Restore self-hosted /api/imaging/avatar (and badge) endpoints.

The clothing importer and imager helpers pointed at a missing route; proxy Habbo with disk/memory cache so avatars work again.

Co-authored-by: Cursor <[email protected]>

.gitignore

@@ -6,8 +6,9 @@ next-env.d.ts
 *.tsbuildinfo
 # Prisma client is generated by `prisma generate`
 src/generated/
-# Runtime logs (not part of the codebase)
-storage/logs/
+# Runtime avatar/badge imaging disk cache
+public/cache/
+
 prod.log
 *.log
 

src/app/api/imaging/badge/route.ts

@@ -0,0 +1,46 @@
+import { type NextRequest, NextResponse } from "next/server";
+import { clientIp, rateLimit } from "@/lib/rate-limit";
+import { siteSettings } from "@/lib/services/site-settings";
+
+/**
+ * GET /api/imaging/badge?code=ADM
+ *
+ * Resolves a Habbo badge code to its image URL and redirects there.
+ */
+
+const CODE_RE = /^[A-Za-z0-9_+.-]+$/;
+const CODE_MAX_LEN = 50;
+const DEFAULT_BASE = "https://images.habbo.com/c_images/album1584";
+
+export async function GET(request: NextRequest) {
+	const ip = await clientIp();
+	const limited = await rateLimit(`badge-imaging:${ip}`, 60, 60_000);
+	if (!limited.ok) {
+		return new NextResponse(null, {
+			status: 429,
+			headers: { "Retry-After": String(limited.retryAfter) },
+		});
+	}
+
+	const code = request.nextUrl.searchParams.get("code")?.trim();
+	if (!code || code.length > CODE_MAX_LEN || !CODE_RE.test(code)) {
+		return NextResponse.json({ error: "Invalid badge code" }, { status: 400 });
+	}
+
+	const configured = (
+		(await siteSettings.get("badge_base_url", "")) ?? ""
+	).trim();
+	const base = (configured || DEFAULT_BASE).replace(/\/+$/, "");
+	const isAbsolute = /^https?:\/\//i.test(base);
+	const target = `${base}/${code}.gif`;
+	const absoluteTarget = isAbsolute
+		? target
+		: new URL(target, request.nextUrl.origin).toString();
+
+	return NextResponse.redirect(absoluteTarget, {
+		status: 302,
+		headers: {
+			"Cache-Control": "public, max-age=300",
+		},
+	});
+}

src/lib/services/imager/memory-cache.ts

@@ -0,0 +1,97 @@
+/**
+ * Tiny LRU + in-flight dedup utilities for the avatar imager.
+ * Pure in-house, zero deps. Map preserves insertion order, so we
+ * implement LRU by deleting + re-inserting on access.
+ */
+
+export class LruCache<V> {
+	private map = new Map<string, V>();
+
+	constructor(private readonly capacity: number) {}
+
+	get(key: string): V | undefined {
+		const v = this.map.get(key);
+		if (v === undefined) return undefined;
+		this.map.delete(key);
+		this.map.set(key, v);
+		return v;
+	}
+
+	set(key: string, value: V): void {
+		if (this.map.has(key)) this.map.delete(key);
+		this.map.set(key, value);
+		if (this.map.size > this.capacity) {
+			const oldest = this.map.keys().next().value;
+			if (oldest !== undefined) this.map.delete(oldest);
+		}
+	}
+
+	has(key: string): boolean {
+		return this.map.has(key);
+	}
+
+	delete(key: string): void {
+		this.map.delete(key);
+	}
+
+	clear(): void {
+		this.map.clear();
+	}
+
+	get size(): number {
+		return this.map.size;
+	}
+}
+
+/**
+ * In-flight request deduplication. If N callers ask for the same key
+ * concurrently, only the first one runs `loader` and the rest await
+ * the same Promise.
+ */
+export class InFlight<V> {
+	private pending = new Map<string, Promise<V>>();
+
+	async dedup(key: string, loader: () => Promise<V>): Promise<V> {
+		const existing = this.pending.get(key);
+		if (existing) return existing;
+		const p = loader().finally(() => {
+			this.pending.delete(key);
+		});
+		this.pending.set(key, p);
+		return p;
+	}
+}
+
+/**
+ * Negative cache: marks a key as "known to fail" for `ttlMs` so we don't
+ * hammer the upstream / re-attempt expensive renders for broken figures.
+ */
+export class NegativeCache {
+	private map = new Map<string, number>();
+
+	constructor(private readonly ttlMs: number) {}
+
+	isMarked(key: string): boolean {
+		const exp = this.map.get(key);
+		if (exp === undefined) return false;
+		if (Date.now() > exp) {
+			this.map.delete(key);
+			return false;
+		}
+		return true;
+	}
+
+	mark(key: string): void {
+		this.map.set(key, Date.now() + this.ttlMs);
+		if (this.map.size > 1000) {
+			const now = Date.now();
+			for (const [k, exp] of this.map) {
+				if (now > exp) this.map.delete(k);
+			}
+		}
+	}
+
+	clear(): void {
+		this.map.clear();
+	}
+}