feat: Added AvatarType to Bitmap logic in core.coil

[amariaux]

Usefull for : Infomaniak/android-kMail#2854

[github-actions]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 2 🔵🔵⚪⚪⚪

🧪 No relevant tests

🔒 Security concerns Sensitive information exposure: The error logging in loadAsBitmap includes the full URL ($url) in the Sentry log message. If avatar URLs contain authentication tokens, API keys, or other sensitive query parameters in the URL, these secrets will be transmitted to and stored in Sentry. This violates security best practices for handling URLs that may contain credentials or signed access tokens.

⚡ Recommended focus areas for review Inconsistent Bitmap Sizes The loadAsBitmap function uses a default size of 256, but the fallback initials generation in AvatarType.WithInitials.Url and AvatarType.WithInitials.Initials uses the default size of 64 from generateInitialsAvatarDrawable. This results in inconsistent bitmap dimensions (256x256 for successful network loads vs 64x64 for initials fallback), potentially causing UI scaling issues or blurry avatars. suspend fun AvatarType.toBitmap( appContext : Context): Bitmap? = when (this) { is AvatarType.WithInitials.Url -> { loadAsBitmap(url = this.url, appContext = appContext) ?: appContext.generateInitialsAvatarDrawable( initials = this.initials, background = getBackgroundColorGradientDrawable(this.colors.containerColor.toArgb()), initialsColor = this.colors.contentColor.toArgb(), ).toBitmap() } is AvatarType.WithInitials.Initials -> { appContext.generateInitialsAvatarDrawable( initials = this.initials, background = getBackgroundColorGradientDrawable(this.colors.containerColor.toArgb()), initialsColor = this.colors.contentColor.toArgb(), ).toBitmap() } is AvatarType.DrawableResource -> { ContextCompat.getDrawable(appContext, this.resource)?.toBitmap() } else -> null } Potential Information Disclosure The loadAsBitmap function logs the full URL to Sentry on error ("Failed to load SVG avatar: $url"). If avatar URLs contain sensitive query parameters (e.g., authentication tokens, signed URLs with secrets), these will be exposed in Sentry logs. Consider logging only the domain or a sanitized version of the URL. SentryLog.e(TAG, "Failed to load SVG avatar: $url", result.throwable)

[github-actions]

Failed to generate code suggestions for PR

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Failed to generate code suggestions for PR