Add optional OIDC avatar fetching from the “picture” claim

[bookstack] / app / Uploads / UserAvatars.php

diff --git a/app/Uploads/UserAvatars.php b/app/Uploads/UserAvatars.php
index 49a54bbbbb9b387dfa3e964bbe004f62e42e274b..af91dfe70f146236912948887e9dfff598a79053 100644 (file)
--- a/app/Uploads/UserAvatars.php
+++ b/app/Uploads/UserAvatars.php
@@ -2,21 +2,21 @@
 
 namespace BookStack\Uploads;
 
-use BookStack\Auth\User;
 use BookStack\Exceptions\HttpFetchException;
+use BookStack\Http\HttpRequestService;
+use BookStack\Users\Models\User;
 use Exception;
+use GuzzleHttp\Psr7\Request;
 use Illuminate\Support\Facades\Log;
 use Illuminate\Support\Str;
+use Psr\Http\Client\ClientExceptionInterface;
 
 class UserAvatars
 {
-    protected $imageService;
-    protected $http;
-
-    public function __construct(ImageService $imageService, HttpFetcher $http)
-    {
-        $this->imageService = $imageService;
-        $this->http = $http;
+    public function __construct(
+        protected ImageService $imageService,
+        protected HttpRequestService $http
+    ) {
     }
 
     /**
@@ -34,7 +34,7 @@ class UserAvatars
             $user->avatar()->associate($avatar);
             $user->save();
         } catch (Exception $e) {
-            Log::error('Failed to save user avatar image');
+            Log::error('Failed to save user avatar image', ['exception' => $e]);
         }
     }
 
@@ -49,14 +49,39 @@ class UserAvatars
             $user->avatar()->associate($avatar);
             $user->save();
         } catch (Exception $e) {
-            Log::error('Failed to save user avatar image');
+            Log::error('Failed to save user avatar image', ['exception' => $e]);
+        }
+    }
+
+    /**
+     * Assign a new avatar image to the given user by fetching from a remote URL.
+     */
+    public function assignToUserFromUrl(User $user, string $avatarUrl, ?string $accessToken = null): void
+    {
+        // Quickly skip invalid or non-HTTP URLs
+        if (!$avatarUrl || !str_starts_with($avatarUrl, 'http')) {
+            return;
+        }
+
+        try {
+            $this->destroyAllForUser($user);
+            $imageData = $this->getAvatarImageData($avatarUrl, $accessToken);
+            $avatar = $this->createAvatarImageFromData($user, $imageData, 'png');
+            $user->avatar()->associate($avatar);
+            $user->save();
+        } catch (Exception $e) {
+            Log::error('Failed to save user avatar image from URL', [
+                'exception' => $e,
+                'url'       => $avatarUrl,
+                'user_id'   => $user->id,
+            ]);
         }
     }
 
     /**
      * Destroy all user avatars uploaded to the given user.
      */
-    public function destroyAllForUser(User $user)
+    public function destroyAllForUser(User $user): void
     {
         $profileImages = Image::query()->where('type', '=', 'user')
             ->where('uploaded_to', '=', $user->id)
@@ -70,7 +95,7 @@ class UserAvatars
     /**
      * Save an avatar image from an external service.
      *
-     * @throws Exception
+     * @throws HttpFetchException
      */
     protected function saveAvatarImage(User $user, int $size = 500): Image
     {
@@ -105,35 +130,45 @@ class UserAvatars
     }
 
     /**
-     * Gets an image from url and returns it as a string of image data.
+     * Gets an image from a URL (public or private) and returns it as a string of image data.
      *
-     * @throws Exception
+     * @throws HttpFetchException
      */
-    protected function getAvatarImageData(string $url): string
+    protected function getAvatarImageData(string $url, ?string $accessToken = null): string
     {
         try {
-            $imageData = $this->http->fetch($url);
-        } catch (HttpFetchException $exception) {
-            throw new Exception(trans('errors.cannot_get_image_from_url', ['url' => $url]));
-        }
+            $headers = [];
+            if (!empty($accessToken)) {
+                $headers['Authorization'] = 'Bearer ' . $accessToken;
+            }
+
+            $client = $this->http->buildClient(5);
+            $response = $client->sendRequest(new Request('GET', $url, $headers));
 
-        return $imageData;
+            if ($response->getStatusCode() !== 200) {
+                throw new HttpFetchException(trans('errors.cannot_get_image_from_url', ['url' => $url]));
+            }
+
+            return (string) $response->getBody();
+        } catch (ClientExceptionInterface $exception) {
+            throw new HttpFetchException(trans('errors.cannot_get_image_from_url', ['url' => $url]), $exception->getCode(), $exception);
+        }
     }
 
     /**
      * Check if fetching external avatars is enabled.
      */
-    protected function avatarFetchEnabled(): bool
+    public function avatarFetchEnabled(): bool
     {
         $fetchUrl = $this->getAvatarUrl();
 
-        return is_string($fetchUrl) && strpos($fetchUrl, 'http') === 0;
+        return str_starts_with($fetchUrl, 'http');
     }
 
     /**
      * Get the URL to fetch avatars from.
      */
-    protected function getAvatarUrl(): string
+    public function getAvatarUrl(): string
     {
         $configOption = config('services.avatar_url');
         if ($configOption === false) {