···295295 }
296296297297 await Promise.all(promises);
298298+299299+ // Invalidate cached OG image so the next scrape regenerates it.
300300+ // Fire-and-forget; server checks auth against the signed-cookie session.
301301+ fetch(`/${data.did}/og-new.png`, { method: 'DELETE' }).catch(() => {});
298302}
299303300304export function createEmptyCard(page: string) {
+27-1
src/routes/[[actor=actor]]/og-new.png/+server.ts
···11import { env } from '$env/dynamic/private';
22import { env as publicEnv } from '$env/dynamic/public';
33-import { error } from '@sveltejs/kit';
33+import { error, json } from '@sveltejs/kit';
44import { getActor } from '$lib/actor';
55import { createCache } from '$lib/cache';
66···8585 }
8686 });
8787}
8888+8989+export async function DELETE({ params, platform, request, locals }) {
9090+ if (!locals.did) {
9191+ throw error(401, 'Not authenticated');
9292+ }
9393+9494+ const actor = await getActor({
9595+ request,
9696+ paramActor: params.actor,
9797+ platform,
9898+ blockBoth: false
9999+ });
100100+101101+ if (!actor) {
102102+ throw error(404, 'Page not found');
103103+ }
104104+105105+ if (actor !== locals.did) {
106106+ throw error(403, 'Cannot invalidate another user\'s OG image');
107107+ }
108108+109109+ const cache = createCache(platform);
110110+ await cache?.delete('og', actor);
111111+112112+ return json({ success: true });
113113+}