feat(auth): add dedicated avatar endpoints, session pagination, and audit log idempotency (!36) · Merge Requests · ThinhNC / finwise-miniapp-be

feat(auth): add dedicated avatar endpoints, session pagination, and audit log idempotency

Summary of Changes

This PR introduces dedicated avatar management endpoints with S3/MinIO cleanup, adds pagination support for active sessions, optimizes audit log creation through idempotency checks, and enhances user projection security.

Key Changes

Dedicated Avatar Endpoints:
- Added PUT /api/v1/auth/avatar: Updates avatarUrl, avatarPositionX, and avatarPositionY.
- Added DELETE /api/v1/auth/avatar: Deletes user avatar, resets position to default (50/50), and deletes stored image object via UploadService.deleteObject.
- Decoupled avatar payload from general profile update (PUT /api/v1/auth/profile).
Session Pagination:
- Updated GET /api/v1/auth/sessions with page and limit query validation and standard pagination metadata (meta: { total, page, limit, totalPages }).
Audit Log Idempotency & Optimization:
- Prevented redundant audit logs in updateProfile, updateAvatar, and assignPermissions when incoming payload matches existing database state.
Security & Data Projections:
- Added userSelect masking across user repository queries to avoid leaking passwordHash on soft delete and projection updates.
- Added fullName support during admin user creation.
Testing:
- Added comprehensive integration tests covering avatar lifecycle, profile updates, session pagination query validation, and RBAC idempotency.

## Summary of Changes

### Key Changes
- **Dedicated Avatar Endpoints**:
  - Added `PUT /api/v1/auth/avatar`: Updates `avatarUrl`, `avatarPositionX`, and `avatarPositionY`.
  - Added `DELETE /api/v1/auth/avatar`: Deletes user avatar, resets position to default (50/50), and deletes stored image object via `UploadService.deleteObject`.
  - Decoupled avatar payload from general profile update (`PUT /api/v1/auth/profile`).
- **Session Pagination**:
  - Updated `GET /api/v1/auth/sessions` with `page` and `limit` query validation and standard pagination metadata (`meta: { total, page, limit, totalPages }`).
- **Audit Log Idempotency & Optimization**:
  - Prevented redundant audit logs in `updateProfile`, `updateAvatar`, and `assignPermissions` when incoming payload matches existing database state.
- **Security & Data Projections**:
  - Added `userSelect` masking across user repository queries to avoid leaking `passwordHash` on soft delete and projection updates.
  - Added `fullName` support during admin user creation.
- **Testing**:
  - Added comprehensive integration tests covering avatar lifecycle, profile updates, session pagination query validation, and RBAC idempotency.