Profile Image Upload System

.env.example

@@ -1,7 +1,21 @@
-# Backend Secrets (place in backend/.env)
+# Backend environment (copy the backend section to backend/.env for Docker Compose)
+PORT=1313
+DATABASE_URI=mongodb://localhost:27017/debateai
 GEMINI_API_KEY=your_gemini_key_here
 JWT_SECRET=your_jwt_secret_here
 GOOGLE_CLIENT_ID=your_google_client_id_here
+
+# S3 avatar storage
+AWS_REGION=ap-south-1
+AWS_S3_BUCKET=your_public_avatar_bucket_without_dots
+AWS_S3_PRESIGN_TTL_SECONDS=300
+
+# Local development only. Prefer an IAM role in production.
+# Never commit real AWS credentials.
+AWS_ACCESS_KEY_ID=your_iam_access_key_id
+AWS_SECRET_ACCESS_KEY=your_iam_secret_access_key
+# AWS_SESSION_TOKEN=your_temporary_session_token
+
 # SMTP_PASSWORD=your_smtp_password_here (if needed)
 
 # Frontend Secrets (place in frontend/.env)

.gitignore

@@ -2,4 +2,4 @@
 *.log
 *.env
 config.prod.yml
-vite.config.ts.timestamp-*.mjs
+vite.config.ts.timestamp-*.mjs

README.md

@@ -73,7 +73,17 @@ gemini:
 
 ---
 
-### 4. Run the Backend Server
+### 4. (Optional) Custom Avatar Storage
+
+Custom profile picture uploads use presigned Amazon S3 URLs and permanent public
+links from a dedicated S3 bucket. See [Avatar storage setup](docs/avatar-storage.md)
+for the bucket policy, CORS, IAM permissions, configuration, and cleanup rule.
+The backend still runs when S3 is not configured, but custom uploads remain
+disabled.
+
+---
+
+### 5. Run the Backend Server
 
 From the `backend` directory, start the server:
 

backend/cmd/server/main.go

@@ -1,11 +1,12 @@
 package main
 
 import (
+	"context"
 	"log"
-	"os"
 	"strconv"
 
 	"arguehub/config"
+	"arguehub/controllers"
 	"arguehub/db"
 	"arguehub/internal/debate"
 	"arguehub/middlewares"
@@ -34,8 +35,8 @@ func main() {
 	log.Println("Connected to MongoDB")
 
 	if err := db.EnsureIndexes(); err != nil {
-    log.Fatalf("Failed to ensure indexes: %v", err)
-    }
+		log.Fatalf("Failed to ensure indexes: %v", err)
+	}
 
 	if err := middlewares.InitCasbin("./config/config.prod.yml"); err != nil {
 		log.Fatalf("Failed to initialize Casbin: %v", err)
@@ -63,17 +64,32 @@ func main() {
 	utils.SeedDebateData()
 	utils.PopulateTestUsers()
 
-	os.MkdirAll("uploads", os.ModePerm)
+	var avatarStorage services.AvatarStorage
+	if cfg.S3.HasEndpointConfig() && !cfg.S3.IsConfigured() {
+		log.Fatal("Incomplete S3 avatar configuration: region and bucket are required")
+	}
+	if cfg.S3.IsConfigured() {
+		storage, err := services.NewS3AvatarStorage(context.Background(), cfg.S3)
+		if err != nil {
+			log.Fatalf("Failed to initialize S3 avatar storage: %v", err)
+		}
+		avatarStorage = storage
+		log.Println("S3 avatar storage initialized")
+	} else {
+		log.Println("S3 avatar storage is not configured; custom avatar uploads are disabled")
+	}
+	avatarController := controllers.NewAvatarController(avatarStorage)
 
-	router := setupRouter(cfg)
+	// Set up the Gin router and configure routes
+	router := setupRouter(cfg, avatarController)
 	port := strconv.Itoa(cfg.Server.Port)
 
 	if err := router.Run(":" + port); err != nil {
 		panic("Failed to start server: " + err.Error())
 	}
 }
 
-func setupRouter(cfg *config.Config) *gin.Engine {
+func setupRouter(cfg *config.Config, avatarController *controllers.AvatarController) *gin.Engine {
 	router := gin.Default()
 
 	router.SetTrustedProxies([]string{"127.0.0.1", "localhost"})
@@ -105,7 +121,8 @@ func setupRouter(cfg *config.Config) *gin.Engine {
 	{
 		auth.GET("/user/fetchprofile", routes.GetProfileRouteHandler)
 		auth.PUT("/user/updateprofile", routes.UpdateProfileRouteHandler)
-        auth.GET("/user/check-displayname", routes.CheckDisplayNameRouteHandler)		
+		auth.GET("/user/check-displayname", routes.CheckDisplayNameRouteHandler)
+		routes.SetupAvatarRoutes(auth, avatarController)
 		auth.GET("/leaderboard", routes.GetLeaderboardRouteHandler)
 		auth.POST("/debate/result", routes.UpdateRatingAfterDebateRouteHandler)
 
