Users without profile image inherit group profile image unintentionally

[mindmonk]

Please agree to the following

• I have searched existing issues for duplicates
• I agree to follow this project's Code of Conduct

Summary

Users without a profile image may incorrectly display the profile image of one of their Groups. This behavior was introduced after adding support for profile images on Groups and results in misleading user representations.

System Setup

- Affected changes are not yet part of a released version
- Behavior exists on the develop branch after a recent commit
- Milestone: 1.5.0
- Suspected causing PR: https://github.com/cryptomator/hub/pull/375

Steps to Reproduce

1. Create or use a User without a profile image.
2. Assign the User to at least one Group that has a profile image.
3. Log in with that User.
4. Observe the displayed profile image.

Expected Behavior

• A User without a profile image must not inherit or display the profile image of any Group.
• Group profile images should only be used for Groups and never as a fallback for Users.

Actual Behavior

• If a User does not have a profile image but is a member of a Group that has a profile image, the User is displayed with the Group’s image as their profile image.
• If the User is a member of multiple Groups with profile images, the image of the first Group (sorted alphabetically by group name) is used.

Reproducibility

Always

Relevant Log Output

Anything else?

No response

[overheadhunter]

Can you retest this with the users-and-groups feature now being merged?

[mindmonk]

The issue is still present after merging users-and-groups.
I noticed that users who have logged in at least once incorrectly inherit a group profile image, while users who never logged in still show the fallback image.

[overheadhunter]

I did some tests and noticed that the access token JWT does in fact contain a "picture" claim with the data from the group. This is then being transferred to hub during PUT /api/users/me and can be observed in GET /api/users/me (but apparently not for long, as some background synchronization resets the user data whenever I try to reply the GET request)...

[overheadhunter]

Quoting the KC docs:

Users can be members of any number of groups and inherit the attributes and role mappings assigned to each group.

So either we stop importing attributes from the JWT claims during PUT /api/users/me (and instead rely on the new sync mechanism introduced in #376 or rename the attributes, so they don't overlap (e.g. user.picture and group.picture).

CC @SailReal