Authenticate media requests when loading avatars

[Half-Shot]

Fixes #2845

This introduces support for authenticated matrix media for avatars. All media requests are now made via fetch and then the result is stored as a local object url.

[hughns]

What is the intended behaviour when EC is running as a widget?

[Half-Shot]

What is the intended behaviour when EC is running as a widget?

😢 , I suspect. There isn't an API presently to fetch media over the widget API and we don't have a token to use that could do it. I wish for a world where we get scoped OIDC tokens and can just use the actual API. matrix-org/matrix-widget-api#115 would be useful.

I think for the moment we could either still support unauthenticated media for widgets while new avatars slowly replace the old ones and we lose access to them. Or we could just show placeholders for all avatars until we can properly support authenticated media.

[hughns]

What is the intended behaviour when EC is running as a widget?

😢 , I suspect. There isn't an API presently to fetch media over the widget API and we don't have a token to use that could do it. I wish for a world where we get scoped OIDC tokens and can just use the actual API. matrix-org/matrix-widget-api#115 would be useful.

I think for the moment we could either still support unauthenticated media for widgets while new avatars slowly replace the old ones and we lose access to them. Or we could just show placeholders for all avatars until we can properly support authenticated media.

If the PR can be updated to make it work with the widget mode fallback (with appropriate tests too), then I think we could merge this PR without having to figure out the whole widget API solution.

[hughns]

@fkwp as this is currently proposed user profile thumbnails will no longer show when running in widget/embedded mode. Is this acceptable? or should EC be continuing to use non-authenticated media requests when running as a widget?

Marking as draft with X-Needs-Product label until answered.

[Half-Shot]

https://matrix.to/#/!tDLCaLXijNtYcJZEey:element.io/$rljmYPXis_Ja28l-Z7_XIqkdgC7Y3TmqFFxssHj1o4Q?via=element.io&via=matrix.org&via=half-shot.uk

So I believe we were okay to merge this now, and then fix the thumbnail in widgets later as we didn't deem it critical enough. I was going to look at expanding the widget API to do so as a next-up item.

[hughns]

So I believe we were okay to merge this now, and then fix the thumbnail in widgets later as we didn't deem it critical enough. I was going to look at expanding the widget API to do so as a next-up item.

👌 I made #2876 to add the feature back in.

[hughns]

One typo. Otherwise looks good. 👍

[dillfrescott]

Will this merge be in a release soon?

[hughns]

Will this merge be in a release soon?

There is currently a release blocker which is now being tracked at #2972

[dillfrescott]

Thank you!