fix(avatar): 修复群成员拉取他人头像 403 及补充 avatar_url 回填规则

server/db/mysql/adapter.go

@@ -4729,6 +4729,17 @@ func (a *adapter) FileUserHasAccess(fid string, uid t.Uid) (bool, error) {
 			WHERE (gf.file_id=? OR gf.file_id LIKE CONCAT(?,'.%')) AND gf.status='active'
 					AND s.deletedat IS NULL AND INSTR(s.modewant,'R')>0 AND INSTR(s.modegiven,'R')>0
 			)
+			OR EXISTS (
+				-- 用户头像/资料文件：设置头像时写入的链接行有两种形态——
+				-- userid 形态（topic/msgid 为 NULL，userid=头像主人，旧版写入）与
+				-- 纯数字 uid topic 形态（现行写入；合法业务 topic 均带字母前缀，不会误伤）。
+				-- 头像属于公开资料，对任何登录用户放行。
+				SELECT 1 FROM im_filemsglinks AS fml
+				WHERE fml.fileid=fu.id AND fml.msgid IS NULL AND (
+					(fml.topic IS NULL AND fml.userid IS NOT NULL)
+					OR fml.topic REGEXP '^[0-9]+$'
+				)
+			)
 		) LIMIT 1`, args
 	}
 	run := func() error {

server/default_avatar.go

@@ -36,6 +36,12 @@ func applyAvatarURL(data map[string]any) {
 	avatar := strings.TrimSpace(stringFromAny(data["avatar_file_id"]))
 	if isAvatarURLValue(avatar) {
 		data["avatar_url"] = avatar
+		return
+	}
+	// 裸文件 ID：统一补一个可直接下载的 avatar_url。
+	// 下载走 /v0/file/s/{file_id}，自定义头像的 ACL 对登录用户放行（见 adapter.FileUserHasAccess）。
+	if avatar != "" && !types.ParseUid(avatar).IsZero() {
+		data["avatar_url"] = "/v0/file/s/" + avatar
 	}
 }
 

server/im_http.go

@@ -7439,13 +7439,15 @@ func forwardTargetPayload(sub types.Subscription) map[string]any {
 	default:
 		return nil
 	}
-	return map[string]any{
+	target := map[string]any{
 		"topic":               sub.Topic,
 		"type":                topicType,
 		"display_name":        imDisplayNameFromPublic(sub.GetPublic(), sub.Topic),
 		"avatar_file_id":      imAvatarFileIDFromPublic(sub.GetPublic()),
 		"can_receive_forward": true,
 	}
+	applyAvatarURL(target)
+	return target
 }
 
 func forwardTargetMatches(topic, displayName, query string) bool {
@@ -7643,7 +7645,7 @@ func groupBusinessMemberPayload(member types.GroupMember, remark string) map[str
 }
 
 func maskIMGroupMemberProfileEntrypoint(data map[string]any) {
-	for _, key := range []string{"avatar_file_id", "public_account", "signature", "gender", "region"} {
+	for _, key := range []string{"avatar_file_id", "avatar_url", "public_account", "signature", "gender", "region"} {
 		delete(data, key)
 	}
 	data["can_add"] = false