refactor testing

server/api/me/avatar.delete.js

@@ -6,13 +6,13 @@ import { requireAuth } from '../../utils/authHelpers.js'
 export default defineEventHandler(async (event) => {
   const user = requireAuth(event)
   if (!user.avatar_path) return { ok: true }
-  
+
   // Validate avatar path to prevent path traversal attacks
   const filename = user.avatar_path
-  if (!filename || !/^[a-f0-9-]+\.(jpg|jpeg|png)$/i.test(filename)) {
+  if (!filename || !/^[a-f0-9-]+\.(?:jpg|jpeg|png)$/i.test(filename)) {
     throw createError({ statusCode: 400, message: 'Invalid avatar path' })
   }
-  
+
   const path = join(getAvatarsDir(), filename)
   await unlink(path).catch(() => {})
   const { run } = await getDb()

server/api/me/avatar.get.js

@@ -8,13 +8,13 @@ const MIME = Object.freeze({ jpg: 'image/jpeg', jpeg: 'image/jpeg', png: 'image/
 export default defineEventHandler(async (event) => {
   const user = requireAuth(event)
   if (!user.avatar_path) throw createError({ statusCode: 404, message: 'No avatar' })
-  
+
   // Validate avatar path to prevent path traversal attacks
   const filename = user.avatar_path
-  if (!filename || !/^[a-f0-9-]+\.(jpg|jpeg|png)$/i.test(filename)) {
+  if (!filename || !/^[a-f0-9-]+\.(?:jpg|jpeg|png)$/i.test(filename)) {
     throw createError({ statusCode: 400, message: 'Invalid avatar path' })
   }
-  
+
   const path = join(getAvatarsDir(), filename)
   const ext = filename.split('.').pop()?.toLowerCase()
   const mime = MIME[ext] ?? 'application/octet-stream'

server/api/me/avatar.put.js

@@ -34,13 +34,13 @@ export default defineEventHandler(async (event) => {
   if (file.data.length > MAX_SIZE) throw createError({ statusCode: 400, message: 'File too large' })
   const mime = file.type ?? ''
   if (!ALLOWED_TYPES.includes(mime)) throw createError({ statusCode: 400, message: 'Invalid type; use JPEG or PNG' })
-  
+
   // Validate file content matches declared MIME type
   const actualMime = validateImageContent(file.data)
   if (!actualMime || actualMime !== mime) {
     throw createError({ statusCode: 400, message: 'File content does not match declared type' })
   }
-  
+
   const ext = EXT_BY_MIME[actualMime] ?? 'jpg'
   const filename = `${user.id}.${ext}`
   const dir = getAvatarsDir()