@@ -150,4 +167,4 @@ func setupRouter(cfg *config.Config) *gin.Engine {
 	router.GET("/ws/debate/:debateID", websocket.DebateWebsocketHandler)
 
 	return router
-}
+}

backend/config/config.go

@@ -3,10 +3,25 @@ package config
 import (
 	"fmt"
 	"os"
+	"strconv"
 
 	"gopkg.in/yaml.v3"
 )
 
+type S3Config struct {
+	Region            string `yaml:"region"`
+	Bucket            string `yaml:"bucket"`
+	PresignTTLSeconds int    `yaml:"presignTTLSeconds"`
+}
+
+func (c S3Config) IsConfigured() bool {
+	return c.Region != "" && c.Bucket != ""
+}
+
+func (c S3Config) HasEndpointConfig() bool {
+	return c.Region != "" || c.Bucket != ""
+}
+
 type Config struct {
 	Server struct {
 		Port int `yaml:"port"`
@@ -54,6 +69,8 @@ type Config struct {
 	GoogleOAuth struct {
 		ClientID string `yaml:"clientID"`
 	} `yaml:"googleOAuth"`
+
+	S3 S3Config `yaml:"s3"`
 }
 
 // LoadConfig reads the configuration file
@@ -86,6 +103,22 @@ func LoadConfig(path string) (*Config, error) {
 	if envGoogleClient := os.Getenv("GOOGLE_CLIENT_ID"); envGoogleClient != "" {
 		cfg.GoogleOAuth.ClientID = envGoogleClient
 	}
+	if envAWSRegion := os.Getenv("AWS_REGION"); envAWSRegion != "" {
+		cfg.S3.Region = envAWSRegion
+	}
+	if envS3Bucket := os.Getenv("AWS_S3_BUCKET"); envS3Bucket != "" {
+		cfg.S3.Bucket = envS3Bucket
+	}
+	if envPresignTTL := os.Getenv("AWS_S3_PRESIGN_TTL_SECONDS"); envPresignTTL != "" {
+		presignTTL, err := strconv.Atoi(envPresignTTL)
+		if err != nil || presignTTL <= 0 {
+			return nil, fmt.Errorf("AWS_S3_PRESIGN_TTL_SECONDS must be a positive integer")
+		}
+		cfg.S3.PresignTTLSeconds = presignTTL
+	}
+	if cfg.S3.PresignTTLSeconds == 0 {
+		cfg.S3.PresignTTLSeconds = 300
+	}
 	// Add other overrides as needed
 
 	return &cfg, nil

backend/config/config.prod.sample.yml

@@ -41,3 +41,10 @@ googleOAuth:
   clientID: "<YOUR_GOOGLE_OAUTH_CLIENT_ID>"
   # Google OAuth Client ID for OAuth login
   # Obtain from Google Cloud Console (APIs & Services > Credentials > OAuth 2.0 Client IDs)
+
+s3:
+  region: "" # Example: ap-south-1
+  bucket: "" # Public avatar bucket name; use a bucket name without dots
+  presignTTLSeconds: 300
+  # AWS credentials are intentionally not stored here. The AWS SDK uses its
+  # default credential chain (environment variables, local profile, or IAM role).

backend/config/config_test.go

@@ -0,0 +1,33 @@
+package config
+
+import "testing"
+
+func TestS3ConfigEndpointState(t *testing.T) {
+	tests := []struct {
+		name              string
+		config            S3Config
+		hasEndpointConfig bool
+		isConfigured      bool
+	}{
+		{name: "empty", config: S3Config{}, hasEndpointConfig: false, isConfigured: false},
+		{name: "region only", config: S3Config{Region: "us-east-1"}, hasEndpointConfig: true, isConfigured: false},
+		{name: "bucket only", config: S3Config{Bucket: "avatar-bucket"}, hasEndpointConfig: true, isConfigured: false},
+		{
+			name:              "complete",
+			config:            S3Config{Region: "us-east-1", Bucket: "avatar-bucket"},
+			hasEndpointConfig: true,
+			isConfigured:      true,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			if got := test.config.HasEndpointConfig(); got != test.hasEndpointConfig {
+				t.Fatalf("HasEndpointConfig() = %v, want %v", got, test.hasEndpointConfig)
+			}
+			if got := test.config.IsConfigured(); got != test.isConfigured {
+				t.Fatalf("IsConfigured() = %v, want %v", got, test.isConfigured)
+			}
+		})
+	}
+}