lukasandClaude Opus 5.5
caed8543ea
The shared Redis client decodes replies as UTF-8 text, but the avatar cache holds raw image bytes and a b"none" miss marker: an image could not be read back at all, and a miss came back as str and crashed on .partition(b"\n"). Only a sender's first request worked; after that, a 500. The cache now goes through a binary-safe client, get_redis_bytes(). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
93 lines
3.3 KiB
Python
93 lines
3.3 KiB
Python
"""Sender avatars — Gravatar then the sender domain's favicon (SPEC §9.1).
|
|
|
|
The browser only ever calls ``GET /api/avatar`` (same origin), so a sender can never
|
|
see the user's IP or read activity: the server does the outbound fetch under the
|
|
§10.6 SSRF guard and caches the result (both hits and misses) in Redis. A miss
|
|
returns 404, which the UI renders as its initials avatar. Disable with
|
|
``SENDER_AVATARS_ENABLED=false``.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import hashlib
|
|
|
|
import httpx
|
|
from fastapi import APIRouter, Query, Response
|
|
|
|
from app.accounts.ssrf import SsrfError, guarded_request
|
|
from app.config import get_settings
|
|
from app.identity.deps import CurrentUser
|
|
from app.redis_client import get_redis_bytes
|
|
|
|
router = APIRouter(prefix="/avatar", tags=["mail"])
|
|
|
|
_CACHE_TTL_HIT = 7 * 24 * 3600 # remember a found avatar for a week
|
|
_CACHE_TTL_MISS = 24 * 3600 # re-check "no avatar" daily
|
|
_MAX_BYTES = 200 * 1024
|
|
_NONE = b"none"
|
|
|
|
|
|
def _email_md5(email: str) -> str:
|
|
# Gravatar keys on md5(lowercased email); reused as our cache key. Not security.
|
|
return hashlib.md5(email.encode()).hexdigest() # noqa: S324
|
|
|
|
|
|
async def _fetch_image(url: str) -> tuple[str, bytes] | None:
|
|
"""GET ``url`` under the SSRF guard; return (content_type, bytes) for a 200 image."""
|
|
try:
|
|
resp = await guarded_request("GET", url, timeout=5.0, max_bytes=_MAX_BYTES)
|
|
except (SsrfError, httpx.HTTPError, OSError):
|
|
return None
|
|
if resp.status != 200 or not resp.content:
|
|
return None
|
|
ctype = resp.headers.get("content-type", "").split(";")[0].strip().lower()
|
|
if not ctype.startswith("image/"):
|
|
return None
|
|
return ctype, resp.content
|
|
|
|
|
|
async def _resolve(email: str, md5: str) -> tuple[str, bytes] | None:
|
|
"""Gravatar first (``d=404`` so it 404s when the user has none), then the sender
|
|
domain's ``/favicon.ico`` as a brand-ish fallback."""
|
|
gravatar = await _fetch_image(f"https://www.gravatar.com/avatar/{md5}?d=404&s=80")
|
|
if gravatar is not None:
|
|
return gravatar
|
|
domain = email.rsplit("@", 1)[-1]
|
|
if domain:
|
|
favicon = await _fetch_image(f"https://{domain}/favicon.ico")
|
|
if favicon is not None:
|
|
return favicon
|
|
return None
|
|
|
|
|
|
@router.get("")
|
|
async def sender_avatar(_user: CurrentUser, email: str = Query(...)) -> Response:
|
|
email = email.strip().lower()
|
|
if not get_settings().sender_avatars_enabled or "@" not in email:
|
|
return Response(status_code=404)
|
|
|
|
# Binary-safe client: the cache holds raw image bytes (and a b"none" marker).
|
|
redis = get_redis_bytes()
|
|
md5 = _email_md5(email)
|
|
key = f"avatar:{md5}"
|
|
headers = {"Cache-Control": "private, max-age=86400"}
|
|
|
|
cached: bytes | None = await redis.get(key)
|
|
if cached == _NONE:
|
|
return Response(status_code=404)
|
|
if cached:
|
|
cached_ctype, _, cached_body = cached.partition(b"\n")
|
|
return Response(
|
|
content=cached_body,
|
|
media_type=cached_ctype.decode("ascii", "ignore"),
|
|
headers=headers,
|
|
)
|
|
|
|
result = await _resolve(email, md5)
|
|
if result is None:
|
|
await redis.set(key, _NONE, ex=_CACHE_TTL_MISS)
|
|
return Response(status_code=404)
|
|
ctype, body = result
|
|
await redis.set(key, ctype.encode("ascii", "ignore") + b"\n" + body, ex=_CACHE_TTL_HIT)
|
|
return Response(content=body, media_type=ctype, headers=headers)
|