From 2e2d5d1dff937170ad3567d5d9d566d9e548ac2a Mon Sep 17 00:00:00 2001
From: Lloyd Owen <lloyd@lloydowen.net>
Date: Tue, 24 Mar 2026 11:48:20 +0000
Subject: [PATCH] Update oidc-callback.ts

---
 app/routes/auth/oidc-callback.ts | 42 +++++++++++++++++++++++---------
 1 file changed, 31 insertions(+), 11 deletions(-)

diff --git a/app/routes/auth/oidc-callback.ts b/app/routes/auth/oidc-callback.ts
index ead2891..0d3eaa1 100644
--- a/app/routes/auth/oidc-callback.ts
+++ b/app/routes/auth/oidc-callback.ts
@@ -67,18 +67,38 @@ export async function loader({ request, context }: Route.LoaderArgs) {
         ? `${userInfo.given_name} ${userInfo.family_name}`
         : (userInfo.preferred_username ?? "SSO User"));
 
-    const picture =
-      context.config.oidc?.profile_picture_source === "gravatar"
-        ? (() => {
-            if (!userInfo.email) {
-              return undefined;
-            }
+    const picture = await (async () => {
+      if (context.config.oidc?.profile_picture_source === "gravatar") {
+        if (!userInfo.email) {
+          return undefined;
+        }
 
-            const emailHash = userInfo.email.trim().toLowerCase();
-            const hash = createHash("sha256").update(emailHash).digest("hex");
-            return `https://www.gravatar.com/avatar/${hash}?s=200&d=identicon&r=x`;
-          })()
-        : userInfo.picture;
+        const emailHash = userInfo.email.trim().toLowerCase();
+        const hash = createHash("sha256").update(emailHash).digest("hex");
+        return `https://www.gravatar.com/avatar/${hash}?s=200&d=identicon&r=x`;
+      }
+
+      if (!userInfo.picture) {
+        return undefined;
+      }
+
+      try {
+        const response = await fetch(userInfo.picture, {
+          headers: { Authorization: `Bearer ${tokens.access_token}` },
+        });
+
+        if (response.ok) {
+          const contentType = response.headers.get("content-type");
+          if (contentType?.startsWith("image/")) {
+            const buffer = await response.arrayBuffer();
+            const base64 = Buffer.from(buffer).toString("base64");
+            return `data:${contentType};base64,${base64}`;
+          }
+        }
+      } catch {}
+
+      return userInfo.picture;
+    })();
 
     const userId = await context.auth.findOrCreateUser(claims.sub, {
       name,