Restore self-hosted /api/imaging/avatar (and badge) endpoints.

The clothing importer and imager helpers pointed at a missing route; proxy Habbo with disk/memory cache so avatars work again.

Co-authored-by: Cursor <[email protected]>

src/app/api/imaging/avatar/route.ts

@@ -0,0 +1,125 @@
+import { type NextRequest, NextResponse } from "next/server";
+import { clientIp, rateLimit } from "@/lib/rate-limit";
+import {
+	type AvatarRenderResult,
+	renderAvatar,
+} from "@/lib/services/imager/avatar-renderer";
+
+/**
+ * GET /api/imaging/avatar?figure=hr-115-42.hd-195-19&size=l&direction=2&...
+ *
+ * Self-hosted avatar imager with disk + memory cache and Habbo upstream fallback.
+ */
+
+const FIGURE_RE = /^[a-z]{2}-\d+/i;
+const FIGURE_MAX_LEN = 512;
+const FIGURE_MAX_PARTS = 24;
+
+export async function GET(request: NextRequest) {
+	const ip = await clientIp();
+	const limited = await rateLimit(`avatar-imaging:${ip}`, 60, 60_000);
+	if (!limited.ok) {
+		return new NextResponse(null, {
+			status: 429,
+			headers: { "Retry-After": String(limited.retryAfter) },
+		});
+	}
+
+	const { searchParams } = new URL(request.url);
+
+	const figure = (
+		searchParams.get("figure") ??
+		searchParams.get("look") ??
+		""
+	).trim();
+	if (!figure) {
+		return NextResponse.json(
+			{ error: "Missing figure parameter" },
+			{ status: 400 },
+		);
+	}
+	if (figure.length > FIGURE_MAX_LEN || !FIGURE_RE.test(figure)) {
+		return NextResponse.json(
+			{ error: "Invalid figure format" },
+			{ status: 400 },
+		);
+	}
+	if (figure.split(".").length > FIGURE_MAX_PARTS) {
+		return NextResponse.json(
+			{ error: "Figure has too many parts" },
+			{ status: 400 },
+		);
+	}
+
+	const sizeParam = searchParams.get("size");
+	const size: "s" | "m" | "l" =
+		sizeParam === "s" || sizeParam === "l" ? sizeParam : "m";
+
+	const direction = clampInt(searchParams.get("direction"), 0, 7, 2);
+	const headDirection = clampInt(
+		searchParams.get("head_direction") ?? searchParams.get("headDirection"),
+		0,
+		7,
+		3,
+	);
+	const headOnly =
+		searchParams.get("headonly") === "1" ||
+		searchParams.get("headOnly") === "1";
+	const gesture = searchParams.get("gesture") ?? undefined;
+	const action = searchParams.get("action") ?? undefined;
+
+	const result: AvatarRenderResult = await renderAvatar({
+		figure,
+		size,
+		direction,
+		headDirection,
+		headOnly,
+		gesture,
+		action,
+	});
+
+	const ifNoneMatch = request.headers.get("if-none-match");
+	if (ifNoneMatch && ifNoneMatch === result.etag) {
+		return new NextResponse(null, {
+			status: 304,
+			headers: {
+				ETag: result.etag,
+				"Cache-Control": "public, max-age=604800, immutable",
+			},
+		});
+	}
+
+	return new NextResponse(new Uint8Array(result.buffer), {
+		status: 200,
+		headers: {
+			"Content-Type": "image/png",
+			"Cache-Control": "public, max-age=604800, immutable",
+			"Access-Control-Allow-Origin": "*",
+			ETag: result.etag,
+			"X-Imager-Source": result.source,
+		},
+	});
+}
+
+export async function OPTIONS() {
+	return new NextResponse(null, {
+		status: 204,
+		headers: {
+			"Access-Control-Allow-Origin": "*",
+			"Access-Control-Allow-Methods": "GET, OPTIONS",
+			"Access-Control-Allow-Headers": "Content-Type, If-None-Match",
+		},
+	});
+}
+
+function clampInt(
+	raw: string | null,
+	min: number,
+	max: number,
+	fallback: number,
+): number {
+	if (raw == null) return fallback;
+	const n = Number.parseInt(raw, 10);
+	if (Number.isNaN(n) || n < min || n > max) return fallback;
+	return n;
+}

src/app/api/imaging/badge/route.ts

@@ -0,0 +1,46 @@
+import { type NextRequest, NextResponse } from "next/server";
+import { clientIp, rateLimit } from "@/lib/rate-limit";
+import { siteSettings } from "@/lib/services/site-settings";
+
+/**
+ * GET /api/imaging/badge?code=ADM
+ *
+ * Resolves a Habbo badge code to its image URL and redirects there.
+ */
+
+const CODE_RE = /^[A-Za-z0-9_+.-]+$/;
+const CODE_MAX_LEN = 50;
+const DEFAULT_BASE = "https://images.habbo.com/c_images/album1584";
+
+export async function GET(request: NextRequest) {
+	const ip = await clientIp();
+	const limited = await rateLimit(`badge-imaging:${ip}`, 60, 60_000);
+	if (!limited.ok) {
+		return new NextResponse(null, {
+			status: 429,
+			headers: { "Retry-After": String(limited.retryAfter) },
+		});
+	}
+
+	const code = request.nextUrl.searchParams.get("code")?.trim();
+	if (!code || code.length > CODE_MAX_LEN || !CODE_RE.test(code)) {
+		return NextResponse.json({ error: "Invalid badge code" }, { status: 400 });
+	}
+
+	const configured = (
+		(await siteSettings.get("badge_base_url", "")) ?? ""
+	).trim();
+	const base = (configured || DEFAULT_BASE).replace(/\/+$/, "");
+	const isAbsolute = /^https?:\/\//i.test(base);
+	const target = `${base}/${code}.gif`;
+	const absoluteTarget = isAbsolute
+		? target
+		: new URL(target, request.nextUrl.origin).toString();
+
+	return NextResponse.redirect(absoluteTarget, {
+		status: 302,
+		headers: {
+			"Cache-Control": "public, max-age=300",
+		},
+	});
+}