feat(uploads): add R2 avatar upload flow (!22) · Merge Requests · ThinhNC / finwise-miniapp-be

feat(uploads): add R2 avatar upload flow

Summary

Add an authenticated POST /uploads/presign endpoint for direct browser uploads to Cloudflare R2.
Generate short-lived presigned PUT URLs with user-scoped, UUID-based object keys.
Restrict avatar uploads to JPEG, PNG, and WebP files with configurable size limits.
Add Cloudflare R2 environment configuration and AWS S3-compatible SDK dependencies.
Persist avatar horizontal and vertical crop positions in the user profile.
Support avatar removal and reset crop positions to their default values when an avatar is deleted.
Return the updated user object from the profile update endpoint.
Normalize the authenticated user response across login, profile, and current-user APIs.
Update API documentation and Swagger schemas for the upload and profile flows.

Configuration

The following environment variables must be configured:

R2_ACCOUNT_ID
R2_BUCKET_NAME
R2_ACCESS_KEY_ID
R2_SECRET_ACCESS_KEY
R2_PUBLIC_BASE_URL
R2_PRESIGNED_URL_EXPIRES_IN_SECONDS
R2_AVATAR_MAX_FILE_SIZE_MB

The R2 bucket must also allow browser PUT requests from the frontend origins.

## Summary

- Add an authenticated `POST /uploads/presign` endpoint for direct browser uploads to Cloudflare R2.
- Generate short-lived presigned PUT URLs with user-scoped, UUID-based object keys.
- Restrict avatar uploads to JPEG, PNG, and WebP files with configurable size limits.
- Add Cloudflare R2 environment configuration and AWS S3-compatible SDK dependencies.
- Persist avatar horizontal and vertical crop positions in the user profile.
- Support avatar removal and reset crop positions to their default values when an avatar is deleted.
- Return the updated user object from the profile update endpoint.
- Normalize the authenticated user response across login, profile, and current-user APIs.
- Update API documentation and Swagger schemas for the upload and profile flows.

## Configuration

The following environment variables must be configured:

- `R2_ACCOUNT_ID`
- `R2_BUCKET_NAME`
- `R2_ACCESS_KEY_ID`
- `R2_SECRET_ACCESS_KEY`
- `R2_PUBLIC_BASE_URL`
- `R2_PRESIGNED_URL_EXPIRES_IN_SECONDS`
- `R2_AVATAR_MAX_FILE_SIZE_MB`

The R2 bucket must also allow browser `PUT` requests from the frontend origins.