u

src/automats/authAutomat.js

@@ -40,6 +40,15 @@ export function setAuthEventDispatcher(dispatch) {
     emit = dispatch;
 }
 
+function normalizePicture(picture) {
+    if (!picture || typeof picture !== 'string') return null;
+    if (picture.startsWith('http://') || picture.startsWith('https://') || picture.startsWith('data:')) {
+        return picture;
+    }
+    const mime = picture.startsWith('/9j/') ? 'image/jpeg' : 'image/png';
+    return `data:${mime};base64,${picture}`;
+}
+
 /**
  * Merges API user data while retaining the current company selection when the
  * response does not contain one.
@@ -52,7 +61,11 @@ function mergeUser(current, incoming) {
     if (!incoming) return current;
     const selectedCompanyId =
         incoming.selectedCompanyId ?? current?.selectedCompanyId ?? null;
-    return { ...current, ...incoming, selectedCompanyId };
+    const merged = { ...current, ...incoming, selectedCompanyId };
+    if (merged.picture) {
+        merged.picture = normalizePicture(merged.picture);
+    }
+    return merged;
 }
 
 let authAutomat;
@@ -104,8 +117,9 @@ const actions = {
             if (!session?.user) {
                 throw new Error('Login ok but session cookie not accepted (/api/auth/me still unauthorized)');
             }
+            const user = mergeUser(authAutomat.state.user, session.user);
             authAutomat.setState({
-                user: session.user,
+                user,
                 googleClientId: session.googleClientId ?? authAutomat.state.googleClientId,
                 status: 'authed',
             });