--- a/mod_http_pep_avatar/mod_http_pep_avatar.lua	Fri May 29 12:38:23 2020 +0200
+++ b/mod_http_pep_avatar/mod_http_pep_avatar.lua	Tue Jun 02 20:00:03 2020 +0200
@@ -11,14 +11,16 @@
 module:depends("http")
 module:provides("http", {
 	route = {
-		["GET /*"] = function (event, user)
-			if user == "" then
+		["GET /*"] = function (event, path)
+			if path == "" then
 				return [[<h1>Hello from mod_http_pep_avatar</h1><p>This module provides access to public avatars of local users.</p>]];
 			end;
 
 			local request, response = event.request, event.response;
 			local actor = request.ip;
 
+			local user, item_id = path:match("^([^/]+)/(%x+)$");
+			if not user then user = path; end
 			local prepped = nodeprep(user);
 			if not prepped then return 400; end
 			if prepped ~= user then
@@ -37,21 +39,34 @@
 				return 404;
 			end
 
-			if avatar_hash == request.headers.if_none_match then
+			if (item_id or avatar_hash) == request.headers.if_none_match then
 				return 304;
 			end
 
-			local data_ok, avatar_data = pep_service:get_items("urn:xmpp:avatar:data", actor, avatar_hash);
-			if not data_ok or type(avatar_data) ~= "table" or not avatar_data[avatar_hash] then
+			local data_ok, avatar_data = pep_service:get_items("urn:xmpp:avatar:data", actor, item_id or avatar_hash);
+			if not data_ok or type(avatar_data) ~= "table" or not avatar_data[item_id or avatar_hash] then
 				return 404;
 			end
 
-			response.headers.etag = avatar_hash;
+			local info = avatar_meta.tags[1]:get_child("info");
+			if item_id and info.attr.id ~= item_id then
+				info = nil;
+				for altinfo in avatar_meta.tags[1]:childtags("info") do
+					if altinfo.attr.id == item_id then
+						info = altinfo;
+					end
+				end
+			end
 
-			local info = avatar_meta.tags[1]:get_child("info");
+			if not info then
+				return 404;
+			end
+
+			response.headers.etag = item_id or avatar_hash;
+
 			response.headers.content_type = info and info.attr.type or "application/octet-stream";
 
-			local data = avatar_data[avatar_hash];
+			local data = avatar_data[item_id or avatar_hash];
 			return base64_decode(data.tags[1]:get_text());
 		end;
 	}