assets and tier plans revamp

Signed-off-by: Kenneth Obsequio <k80308392@gmail.com>

controllers/auth.controller.js

@@ -51,16 +51,17 @@ const { sendEmail }    = require('../services/email.service');
 const buildSessionInfo = require('../utils/session_info.util');
 const logActivity      = require('../utils/logActivity.util');
 const trustedDevice    = require('../services/trustedDevice.service');
+const { resolveUserAvatar } = require('../utils/resolveAvatar.util');
 const R = require('../utils/response.util');
 
 const EXCLUDED = ['password', 'otp_code', 'otp_expires_at', 'must_change_password', 'password_expires_at', 'createdAt', 'updatedAt', 'deletedAt', 'createdBy', 'updatedBy', 'deletedBy'];
 
-const safeUser = (user, extraExclude = []) => {
+const safeUser = async (user, extraExclude = []) => {
   const u = user.toJSON ? user.toJSON() : { ...user };
 
   [...EXCLUDED, ...extraExclude].forEach((key) => delete u[key]);
 
-  return u;
+  return resolveUserAvatar(u);
 };
 
 const setRefreshCookie = (res, refreshToken) => {
@@ -321,7 +322,7 @@ exports.verifyOTP = async (req, res) => {
     return R.success(res, wasVerified ? 'Login successful.' : 'Email verified successfully. You are now logged in.', {
       accessToken,
       session_id: session.session_id,
-      user: safeUser(user),
+      user: await safeUser(user),
     });
   } catch (err) {
     await transaction.rollback();
@@ -403,7 +404,7 @@ exports.login = async (req, res) => {
         otpRequired: false,
         accessToken,
         session_id: session.session_id,
-        user: safeUser(user),
+        user: await safeUser(user),
       });
     }
 
@@ -637,7 +638,7 @@ exports.refreshToken = async (req, res) => {
     // Check if refresh token is expired
     if (!shouldRotateRefreshToken(decoded)) {
       const { accessToken } = generateTokens(user);
-      return R.success(res, 'Token refreshed.', { accessToken, session_id: session.session_id, user: safeUser(user) });
+      return R.success(res, 'Token refreshed.', { accessToken, session_id: session.session_id, user: await safeUser(user) });
     }
 
     // ─── Rotate refresh token ───────────────────────────────────────────────────
@@ -646,7 +647,7 @@ exports.refreshToken = async (req, res) => {
 
     setRefreshCookie(res, tokens.refreshToken);
 
-    return R.success(res, 'Token refreshed.', { accessToken: tokens.accessToken, session_id: session.session_id, user: safeUser(user) });
+    return R.success(res, 'Token refreshed.', { accessToken: tokens.accessToken, session_id: session.session_id, user: await safeUser(user) });
   } catch (err) {
     console.error('[AUTH] refresh token error:', err);
     return R.error(res, 'Invalid or expired refresh token.', 401);