From e85c5736c924d5a365deb6bffd9fdb4f9b00c37d Mon Sep 17 00:00:00 2001
From: "Stanko K.R." <stanko@stanko.io>
Date: Mon, 24 Nov 2025 11:47:29 +0100
Subject: [PATCH] Render system user avatars using redirects

---
 app/controllers/users/avatars_controller.rb       |  4 +++-
 app/models/account.rb                             | 11 +----------
 app/models/user/role.rb                           |  2 +-
 test/controllers/users/avatars_controller_test.rb |  7 +++++++
 4 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/app/controllers/users/avatars_controller.rb b/app/controllers/users/avatars_controller.rb
index 9101ee401..86fc678bf 100644
--- a/app/controllers/users/avatars_controller.rb
+++ b/app/controllers/users/avatars_controller.rb
@@ -7,7 +7,9 @@ class Users::AvatarsController < ApplicationController
   before_action :ensure_permission_to_administer_user, only: :destroy
 
   def show
-    if @user.avatar.attached?
+    if @user.system?
+      redirect_to "/apple-touch-icon.png"
+    elsif @user.avatar.attached?
       redirect_to rails_blob_url(@user.avatar.variant(:thumb), disposition: "inline")
     elsif stale? @user, cache_control: cache_control
       render_initials
diff --git a/app/models/account.rb b/app/models/account.rb
index 8a797ef45..0e7708847 100644
--- a/app/models/account.rb
+++ b/app/models/account.rb
@@ -18,16 +18,7 @@ class Account < ApplicationRecord
   class << self
     def create_with_admin_user(account:, owner:)
       create!(**account).tap do |account|
-        system_user = account.users.create!(role: :system, name: "System")
-
-        Current.with_account(account) do
-          system_user.avatar.attach(
-            io: File.open(Rails.root.join("public", "apple-touch-icon.png")),
-            filename: "apple-touch-icon.png",
-            content_type: "image/png"
-          )
-        end
-
+        account.users.create!(role: :system, name: "System")
         account.users.create!(**owner.reverse_merge(role: "admin"))
       end
     end
diff --git a/app/models/user/role.rb b/app/models/user/role.rb
index e12bf0191..0712e2cf3 100644
--- a/app/models/user/role.rb
+++ b/app/models/user/role.rb
@@ -10,7 +10,7 @@ module User::Role
 
   class_methods do
     def system
-      find_or_create_by!(role: :system) { it.name = "System" }
+      find_or_create_by!(account: Current.account, role: :system) { it.name = "System" }
     end
   end
 
diff --git a/test/controllers/users/avatars_controller_test.rb b/test/controllers/users/avatars_controller_test.rb
index 304825639..3320dd6a4 100644
--- a/test/controllers/users/avatars_controller_test.rb
+++ b/test/controllers/users/avatars_controller_test.rb
@@ -5,6 +5,13 @@ class Users::AvatarsControllerTest < ActionDispatch::IntegrationTest
     sign_in_as :david
   end
 
+  test "show system user" do
+    get user_avatar_path(users(:system))
+
+    assert_response :redirect
+    assert_redirected_to "/apple-touch-icon.png"
+  end
+
   test "show own initials without caching" do
     get user_avatar_path(users(:david))
     assert_match "image/svg+xml", @response.content_type