Function resolveProviderPicture

server-source-code/internal/auth/oidc/client.go:265–296

(ctx context.Context, issuerURL string, token *oauth2.Token, rawPicture string)

}

func resolveProviderPicture(ctx context.Context, issuerURL string, token *oauth2.Token, rawPicture string) (string, error) {
	if !isMicrosoftIdentityIssuer(issuerURL) {
		return rawPicture, nil
	}
	// For Microsoft Entra, the `picture` claim is NOT directly renderable:
	//   - Often empty (Entra doesn't include it unless configured as an optional claim).
	//   - A bare user GUID.
	//   - Or `https://graph.microsoft.com/v1.0/me/photo/$value` — a Graph API endpoint
	//     that requires a bearer token; the browser can't fetch it directly.
	// So regardless of what the claim contains, the right thing to do is call Graph
	// with our access token and embed the returned image bytes as a data: URL.
	// If Graph fetch succeeds, prefer it; otherwise fall back to the raw claim only
	// if it's a renderable non-Graph URL (rare but possible for hybrid setups).
	if token != nil && token.AccessToken != "" {
		picture, err := fetchMicrosoftGraphPhotoDataURL(ctx, token)
		if err == nil && picture != "" {
			return picture, nil
		}
		// Graph fetch failed or returned no photo — log-by-returning-err semantics are
		// preserved below only when the claim is unusable, so we don't surface transient
		// Graph errors to the caller when we have a usable fallback.
		if err != nil && (rawPicture == "" || isMicrosoftGraphURL(rawPicture)) {
			return "", err
		}
	}
	// No token or Graph failed: fall back to the claim ONLY if it's renderable AND
	// not a Graph API URL (which the browser can never load without auth).
	if isRenderableImageSrc(rawPicture) && !isMicrosoftGraphURL(rawPicture) {
		return rawPicture, nil
	}
	return "", nil
}

// isMicrosoftGraphURL detects URLs pointing at Microsoft Graph, which require a
// bearer token and therefore cannot be used as a browser-renderable <img src>.