Validate font file for avatar generation

and fix the tests that we're broken by the new avatar feature

server/system/service/attachment.go

@@ -3,6 +3,7 @@ package service
 import (
 	"bytes"
 	"context"
+	"errors"
 	"fmt"
 	"github.com/cortezaproject/corteza/server/pkg/actionlog"
 	intAuth "github.com/cortezaproject/corteza/server/pkg/auth"
@@ -269,12 +270,12 @@ func (svc attachment) CreateAvatarInitialsAttachment(ctx context.Context, initia
 	dc.SetHexColor(bgColor)
 	dc.Clear()
 
-	// Get the font face properties
-	fontBytes, err := os.ReadFile(svc.opt.AvatarInitialsFontPath)
+	fontBytes, err := svc.processFontsFile()
 	if err != nil {
-		fmt.Println(err.Error())
+		return nil, err
 	}
 
+	// Get the font face properties
 	f, _ := truetype.Parse(fontBytes)
 
 	face := truetype.NewFace(f, &truetype.Options{
@@ -521,3 +522,28 @@ func (svc attachment) processImage(original io.ReadSeeker, att *types.Attachment
 
 	return svc.files.Save(att.PreviewUrl, buf)
 }
+
+// processFontsFile validates the file path provided in the AVATAR_INITIALS_FONT_PATH environment variable,
+// It checks if the file exists and has the correct file extension, then reads and returns the file content
+func (svc attachment) processFontsFile() (fontBytes []byte, err error) {
+	aux, err := filepath.Glob(svc.opt.AvatarInitialsFontPath)
+	if err != nil {
+		return nil, err
+	}
+	if aux == nil || len(aux) != 1 {
+		return nil, errors.New("font file not found, please ensure that the correct AVATAR_INITIALS_FONT_PATH is set")
+	}
+
+	ext := strings.ToLower(filepath.Ext(aux[0]))
+
+	if ext != ".ttf" {
+		return nil, errors.New("invalid font file extension, please provide a truetype font (.ttf) file")
+	}
+
+	fontBytes, err = os.ReadFile(aux[0])
+	if err != nil {
+		return nil, err
+	}
+
+	return fontBytes, nil
+}

server/system/service/user.go

@@ -431,7 +431,7 @@ func (svc user) Update(ctx context.Context, upd *types.User) (u *types.User, err
 			return UserErrInvalidEmail()
 		}
 
-		if u, err = svc.FindByID(ctx, upd.ID); err != nil {
+		if u, err = loadUser(ctx, svc.store, upd.ID); err != nil {
 			return
 		}
 
@@ -461,7 +461,7 @@ func (svc user) Update(ctx context.Context, upd *types.User) (u *types.User, err
 		}
 
 		if err = svc.generateUserAvatarInitial(ctx, u); err != nil {
-			return err
+			return
 		}
 
 		if err = svc.eventbus.WaitFor(ctx, event.UserBeforeUpdate(upd, u)); err != nil {
@@ -1073,6 +1073,10 @@ func (svc user) UploadAvatar(ctx context.Context, userID uint64, upload *multipa
 			return
 		}
 
+		if !svc.ac.CanUpdateUser(ctx, u) {
+			return UserErrNotAllowedToUpdate()
+		}
+
 		if u.Meta.AvatarID != 0 {
 			if err = svc.att.DeleteByID(ctx, u.Meta.AvatarID); err != nil {
 				return
@@ -1236,6 +1240,10 @@ func (svc user) GenerateAvatar(ctx context.Context, userID uint64, bgColor strin
 			return
 		}
 
+		if !svc.ac.CanUpdateUser(ctx, u) {
+			return UserErrNotAllowedToUpdate()
+		}
+
 		u.Meta.AvatarColor = initialColor
 		u.Meta.AvatarBgColor = bgColor
 		if err = svc.generateUserAvatarInitial(ctx, u); err != nil {