fix(server): invalidate old user avatar when updated (#7285)

fix CLOUD-41

packages/backend/server/src/core/user/controller.ts

@@ -2,8 +2,10 @@ import { Controller, Get, Param, Res } from '@nestjs/common';
 import type { Response } from 'express';
 
 import { ActionForbidden, UserAvatarNotFound } from '../../fundamentals';
+import { Public } from '../auth/guard';
 import { AvatarStorage } from '../storage';
 
+@Public()
 @Controller('/api/avatars')
 export class UserAvatarController {
   constructor(private readonly storage: AvatarStorage) {}

packages/backend/server/src/core/user/resolver.ts

@@ -91,18 +91,26 @@ export class UserResolver {
     @Args({ name: 'avatar', type: () => GraphQLUpload })
     avatar: FileUpload
   ) {
+    if (!avatar.mimetype.startsWith('image/')) {
+      throw new Error('Invalid file type');
+    }
+
     if (!user) {
       throw new UserNotFound();
     }
 
     const avatarUrl = await this.storage.put(
-      `${user.id}-avatar`,
+      `${user.id}-avatar-${Date.now()}`,
       avatar.createReadStream(),
       {
         contentType: avatar.mimetype,
       }
     );
 
+    if (user.avatarUrl) {
+      await this.storage.delete(user.avatarUrl);
+    }
+
     return this.users.updateUser(user.id, { avatarUrl });
   }