Method uploadAvatar

backend/src/user/user.resolver.ts:96–117

(
    @GetUserIdFromToken() userId: string,
    @Args('file', { type: () => GraphQLUpload }) file: Promise<FileUpload>,
  )

  @Query(() => User)
  @UseGuards(JWTAuthGuard)
  async me(@GetUserIdFromToken() id: string): Promise<User> {
    Logger.log('me id:', id);
    return this.userService.getUser(id);
  }

  /**
   * Role names for the caller, so the client can offer the operator console to
   * the people who can actually open it. Names rather than the Role entity:
   * the GraphQL type `Role` is already the message-author enum.
   *
   * A top-level guarded query rather than a field on User. As a @ResolveField
   * it ran with no guard at all — APP_GUARD does not reach field resolvers
   * unless `fieldResolverEnhancers` is set, and it is not — so anonymous
   * callers could walk fetchPublicProjects (@Public) → Project.user → roles
   * and enumerate which accounts are admins. Asking only about the bearer
   * means there is no other user's roles to leak.
   */
  @Query(() => [String])
  @UseGuards(JWTAuthGuard)
  async myRoles(@GetUserIdFromToken() id: string): Promise<string[]> {
    const { roles } = await this.authService.getUserRoles(id);
    return roles.map((role) => role.name);
  }

  /** Rename yourself. The settings page called this "not editable yet". */