add server side validation of image URLs

libs/model/test/community/community-goals-lifecycle.spec.ts

@@ -47,7 +47,7 @@ describe('community goals lifecycle', () => {
       payload: {
         name: `xp ${type} quest`,
         description: chance.sentence(),
-        image_url: chance.url(),
+        image_url: 'https://example.com/image.png',
         start_date: dayjs().add(2, 'day').toDate(),
         end_date: dayjs().add(3, 'day').toDate(),
         max_xp_to_end: 100,

libs/model/test/community/community-lifecycle.spec.ts

@@ -65,7 +65,7 @@ function buildCreateGroupPayload(
     metadata: {
       name: chance.name(),
       description: chance.sentence(),
-      groupImageUrl: chance.url(),
+      groupImageUrl: 'https://example.com/group.png',
       required_requirements: 1,
       membership_ttl: 100,
     },
@@ -808,7 +808,7 @@ describe('Community lifecycle', () => {
     const baseRequest = {
       default_symbol: 'EDG',
       base: ChainBase.Substrate,
-      icon_url: 'assets/img/protocols/edg.png',
+      icon_url: 'https://assets.commonwealth.im/edg.png',
       active: true,
       type: ChainType.Chain,
       social_links: [],
@@ -836,7 +836,7 @@ describe('Community lifecycle', () => {
       assert.equal(updated?.default_symbol, 'EDG');
       // don't allow updating base
       assert.equal(updated?.base, 'ethereum');
-      assert.equal(updated?.icon_url, 'assets/img/protocols/edg.png');
+      assert.equal(updated?.icon_url, 'https://assets.commonwealth.im/edg.png');
       assert.equal(updated?.active, true);
       expect(updated?.social_links).toContain('http://discord.gg');
       expect(updated?.social_links).toContain('https://t.me/');

libs/model/test/contest/contests-metadata-commands-lifecycle.spec.ts

@@ -14,7 +14,7 @@ describe('Contests metadata commands lifecycle', () => {
   const payout_structure = [10, 90];
   const prize_percentage = 1;
   const funding_token_address = 'funding-address';
-  const image_url = 'url';
+  const image_url = 'https://example.com/contest.png';
   const interval = 10;
   const ticker = 'XYZ';
   const decimals = 18;
@@ -237,7 +237,7 @@ describe('Contests metadata commands lifecycle', () => {
           community_id,
           contest_address,
           name: 'xxx',
-          image_url: 'https://blah',
+          image_url: 'https://example.com/updated.png',
         },
       });
 
@@ -269,7 +269,7 @@ describe('Contests metadata commands lifecycle', () => {
             community_id,
             contest_address,
             name: 'xxx',
-            image_url: 'https://blah',
+            image_url: 'https://example.com/updated.png',
           },
         },
       );
@@ -279,7 +279,7 @@ describe('Contests metadata commands lifecycle', () => {
         contest_address,
         name: 'xxx',
         community_id,
-        image_url: 'https://blah',
+        image_url: 'https://example.com/updated.png',
         funding_token_address,
         prize_percentage,
         payout_structure,

libs/model/test/launchpad/launchpad-lifecycle.spec.ts

@@ -165,7 +165,7 @@ describe('Launchpad Lifecycle', () => {
       payload: {
         name: 'launchpad quest',
         description: chance.sentence(),
-        image_url: chance.url(),
+        image_url: 'https://example.com/image.png',
         start_date: dayjs().add(2, 'day').toDate(),
         end_date: dayjs().add(3, 'day').toDate(),
         max_xp_to_end: 100,
@@ -212,7 +212,7 @@ describe('Launchpad Lifecycle', () => {
         transaction_hash: CREATE_TOKEN_TXN_HASH,
         eth_chain_id,
         description: 'test',
-        icon_url: 'test',
+        icon_url: 'https://example.com/icon.png',
         community_id: community_id!,
       },
     });

libs/model/test/quest/quest-lifecycle.spec.ts

@@ -36,7 +36,7 @@ async function createQuest(
       community_id,
       name,
       description: chance.sentence(),
-      image_url: chance.url(),
+      image_url: 'https://example.com/image.png',
       start_date,
       end_date,
       max_xp_to_end,

