Avatar Support

[Joebeurg]

Hi,

Today I've been exploring this repo and it looks very appealing. The docs are 5/5.
I have a question if the avatar (profile picture) is planned for support?

[leodip]

Thanks for your interest and for sending this message 🙂

The profile picture should be supported in the /userinfo endpoint. Docs: https://goiabada.dev/integration/endpoints/#userinfo-get-or-post

For the image URL to be returned by that endpoint, the user must have a picture uploaded. It can be uploaded by them, via the 'my account' personal area, or an admin uploading a picture for them, in the admin console (users).

If you miss a feature / use case, let me know.

[Joebeurg]

Thanks for your reply!
I apologize I did not give a good description, must be left in mind haha. Well, I was trying to mention if there is an API endpoint so that the user has the ability to upload their avatar?
And how does it get stored, is itinto the server or as blob in a db (we know this one is bad 😅) as I was looking at the REST API (and its options for a possibility to generate a GO SDK) https://goiabada.dev/integration/rest-api/#account-api

The link you shared does show the expected standard response of authenticated userinfo endpoint, but I am unable to find how the user can upload/change their profile picture.

I hope I explained my point very well 😀

Edit: for more clarity

[leodip]

Hello 🙂
These API endpoints actually already exist, we just missed including them in the docs. Sorry about the confusion!

I think this is what you're looking for:

Self-service (for users managing their own picture):
Scope needed: authserver:manage-account

• GET /api/v1/account/profile-picture – check if you have a picture
• POST /api/v1/account/profile-picture – upload (multipart form, field name is picture)
• DELETE /api/v1/account/profile-picture – remove it

Admin (for managing any user's picture):
Scope needed: authserver:manage-users or authserver:manage

• GET /api/v1/admin/users/{id}/profile-picture
• POST /api/v1/admin/users/{id}/profile-picture
• DELETE /api/v1/admin/users/{id}/profile-picture

Regarding storage... yes, they're stored as blobs in the database (in a user_profile_pictures table). Not ideal for massive scale, but works fine for most use cases.

Image requirements: JPEG/PNG/GIF/WebP, between 10x10 and 512x512 pixels, max 3MB.

We also have the same functionality in the UI. Here's what the UI looks like in the admin console:

I will get the docs updated...

Thanks!

[Joebeurg]

Awesome man, thank you so much, i am just starting with the library, as I have spent months testing other libraries like ZITADEL for multi-tenancy, tesseral, Ory Kratos, etc. but all add so much complexity to configuration and not as lightweight as yours, so I am hoping to adopt Goiabada and provide feedback/PRs as needed.
I have a question, what is the LOE when it comes to providing my own frontend for Login, account management as self hosted UI, let's say Angular? Based on the docs I know we can completely customize the templates, but just want to know your thought of the level of effort for such a case.

[leodip]

@Joebeurg

Hmmm. Here's the deal with building your own frontend:

Account management (post-login) = totally doable via API

Once a user is authenticated, you can build a completely custom Angular UI for all self-service stuff. Goiabada has REST APIs for:

• Profile updates
• Password changes
• Email/phone management + verification
• 2FA enrollment and management
• Session management (list/revoke)
• Consent management

All documented and there's an OpenAPI spec at GET /openapi.yaml. So for the "my account" section, you're good to go with a fully decoupled SPA.

Now... Login flow = this is where it gets tricky

The authentication itself (login, OTP, consent) follows the standard OAuth2 pattern with browser redirects. There's no pure POST /api/login endpoint that just returns tokens. This is by design in OAuth2/OIDC. The credentials stay between the user and the auth server, never touching your app.

Your options are...

1. Go with the redirect flow (what most apps do) - your Angular app redirects to Goiabada for login, then back with an auth code. You can customize our templates to match your app's look so it feels in-tone.

2. ROPC grant (password flow) - we support grant_type=password which lets you POST credentials directly from your app. BUT... fair warning: it's deprecated in OAuth 2.1, it's not a recommended flow for new applications, it's more to support a transitional legacy app. And it won't work for users with 2FA enabled (by design again, since there's no way to handle the OTP step).

Bottom line,

I'd suggest the hybrid approach: customize the login templates to match your Angular app's styling, and build a pure SPA for account management / admin stuff.

Regarding template customization:

The templates are standard Go HTML templates using Tailwind CSS + DaisyUI. For example, here's essentially what the login page looks like:

<h2 class='mb-2 text-xl font-semibold text-center'>Login</h2>
<form action="" method="post">
    <input type="text" name="email" class="w-full input input-bordered" />
    <input type="password" name="password" class="w-full input input-bordered" />
    <button class="w-full mt-2 btn btn-primary">Login</button>
    {{ .csrfField }}
</form>

There are ~10 auth-related templates you'd potentially edit:

• auth_pwd.html - login form
• auth_otp.html - OTP verification
• auth_otp_enrollment.html - 2FA setup during login
• consent.html - OAuth consent screen
• forgot_password.html / reset_password.html
• account_register.html + activation pages

The layout (auth_layout.html) uses DaisyUI themes, so just changing the data-theme attribute gives you a different look instantly (there's an admin page to change the theme in the admin console).

Or you can completely replace the HTML/CSS structure - just keep the form field names and {{ .csrfField }} intact.

Process is: copy templates out of the container, edit what you want, mount them back via volume. If you add new Tailwind classes, regenerate the CSS with the Tailwind CLI.

[Joebeurg]

Fantastic, thanks again 👍👍