/**
 * @file avatar-redirect.js
 * @description Answers an avatar GET (`/api/me/avatar`, `/api/users/:id/avatar`)
 * with a 302 to the account's stored avatar LINK (server/lib/avatars.js), so
 * the viewer's browser loads the picture itself — with its own logins and
 * network — and the server never fetches it. No referrer is sent with it.
 * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
 */

/** True when the account has a link and the redirect was sent. */
function sendAvatarLink(res, userId) {
  const link = require("./avatars").avatarLink(userId);
  if (!link) return false;
  res.set("Referrer-Policy", "no-referrer");
  // The client versions the URL with `avatarAt`, so a new link is a new URL.
  res.set("Cache-Control", "private, max-age=86400");
  res.redirect(302, link);
  return true;
}

module.exports = { sendAvatarLink };