assets and tier plans revamp

Signed-off-by: Kenneth Obsequio <k80308392@gmail.com>

utils/resolveAvatar.util.js

@@ -0,0 +1,48 @@
+// utils/resolveAvatar.util.js
+//
+// Resolves a stored avatar into a browser-usable URL at read time.
+//
+// personal_info.avatar.url is never trustworthy as stored:
+//   - S3-stored avatars (avatar.uuid present) were historically saved with a
+//     raw, unsigned bucket URL (see s3.service.js buildPublicUrl). The current
+//     Garage ingress (Cloudflare lane, see chibistar/Caddyfile) forwards reads
+//     straight to Garage with no re-signing, and Garage rejects anonymous
+//     requests outright — so that stored URL 403s in the browser. Even a
+//     presigned URL would go stale if persisted (getPublicUrl() expires in 4h),
+//     so the only correct fix is to mint a fresh one on every read from the
+//     stored key (avatar.uuid), never trust what's on the row.
+//   - Google-picture avatars (reg_type: 'google', no uuid — see
+//     auth.controller.js googleCallback) are an external CDN URL and pass
+//     through unchanged; there's nothing of ours to sign.
+//
+const { getPublicUrl } = require('../services/s3.service');
+
+async function resolveAvatarUrl(avatar) {
+  if (!avatar) return avatar ?? null;
+  if (!avatar.uuid) return avatar; // external URL (e.g. Google) — nothing to sign
+
+  try {
+    const url = await getPublicUrl(avatar.uuid);
+    return { ...avatar, url };
+  } catch (err) {
+    console.error('[AVATAR] Failed to resolve presigned URL for', avatar.uuid, err);
+    return avatar; // fall back to the stored value rather than failing the whole response
+  }
+}
+
+// Mutates-and-returns a shallow copy of a user (plain object or Sequelize
+// instance) with personal_info.avatar resolved. Safe to call on a user with
+// no avatar at all.
+async function resolveUserAvatar(user) {
+  if (!user) return user;
+  const u = user.toJSON ? user.toJSON() : { ...user };
+  if (!u.personal_info?.avatar) return u;
+
+  u.personal_info = {
+    ...u.personal_info,
+    avatar: await resolveAvatarUrl(u.personal_info.avatar),
+  };
+  return u;
+}
+
+module.exports = { resolveAvatarUrl, resolveUserAvatar };