feat: avatars for humans (#273)

* implement avatar backend functionality

* add avatar endpoints

* typo

* implement client side avatar upload and handling

* fixes

* Update go/internal/handler/handler.go

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

* Update js/desktop/src/lib/avatar-image.ts

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

* bug in order

* remove unused component

* fix invalid migration

* fix syntax errors

---------

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

go/internal/handler/handler.go

@@ -73,6 +73,7 @@ type Human struct {
 	Email                     string    `json:"email"`
 	EmailPrefix               string    `json:"email_prefix"`
 	EmailNotificationsEnabled bool      `json:"email_notifications_enabled"`
+	AvatarObjectID            *string   `json:"avatar_object_id"`
 	CreatedAt                 time.Time `json:"created_at"`
 }
 
@@ -334,6 +335,83 @@ func (h *Handler) UpdateSettings(w http.ResponseWriter, r *http.Request) {
 	w.WriteHeader(http.StatusNoContent)
 }
 
+func (h *Handler) DeleteAvatar(w http.ResponseWriter, r *http.Request) {
+	humanId, ok := middleware.HumanIdFromContext(r.Context())
+	if !ok {
+		http.Error(w, "unauthorized", http.StatusUnauthorized)
+		return
+	}
+
+	human, err := h.humanSvc.GetByID(r.Context(), humanId)
+	if err != nil {
+		flog.Error("failed to get human by id", "error", err, "humanId", humanId)
+		http.Error(w, "internal server error", http.StatusInternalServerError)
+		return
+	}
+
+	err = h.humanSvc.DeleteAvatar(r.Context(), humanId)
+	if err != nil {
+		flog.Error("failed to delete avatar from human", "error", err)
+		http.Error(w, "internal server error", http.StatusInternalServerError)
+		return
+	}
+
+	if human.AvatarObjectID != nil {
+		err = h.depotSvc.Delete(r.Context(), utils.OptionalString(human.AvatarObjectID))
+		if err != nil {
+			flog.Error("failed to delete object", "error", err, "objectID", human.AvatarObjectID)
+		}
+	}
+
+	w.WriteHeader(http.StatusNoContent)
+	return
+}
+
+func (h *Handler) UpdateAvatar(w http.ResponseWriter, r *http.Request) {
+	humanId, ok := middleware.HumanIdFromContext(r.Context())
+	if !ok {
+		http.Error(w, "unauthorized", http.StatusUnauthorized)
+		return
+	}
+
+	// 5MB limit = 5 * 1024 * 1024 bytes
+	const maxBodySize = 5 << 20
+
+	r.Body = http.MaxBytesReader(w, r.Body, maxBodySize)
+
+	object, err := h.depotSvc.CreateFromReader(r.Context(), depot.CreateFromReaderInput{
+		Prefix:      "avatars",
+		Name:        fmt.Sprintf("%s-avatar", humanId),
+		ContentType: r.Header.Get("Content-Type"),
+	}, r.Body)
+	if err != nil {
+		var maxErr *http.MaxBytesError
+		if errors.As(err, &maxErr) {
+			http.Error(w, "avatar file too large", http.StatusRequestEntityTooLarge)
+			return
+		}
+		flog.Error("failed to upload avatar with depo", "error", err, "humanId", humanId)
+		http.Error(w, "internal server error", http.StatusInternalServerError)
+		return
+	}
+
+	err = h.humanSvc.UpdateAvatar(r.Context(), humanId, object.ID)
+	if err != nil {
+		flog.Error("failed to update human avatar", "error", err, "humanId", humanId)
+		http.Error(w, "internal server error", http.StatusInternalServerError)
+
+		// best effort
+		err = h.depotSvc.Delete(r.Context(), object.ID)
+		if err != nil {
+			flog.Error("best-effort delete of object failed", "error", err)
+		}
+
+		return
+	}
+
+	w.WriteHeader(http.StatusNoContent)
+}
+
 // ============================================================================
 // Network Handlers
 // ============================================================================
@@ -717,8 +795,8 @@ func (h *Handler) RevokeInvitation(w http.ResponseWriter, r *http.Request) {
 	w.WriteHeader(http.StatusNoContent)
 }
 
-// DownloadParticleMedia returns a fresh signed URL for media/file particles.
-func (h *Handler) DownloadParticleMedia(w http.ResponseWriter, r *http.Request) {
+// GetObjectDownloadUrl returns a fresh signed URL for media/file particles.
+func (h *Handler) GetObjectDownloadUrl(w http.ResponseWriter, r *http.Request) {
 	_, ok := middleware.EmailFromContext(r.Context())
 	if !ok {
 		http.Error(w, "unauthorized", http.StatusUnauthorized)
@@ -1007,6 +1085,7 @@ func humanToDTO(h *human.Human) Human {
 		Email:                     h.Email,
 		EmailPrefix:               h.EmailPrefix,
 		EmailNotificationsEnabled: h.EmailNotificationsEnabled,
+		AvatarObjectID:            h.AvatarObjectID,
 		CreatedAt:                 h.CreatedAt,
 	}
 }