fix(activity): keep presence avatars without trusting client readerId

Accept an optional https image on updatePresence, return only the public
reader card, and resolve readerId from session or socket only.

Author: Innei

apps/core/src/modules/activity/activity.controller.ts

@@ -37,6 +37,7 @@ import {
   UpdatePresenceDto,
 } from './activity.schema'
 import { ActivityService } from './activity.service'
+import { toPublicPresenceReader } from './activity.util'
 import { ActivitySampleService } from './sample/activity-sample.service'
 
 const ARTICLE_REF_FIELDS = [
@@ -126,7 +127,7 @@ export class ActivityController {
       .map((item) => item.readerId)
       .filter(Boolean) as string[]
     const readerRows = await this.readerService.findReaderInIds(readerIds)
-    const readers = readerRows.map((item) => ({ ...item, id: item.id }))
+    const readers = readerRows.map((item) => toPublicPresenceReader(item))
 
     return {
       presence: keyBy(

apps/core/src/modules/activity/activity.interface.ts

@@ -19,4 +19,5 @@ export interface ActivityPresence {
 
   ip?: string
   readerId?: string
+  image?: string
 }

apps/core/src/modules/activity/activity.schema.ts

@@ -1,7 +1,7 @@
 import { createZodDto } from 'nestjs-zod'
 import { z } from 'zod'
 
-import { zCoerceInt, zEntityId } from '~/common/zod'
+import { zCoerceInt, zEntityId, zHttpsUrl } from '~/common/zod'
 import { BasicPagerSchema } from '~/shared/dto/pager.dto'
 
 import { Activity } from './activity.constant'
@@ -99,6 +99,7 @@ export const UpdatePresenceSchema = z.object({
   displayName: z.string().max(50).optional(),
   sid: z.string().min(1).max(64),
   readerId: z.string().optional(),
+  image: z.string().max(2048).pipe(zHttpsUrl).optional(),
 })
 
 export class UpdatePresenceDto extends createZodDto(UpdatePresenceSchema) {}

apps/core/src/modules/activity/activity.service.ts

@@ -41,6 +41,8 @@ import {
   extractArticleIdFromRoomName,
   isValidRoomName,
   parseRoomName,
+  resolvePresenceReaderId,
+  toPublicPresenceReader,
 } from './activity.util'
 
 interface ActivityPayloadWithRef {
@@ -346,12 +348,10 @@ export class ActivityService implements OnModuleInit, OnModuleDestroy {
     const socket = roomSockets[index]
     const socketMeta = roomSocketMetas[index]
 
-    // Prefer the readerId resolved server-side from the HTTP session cookie
-    // (RolesGuard runs globally and fills request.readerId before this
-    // service runs). Fall back to the socket-handshake binding, and finally
-    // the client-provided value, both of which are less authoritative.
-    const resolvedReaderId =
-      RequestContext.currentReaderId() || socketMeta?.readerId || data.readerId
+    const resolvedReaderId = resolvePresenceReaderId(
+      RequestContext.currentReaderId(),
+      socketMeta?.readerId,
+    )
 
     const presenceData: ActivityPresence = {
       ...data,
@@ -360,6 +360,7 @@ export class ActivityService implements OnModuleInit, OnModuleDestroy {
       updatedAt: Date.now(),
       connectedAt: socketMeta?.connectedAt ?? Date.now(),
       readerId: resolvedReaderId,
+      image: data.image,
       ip,
     }
 
@@ -370,12 +371,14 @@ export class ActivityService implements OnModuleInit, OnModuleDestroy {
         resolvedReaderId,
       ])
       if (reader.length) {
+        const publicReader = toPublicPresenceReader(reader[0])
         Object.assign(serializedPresenceData, {
-          reader: camelcaseKeys({
-            ...reader[0],
-            id: reader[0].id.toString(),
-          }),
+          reader: camelcaseKeys(publicReader),
         })
+        if (!serializedPresenceData.image && publicReader.image) {
+          serializedPresenceData.image = publicReader.image
+          presenceData.image = publicReader.image
+        }
       }
     }
 

apps/core/src/modules/activity/activity.util.ts

@@ -1,5 +1,27 @@
 const prefix = 'article-'
 
+export function resolvePresenceReaderId(
+  sessionReaderId?: string | null,
+  socketReaderId?: string | null,
+  _clientReaderId?: string | null,
+): string | undefined {
+  return sessionReaderId || socketReaderId || undefined
+}
+
+export function toPublicPresenceReader(reader: {
+  id: string | number | bigint
+  name?: string | null
+  image?: string | null
+  handle?: string | null
+}) {
+  return {
+    id: String(reader.id),
+    name: reader.name ?? null,
+    image: reader.image ?? null,
+    handle: reader.handle ?? null,
+  }
+}
+
 export const buildArticleRoomName = (articleId: string) =>
   `${prefix}${articleId}`
 

apps/core/test/src/modules/activity/activity.controller.spec.ts

@@ -103,9 +103,45 @@ const createController = (opts: {
     translationService as any,
   )
 
