From 5c86930220e97888eeae1c5440572ba7ef2434be Mon Sep 17 00:00:00 2001
From: Meier Lukas <meierschlumpf@gmail.com>
Date: Mon, 13 Oct 2025 23:52:17 +0200
Subject: [PATCH] feat(users): allow profile picture change for external
 providers (#4275)

---
 .../_components/_profile-avatar-form.tsx      | 42 +++++++------------
 packages/api/src/router/user.ts               |  7 ----
 packages/auth/events.ts                       | 10 +++++
 packages/auth/providers/oidc/oidc-provider.ts |  1 +
 4 files changed, 25 insertions(+), 35 deletions(-)

diff --git a/apps/nextjs/src/app/[locale]/manage/users/[userId]/general/_components/_profile-avatar-form.tsx b/apps/nextjs/src/app/[locale]/manage/users/[userId]/general/_components/_profile-avatar-form.tsx
index b510f37dc..485bffdf5 100644
--- a/apps/nextjs/src/app/[locale]/manage/users/[userId]/general/_components/_profile-avatar-form.tsx
+++ b/apps/nextjs/src/app/[locale]/manage/users/[userId]/general/_components/_profile-avatar-form.tsx
@@ -92,38 +92,24 @@ export const UserProfileAvatarForm = ({ user }: UserProfileAvatarForm) => {
     });
   }, [mutate, user.id, openConfirmModal, tManageAvatar]);
 
-  const isCredentialsUser = user.provider === "credentials";
-
   return (
     <Box pos="relative">
-      <Menu
-        opened={opened}
-        keepMounted
-        onChange={isCredentialsUser ? toggle : undefined}
-        position="bottom-start"
-        withArrow
-      >
+      <Menu opened={opened} keepMounted onChange={toggle} position="bottom-start" withArrow>
         <Menu.Target>
-          <UnstyledButton
-            component={isCredentialsUser ? undefined : "div"}
-            style={{ cursor: !isCredentialsUser ? "default" : undefined }}
-            onClick={isCredentialsUser ? toggle : undefined}
-          >
+          <UnstyledButton onClick={toggle}>
             <UserAvatar user={user} size={200} />
-            {isCredentialsUser && (
-              <Button
-                component="div"
-                pos="absolute"
-                bottom={0}
-                left={0}
-                size="compact-md"
-                fw="normal"
-                variant="default"
-                leftSection={<IconPencil size={18} stroke={1.5} />}
-              >
-                {t("common.action.edit")}
-              </Button>
-            )}
+            <Button
+              component="div"
+              pos="absolute"
+              bottom={0}
+              left={0}
+              size="compact-md"
+              fw="normal"
+              variant="default"
+              leftSection={<IconPencil size={18} stroke={1.5} />}
+            >
+              {t("common.action.edit")}
+            </Button>
           </UnstyledButton>
         </Menu.Target>
         <Menu.Dropdown>
diff --git a/packages/api/src/router/user.ts b/packages/api/src/router/user.ts
index ebb0b432b..f59d6740e 100644
--- a/packages/api/src/router/user.ts
+++ b/packages/api/src/router/user.ts
@@ -146,13 +146,6 @@ export const userRouter = createTRPCRouter({
         });
       }
 
-      if (user.provider !== "credentials") {
-        throw new TRPCError({
-          code: "FORBIDDEN",
-          message: "Profile image can not be changed for users with external providers",
-        });
-      }
-
       await ctx.db
         .update(users)
         .set({
diff --git a/packages/auth/events.ts b/packages/auth/events.ts
index 7ca77e0f9..b1222abb7 100644
--- a/packages/auth/events.ts
+++ b/packages/auth/events.ts
@@ -20,6 +20,7 @@ export const createSignInEventHandler = (db: Database): Exclude<NextAuthConfig["
       where: eq(users.id, user.id),
       columns: {
         name: true,
+        image: true,
         colorScheme: true,
       },
     });
@@ -59,6 +60,15 @@ export const createSignInEventHandler = (db: Database): Exclude<NextAuthConfig["
           `Username for user of oidc provider has changed. user=${user.id} old='${dbUser.name}' new='${profileUsername}'`,
         );
       }
+
+      if (
+        typeof profile.picture === "string" &&
+        dbUser.image !== profile.picture &&
+        !dbUser.image?.startsWith("data:")
+      ) {
+        await db.update(users).set({ image: profile.picture }).where(eq(users.id, user.id));
+        logger.info(`Profile picture for user of oidc provider has changed. user=${user.id}'`);
+      }
     }
 
     logger.info(`User '${dbUser.name}' logged in at ${dayjs().format()}`);
diff --git a/packages/auth/providers/oidc/oidc-provider.ts b/packages/auth/providers/oidc/oidc-provider.ts
index 72fe191e8..7441b8f60 100644
--- a/packages/auth/providers/oidc/oidc-provider.ts
+++ b/packages/auth/providers/oidc/oidc-provider.ts
@@ -61,6 +61,7 @@ export const OidcProvider = (headers: ReadonlyHeaders | null): OIDCConfig<Profil
       id: profile.sub,
       name,
       email: profile.email,
+      image: typeof profile.picture === "string" ? profile.picture : null,
       provider: "oidc",
     };
   },