diff --git a/keyserver/src/creators/role-creator.js b/keyserver/src/creators/role-creator.js
index e129da2fe..baf3fd757 100644
--- a/keyserver/src/creators/role-creator.js
+++ b/keyserver/src/creators/role-creator.js
@@ -1,310 +1,316 @@
 // @flow
 
 import {
   type RoleInfo,
   threadPermissions,
   threadPermissionPropagationPrefixes,
   threadPermissionFilterPrefixes,
   type ThreadRolePermissionsBlob,
   type ThreadType,
   threadTypes,
 } from 'lib/types/thread-types.js';
 
 import createIDs from './id-creator.js';
 import { dbQuery, SQL } from '../database/database.js';
 
 type InitialRoles = {
   +default: RoleInfo,
   +creator: RoleInfo,
 };
 async function createInitialRolesForNewThread(
   threadID: string,
   threadType: ThreadType,
 ): Promise<InitialRoles> {
   const rolePermissions = getRolePermissionBlobs(threadType);
   const ids = await createIDs('roles', Object.values(rolePermissions).length);
 
   const time = Date.now();
   const newRows = [];
   const namesToIDs = {};
   for (const name in rolePermissions) {
     const id = ids.shift();
     namesToIDs[name] = id;
     const permissionsBlob = JSON.stringify(rolePermissions[name]);
     newRows.push([id, threadID, name, permissionsBlob, time]);
   }
 
   const query = SQL`
     INSERT INTO roles (id, thread, name, permissions, creation_time)
     VALUES ${newRows}
   `;
   await dbQuery(query);
 
   const defaultRoleInfo = {
     id: namesToIDs.Members,
     name: 'Members',
     permissions: rolePermissions.Members,
     isDefault: true,
   };
   if (!rolePermissions.Admins) {
     return {
       default: defaultRoleInfo,
       creator: defaultRoleInfo,
     };
   }
 
   const adminRoleInfo = {
     id: namesToIDs.Admins,
     name: 'Admins',
     permissions: rolePermissions.Admins,
     isDefault: false,
   };
   return {
     default: defaultRoleInfo,
     creator: adminRoleInfo,
   };
 }
 
 type RolePermissionBlobs = {
   +Members: ThreadRolePermissionsBlob,
   +Admins?: ThreadRolePermissionsBlob,
 };
 
 const { CHILD, DESCENDANT } = threadPermissionPropagationPrefixes;
 const { OPEN, TOP_LEVEL, OPEN_TOP_LEVEL } = threadPermissionFilterPrefixes;
 const OPEN_CHILD = CHILD + OPEN;
 const OPEN_DESCENDANT = DESCENDANT + OPEN;
 const TOP_LEVEL_DESCENDANT = DESCENDANT + TOP_LEVEL;
 const OPEN_TOP_LEVEL_DESCENDANT = DESCENDANT + OPEN_TOP_LEVEL;
 
 const voicedPermissions = {
   [threadPermissions.VOICED]: true,
   [threadPermissions.EDIT_ENTRIES]: true,
   [threadPermissions.EDIT_THREAD_NAME]: true,
   [threadPermissions.EDIT_THREAD_COLOR]: true,
   [threadPermissions.EDIT_THREAD_DESCRIPTION]: true,
+  [threadPermissions.EDIT_THREAD_AVATAR]: true,
   [threadPermissions.CREATE_SUBCHANNELS]: true,
   [threadPermissions.ADD_MEMBERS]: true,
 };
 
 function getRolePermissionBlobsForCommunity(
   threadType: ThreadType,
 ): RolePermissionBlobs {
   const openDescendantKnowOf = OPEN_DESCENDANT + threadPermissions.KNOW_OF;
   const openDescendantVisible = OPEN_DESCENDANT + threadPermissions.VISIBLE;
   const openTopLevelDescendantJoinThread =
     OPEN_TOP_LEVEL_DESCENDANT + threadPermissions.JOIN_THREAD;
   const openChildJoinThread = OPEN_CHILD + threadPermissions.JOIN_THREAD;
   const openChildAddMembers = OPEN_CHILD + threadPermissions.ADD_MEMBERS;
 
   const genesisMemberPermissions = {
     [threadPermissions.KNOW_OF]: true,
     [threadPermissions.VISIBLE]: true,
     [openDescendantKnowOf]: true,
     [openDescendantVisible]: true,
     [openTopLevelDescendantJoinThread]: true,
   };
   const baseMemberPermissions = {
     ...genesisMemberPermissions,
     [threadPermissions.REACT_TO_MESSAGE]: true,
     [threadPermissions.EDIT_MESSAGE]: true,
     [threadPermissions.LEAVE_THREAD]: true,
     [threadPermissions.CREATE_SIDEBARS]: true,
     [threadPermissions.ADD_MEMBERS]: true,
     [openChildJoinThread]: true,
     [openChildAddMembers]: true,
   };
 
