make kestrel a tak server, so that it can send and receive pois as cots data

server/api/me/avatar.delete.js

@@ -6,7 +6,14 @@ import { requireAuth } from '../../utils/authHelpers.js'
 export default defineEventHandler(async (event) => {
   const user = requireAuth(event)
   if (!user.avatar_path) return { ok: true }
-  const path = join(getAvatarsDir(), user.avatar_path)
+  
+  // Validate avatar path to prevent path traversal attacks
+  const filename = user.avatar_path
+  if (!filename || !/^[a-f0-9-]+\.(jpg|jpeg|png)$/i.test(filename)) {
+    throw createError({ statusCode: 400, message: 'Invalid avatar path' })
+  }
+  
+  const path = join(getAvatarsDir(), filename)
   await unlink(path).catch(() => {})
   const { run } = await getDb()
   await run('UPDATE users SET avatar_path = NULL WHERE id = ?', [user.id])