umputun / remark42 / 28528304245

84%

master: 84%

Pull #2104

github

fix: remove user avatar on deleteme request

The delete_me token built by deleteMeCtrl omitted the user's Picture, so the
avatar-removal branch in deleteMeRequestCtrl never ran for real requests and
avatars survived account deletion. Carry Picture in the token so the stored
avatar is removed when the request is processed.

Make the removal best-effort: the avatar stores report an already-missing
avatar as an error with no distinguishable sentinel, and the user's data is
already deleted at that point, so a missing avatar (e.g. a repeated request)
no longer fails the whole deletion with a 400.

Only remove a well-formed avatar id ("<hash>.image") so a malformed picture
can't make a filesystem-backed store target an unexpected path.

14 of 16 new or added lines in 2 files covered. (87.5%)

6412 of 7598 relevant lines covered (84.39%)

36.82 hits per line