-  return { controller, activityService, translationService }
+  return { controller, activityService, translationService, readerService }
 }
 
+describe('ActivityController.getPresence', () => {
+  it('returns only the public reader card', async () => {
+    const { controller, activityService, readerService } = createController({})
+    activityService.getRoomPresence = vi.fn(async () => [
+      {
+        identity: 'abcd1234',
+        readerId: 'reader-1',
+        ip: '1.2.3.4',
+        position: 12,
+      },
+    ])
+    readerService.findReaderInIds = vi.fn(async () => [
+      {
+        id: 'reader-1',
+        name: 'Magren',
+        image: 'https://avatars.githubusercontent.com/u/1?v=4',
+        handle: 'magren',
+        email: 'hidden@example.com',
+        emailVerified: true,
+        role: 'reader',
+        membership: { status: 'active' },
+      },
+    ])
+
+    const res = await controller.getPresence({ roomName: 'article-1' } as any)
+
+    expect(res.readers['reader-1']).toEqual({
+      id: 'reader-1',
+      name: 'Magren',
+      image: 'https://avatars.githubusercontent.com/u/1?v=4',
+      handle: 'magren',
+    })
+    expect(res.presence.abcd1234).not.toHaveProperty('ip')
+  })
+})
+
 describe('ActivityController.getRoomsInfo', () => {
   it('returns bare data when lang is absent', async () => {
     const { controller } = createController({

apps/core/test/src/modules/activity/activity.schema.spec.ts

@@ -0,0 +1,36 @@
+import { describe, expect, it } from 'vitest'
+
+import { UpdatePresenceSchema } from '~/modules/activity/activity.schema'
+
+const base = {
+  identity: 'abcd1234',
+  roomName: 'article-1',
+  ts: 1,
+  position: 10,
+  sid: 'abcd1234',
+}
+
+describe('UpdatePresenceSchema image', () => {
+  it('accepts an https avatar url', () => {
+    const parsed = UpdatePresenceSchema.parse({
+      ...base,
+      image: 'https://avatars.githubusercontent.com/u/1?v=4',
+    })
+    expect(parsed.image).toBe('https://avatars.githubusercontent.com/u/1?v=4')
+  })
+
+  it('rejects http and non-url images', () => {
+    expect(() =>
+      UpdatePresenceSchema.parse({
+        ...base,
+        image: 'http://example.com/a.png',
+      }),
+    ).toThrow()
+    expect(() =>
+      UpdatePresenceSchema.parse({
+        ...base,
+        image: 'data:image/png;base64,abc',
+      }),
+    ).toThrow()
+  })
+})

apps/core/test/src/modules/activity/activity.util.spec.ts

@@ -0,0 +1,43 @@
+import { describe, expect, it } from 'vitest'
+
+import {
+  resolvePresenceReaderId,
+  toPublicPresenceReader,
+} from '~/modules/activity/activity.util'
+
+describe('resolvePresenceReaderId', () => {
+  it('prefers the session reader over the socket binding', () => {
+    expect(resolvePresenceReaderId('session-1', 'socket-1')).toBe('session-1')
+  })
+
+  it('falls back to the socket handshake reader', () => {
+    expect(resolvePresenceReaderId(null, 'socket-1')).toBe('socket-1')
+  })
+
+  it('ignores a client-supplied reader id', () => {
+    expect(resolvePresenceReaderId(null, undefined, 'client-1')).toBeUndefined()
+  })
+})
+
+describe('toPublicPresenceReader', () => {
+  it('keeps only the public card fields', () => {
+    expect(
+      toPublicPresenceReader({
+        id: 133259626412523520n as unknown as string,
+        name: 'Magren',
+        image: 'https://avatars.githubusercontent.com/u/1?v=4',
+        handle: 'magren',
+        email: 'hidden@example.com',
+        emailVerified: true,
+        role: 'reader',
+        bannedAt: new Date(),
+        membership: { status: 'active' },
+      }),
+    ).toEqual({
+      id: '133259626412523520',
+      name: 'Magren',
+      image: 'https://avatars.githubusercontent.com/u/1?v=4',
+      handle: 'magren',
+    })
+  })
+})

packages/api-client/controllers/activity.ts

@@ -94,6 +94,7 @@ export class ActivityController<ResponseWrapper> implements IController {
     ts,
     displayName,
     readerId,
+    image,
   }: {
     roomName: string
     position: number
@@ -103,6 +104,7 @@ export class ActivityController<ResponseWrapper> implements IController {
     displayName?: string
     ts?: number
     readerId?: string
+    image?: string
   }) {
     return this.proxy.presence.update.post({
       data: {
@@ -113,6 +115,7 @@ export class ActivityController<ResponseWrapper> implements IController {
         sid,
         readerId,
         displayName,
+        image,
       },
     })
   }

packages/api-client/models/activity.ts

@@ -13,6 +13,7 @@ export interface ActivityPresence {
   readerId?: string
 
   displayName?: string
+  image?: string
 }
 
 export interface RoomOmittedNote {