chore: Do not return fallback for UID route

apps/meteor/server/routes/avatar/middlewares/auth.ts

@@ -0,0 +1,47 @@
+import type { ServerResponse } from 'http';
+
+import type { IIncomingMessage } from '@rocket.chat/core-typings';
+import type { NextFunction } from 'connect';
+
+import { userCanAccessAvatar, renderSVGLetters } from '../utils';
+
+const renderFallback = (req: IIncomingMessage, res: ServerResponse) => {
+	if (!req.url) {
+		res.writeHead(404);
+		res.end();
+		return;
+	}
+
+	let roomOrUsername;
+
+	if (req.url.startsWith('/room')) {
+		roomOrUsername = req.url.split('/')[2] || 'Room';
+	} else {
+		roomOrUsername = req.url.split('/')[1] || 'Anonymous';
+	}
+
+	res.writeHead(200, { 'Content-Type': 'image/svg+xml' });
+	res.write(renderSVGLetters(roomOrUsername, 200));
+	res.end();
+};
+
+const getProtectAvatars = (callback?: typeof renderFallback) => async (req: IIncomingMessage, res: ServerResponse, next: NextFunction) => {
+	if (!(await userCanAccessAvatar(req))) {
+		if (callback) {
+			callback(req, res);
+			return;
+		}
+
+		res.writeHead(404);
+		res.end();
+		return;
+	}
+
+	return next();
+};
+
+// If unauthorized returns the SVG fallback (letter avatar)
+export const protectAvatarsWithFallback = getProtectAvatars(renderFallback);
+
+// Just returns 404
+export const protectAvatars = getProtectAvatars();

apps/meteor/server/routes/avatar/middlewares/index.js

@@ -1,8 +1,8 @@
 import { WebApp } from 'meteor/webapp';
 
-import { protectAvatars } from './auth';
+import { protectAvatars, protectAvatarsWithFallback } from './auth';
 
 import './browserVersion';
 
-WebApp.connectHandlers.use('/avatar/', protectAvatars);
+WebApp.connectHandlers.use('/avatar/', protectAvatarsWithFallback);
 WebApp.connectHandlers.use('/avatar/uid/', protectAvatars);

apps/meteor/server/routes/avatar/user.ts

@@ -1,6 +1,5 @@
 import type { ServerResponse } from 'http';
 
-// TODO: what is the type of re.query?
 import type { IUpload, IIncomingMessage } from '@rocket.chat/core-typings';
 import { Avatars, Users } from '@rocket.chat/models';
 import { serverFetch as fetch } from '@rocket.chat/server-fetch';