Fix WeChat avatar expiry causing "Image temporarily unavailable"

[Copilot]

WeChat OAuth avatar URLs are temporary and expire, causing broken avatar display in Casdoor. SetUserOAuthProperties never uploaded OAuth avatars to CDN (PermanentAvatar was never populated for OAuth logins), so once the WeChat URL expired there was no stable fallback.

Changes

• object/user_util.go — SetUserOAuthProperties:
  • Capture the previously stored oauth_<type>_avatarUrl property before overwriting it
  • Extend the user.Avatar update condition to also trigger when the current avatar matches the old OAuth URL (keeps avatar current as provider URLs rotate)
  • When the OAuth avatar URL changes or PermanentAvatar is unset, call getPermanentAvatarUrl(..., upload=true) to download the avatar and store it permanently in the configured CDN/storage provider
  • Set user.PermanentAvatar to the resulting stable CDN URL
  • If user.Avatar is still pointing at the temporary OAuth URL at this point, replace it with the permanent CDN URL

// Before: only set Avatar if empty/default, PermanentAvatar never populated
if user.Avatar == "" || user.Avatar == organization.DefaultAvatar {
    user.Avatar = userInfo.AvatarUrl
}

// After: also sync when current avatar is the old OAuth URL; upload to CDN when URL
// changes or PermanentAvatar is missing
oldAvatarUrl := getUserProperty(user, propertyName)
if user.Avatar == "" || user.Avatar == organization.DefaultAvatar || user.Avatar == oldAvatarUrl {
    user.Avatar = userInfo.AvatarUrl
}
if oldAvatarUrl != userInfo.AvatarUrl || user.PermanentAvatar == "" {
    permanentAvatarUrl, _ := getPermanentAvatarUrl(user.Owner, user.Name, userInfo.AvatarUrl, true)
    if permanentAvatarUrl != "" {
        user.PermanentAvatar = permanentAvatarUrl
        if user.Avatar == userInfo.AvatarUrl {
            user.Avatar = permanentAvatarUrl
        }
    }
}

This aligns OAuth login with the existing pattern in syncer_user.go, which already uses upload=true when syncing avatars from external systems.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• www.google.com
  • Triggering command: /usr/bin/curl curl www.google.com -o /dev/null --connect-timeout 5 rtificates/mozil-ifaceassert /usr/bin/basenam-nilfunc ion_Root_E46.pem/usr/local/go/pkg/tool/linux_amd64/vet (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Avatar Display Error After WeChat Avatar Update</issue_title>
<issue_description>Dear Casdoor Team,
I hope this message finds you well.
I am writing to report a minor bug in the Casdoor system related to WeChat login functionality. When a user logs into Casdoor via WeChat and subsequently updates their avatar on the WeChat platform, the avatar displayed in Casdoor will change to the prompt "Image temporarily unavailable" instead of the newly updated avatar.
Could you please look into this issue and fix it at your earliest convenience?
Thank you for your efforts in maintaining and improving Casdoor.</issue_description>

Comments on the Issue (you are @copilot in this section)

@hsluoyz @Len12749 User.PermanentAvatar will store the image content using storage provider like CDN. User.Avatar will only use the image URL provided by the OAuth service provider, so it can be invalid soon probably. But I forgot how to enable User.PermanentAvatar

• Fixes Avatar Display Error After WeChat Avatar Update #4913

---

📍 Connect Copilot coding agent with Jira, Azure Boards or Linear to delegate work to Copilot in one click without leaving your project management tool.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}