feat: complete phase 3 career workspace

JobTrackerApi/Controllers/AuthController.cs

@@ -24,8 +24,9 @@ public sealed class AuthController : ControllerBase
     private readonly ILogger<AuthController> _logger;
     private readonly ITwoFactorPendingTokenService _twoFactorPending;
     private readonly JobTrackerContext _db;
+    private readonly string _avatarDataRoot;
 
-    public AuthController(IConfiguration cfg, UserManager<ApplicationUser> users, ITokenService tokens, IAppEmailSender email, IGoogleTokenValidator googleTokens, IMicrosoftTokenValidator microsoftTokens, ILogger<AuthController> logger, ITwoFactorPendingTokenService twoFactorPending, JobTrackerContext db)
+    public AuthController(IConfiguration cfg, UserManager<ApplicationUser> users, ITokenService tokens, IAppEmailSender email, IGoogleTokenValidator googleTokens, IMicrosoftTokenValidator microsoftTokens, ILogger<AuthController> logger, ITwoFactorPendingTokenService twoFactorPending, JobTrackerContext db, IHostEnvironment? environment = null)
     {
         _cfg = cfg;
         _users = users;
@@ -36,6 +37,7 @@ public sealed class AuthController : ControllerBase
         _logger = logger;
         _twoFactorPending = twoFactorPending;
         _db = db;
+        _avatarDataRoot = Path.GetFullPath((_cfg["Data:Root"] ?? environment?.ContentRootPath ?? AppContext.BaseDirectory).Trim());
     }
 
     [HttpGet("config")]
@@ -575,8 +577,7 @@ public sealed class AuthController : ControllerBase
             return BadRequest("Only PNG, JPEG, or WebP images are supported.");
         }
 
-        var base64 = Convert.ToBase64String(bytes);
-        user.AvatarImageDataUrl = $"data:{detectedContentType};base64,{base64}";
+        user.AvatarImageDataUrl = await AvatarStorage.StoreAsync(_avatarDataRoot, user.Id, bytes, detectedContentType, HttpContext.RequestAborted);
 
         var result = await _users.UpdateAsync(user);
         if (!result.Succeeded)
@@ -584,7 +585,7 @@ public sealed class AuthController : ControllerBase
             return BadRequest(string.Join("; ", result.Errors.Select(e => e.Description)));
         }
 
-        return Ok(new { avatarImageDataUrl = user.AvatarImageDataUrl });
+        return Ok(new { avatarImageDataUrl = AvatarStorage.Resolve(user.AvatarImageDataUrl) });
     }
 
     [HttpDelete("avatar")]
@@ -597,6 +598,7 @@ public sealed class AuthController : ControllerBase
             return Unauthorized();
         }
 
+        var storedAvatar = user.AvatarImageDataUrl;
         user.AvatarImageDataUrl = null;
         var result = await _users.UpdateAsync(user);
         if (!result.Succeeded)
@@ -604,6 +606,7 @@ public sealed class AuthController : ControllerBase
             return BadRequest(string.Join("; ", result.Errors.Select(e => e.Description)));
         }
 
+        AvatarStorage.Delete(storedAvatar);
         return NoContent();
     }
 
@@ -876,7 +879,7 @@ public sealed class AuthController : ControllerBase
             DisplayName: user.DisplayName,
             ProfileCvText: user.ProfileCvText,
             ProfileCvStructureJson: user.ProfileCvStructureJson,
-            AvatarImageDataUrl: user.AvatarImageDataUrl,
+            AvatarImageDataUrl: AvatarStorage.Resolve(user.AvatarImageDataUrl),
             Roles: roles,
             GoogleLink: new GoogleLinkDto(
                 Linked: !string.IsNullOrWhiteSpace(user.GoogleSubject),