src/Appwrite/Platform/Modules/Avatars/Services/Http.php (1)

7-7: Consider more explicit naming for cloud card variants.

The import alias GetCloudCard for Cards\Cloud\Front\Get is implicit about being the "Front" variant, while GetCloudCardBack and GetCloudCardOG are explicit. Consider renaming to GetCloudCardFront for consistency.

♻️ Proposed naming improvement

-use Appwrite\Platform\Modules\Avatars\Http\Cards\Cloud\Front\Get as GetCloudCard;
+use Appwrite\Platform\Modules\Avatars\Http\Cards\Cloud\Front\Get as GetCloudCardFront;

-        $this->addAction(GetCloudCard::getName(), new GetCloudCard());
+        $this->addAction(GetCloudCardFront::getName(), new GetCloudCardFront());

Also applies to: 32-32

src/Appwrite/Platform/Modules/Avatars/Http/Initials/Get.php (2)

33-42: Missing cache label.

Other avatar endpoints (e.g., CreditCards, Browsers, Favicon) include ->label('cache', true). This endpoint only has cache.resource but is missing the primary cache label, which may cause inconsistent caching behavior.

📝 Proposed fix

             ->groups(['api', 'avatars'])
             ->label('scope', 'avatars.read')
+            ->label('cache', true)
             ->label('cache.resource', 'avatar/initials')

---

99-125: Consider explicitly destroying Imagick objects.

The $image, $punch, and $draw Imagick objects are not explicitly destroyed. While PHP's garbage collector will handle this, explicit cleanup via destroy() is recommended for memory-intensive image operations.

♻️ Proposed fix

+        $imageBlob = $image->getImageBlob();
+
+        $draw->clear();
+        $punch->destroy();
+        $image->destroy();
+
         $response
             ->addHeader('Cache-Control', 'private, max-age=3888000') // 45 days
             ->setContentType('image/png')
-            ->file($image->getImageBlob());
+            ->file($imageBlob);
     }

src/Appwrite/Platform/Modules/Avatars/Http/Favicon/Get.php (1)

176-188: ICO validation heuristic is fragile.

The check stripos($data, '<html') === 0 || stripos($data, '<!doc') === 0 only detects HTML at the very start of the response body. A valid ICO file could theoretically start with bytes that match these patterns, or an error page might have leading whitespace.

Consider checking the response Content-Type header as a primary indicator before falling back to content inspection:

+        $contentType = $res->getHeader('Content-Type')[0] ?? '';
+        $isHtmlResponse = \str_contains($contentType, 'text/html');
+
         if ('ico' === $outputExt) {
             if (
                 empty($data) ||
+                $isHtmlResponse ||
                 stripos($data, '<html') === 0 ||
                 stripos($data, '<!doc') === 0
             ) {

src/Appwrite/Platform/Modules/Avatars/Http/Cards/Cloud/Back/Get.php (1)

47-49: Injected $user parameter is immediately overwritten.

The $user is injected via ->inject('user') but the action immediately overwrites it with a fresh database query. Either remove the injection or utilize the injected user when $userId matches.

♻️ Proposed fix - remove unused injection

             ->param('height', 0, new Range(0, 320), 'Resize image height, Pass an integer between 0 to 320.', true)
-            ->inject('user')
             ->inject('project')
             ->inject('dbForProject')

And update the action signature:

-    public function action(string $userId, string $mock, int $width, int $height, Document $user, Document $project, Database $dbForProject, Database $dbForPlatform, Response $response, array $heroes, array $contributors, array $employees, ?Logger $logger)
+    public function action(string $userId, string $mock, int $width, int $height, Document $project, Database $dbForProject, Database $dbForPlatform, Response $response, array $heroes, array $contributors, array $employees, ?Logger $logger)

Also applies to: 59-61

src/Appwrite/Platform/Modules/Avatars/Http/Image/Get.php (1)

64-66: Remove redundant variable assignments.

The $output and $type variables are both always 'png', and the conditional (empty($output)) ? $type : $output on line 98 will never trigger. This is dead code.

♻️ Proposed fix

     public function action(string $url, int $width, int $height, Response $response)
     {
         $quality = 80;
-        $output = 'png';
-        $type = 'png';

         // ... existing code ...

         $image->crop((int) $width, (int) $height);
-        $output = (empty($output)) ? $type : $output;
-        $data = $image->output($output, $quality);
+        $data = $image->output('png', $quality);

Also applies to: 97-98

src/Appwrite/Platform/Modules/Avatars/Http/QR/Get.php (1)

36-52: Missing cache and cache.resource labels.

Unlike other avatar endpoints (Browsers, CreditCards, Favicon, Image), this endpoint doesn't have the cache and cache.resource labels, which may lead to inconsistent caching behavior for QR codes.

📝 Proposed fix

             ->groups(['api', 'avatars'])
             ->label('scope', 'avatars.read')
+            ->label('cache', true)
+            ->label('cache.resource', 'avatar/qr')
             ->label('sdk', new Method(

src/Appwrite/Platform/Modules/Avatars/Http/Screenshots/Get.php (1)

154-161: Geolocation at (0, 0) is a valid coordinate but will be ignored.

The condition $latitude != 0 || $longitude != 0 excludes the valid coordinate (0, 0) in the Gulf of Guinea. While this is an edge case, consider using a separate flag or null defaults to distinguish "not provided" from "explicitly set to zero."

src/Appwrite/Platform/Modules/Avatars/Http/Action.php (2)

61-61: Unused $logger parameter.

The $logger parameter is declared but never used in getUserGitHub. Either remove it or add logging for OAuth token refresh failures and race condition retries to aid debugging.

---

42-53: Dead code: $output reassignment is a no-op.

$output is set to 'png' on line 42, so the condition empty($output) on line 52 is always false. The $type variable (line 44) is also unused after being set.

Proposed cleanup

-        $output = 'png';
         $path = $set[$code]['path'];
-        $type = 'png';

         if (!\is_readable($path)) {
             throw new Exception(Exception::GENERAL_SERVER_ERROR, 'File not readable in ' . $path);
         }

         $image = new Image(\file_get_contents($path));
         $image->crop((int) $width, (int) $height);
-        $output = (empty($output)) ? $type : $output;
-        $data = $image->output($output, $quality);
+        $data = $image->output('png', $quality);

src/Appwrite/Platform/Modules/Avatars/Http/Cards/Cloud/Front/Get.php (1)

59-61: Injected $user parameter is immediately overwritten.

The $user Document is injected via ->inject('user') at line 47 but immediately replaced at line 61 with a fresh database fetch using $userId. Either remove the injection or use the injected user when $userId is empty.

src/Appwrite/Platform/Modules/Avatars/Http/Cards/Cloud/OG/Get.php (3)

59-61: Injected $user parameter is immediately overwritten.

Same issue as in Front/Get.php: the $user Document is injected but replaced at line 61 with a fresh database fetch.

---

67-100: Significant code duplication with Front/Get.php.

The role determination logic (isHero, isContributor, isEmployee, isPlatinum), GitHub fetching, memberSince calculation, and mutual exclusion normalization (lines 123-140) are nearly identical to Front/Get.php. Consider extracting this common logic to a shared method in the base Action class to improve maintainability.

Also applies to: 123-140

---

284-287: Commented-out iconv lines should be removed or explained.

The commented-out transliteration code appears in both this file and Front/Get.php. If it's no longer needed, remove it; if it's being preserved for future use, add a TODO comment explaining why.

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro