From 87ef6bed4abb669deb6acc20b12da88033c895d0 Mon Sep 17 00:00:00 2001 From: timonrieger Date: Wed, 29 Apr 2026 22:53:58 +0200 Subject: [PATCH] fix(server): unify profile image errors to prevent user-existence oracle via status code GET /users/:id/profile-image returned HTTP 400 for an unknown user ID but HTTP 404 when the user existed without a photo, letting callers distinguish the two cases. Both now return 404 so the response is identical regardless of whether the UUID maps to an account. --- server/src/services/user.service.spec.ts | 2 +- server/src/services/user.service.ts | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/server/src/services/user.service.spec.ts b/server/src/services/user.service.spec.ts index 847f96cfc6..a00efe82fd 100644 --- a/server/src/services/user.service.spec.ts +++ b/server/src/services/user.service.spec.ts @@ -179,7 +179,7 @@ describe(UserService.name, () => { it('should throw an error if the user does not exist', async () => { mocks.user.get.mockResolvedValue(void 0); - await expect(sut.getProfileImage(userStub.admin.id)).rejects.toBeInstanceOf(BadRequestException); + await expect(sut.getProfileImage(userStub.admin.id)).rejects.toBeInstanceOf(NotFoundException); expect(mocks.user.get).toHaveBeenCalledWith(userStub.admin.id, {}); }); diff --git a/server/src/services/user.service.ts b/server/src/services/user.service.ts index 3627fe1096..906a31106d 100644 --- a/server/src/services/user.service.ts +++ b/server/src/services/user.service.ts @@ -134,8 +134,8 @@ export class UserService extends BaseService { } async getProfileImage(id: string): Promise { - const user = await this.findOrFail(id, {}); - if (!user.profileImagePath) { + const user = await this.userRepository.get(id, {}); + if (!user || !user.profileImagePath) { throw new NotFoundException('Not found'); }