Expand direct image links instead of showing nothing (#43 follow-up)

A URL that points straight at an image file (Content-Type: image/*) has
no HTML to scrape Open Graph tags from, so the fetch found nothing and
the message showed no preview at all -- reported against
https://imgs.xkcd.com/comics/creepy.png.

link_preview_service now recognizes an allowed image content-type (same
list storage.py uses for uploads) before falling through to the HTML/og:
path, and returns the URL itself as the preview (LinkPreview.is_image).
No need to download the body -- the already-SSRF-validated URL is the
image. The frontend renders that case as a real expandable image
(message-image + lightbox, same as an actual attachment) instead of the
small title+description card, which would have nothing to show anyway.

Verified end-to-end against the reported URL.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/app/models/link_preview.py

@@ -23,6 +23,12 @@ class LinkPreview(Base):
     description: Mapped[str | None] = mapped_column(String(1000))
     image_url: Mapped[str | None] = mapped_column(String(2048))
     site_name: Mapped[str | None] = mapped_column(String(200))
+    # A direct link to an image file (Content-Type: image/*, no HTML to
+    # scrape og: tags from) gets image_url = the URL itself and no
+    # title/description/site_name -- this flags that case so the frontend
+    # renders it as an actual expanded image rather than the small
+    # title+description unfurl card.
+    is_image: Mapped[bool] = mapped_column(Boolean, default=False, nullable=False)
     # Cached separately from a "no row yet" state so a URL that genuinely
     # doesn't unfurl (no title, fetch error, blocked by SSRF checks) isn't
     # re-fetched on every message that references it within the TTL.

backend/app/schemas/message.py

@@ -27,6 +27,7 @@ class LinkPreviewInfo(BaseModel):
     description: str | None
     image_url: str | None
     site_name: str | None
+    is_image: bool
 
 
 class MessageRead(BaseModel):

backend/app/services/link_preview_service.py

@@ -11,6 +11,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
 from app.database import async_session_factory
 from app.models import LinkPreview
 from app.services.ssrf import UnsafeUrlError, validate_target_url
+from app.storage import ALLOWED_IMAGE_CONTENT_TYPES
 from app.ws.broadcaster import Broadcaster
 
 logger = logging.getLogger(__name__)
@@ -99,8 +100,21 @@ async def _fetch_preview_data(url: str) -> dict | None:
                         continue
                     if response.status_code >= 400:
                         return None
-                    content_type = response.headers.get("content-type", "")
-                    if "text/html" not in content_type:
+                    content_type = response.headers.get("content-type", "").split(";")[0].strip()
+                    # A direct link to an image file -- render the image
+                    # itself rather than trying to scrape og: tags from
+                    # nonexistent HTML. No need to read the body at all;
+                    # the URL (now fully resolved through any redirects,
+                    # each already SSRF-validated above) *is* the preview.
+                    if content_type in ALLOWED_IMAGE_CONTENT_TYPES:
+                        return {
+                            "title": None,
+                            "description": None,
+                            "image_url": current_url,
+                            "site_name": None,
+                            "is_image": True,
+                        }
+                    if content_type != "text/html":
                         return None
                     body = b""
                     async for chunk in response.aiter_bytes():
@@ -128,6 +142,7 @@ async def _fetch_preview_data(url: str) -> dict | None:
         "description": (parser.og.get("og:description") or "").strip()[:1000] or None,
         "image_url": parser.og.get("og:image") or None,
         "site_name": (parser.og.get("og:site_name") or "").strip()[:200] or None,
+        "is_image": False,
     }
 
 
@@ -148,6 +163,7 @@ async def _get_or_fetch(db: AsyncSession, url: str) -> LinkPreview | None:
             existing.description = data["description"]
             existing.image_url = data["image_url"]
             existing.site_name = data["site_name"]
+            existing.is_image = data["is_image"]
         existing.fetched_at = datetime.now(timezone.utc)
         await db.commit()
         return None if data is None else existing
@@ -155,7 +171,16 @@ async def _get_or_fetch(db: AsyncSession, url: str) -> LinkPreview | None:
     row = LinkPreview(
         url=url,
         fetch_failed=data is None,
-        **(data or {"title": None, "description": None, "image_url": None, "site_name": None}),
+        **(
+            data
+            or {
+                "title": None,
+                "description": None,
+                "image_url": None,
+                "site_name": None,
+                "is_image": False,
+            }
+        ),
     )
     db.add(row)
     await db.commit()
@@ -192,6 +217,7 @@ async def fetch_and_broadcast_link_preview(
             "description": preview.description,
             "image_url": preview.image_url,
             "site_name": preview.site_name,
+            "is_image": preview.is_image,
         },
     )