   let memberPermissions;
   if (threadType === threadTypes.COMMUNITY_ANNOUNCEMENT_ROOT) {
     memberPermissions = baseMemberPermissions;
   } else if (threadType === threadTypes.GENESIS) {
     memberPermissions = genesisMemberPermissions;
   } else {
     memberPermissions = {
       ...baseMemberPermissions,
       ...voicedPermissions,
     };
   }
 
   const descendantKnowOf = DESCENDANT + threadPermissions.KNOW_OF;
   const descendantVisible = DESCENDANT + threadPermissions.VISIBLE;
   const topLevelDescendantJoinThread =
     TOP_LEVEL_DESCENDANT + threadPermissions.JOIN_THREAD;
   const childJoinThread = CHILD + threadPermissions.JOIN_THREAD;
   const descendantVoiced = DESCENDANT + threadPermissions.VOICED;
   const descendantEditEntries = DESCENDANT + threadPermissions.EDIT_ENTRIES;
   const descendantEditThreadName =
     DESCENDANT + threadPermissions.EDIT_THREAD_NAME;
   const descendantEditThreadColor =
     DESCENDANT + threadPermissions.EDIT_THREAD_COLOR;
   const descendantEditThreadDescription =
     DESCENDANT + threadPermissions.EDIT_THREAD_DESCRIPTION;
+  const descendantEditThreadAvatar =
+    DESCENDANT + threadPermissions.EDIT_THREAD_AVATAR;
   const topLevelDescendantCreateSubchannels =
     TOP_LEVEL_DESCENDANT + threadPermissions.CREATE_SUBCHANNELS;
   const topLevelDescendantCreateSidebars =
     TOP_LEVEL_DESCENDANT + threadPermissions.CREATE_SIDEBARS;
   const descendantAddMembers = DESCENDANT + threadPermissions.ADD_MEMBERS;
   const descendantDeleteThread = DESCENDANT + threadPermissions.DELETE_THREAD;
   const descendantEditPermissions =
     DESCENDANT + threadPermissions.EDIT_PERMISSIONS;
   const descendantRemoveMembers = DESCENDANT + threadPermissions.REMOVE_MEMBERS;
   const descendantChangeRole = DESCENDANT + threadPermissions.CHANGE_ROLE;
 
   const baseAdminPermissions = {
     [threadPermissions.KNOW_OF]: true,
     [threadPermissions.VISIBLE]: true,
     [threadPermissions.VOICED]: true,
     [threadPermissions.REACT_TO_MESSAGE]: true,
     [threadPermissions.EDIT_MESSAGE]: true,
     [threadPermissions.EDIT_ENTRIES]: true,
     [threadPermissions.EDIT_THREAD_NAME]: true,
     [threadPermissions.EDIT_THREAD_COLOR]: true,
     [threadPermissions.EDIT_THREAD_DESCRIPTION]: true,
+    [threadPermissions.EDIT_THREAD_AVATAR]: true,
     [threadPermissions.CREATE_SUBCHANNELS]: true,
     [threadPermissions.CREATE_SIDEBARS]: true,
     [threadPermissions.ADD_MEMBERS]: true,
     [threadPermissions.DELETE_THREAD]: true,
     [threadPermissions.REMOVE_MEMBERS]: true,
     [threadPermissions.CHANGE_ROLE]: true,
     [descendantKnowOf]: true,
     [descendantVisible]: true,
     [topLevelDescendantJoinThread]: true,
     [childJoinThread]: true,
     [descendantVoiced]: true,
     [descendantEditEntries]: true,
     [descendantEditThreadName]: true,
     [descendantEditThreadColor]: true,
     [descendantEditThreadDescription]: true,
+    [descendantEditThreadAvatar]: true,
     [topLevelDescendantCreateSubchannels]: true,
     [topLevelDescendantCreateSidebars]: true,
     [descendantAddMembers]: true,
     [descendantDeleteThread]: true,
     [descendantEditPermissions]: true,
     [descendantRemoveMembers]: true,
     [descendantChangeRole]: true,
   };
 
   let adminPermissions;
   if (threadType === threadTypes.GENESIS) {
     adminPermissions = baseAdminPermissions;
   } else {
     adminPermissions = {
       ...baseAdminPermissions,
       [threadPermissions.LEAVE_THREAD]: true,
     };
   }
 
   return {
     Members: memberPermissions,
     Admins: adminPermissions,
   };
 }
 
 function getRolePermissionBlobs(threadType: ThreadType): RolePermissionBlobs {
   if (threadType === threadTypes.SIDEBAR) {
     const memberPermissions = {
       [threadPermissions.VOICED]: true,
       [threadPermissions.REACT_TO_MESSAGE]: true,
       [threadPermissions.EDIT_MESSAGE]: true,
       [threadPermissions.EDIT_THREAD_NAME]: true,
       [threadPermissions.EDIT_THREAD_COLOR]: true,
       [threadPermissions.EDIT_THREAD_DESCRIPTION]: true,
+      [threadPermissions.EDIT_THREAD_AVATAR]: true,
       [threadPermissions.ADD_MEMBERS]: true,
       [threadPermissions.EDIT_PERMISSIONS]: true,
       [threadPermissions.REMOVE_MEMBERS]: true,
       [threadPermissions.LEAVE_THREAD]: true,
     };
     return {
       Members: memberPermissions,
     };
   }
 
