flyer upload (anon) issues

src/routes/auth.routes.test.ts

@@ -165,6 +165,38 @@ describe('Auth Routes (/api/auth)', () => {
       );
     });
 
+    it('should allow registration with an empty string for avatar_url', async () => {
+      // Arrange
+      const email = 'avatar-user@test.com';
+      const mockNewUser = createMockUserProfile({
+        user: { user_id: 'avatar-user-id', email },
+      });
+      mockedAuthService.registerAndLoginUser.mockResolvedValue({
+        newUserProfile: mockNewUser,
+        accessToken: 'avatar-access-token',
+        refreshToken: 'avatar-refresh-token',
+      });
+
+      // Act
+      const response = await supertest(app).post('/api/auth/register').send({
+        email,
+        password: strongPassword,
+        full_name: 'Avatar User',
+        avatar_url: '', // Send an empty string
+      });
+
+      // Assert
+      expect(response.status).toBe(201);
+      expect(response.body.message).toBe('User registered successfully!');
+      expect(mockedAuthService.registerAndLoginUser).toHaveBeenCalledWith(
+        email,
+        strongPassword,
+        'Avatar User',
+        undefined, // The preprocess step in the Zod schema should convert '' to undefined
+        mockLogger,
+      );
+    });
+
     it('should set a refresh token cookie on successful registration', async () => {
       const mockNewUser = createMockUserProfile({
         user: { user_id: 'new-user-id', email: 'cookie@test.com' },

src/routes/auth.routes.ts

@@ -51,7 +51,11 @@ const registerSchema = z.object({
       }),
     // Sanitize optional string inputs.
     full_name: z.string().trim().optional(),
-    avatar_url: z.string().trim().url().optional(),
+    // Allow empty string or valid URL. If empty string is received, convert to undefined.
+    avatar_url: z.preprocess(
+      (val) => (val === '' ? undefined : val),
+      z.string().trim().url().optional(),
+    ),
   }),
 });
 

src/routes/user.routes.test.ts

@@ -585,6 +585,27 @@ describe('User Routes (/api/users)', () => {
         expect(response.body).toEqual(updatedProfile);
       });
 
+      it('should allow updating the profile with an empty string for avatar_url', async () => {
+        // Arrange
+        const profileUpdates = { avatar_url: '' };
+        // The service should receive `undefined` after Zod preprocessing
+        const updatedProfile = createMockUserProfile({ ...mockUserProfile, avatar_url: undefined });
+        vi.mocked(db.userRepo.updateUserProfile).mockResolvedValue(updatedProfile);
+
+        // Act
+        const response = await supertest(app).put('/api/users/profile').send(profileUpdates);
+
+        // Assert
+        expect(response.status).toBe(200);
+        expect(response.body).toEqual(updatedProfile);
+        // Verify that the Zod schema preprocessed the empty string to undefined
+        expect(db.userRepo.updateUserProfile).toHaveBeenCalledWith(
+          mockUserProfile.user.user_id,
+          { avatar_url: undefined },
+          expectLogger,
+        );
+      });
+
       it('should return 500 on a generic database error', async () => {
         const dbError = new Error('DB Connection Failed');
         vi.mocked(db.userRepo.updateUserProfile).mockRejectedValue(dbError);

src/routes/user.routes.ts

@@ -26,7 +26,13 @@ const router = express.Router();
 
 const updateProfileSchema = z.object({
   body: z
-    .object({ full_name: z.string().optional(), avatar_url: z.string().url().optional() })
+    .object({
+      full_name: z.string().optional(),
+      avatar_url: z.preprocess(
+        (val) => (val === '' ? undefined : val),
+        z.string().trim().url().optional(),
+      ),
+    })
     .refine((data) => Object.keys(data).length > 0, {
       message: 'At least one field to update must be provided.',
     }),