Issue #2927 Fix user avatars

[jmevissen]

[netlify[bot]]

✅ Deploy Preview for volto canceled.

Name	Link
🔨 Latest commit	9ea97013a94a6574526fc73c3ba16da5f76a060e
🔍 Latest deploy log	https://app.netlify.com/sites/volto/deploys/62d6b64b82dbb20008d76b57

[jmevissen]

The getNonAPIResourceWithAuth Function is questionable. But the User-Portrait is called like: http://localhost:8080/Plone/portal_memberdata/portraits/jm without '/++api++'. Maybe the getAPIResourceWithAuth Function could be updated to conditionally not use the '/++api++' part. Or an new Api resource for User-Portraits is needed.

[cypress[bot]]

---

Test summary

241 • 0 • 10 • 0

---

Run details

Project	Volto
Status	Passed
Commit	9ea97013a9
Started	Jul 19, 2022 1:51 PM
Ended	Jul 19, 2022 2:02 PM
Duration	11:06 💡
OS	Linux Ubuntu - 20.04
Browser	Chrome 103

View run in Cypress Dashboard ➡️

---

This comment has been generated by cypress-bot as a result of this project's GitHub integration settings. You can manage this integration in this project's settings in the Cypress Dashboard

[sneridagh]

@jmevissen thanks for opening the PR! From my point of view, if the portrait URL is not accessible using the ++api++ traversal, it should be, and it's a backend issue. In short, all resources used by the frontend should be accessible using the api traversal, and if they do not, they should be fixed.

@davisagli @jensens any idea why it might not be traversable using the api traversal?

[jmevissen]

@sneridagh thanks for your comment. The User Portraits are called like: http://localhost:8080/Plone/portal_memberdata/portraits/jm Where "portal_memberdata" is a MemberDataTool and "portraits" is a BTreeFolder2 that is an attribute of the MemberDataTool.

The ++api++ traversal does not work in this case and throws a KeyError quite early, when trying to call http://localhost:8080/Plone/++api++/portal_memberdata/portraits/jm (https://github.com/plone/plone.rest/blob/master/src/plone/rest/traverse.py#L25)

[jmevissen]

@sneridagh I think that options maybe:

• enable the ++api++ traversal to access attributes of Tools (I tested this with a little hack in https://github.com/plone/plone.rest/blob/master/src/plone/rest/traverse.py. It works as a proof of concept, but I think it would be better to talk about it)
• add a new rest-api service for user portraits

[sneridagh]

@davisagli @jensens what do you think about this one?

My take is that we should make the ++api++ traversal work, but I don't like the idea to expose things inside a tool through that...

[davisagli]

@sneridagh I need to think about it some more. I agree in principle that user portraits should be made available by the API. But on the backend member info is looked up via the pluggable auth service so we can't assume it is always stored in portal_memberdata; for example with membrane and Dexterity-based members it could come from a NamedBlobImage field on a content item.

[jensens]

The whole portrait handling in the backend is a PITA and I would like to see plone.api and plone.restapi to abstract this away from the existing tools and to not depend Volto to traverse to portal_memberdata behavior at all .

I.e. if it comes to pas.plugins.ldap there is still an ugly patch active https://github.com/collective/pas.plugins.ldap/blob/master/src/pas/plugins/ldap/monkey.py to get portraits into our old (IIRC GRUF based, or even earlier CMF based) approach. This never got lifted up to PAS. And IIRC other plugins do the same (so you can not use them together).

That said, I have no good idea why traversal fails.

[sneridagh]

This gets superseded by: https://github.com/plone/volto/pull/3487

[sneridagh]

@jmevissen closing as fixed in https://github.com/plone/volto/pull/3487