Fix KHIX Guild profile images

[cataladev]

Why

The Blade roster response currently contains two profile-picture representations: older absolute bucket URLs and newer Guild object keys. KHIX passed both directly to Next Image, so newer keys such as Estefanie Parra's were not browser-loadable.

What

• Normalize profile-picture references inside the KHIX roster adapter only.
• Convert both absolute bucket URLs and current Guild object keys to the existing public image host already allowed by KHIX.
• Reject malformed references so the existing initials fallback remains safe.
• Remove Lena Tran from the KHIX featured-designer list only.
• Do not add profile-picture or Lena-specific regression tests.

Scope audit

The final PR diff contains exactly two files, both under apps/khix.

Earlier changes to the shared Club roster API, API package exports, profile-picture security utility, global MinIO constant, Cron, and T.K. were audited and completely reverted. The Guild router, Guild public profiles, Blade, Club, Cron, T.K., shared packages, and production database are unchanged from main.

There are no Markdown artifacts, dependencies, lockfile changes, migrations, environment-variable changes, Guild data changes, or deployment-configuration changes. The older absolute database values remain untouched because a database-wide migration is outside this KHIX-only scope.

Validation

• Existing KHIX tests: 4 files, 14 tests passed.
• KHIX typecheck passed.
• KHIX production build passed.
• Root pnpm format, pnpm lint, and pnpm typecheck passed.
• pnpm analyze:react:changed passed with no changed React components.
• Local browser review: 29 roster members, 29 decoded images, 0 initials, 0 broken images, and 0 pending images.
• Estefanie is present with a decoded image; Lena is absent from the rendered roster.

Review checkpoint

This PR is ready for review and merge based on local validation. Full remote CI was not awaited, as requested. Only the KHIX deployment needs to finish before the production hard-refresh check.

Checklist

• Database: unchanged.
• Environment variables: unchanged.

[alexanderpaolini]

Extract the Guild public profile-picture resolver into a shared API utility that validates and signs both current object keys and legacy MinIO URLs.

"legacy MinIO URLs" what does this mean and why do we do it if its "legacy"

[coderabbitai]

Important

Approval pending

CodeRabbit has no unresolved comments, but it has not reviewed the latest commit.

Use the checkbox below to review the latest commit. CodeRabbit will approve the changes if it finds no blocking issues.

• 🔍 Trigger review

📝 Walkthrough

Walkthrough

Public guild rosters now resolve stored profile-picture references into validated public URLs before roster construction. The resolver supports object keys and legacy MinIO URLs, encodes path segments, validates ownership, and returns null for invalid references. The MinIO endpoint changed. Team cascade loading now excludes one designer from the featured designer group, with tests for filtering and abort-signal forwarding.

🚥 Pre-merge checks | ✅ 6 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 16.67% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Title check	⚠️ Warning	The title describes the main profile-image change but does not start with the required issue number format.	Add an issue number prefix, such as "[#513] Fix KHIX Guild profile images".

✅ Passed checks (6 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No Hardcoded Secrets	✅ Passed	The PR diff adds no API key, password, token, or secret literal. The MinIO change is a public hostname replacement; other URLs and UUIDs are test fixtures.
Validated Env Access	✅ Passed	The PR diff against origin/main adds no process.env usage; all changed source files are free of raw environment access.
No Typescript Escape Hatches	✅ Passed	PR-wide added TypeScript lines contain no any, @ts-ignore, @ts-expect-error, or non-null assertions; exclamation marks are only boolean negations.
Description check	✅ Passed	The description discusses profile-image normalization and KHIX roster changes, which are related to the changeset.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/khix-guild-profile-images

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Note

Quiet mode is enabled, so only the most important comments were posted inline. Other review comments are grouped below.

🟡 Other comments (1)

packages/consts/src/minio.ts-1-2 (1)

1-2: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Document the exported endpoint.

Add a concise comment that identifies this hostname as the production public MinIO endpoint and records its infrastructure owner or source. As per path instructions, “Values are intentional and well-documented” and “URLs and external API endpoints are correct and won't break integrations.”

Source: Path instructions

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: QUIET

Plan: Pro Plus

Run ID: 4dbd6ae4-995f-48ec-8122-03fb14442ae5

📥 Commits

Reviewing files that changed from the base of the PR and between dfac35c and 845aa3a.

📒 Files selected for processing (7)

• apps/khix/src/app/_components/team-cascade/team-roster.test.ts
• apps/khix/src/app/_components/team-cascade/team-roster.ts
• packages/api/src/tests/guild/club-roster.test.ts
• packages/api/src/tests/guild/profile-picture.test.ts
• packages/api/src/utils/guild/club-roster.ts
• packages/api/src/utils/guild/profile-picture.ts
• packages/consts/src/minio.ts

💤 Files with no reviewable changes (1)

• apps/khix/src/app/_components/team-cascade/team-roster.ts

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

[alexanderpaolini]

LGTM

[cataladev]

it works btw