refactor testing

server/api/me/avatar.get.js

@@ -8,13 +8,13 @@ const MIME = Object.freeze({ jpg: 'image/jpeg', jpeg: 'image/jpeg', png: 'image/
 export default defineEventHandler(async (event) => {
   const user = requireAuth(event)
   if (!user.avatar_path) throw createError({ statusCode: 404, message: 'No avatar' })
-  
+
   // Validate avatar path to prevent path traversal attacks
   const filename = user.avatar_path
-  if (!filename || !/^[a-f0-9-]+\.(jpg|jpeg|png)$/i.test(filename)) {
+  if (!filename || !/^[a-f0-9-]+\.(?:jpg|jpeg|png)$/i.test(filename)) {
     throw createError({ statusCode: 400, message: 'Invalid avatar path' })
   }
-  
+
   const path = join(getAvatarsDir(), filename)
   const ext = filename.split('.').pop()?.toLowerCase()
   const mime = MIME[ext] ?? 'application/octet-stream'