feat: avatar upload to S3, proxied through the backend (#733)

[benedictworks-home]

Description:

Summary

Implements POST /api/users/profile/avatar as an authenticated multipart upload route. Users can upload an image (JPEG, PNG, GIF, WebP) which is decoded, resized to 256×256, re-encoded as JPEG, uploaded to S3, and the resulting public URL is saved to users.avatar_url.

Changes

Backend (backend/)

• Cargo.toml — Added image, aws-sdk-s3, aws-config dependencies
• src/config.rs — Added S3 config fields:
  • AWS_S3_BUCKET (required for upload to work)
  • AWS_S3_REGION (defaults to us-east-1)
  • AWS_S3_PUBLIC_URL_BASE (optional CloudFront/bucket URL prefix)
  • AWS credentials come from the standard SDK credential chain (env vars / instance role)
• src/api/user.rs — Added upload_avatar handler:
  • Accepts multipart field named file or avatar
  • Validates image decoding, returns 400 for invalid/empty uploads
  • Resizes to 256×256 with Lanczos3, re-encodes as JPEG at quality 85
  • Uploads to S3 at avatars/{user_id}.jpg
  • Updates users.avatar_url in the database
  • Invalidates Redis username cache if present
  • Returns { "avatar_url": "..." }
• src/api/mod.rs — Registered /profile/avatar route

How it works

1. Client sends POST /api/users/profile/avatar with Authorization: Bearer <token> and multipart/form-data body containing the image file
2. Backend validates auth, decodes + resizes the image, uploads to S3
3. Public URL is built from AWS_S3_PUBLIC_URL_BASE (or falls back to the standard S3 URL pattern)
4. users.avatar_url column is updated and the Redis cache is invalidated

Configuration

Set these environment variables in production:

AWS_S3_BUCKET=your-bucket-name
AWS_S3_REGION=us-east-1
AWS_S3_PUBLIC_URL_BASE=https://d1234.cloudfront.net/avatars

AWS credentials are resolved via the standard SDK chain (AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY, instance role, etc.).

Testing

• Upload via: curl -X POST -H "Authorization: Bearer <token>" -F "file=@avatar.jpg" http://localhost:3000/api/users/profile/avatar
• Verify avatar_url appears in GET /api/users/profile response

Closes #733

[drips-wave]

@benedictworks-home Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[ONEONUORA]

@benedictworks-home
PLs make your implementation to pass CI checks

[ONEONUORA]

Great job @benedictworks-home