Fix custom team logo not appearing in link previews for public shares (outline#11872)

* Initial plan

* fix: resolve team avatar to signed URL for public share link previews

Co-authored-by: tommoor <380914+tommoor@users.noreply.github.com>
Agent-Logs-Url: https://github.com/outline/outline/sessions/3632734e-1bb5-4705-bdcd-a2ccbb211af8

* refactor: move avatar URL resolution to Team.publicAvatarUrl()

Co-authored-by: tommoor <380914+tommoor@users.noreply.github.com>
Agent-Logs-Url: https://github.com/outline/outline/sessions/a2191be3-0533-459a-8366-602bb798a60e

* test: add Team.publicAvatarUrl model tests; update JSDoc

Co-authored-by: tommoor <380914+tommoor@users.noreply.github.com>
Agent-Logs-Url: https://github.com/outline/outline/sessions/7609501c-a4d1-44ea-a7bf-fa6fd8e7c999

* test: fix Team.publicAvatarUrl tests to use actual attachment URLs

Co-authored-by: tommoor <380914+tommoor@users.noreply.github.com>
Agent-Logs-Url: https://github.com/outline/outline/sessions/0a768f8b-0dd8-4e7a-a50d-873af58aab28

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: tommoor <380914+tommoor@users.noreply.github.com>

Author: Copilot

server/models/Team.test.ts

@@ -1,4 +1,5 @@
-import { buildTeam, buildCollection } from "@server/test/factories";
+import { randomUUID } from "node:crypto";
+import { buildTeam, buildCollection, buildAttachment } from "@server/test/factories";
 
 describe("Team", () => {
   describe("collectionIds", () => {
@@ -40,4 +41,52 @@ describe("Team", () => {
       expect(team.previousSubdomains?.[1]).toEqual(subdomain);
     });
   });
+
+  describe("publicAvatarUrl", () => {
+    it("should return null when no avatarUrl is set", async () => {
+      const team = await buildTeam({ avatarUrl: null });
+      const result = await team.publicAvatarUrl();
+      expect(result).toBeNull();
+    });
+
+    it("should return external URL unchanged", async () => {
+      const url = "https://example.com/logo.png";
+      const team = await buildTeam({ avatarUrl: url });
+      const result = await team.publicAvatarUrl();
+      expect(result).toEqual(url);
+    });
+
+    it("should return signed URL for private-bucket attachment redirect", async () => {
+      const team = await buildTeam();
+      const attachment = await buildAttachment({
+        teamId: team.id,
+        acl: "private",
+      });
+
+      await team.update({
+        avatarUrl: `/api/attachments.redirect?id=${attachment.id}`,
+      });
+
+      const result = await team.publicAvatarUrl();
+      expect(result).toEqual(await attachment.signedUrl);
+    });
+
+    it("should return canonical URL for public-bucket attachment redirect", async () => {
+      const team = await buildTeam();
+      const id = randomUUID();
+      const attachment = await buildAttachment({
+        id,
+        teamId: team.id,
+        key: `avatars/${team.id}/${id}/logo.png`,
+        acl: "public-read",
+      });
+
+      await team.update({
+        avatarUrl: `/api/attachments.redirect?id=${attachment.id}`,
+      });
+
+      const result = await team.publicAvatarUrl();
+      expect(result).toEqual(attachment.canonicalUrl);
+    });
+  });
 });

server/models/Team.ts

@@ -29,6 +29,7 @@ import { TeamPreferenceDefaults } from "@shared/constants";
 import type { TeamPreferences } from "@shared/types";
 import { TeamPreference, UserRole } from "@shared/types";
 import { getBaseDomain, RESERVED_SUBDOMAINS } from "@shared/utils/domains";
+import { attachmentRedirectRegex } from "@shared/utils/ProsemirrorHelper";
 import { parseEmail } from "@shared/utils/email";
 import { TeamValidation } from "@shared/validations";
 import env from "@server/env";
@@ -57,6 +58,8 @@ export enum TeamFlag {
   MarkedSafe = "markedSafe",
 }
 
+const avatarRedirectPattern = new RegExp(attachmentRedirectRegex.source, "i");
+
 @Scopes(() => ({
   withDomains: {
     include: [{ model: TeamDomain }],
@@ -145,6 +148,37 @@ class Team extends ParanoidModel<
     this.setDataValue("avatarUrl", value);
   }
 
+  /**
+   * Returns a directly-accessible URL for the team's avatar suitable for use
+   * in contexts without authentication. Attachment is loaded and a signed (or
+   * canonical) URL is returned; any other URL is returned unchanged.
+   *
+   * @returns A promise resolving to a direct URL, or null when no avatar is set.
+   */
+  async publicAvatarUrl(): Promise<string | null> {
+    const url = this.avatarUrl;
+    if (!url) {
+      return null;
+    }
+
+    const match = avatarRedirectPattern.exec(url);
+    if (!match?.groups?.id) {
+      return url;
+    }
+
+    const attachment = await Attachment.findOne({
+      where: { id: match.groups.id, teamId: this.id },
+    });
+
+    if (!attachment) {
+      return url;
+    }
+
+    return attachment.isStoredInPublicBucket
+      ? attachment.canonicalUrl
+      : await attachment.signedUrl;
+  }
+
   @Default(true)
   @Column
   sharing: boolean;

server/routes/app.ts

@@ -340,7 +340,9 @@ export const renderShare = async (ctx: Context, next: Next) => {
       (publicBranding && team?.description ? team.description : undefined),
     content,
     shortcutIcon:
-      publicBranding && team?.avatarUrl ? team.avatarUrl : undefined,
+      publicBranding && team?.avatarUrl
+        ? (await team.publicAvatarUrl()) ?? undefined
+        : undefined,
     analytics,
     isShare: true,
     rootShareId,