rill/internal/avatar/avatar.go

// Package avatar 提供当前用户头像的上传与删除。
package avatar

import (
	"net/http"

	"github.com/gin-gonic/gin"
	"gorm.io/gorm"

	"rill/internal/auth"
	"rill/internal/config"
	"rill/internal/file"
	"rill/internal/httpx"
	"rill/internal/model"
)

// @Summary      Update current user avatar
// @Description  Upload an image as the authenticated user's avatar (multipart field file, image only). The avatar URL is stored on the user and the file reference count is managed automatically.
// @Tags         user
// @Accept       mpfd
// @Produce      json
// @Param        file  formData  file  true  "Avatar image"
// @Success      200   {object}  model.User
// @Failure      400   {object}  httpx.ErrorResponse  "invalid request, empty file, or not an image"
// @Failure      413   {object}  httpx.ErrorResponse  "file too large"
// @Security     BearerAuth
// @Failure      401  {object}  httpx.ErrorResponse  "unauthorized or session expired"
// @Failure      403  {object}  httpx.ErrorResponse  "account disabled"
// @Failure      500  {object}  httpx.ErrorResponse
// @Router       /me/avatar [put]
func Update(db *gorm.DB, cfg *config.Config) gin.HandlerFunc {
	return func(c *gin.Context) {
		current, ok := auth.CurrentUser(c)
		if !ok {
			httpx.RespondUnauthorized(c)
			return
		}
		limit, err := file.LimitBytes(c.Request.Context(), db, file.KindImage)
		if err != nil {
			httpx.RespondDBError(c, err)
			return
		}
		header, ok := file.ReadUpload(c, limit)
		if !ok {
			return
		}
		if isImage, err := file.IsImageUpload(header); err != nil {
			httpx.RespondServerError(c, err, "读取上传图片失败")
			return
		} else if !isImage {
			c.JSON(http.StatusBadRequest, httpx.ErrorResponse{Error: "avatar must be an image"})
			return
		}
		src, err := header.Open()
		if err != nil {
			httpx.RespondServerError(c, err, "打开上传图片失败")
			return
		}
		defer src.Close()

		ctx := c.Request.Context()
		saved, err := file.Save(ctx, db, cfg, file.OperatorOf(c, current), header.Filename, src, file.SaveOptions{
			Limit:        limit,
			ExpectedKind: file.KindImage,
		})
		if err != nil {
			file.RespondSaveError(c, err)
			return
		}

		oldID, hasOld := file.ParseLocalURL(cfg.API.Prefix, current.Avatar)
		avatarURL := file.URL(cfg.API.Prefix, saved.ID)
		err = db.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
			if !hasOld || oldID != saved.ID {
				if err := file.Acquire(ctx, tx, saved.ID); err != nil {
					return err
				}
			}
			if hasOld && oldID != saved.ID {
				if err := file.Release(ctx, tx, oldID); err != nil {
					return err
				}
			}
			return tx.Model(&model.User{}).Where("id = ?", current.ID).Update("avatar", avatarURL).Error
		})
		if err != nil {
			httpx.RespondDBError(c, err)
			return
		}

		current.Avatar = avatarURL
		c.JSON(http.StatusOK, current)
	}
}

// @Summary      Delete current user avatar
// @Description  Clear the authenticated user's avatar and release the file reference when it points to a local file.
// @Tags         user
// @Produce      json
// @Success      200  {object}  model.User
// @Security     BearerAuth
// @Failure      401  {object}  httpx.ErrorResponse  "unauthorized or session expired"
// @Failure      403  {object}  httpx.ErrorResponse  "account disabled"
// @Failure      500  {object}  httpx.ErrorResponse
// @Router       /me/avatar [delete]
func Delete(db *gorm.DB, cfg *config.Config) gin.HandlerFunc {
	return func(c *gin.Context) {
		current, ok := auth.CurrentUser(c)
		if !ok {
			httpx.RespondUnauthorized(c)
			return
		}

		ctx := c.Request.Context()
		oldID, hasOld := file.ParseLocalURL(cfg.API.Prefix, current.Avatar)
		err := db.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
			if hasOld {
				if err := file.Release(ctx, tx, oldID); err != nil {
					return err
				}
			}
			return tx.Model(&model.User{}).Where("id = ?", current.ID).Update("avatar", "").Error
		})
		if err != nil {
			httpx.RespondDBError(c, err)
			return
		}

		current.Avatar = ""
		c.JSON(http.StatusOK, current)
	}
}