[ImgBot] Optimize images

app/api/auth/sso/complete/route.ts

@@ -4,6 +4,7 @@ import { logger } from '@/lib/logger';
 import { decryptPayload } from '@/lib/auth/crypto';
 import {
   exchangeCodeForTokens,
+  fetchUserInfoAvatar,
   getRequiredConfig,
   getTokenEndpoint,
 } from '@/lib/oauth/token-exchange';
@@ -73,6 +74,8 @@ export async function POST(request: NextRequest) {
     // Exchange code for tokens
     const tokens = await exchangeCodeForTokens(code, codeVerifier, redirectUri, pendingServerId);
 
+    const avatarUrl = await fetchUserInfoAvatar(tokens.access_token, pendingServerId).catch(() => undefined);
+
     // For the mobile handoff flow the tokens are handed back to the app
     // verbatim - we deliberately don't write any cookies on the webmail
     // origin (the mobile browser tab disposes of the session after the
@@ -110,12 +113,14 @@ export async function POST(request: NextRequest) {
         server_url: serverUrl,
         mobile_redirect_uri: mobileRedirectUri,
         mobile_state: mobileState,
+        ...(avatarUrl ? { avatar_url: avatarUrl } : {}),
       });
     }
 
     return NextResponse.json({
       access_token: tokens.access_token,
       expires_in: tokens.expires_in,
+      ...(avatarUrl ? { avatar_url: avatarUrl } : {}),
     });
   } catch (error) {
     // Clean up pending cookie on any error

components/layout/account-switcher.tsx

@@ -27,6 +27,7 @@ function AccountAvatar({ account, size = "sm" }: { account: AccountEntry; size?:
       size="sm"
       className={cn("flex-shrink-0", size === "md" && "w-9 h-9 text-sm")}
       disableFavicon
+      contactPhotoUri={account.avatarUrl}
       fallbackColor={account.avatarColor}
     />
   );

components/layout/navigation-rail.tsx

@@ -707,6 +707,7 @@ export function NavigationRail({
                     email={account.email || account.username}
                     size="sm"
                     disableFavicon
+                    contactPhotoUri={account.avatarUrl}
                     fallbackColor={account.avatarColor}
                   />
                   {isActive && (

components/protocol/protocol-account-picker.tsx

@@ -117,6 +117,7 @@ export function ProtocolAccountPicker({
                   size="md"
                   className="shrink-0"
                   disableFavicon
+                  contactPhotoUri={account.avatarUrl}
                   fallbackColor={account.avatarColor}
                 />
 

components/settings/account-settings.tsx

@@ -346,6 +346,7 @@ function AccountRow({
           size="sm"
           className="w-9 h-9 text-sm"
           disableFavicon
+          contactPhotoUri={account.avatarUrl}
           fallbackColor={account.avatarColor}
         />
         {isActive && (

lib/oauth/discovery.ts

@@ -2,6 +2,7 @@ export interface OAuthMetadata {
   issuer: string;
   authorization_endpoint: string;
   token_endpoint: string;
+  userinfo_endpoint?: string;
   revocation_endpoint?: string;
   end_session_endpoint?: string;
 }
@@ -104,6 +105,7 @@ async function attemptDiscovery(
         const allPublic = await endpointsArePublic([
           data.authorization_endpoint,
           data.token_endpoint,
+          data.userinfo_endpoint,
           data.revocation_endpoint,
           data.end_session_endpoint,
         ], validate);
@@ -115,6 +117,7 @@ async function attemptDiscovery(
           issuer: data.issuer,
           authorization_endpoint: data.authorization_endpoint,
           token_endpoint: data.token_endpoint,
+          userinfo_endpoint: data.userinfo_endpoint,
           revocation_endpoint: data.revocation_endpoint,
           end_session_endpoint: data.end_session_endpoint,
         };