Harden sessions, uploads, admin demotion, and HTTP timeouts.

Address PR review findings: renew session tokens on auth, sniff/re-encode avatars, serialize last-admin checks, bound server timeouts, rune-safe truncation, and TEST_DATABASE_URL-only integration tests.

internal/web/profile.go

@@ -1,12 +1,18 @@
 package web
 
 import (
+	"bytes"
+	"fmt"
+	"image"
+	"image/jpeg"
+	"image/png"
 	"io"
 	"net/http"
 	"path"
 	"strings"
 
 	"github.com/google/uuid"
+	_ "golang.org/x/image/webp"
 
 	"plumber/internal/blob"
 	"plumber/internal/geo"
@@ -63,23 +69,21 @@ func (s *Server) handleProfile(w http.ResponseWriter, r *http.Request) {
 			s.renderProfile(w, r, u, "Avatar uploads are not configured on this server.", state)
 			return
 		}
-		ct := hdr.Header.Get("Content-Type")
-		ext, contentType, ok := avatarType(hdr.Filename, ct)
-		if !ok {
-			s.renderProfile(w, r, u, "Avatar must be a JPEG, PNG, or WebP image.", state)
-			return
-		}
 		if hdr.Size > 2<<20 {
 			s.renderProfile(w, r, u, "Avatar must be 2MB or smaller.", state)
 			return
 		}
+		body, ext, contentType, prepErr := prepareAvatar(file, 2<<20)
+		if prepErr != nil {
+			s.renderProfile(w, r, u, "Avatar must be a JPEG, PNG, or WebP image.", state)
+			return
+		}
 		key := path.Join("avatars", u.ID, uuid.NewString()+ext)
-		limited := io.LimitReader(file, (2<<20)+1)
 		url, upErr := s.cfg.Blob.Upload(r.Context(), blob.FileUpload{
 			Key:         key,
-			Body:        limited,
+			Body:        bytes.NewReader(body),
 			ContentType: contentType,
-			Size:        hdr.Size,
+			Size:        int64(len(body)),
 		})
 		if upErr != nil {
 			s.renderProfile(w, r, u, "Could not upload avatar. Try again later.", state)
@@ -103,18 +107,49 @@ func (s *Server) handleProfile(w http.ResponseWriter, r *http.Request) {
 	http.Redirect(w, r, "/profile", http.StatusSeeOther)
 }
 
-func avatarType(filename, contentType string) (ext, normalized string, ok bool) {
-	contentType = strings.ToLower(strings.TrimSpace(contentType))
-	filename = strings.ToLower(filename)
+// prepareAvatar reads at most maxBytes, sniffs/decodes the image, and re-encodes
+// it so only valid image bytes are stored publicly.
+func prepareAvatar(r io.Reader, maxBytes int64) (body []byte, ext, contentType string, err error) {
+	limited := io.LimitReader(r, maxBytes+1)
+	raw, err := io.ReadAll(limited)
+	if err != nil {
+		return nil, "", "", err
+	}
+	if int64(len(raw)) > maxBytes {
+		return nil, "", "", fmt.Errorf("avatar too large")
+	}
+	if len(raw) == 0 {
+		return nil, "", "", fmt.Errorf("empty avatar")
+	}
+
+	sniff := http.DetectContentType(raw)
 	switch {
-	case strings.HasPrefix(contentType, "image/jpeg"), strings.HasSuffix(filename, ".jpg"), strings.HasSuffix(filename, ".jpeg"):
-		return ".jpg", "image/jpeg", true
-	case strings.HasPrefix(contentType, "image/png"), strings.HasSuffix(filename, ".png"):
-		return ".png", "image/png", true
-	case strings.HasPrefix(contentType, "image/webp"), strings.HasSuffix(filename, ".webp"):
-		return ".webp", "image/webp", true
+	case strings.HasPrefix(sniff, "image/jpeg"),
+		strings.HasPrefix(sniff, "image/png"),
+		strings.HasPrefix(sniff, "image/webp"):
 	default:
-		return "", "", false
+		return nil, "", "", fmt.Errorf("unsupported type %s", sniff)
+	}
+
+	img, format, err := image.Decode(bytes.NewReader(raw))
+	if err != nil {
+		return nil, "", "", err
+	}
+
+	var out bytes.Buffer
+	switch format {
+	case "jpeg":
+		if err := jpeg.Encode(&out, img, &jpeg.Options{Quality: 90}); err != nil {
+			return nil, "", "", err
+		}
+		return out.Bytes(), ".jpg", "image/jpeg", nil
+	case "png", "webp":
+		if err := png.Encode(&out, img); err != nil {
+			return nil, "", "", err
+		}
+		return out.Bytes(), ".png", "image/png", nil
+	default:
+		return nil, "", "", fmt.Errorf("unsupported format %s", format)
 	}
 }