fix(backend): guard avatar upload against a missing filename

[joj0hq]

Problem

POST /profiles/{profile_id}/avatar builds the temp-file suffix from Path(file.filename).suffix:

with tempfile.NamedTemporaryFile(delete=False, suffix=Path(file.filename).suffix) as tmp:

UploadFile.filename can be None (a multipart part without a filename), and Path(None) raises TypeError. This line runs before the try/except, so the error isn't converted to a clean 4xx — the request fails with an unhandled 500.

Every other upload handler in the codebase already guards this exact case with file.filename or "":

• add_profile_sample — routes/profiles.py:162
• transcribe — routes/transcription.py:30
• audio import — routes/generations.py:415

The avatar endpoint is the lone inconsistency.

Fix

One line — apply the same guard:

suffix=Path(file.filename or "").suffix

A filename-less upload now yields an empty suffix (handled downstream by upload_avatar, which validates the image) instead of crashing with a 500.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes
  • Improved avatar uploads when no filename is provided.
  • Prevented upload failures caused by missing file extension information.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 41306a94-afc0-4b56-a018-18968b68e961

📥 Commits

Reviewing files that changed from the base of the PR and between 52f8d8d and a55a3ba.

📒 Files selected for processing (1)

• backend/routes/profiles.py

---

📝 Walkthrough

Walkthrough

The avatar upload handler now safely derives the temporary file suffix when file.filename is missing, while preserving the existing upload and cleanup flow.

Changes

Avatar upload

Layer / File(s)	Summary
Safe temporary-file suffix backend/routes/profiles.py	The upload route derives the temporary file suffix from an empty-string fallback when no filename is provided.

Estimated code review effort: 2 (Simple) | ~5 minutes

Suggested reviewers: jamiepine

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main fix: guarding avatar uploads against missing filenames.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}