libs/model/test/user/user-lifecycle.spec.ts

@@ -225,7 +225,7 @@ describe('User lifecycle', () => {
         payload: {
           name: 'xp quest 1',
           description: chance.sentence(),
-          image_url: chance.url(),
+          image_url: 'https://example.com/image.png',
           community_id,
           start_date: dayjs().add(2, 'day').toDate(),
           end_date: dayjs().add(3, 'day').toDate(),
@@ -427,7 +427,7 @@ describe('User lifecycle', () => {
         payload: {
           name: 'xp quest 2',
           description: chance.sentence(),
-          image_url: chance.url(),
+          image_url: 'https://example.com/image.png',
           start_date: dayjs().add(2, 'day').toDate(),
           end_date: dayjs().add(3, 'day').toDate(),
           max_xp_to_end: 100,
@@ -839,7 +839,7 @@ describe('User lifecycle', () => {
         payload: {
           name: 'xp concurrent 1',
           description: chance.sentence(),
-          image_url: chance.url(),
+          image_url: 'https://example.com/image.png',
           community_id,
           start_date: dayjs().add(2, 'day').toDate(),
           end_date: dayjs().add(3, 'day').toDate(),
@@ -852,7 +852,7 @@ describe('User lifecycle', () => {
         payload: {
           name: 'xp concurrent 2',
           description: chance.sentence(),
-          image_url: chance.url(),
+          image_url: 'https://example.com/image.png',
           community_id,
           start_date: dayjs().add(2, 'day').toDate(),
           end_date: dayjs().add(3, 'day').toDate(),
@@ -932,7 +932,7 @@ describe('User lifecycle', () => {
         payload: {
           name: 'xp quest with low cap',
           description: chance.sentence(),
-          image_url: chance.url(),
+          image_url: 'https://example.com/image.png',
           community_id,
           start_date: dayjs().add(2, 'day').toDate(),
           end_date: dayjs().add(3, 'day').toDate(),
@@ -1036,7 +1036,7 @@ describe('User lifecycle', () => {
         payload: {
           name: 'xp quest for memberships',
           description: chance.sentence(),
-          image_url: chance.url(),
+          image_url: 'https://example.com/image.png',
           start_date: dayjs().add(2, 'day').toDate(),
           end_date: dayjs().add(3, 'day').toDate(),
           max_xp_to_end: 200,
@@ -1100,7 +1100,7 @@ describe('User lifecycle', () => {
         payload: {
           name: 'xp quest for wallet linking',
           description: chance.sentence(),
-          image_url: chance.url(),
+          image_url: 'https://example.com/image.png',
           start_date: dayjs().add(2, 'day').toDate(),
           end_date: dayjs().add(3, 'day').toDate(),
           max_xp_to_end: 200,

libs/schemas/src/commands/bot-contest.schemas.ts

@@ -6,7 +6,7 @@ import {
 import { z } from 'zod';
 import { Community } from '../entities';
 import { TokenView } from '../queries';
-import { checkIconSize } from '../utils';
+import { ImageUrl, checkIconSize } from '../utils';
 
 export const CreateBotContest = {
   input: z.object({
@@ -30,11 +30,9 @@ export const CreateBotNamespace = {
         message: `String must not contain '${ALL_COMMUNITIES}'`,
       }),
     description: z.string().optional(),
-    icon_url: z
-      .string()
-      .url()
-      .superRefine(async (val, ctx) => await checkIconSize(val, ctx))
-      .optional(),
+    icon_url: ImageUrl.superRefine(
+      async (val, ctx) => await checkIconSize(val, ctx),
+    ).optional(),
     admin_address: z.string(),
     chain_id: z.number().describe('The chain id to create contest for'),
   }),
@@ -50,7 +48,7 @@ export const LaunchToken = {
     symbol: z.string().describe('The symbol of the token'),
     totalSupply: z.number().describe('The total supply of the token'),
     eth_chain_id: z.number().describe('The chain id to create token for'),
-    icon_url: z.string().optional().describe('The icon url of the token'),
+    icon_url: ImageUrl.optional().describe('The icon url of the token'),
     description: z.string().optional().describe('The description of the token'),
   }),
   output: TokenView.extend({

libs/schemas/src/commands/community.schemas.ts

@@ -23,7 +23,7 @@ import { StakeTransaction } from '../entities/stake.schemas';
 import { Tags } from '../entities/tag.schemas';
 import { Topic } from '../entities/topic.schemas';
 import { Address } from '../entities/user.schemas';
-import { PG_INT, checkIconSize } from '../utils';
+import { ImageUrl, PG_INT, checkIconSize } from '../utils';
 
 export const CreateCommunity = {
   input: z.object({
@@ -45,11 +45,9 @@ export const CreateCommunity = {
       }),
     chain_node_id: PG_INT,
     description: z.string().optional(),
-    icon_url: z
-      .string()
-      .url()
-      .superRefine(async (val, ctx) => await checkIconSize(val, ctx))
-      .optional(),
+    icon_url: ImageUrl.superRefine(
+      async (val, ctx) => await checkIconSize(val, ctx),
+    ).optional(),
     social_links: z.array(z.string().url()).default([]),
     tags: z.array(z.string()).default([]), // community tags are dynamic, tags should be validated in service method
     directory_page_enabled: z.boolean().default(false),
@@ -147,6 +145,7 @@ export const UpdateCommunity = {
     .partial()
     .extend({
       community_id: z.string(),
+      icon_url: ImageUrl.nullish(),
       name: z
         .string()
         .max(255)
@@ -161,7 +160,7 @@ export const UpdateCommunity = {
       snapshot: Snapshot.or(z.array(Snapshot)).optional(),
       transactionHash: z.string().optional(),
       launchpad_weighted_voting: z.boolean().optional(),
-      launchpad_token_image: z.string().optional(),
+      launchpad_token_image: ImageUrl.optional(),
     }),
   output: Community,
   context: AuthContext,
@@ -284,7 +283,7 @@ export const ToggleArchiveTopic = {
 const GroupMetadata = z.object({
   name: z.string().max(40),
   description: z.string().max(250),
-  groupImageUrl: z.string().nullish(),
+  groupImageUrl: ImageUrl.nullish(),
   required_requirements: PG_INT.nullish(),
   membership_ttl: PG_INT.optional(),
 });
@@ -535,7 +534,7 @@ export const SubscribeMarket = {
     start_time: z.coerce.date(),
     end_time: z.coerce.date(),
     status: z.enum(MarketStatus),
-    image_url: z.string().nullish(),
+    image_url: ImageUrl.nullish(),
   }),
   output: z.boolean(),
   context: AuthContext,

