new features

alembic/versions/strip_avatar_presigned_urls.py

@@ -0,0 +1,58 @@
+"""strip presigned query params from avatar URLs
+
+Revision ID: a1b2c3d4e5f6
+Revises: 6a41fa07bd94
+Create Date: 2026-02-21 12:00:00.000000
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+# revision identifiers, used by Alembic.
+revision: str = "a1b2c3d4e5f6"
+down_revision: Union[str, None] = "6a41fa07bd94"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    conn = op.get_bind()
+
+    # Extract bare S3 key from presigned URLs.
+    # Example: http://localhost:9000/coffee-bucket/avatars/abc.jpg?X-Amz-...
+    #       -> avatars/abc.jpg
+    #
+    # Strategy: strip the query string, then remove the scheme+host+bucket prefix.
+    # Only touch rows where avatar looks like a full URL (contains '://').
+    result = conn.execute(
+        sa.text("SELECT id, avatar FROM users WHERE avatar IS NOT NULL AND avatar LIKE :pattern"),
+        {"pattern": "%://%"},
+    )
+    for row in result:
+        avatar_url: str = row[1]
+        # Remove query string
+        path = avatar_url.split("?")[0]
+        # Remove scheme + host + bucket prefix: everything up to and including the bucket segment
+        # e.g. "http://localhost:9000/coffee-bucket/avatars/abc.jpg" -> "avatars/abc.jpg"
+        parts = path.split("/")
+        # Find the bucket segment (after host) and take everything after it
+        # URL structure: scheme: / / host:port / bucket / key...
+        # parts: ['http:', '', 'localhost:9000', 'coffee-bucket', 'avatars', 'abc.jpg']
+        try:
+            # Skip scheme ('http:'), empty (''), host, bucket -> index 4 onward is the key
+            key = "/".join(parts[4:])
+        except IndexError:
+            continue
+
+        if key:
+            conn.execute(
+                sa.text("UPDATE users SET avatar = :key WHERE id = :id"),
+                {"key": key, "id": row[0]},
+            )
+
+
+def downgrade() -> None:
+    # Data-only migration; cannot restore original presigned URLs.
+    pass