Website header: the T5DE logo, four links, and a profile menu

The header shows T5DE's logo (the client's, also the tab icon) and Online, Rooms, Products and
Catalogs; the person's pages (Account, Library, Console for moderators) and signing out are in a menu
under their picture: their first linked IMVU account's avatar picture, which /me now gives (kept an
hour), or their initial. Creating a product moves to Products (New product, /products/new; /create
redirects there), as creating a room is on Rooms.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/api/test/products.test.ts

@@ -4,7 +4,7 @@ import { createLocalJWKSet, jwtVerify } from "jose";
 import { openDatabase, type Database } from "@t5de/db";
 import { createApp } from "../src/app";
 import { createAuth } from "../src/auth";
-import { ImvuClient, imvuImage, parseProduct, type ImvuUser } from "../src/imvu";
+import { ImvuClient, imvuImage, parse, parseProduct, type ImvuUser } from "../src/imvu";
 
 const webURL = "http://web.test";
 const apiURL = "http://api.test";
@@ -77,7 +77,7 @@ async function person(name: string, imvu?: { id: number; ageVerified: boolean })
   });
   const p = { cookie: res.headers.getSetCookie().map((c) => c.split(";")[0]).join("; ") };
   if (imvu) {
-    accounts.set(imvu.id, { id: imvu.id, username: `${name}Av`, tagline: "", ageVerified: imvu.ageVerified, accessPass: false });
+    accounts.set(imvu.id, { id: imvu.id, username: `${name}Av`, tagline: "", ageVerified: imvu.ageVerified, accessPass: false, picture: null });
     const started = await call(p, "POST", "/api/v1/account/links", { username: `${name}Av` });
     accounts.get(imvu.id)!.tagline = started.json.challenge.code;
     expect((await call(p, "POST", `/api/v1/account/links/${imvu.id}/check`)).status).toBe(200);
@@ -270,3 +270,11 @@ test("derived products carry their IMVU parent's image and categories", async ()
   expect((await call(dresser, "PUT", `/api/v1/library/${coatID}`)).status).toBe(200);
   expect((await call(dresser, "GET", "/api/v1/library")).json.library[0].product).toMatchObject({ image: coat.product_image });
 });
+
+test("an IMVU account's avatar picture is kept only from IMVU's own hosts", () => {
+  const user = (thumbnail_url: unknown) =>
+    parse({ denormalized: { "https://api.imvu.com/user/user-5": { data: { legacy_cid: 5, username: "Av", thumbnail_url } } } });
+  expect(user("https://webasset-akm.imvu.com/resized_image/p.png").picture).toBe("https://webasset-akm.imvu.com/resized_image/p.png");
+  expect(user("https://evil.example/p.png").picture).toBeNull();
+  expect(user(undefined).picture).toBeNull();
+});