2 commits

Author	SHA1	Message	Date
Deluan	114208e6d6	fix(nativeapi): check avatar permission before reading the request body ... The gate ran inside saveFn, so a request destined for 403 still spooled up to 10MB of multipart body to temp first. Artist, playlist and radio already gate before parsing; the shared handler now takes the gate as a parameter.	2026-09-09 18:24:15 -04:00
Deluan	16c62e075e	feat(nativeapi): add user avatar upload and delete endpoints ... Adds POST/DELETE /api/user/{id}/image, gated by EnableUserAvatarUpload (never EnableArtworkUpload) and restricted to the target user or an admin. Reuses the artist/playlist/radio image-upload handlers via a new gate opt-out so their EnableArtworkUpload behavior is unchanged.	2026-09-09 18:24:15 -04:00