「🔨」 fix(user-management): fix the fact the no fucking route was protected

src/api/user/pAvatar.js

@@ -8,6 +8,9 @@ import sharp from 'sharp';
 export async function pAvatar(request, reply, fastify, getUserInfo, setAvatarId, postImage) {
 	try {
 		const userId = request.params.userId;
+		if (request.user !== userId && request.user !== 'admin') {
+			return reply.code(401).send({ error: 'Unauthorized' });
+		}
 		if (!getUserInfo.get(userId)) {
 			return reply.code(404).send({ error: "User does not exist" });
 		}