string) int64
 // fileupload right after the avatar; a logo uploaded through the admin form
 // API is stored as a system_files row with field logo; OrganisationLogoFields
 // answers has_logo, the disk name and a URL, or false and nils without a
-// logo; the avatar keeps working beside it; and deleting the organisation
+// logo, falling back to the original's public URL when the thumbnail fails;
+// the avatar keeps working beside it; and deleting the organisation
 // removes the logo attachment as it does the avatar. Postgres only: under
 // -short nothing runs.
 func TestOrganisationLogo(t *testing.T) {
@@ -142,6 +145,22 @@ func TestOrganisationLogo(t *testing.T) {
 			t.Fatalf("logo URL %q points at the avatar", url)
 		}
 
+		// A thumbnail that cannot be made (the storage fails) falls back to
+		// the original's public URL, under the public path prefix
+		// (RC-IN-03).
+		closed := memblob.OpenBucket(nil)
+		_ = closed.Close()
+		failing := sessionUserApp(t, "SUMMER_GOLEM15__USER__JWT__SECRET="+sessionSecret)
+		if err := failing.Publish(env.gdb); err != nil {
+			t.Fatal(err)
+		}
+		if err := attach.Publish(failing, closed); err != nil {
+			t.Fatal(err)
+		}
+		if got, ok, err := classes.OrganisationLogoURL(ctx, failing, env.organisation(t, org.ID), 64); err != nil || !ok || got != attach.PublicURL(attach.BlobKey(logoDisk)) {
+			t.Fatalf("failing logo thumbnail = %q %v %v, want %s", got, ok, err, attach.PublicURL(attach.BlobKey(logoDisk)))
+		}
+
 		env.expect(t, http.StatusOK, http.MethodDelete, organisationPath(org.ID, ""), token, nil)
 		if logos, avatars := env.organisationFiles(t, org.ID, "logo"), env.organisationFiles(t, org.ID, "avatar"); logos != 0 || avatars != 0 {
 			t.Fatalf("after the delete: logo rows %d, avatar rows %d, want none", logos, avatars)