fix: replace stub OptionalProfileImageInterceptor with real Fastify multipart file upload

[Josue19-08]

🔖 Title

Fix profile image upload — `OptionalProfileImageInterceptor` is a no-op stub; `@fastify/multipart` is not installed

---

📄 Description

`POST /auth/register` advertises profile image upload support, but the implementation is broken at every layer:

Layer 1 — Missing package: `@fastify/multipart` is not installed. Only `@fastify/cors`, `@fastify/formbody`, and `@fastify/middie` are present. `multer` (Express-only) is listed as a dependency but is incompatible with the Fastify adapter.

Layer 2 — Stub interceptor: `OptionalProfileImageInterceptor` in `auth.controller.ts` is a complete no-op — it calls `next.handle()` and does nothing else. `@UploadedFile()` will always receive `undefined`.

Layer 3 — No plugin registration: even if the package were installed, `@fastify/multipart` must be registered on the Fastify adapter instance in `main.ts` before requests can be parsed as multipart.

As a result, profile images are silently ignored for all users — no error, no upload, the `profileImageUrl` field in the database is always null.

---

✅ Tasks to complete

• Add `@fastify/multipart` to `package.json` and install; remove `multer` if it has no other usages
• Register `@fastify/multipart` plugin in `src/main.ts` with appropriate file size limit (read from env: `MAX_FILE_SIZE_MB`, default 5MB)
• Replace `OptionalProfileImageInterceptor` stub in `src/modules/auth/auth.controller.ts` with real Fastify multipart handling using `request.file()`; make file optional (register succeeds with no image)
• Update `src/modules/auth/auth.service.ts` — ensure `register()` correctly receives the file buffer and calls the storage upload function when a file is present
• Update `src/database/repositories/users.repository.ts` — verify `updateAvatar()` (or equivalent) handles the Fastify file object shape (buffer, mimetype, filename)
• Add `MAX_FILE_SIZE_MB` and allowed MIME types (`image/jpeg`, `image/png`, `image/webp`) to `src/config/env.ts` validation
• Add unit tests in `test/unit/modules/auth/auth.controller.spec.ts`: register with valid image → `profileImageUrl` set; register without image → succeeds with null URL; register with oversized file → 413; register with invalid MIME → 400

---

📚 Documentation/context for AI

(This link never should removed)
https://github.com/TrustUp-app/TrustUp-API/tree/main/docs

Relevant files:

• `src/main.ts`
• `src/modules/auth/auth.controller.ts` (OptionalProfileImageInterceptor)
• `src/modules/auth/auth.service.ts`
• `src/database/repositories/users.repository.ts`
• `src/config/env.ts`

---

🗒️ Additional notes

• Use `@fastify/multipart` directly via `request.file()` inside the controller; do not use NestJS `FileInterceptor` which requires the Express adapter
• Validate MIME type before uploading; reject non-image files with a clear 400 error code `FILE_INVALID_TYPE`
• File size validation should happen at the Fastify plugin level (via `limits.fileSize`), not just in the controller
• If a user registers without a profile image, `profileImageUrl` should be `null` in the DB — this is the current (silently broken) behavior that should now work explicitly

[Chigybillionz]

Good day, TrustUp team.

I'd like to work on this issue.

I'll replace the current stubbed upload flow with proper Fastify multipart handling by registering "@fastify/multipart", implementing optional image uploads with "request.file()", validating file size and MIME types, and updating the auth flow to persist profile images correctly. I'll also add the required environment validation and unit tests covering valid uploads, missing images, oversized files, and invalid MIME types.

GitHub: https://github.com/chiggybillionz

THANK you

[Phantomcall]

Hi! I'd like to work on this issue.

I have experience with NestJS running on the Fastify adapter, including multipart uploads, request validation, and file handling. From the description, the current implementation is effectively a stub, so my goal will be to implement proper Fastify-native multipart support while preserving the existing registration flow.

My implementation plan is to:

• Add and configure @fastify/multipart, removing multer if it is no longer used elsewhere in the project.

• Register the multipart plugin in src/main.ts with a configurable file size limit sourced from MAX_FILE_SIZE_MB (defaulting to 5 MB).

• Replace the no-op OptionalProfileImageInterceptor with Fastify-native multipart handling using request.file(), while keeping profile images optional.

• Validate uploaded files against the allowed MIME types (image/jpeg, image/png, and image/webp) and return a clear FILE_INVALID_TYPE error for unsupported files.

• Update the registration flow so uploaded files are correctly passed to the storage layer and profileImageUrl is persisted when an image is provided.

• Verify the repository layer correctly handles the Fastify file object and continues storing null when no image is uploaded.

• Extend environment validation to include the new upload configuration.

• Add unit tests covering:

  • Registration with a valid image
  • Registration without an image
  • Oversized uploads returning HTTP 413
  • Invalid MIME types returning HTTP 400

• Run the full test suite to ensure there are no regressions.

I'll keep the implementation scoped to Fastify-native multipart support (avoiding Express-specific interceptors), preserve backward compatibility for clients that don't upload an image, and reference the issue in the PR.

I'd be happy to take this on once assigned. Thanks!