Initial avatar decorations work

src/api/routes_toplevel/_spacebar/api/v1/avatar_decorations/#id/index.ts

@@ -0,0 +1,65 @@
+/*
+	Spacebar: A FOSS re-implementation and extension of the Discord.com backend.
+	Copyright (C) 2026 Spacebar and Spacebar Contributors
+	
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU Affero General Public License as published
+	by the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+	
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU Affero General Public License for more details.
+	
+	You should have received a copy of the GNU Affero General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import { Router, Response, Request } from "express";
+import { route } from "@spacebar/api/middlewares";
+import { AvatarDecorations } from "@spacebar/database";
+import { PublicAvatarDecorationResponse, UpdateAvatarDecorationSchema } from "@spacebar/schemas/api/spacebar/AvatarDecorations";
+import { ApiError } from "@spacebar/util";
+
+const router = Router({ mergeParams: true });
+
+router.patch(
+    "/",
+    route({
+        spacebarOnly: true,
+        description: "Get available avatar decorations",
+        requestBody: "UpdateAvatarDecorationSchema",
+        responses: {
+            200: {
+                body: "PublicAvatarDecorationListResponse",
+            },
+        },
+    }),
+    async (req: Request, res: Response) => {
+        const changes = req.body as UpdateAvatarDecorationSchema;
+        const deco = await AvatarDecorations.findOneOrFail({ where: { id: req.params.id as string } });
+
+        if (deco.uploader_id !== req.user_id) throw new ApiError("You do not have permission to update this avatar decoration", 0, 403);
+
+        if (changes.public !== undefined) deco.public = changes.public;
+        if (changes.allowed_user_ids) {
+            if (changes.allowed_user_ids.add) deco.allowed_user_ids.push(...changes.allowed_user_ids.add);
+            if (changes.allowed_user_ids.remove) deco.allowed_user_ids = deco.allowed_user_ids.filter((x) => !changes.allowed_user_ids!.remove!.includes(x));
+        }
+        if (changes.allowed_guild_ids) {
+            if (changes.allowed_guild_ids.add) deco.allowed_user_ids.push(...changes.allowed_guild_ids.add);
+            if (changes.allowed_guild_ids.remove) deco.allowed_user_ids = deco.allowed_user_ids.filter((x) => !changes.allowed_guild_ids!.remove!.includes(x));
+        }
+        if (changes.allowed_role_ids) {
+            if (changes.allowed_role_ids.add) deco.allowed_user_ids.push(...changes.allowed_role_ids.add);
+            if (changes.allowed_role_ids.remove) deco.allowed_user_ids = deco.allowed_user_ids.filter((x) => !changes.allowed_role_ids!.remove!.includes(x));
+        }
+
+        // TODO: remove avatar from users that no longer have access to them
+
+        res.json(deco.toPublicAvatarDecoration() satisfies PublicAvatarDecorationResponse);
+    },
+);
+
+export default router;

src/api/routes_toplevel/_spacebar/api/v1/avatar_decorations/index.ts

@@ -0,0 +1,64 @@
+/*
+	Spacebar: A FOSS re-implementation and extension of the Discord.com backend.
+	Copyright (C) 2026 Spacebar and Spacebar Contributors
+	
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU Affero General Public License as published
+	by the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+	
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU Affero General Public License for more details.
+	
+	You should have received a copy of the GNU Affero General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import { Router, Response, Request } from "express";
+import { Raw } from "typeorm";
+import { route } from "@spacebar/api/middlewares";
+import { AvatarDecorations, Member } from "@spacebar/database";
+import { PublicAvatarDecorationListResponse } from "@spacebar/schemas/api/spacebar/AvatarDecorations";
+import { arrayDistinctBy } from "@spacebar/extensions";
+
+const router = Router({ mergeParams: true });
+
+router.get(
+    "/",
+    route({
+        spacebarOnly: true,
+        description: "Get available avatar decorations",
+        responses: {
+            200: {
+                body: "PublicAvatarDecorationListResponse",
+            },
+        },
+    }),
+    async (req: Request, res: Response) => {
+        const memberships = await Member.find({ select: { guild_id: true, roles: { id: true } }, relations: { roles: true }, where: { id: req.user_id } });
+
+        const decos = (
+            await AvatarDecorations.find({
+                where: [
+                    { approved: true, public: true },
+                    { approved: true, uploader_id: req.user_id },
+                    { approved: true, allowed_user_ids: Raw((columnAlias) => `${columnAlias} && ARRAY[:req_uid]::int8[]`, { req_uid: req.user_id }) },
+                    { approved: true, allowed_guild_ids: Raw((columnAlias) => `${columnAlias} && :guild_ids`, { guild_ids: memberships.map((x) => x.guild_id) }) },
+                    { approved: true, allowed_role_ids: Raw((columnAlias) => `${columnAlias} && :role_ids`, { role_ids: memberships.flatMap((x) => x.roles.map((r) => r.id)) }) },
+                ],
+                relations: {
+                    uploader: true,
+                },
+                order: {
+                    id: "DESC",
+                },
+            })
+        ).map((x) => x.toPublicAvatarDecoration({ available: true }));
+
+        res.json(arrayDistinctBy(decos, (d) => d.id) satisfies PublicAvatarDecorationListResponse);
+    },
+);
+
+export default router;