libs/schemas/src/commands/contest.schemas.ts

@@ -4,15 +4,15 @@ import { AuthContext } from '../context';
 import { ContestManager } from '../entities/contest-manager.schemas';
 import { FarcasterAction } from '../entities/farcaster.schemas';
 import { ContestAction } from '../projections';
-import { PG_INT } from '../utils';
+import { ImageUrl, PG_INT } from '../utils';
 
 export const CreateContestManagerMetadata = {
   input: z.object({
     community_id: z.string(),
     contest_address: z.string().describe('On-Chain contest manager address'),
     name: z.string(),
     description: z.string().nullish(),
-    image_url: z.string().optional(),
+    image_url: ImageUrl.optional(),
     funding_token_address: z
       .string()
       .optional()
@@ -49,7 +49,7 @@ export const UpdateContestManagerMetadata = {
     contest_address: z.string().describe('On-Chain contest manager address'),
     name: z.string().optional(),
     description: z.string().optional(),
-    image_url: z.string().optional(),
+    image_url: ImageUrl.optional(),
     topic_id: PG_INT.optional(),
     namespace_judge_token_id: PG_INT.optional(),
   }),

libs/schemas/src/commands/magic.schemas.ts

@@ -1,12 +1,13 @@
 import { WalletSsoSource } from '@hicommonwealth/shared';
 import { z } from 'zod';
+import { ImageUrl } from '../utils';
 
 export const MagicLogin = z.object({
   community_id: z.string().optional(),
   access_token: z.string().optional(),
   jwt: z.string().nullish(),
   username: z.string().nullish(),
-  avatarUrl: z.string().nullish(),
+  avatarUrl: ImageUrl.nullish(),
   magicAddress: z.string(),
   session: z.string().nullish(),
   walletSsoSource: z.enum(WalletSsoSource),

libs/schemas/src/commands/quest.schemas.ts

@@ -1,15 +1,19 @@
 import { z } from 'zod';
 import { AuthContext } from '../context';
 import { Quest, QuestActionMeta } from '../entities';
-import { EVM_ADDRESS_STRICT, EVM_EVENT_SIGNATURE_STRICT } from '../utils';
+import {
+  EVM_ADDRESS_STRICT,
+  EVM_EVENT_SIGNATURE_STRICT,
+  ImageUrl,
+} from '../utils';
 
 const QuestView = Quest.omit({ scheduled_job_id: true });
 
 export const CreateQuest = {
   input: z.object({
     name: z.string(),
     description: z.string(),
-    image_url: z.string(),
+    image_url: ImageUrl,
     start_date: z.coerce.date(),
     end_date: z.coerce.date(),
     max_xp_to_end: z.number().default(0),
@@ -52,7 +56,7 @@ export const UpdateQuest = {
     name: z.string().optional(),
     description: z.string().optional(),
     community_id: z.string().optional().nullable(),
-    image_url: z.string().optional(),
+    image_url: ImageUrl.optional(),
     start_date: z.coerce.date().optional(),
     end_date: z.coerce.date().optional(),
     max_xp_to_end: z.number().optional(),

libs/schemas/src/commands/token.schemas.ts

@@ -2,14 +2,15 @@ import { z } from 'zod';
 import { AuthContext } from '../context';
 import { events } from '../events';
 import { LaunchpadTradeView, TokenView } from '../queries';
+import { ImageUrl } from '../utils';
 
 export const CreateToken = {
   input: z.object({
     community_id: z.string(),
     eth_chain_id: z.number(),
     transaction_hash: z.string().length(66),
     description: z.string().nullish(),
-    icon_url: z.string().nullish(),
+    icon_url: ImageUrl.nullish(),
   }),
   output: TokenView.extend({
     community_id: z.string().nullish(),

libs/schemas/src/commands/user.schemas.ts

@@ -9,6 +9,7 @@ import {
   User,
   UserProfile,
 } from '../entities';
+import { ImageUrl } from '../utils';
 
 export const SignIn = {
   input: z.object({
@@ -70,6 +71,13 @@ export const UpdateUser = {
             message: 'Username must not contain the word "Common"',
           },
         ),
+      avatar_url: ImageUrl.nullish(),
+      background_image: z
+        .object({
+          url: ImageUrl.nullish(),
+          imageBehavior: z.string().nullish(),
+        })
+        .nullish(),
     }),
   }),
   output: User,