   const openDescendantKnowOf = OPEN_DESCENDANT + threadPermissions.KNOW_OF;
   const openDescendantVisible = OPEN_DESCENDANT + threadPermissions.VISIBLE;
   const openChildJoinThread = OPEN_CHILD + threadPermissions.JOIN_THREAD;
 
   if (threadType === threadTypes.PRIVATE) {
     const memberPermissions = {
       [threadPermissions.KNOW_OF]: true,
       [threadPermissions.VISIBLE]: true,
       [threadPermissions.VOICED]: true,
       [threadPermissions.REACT_TO_MESSAGE]: true,
       [threadPermissions.EDIT_MESSAGE]: true,
       [threadPermissions.EDIT_THREAD_COLOR]: true,
       [threadPermissions.EDIT_THREAD_DESCRIPTION]: true,
       [threadPermissions.CREATE_SIDEBARS]: true,
       [threadPermissions.EDIT_ENTRIES]: true,
       [openDescendantKnowOf]: true,
       [openDescendantVisible]: true,
       [openChildJoinThread]: true,
     };
     return {
       Members: memberPermissions,
     };
   }
 
   if (threadType === threadTypes.PERSONAL) {
     return {
       Members: {
         [threadPermissions.KNOW_OF]: true,
         [threadPermissions.VISIBLE]: true,
         [threadPermissions.VOICED]: true,
         [threadPermissions.REACT_TO_MESSAGE]: true,
         [threadPermissions.EDIT_MESSAGE]: true,
         [threadPermissions.EDIT_ENTRIES]: true,
         [threadPermissions.EDIT_THREAD_NAME]: true,
         [threadPermissions.EDIT_THREAD_COLOR]: true,
         [threadPermissions.EDIT_THREAD_DESCRIPTION]: true,
         [threadPermissions.CREATE_SIDEBARS]: true,
         [openDescendantKnowOf]: true,
         [openDescendantVisible]: true,
         [openChildJoinThread]: true,
       },
     };
   }
 
   const openTopLevelDescendantJoinThread =
     OPEN_TOP_LEVEL_DESCENDANT + threadPermissions.JOIN_THREAD;
 
   const subthreadBasePermissions = {
     [threadPermissions.KNOW_OF]: true,
     [threadPermissions.VISIBLE]: true,
     [threadPermissions.REACT_TO_MESSAGE]: true,
     [threadPermissions.EDIT_MESSAGE]: true,
     [threadPermissions.CREATE_SIDEBARS]: true,
     [threadPermissions.LEAVE_THREAD]: true,
     [openDescendantKnowOf]: true,
     [openDescendantVisible]: true,
     [openTopLevelDescendantJoinThread]: true,
     [openChildJoinThread]: true,
   };
 
   if (
     threadType === threadTypes.COMMUNITY_OPEN_SUBTHREAD ||
     threadType === threadTypes.COMMUNITY_SECRET_SUBTHREAD
   ) {
     const memberPermissions = {
       [threadPermissions.REMOVE_MEMBERS]: true,
       [threadPermissions.EDIT_PERMISSIONS]: true,
       ...subthreadBasePermissions,
       ...voicedPermissions,
     };
     return {
       Members: memberPermissions,
     };
   }
 
   if (
     threadType === threadTypes.COMMUNITY_OPEN_ANNOUNCEMENT_SUBTHREAD ||
     threadType === threadTypes.COMMUNITY_SECRET_ANNOUNCEMENT_SUBTHREAD
   ) {
     return {
       Members: subthreadBasePermissions,
     };
   }
 
   return getRolePermissionBlobsForCommunity(threadType);
 }
 
 export { createInitialRolesForNewThread, getRolePermissionBlobs };
diff --git a/keyserver/src/database/migration-config.js b/keyserver/src/database/migration-config.js
index c2d80111a..d6ded9c71 100644
--- a/keyserver/src/database/migration-config.js
+++ b/keyserver/src/database/migration-config.js
@@ -1,375 +1,376 @@
 // @flow
 
 import fs from 'fs';
 
 import { policyTypes } from 'lib/facts/policies.js';
 
 import { dbQuery, SQL } from '../database/database.js';
 import { updateRolesAndPermissionsForAllThreads } from '../updaters/thread-permission-updaters.js';
 
 const migrations: $ReadOnlyMap<number, () => Promise<void>> = new Map([
   [
     0,
     async () => {
       await makeSureBaseRoutePathExists('facts/commapp_url.json');
       await makeSureBaseRoutePathExists('facts/squadcal_url.json');
     },
   ],
   [
     1,
     async () => {
       try {
         await fs.promises.unlink('facts/url.json');
       } catch {}
     },
   ],
   [
     2,
     async () => {
       await fixBaseRoutePathForLocalhost('facts/commapp_url.json');
       await fixBaseRoutePathForLocalhost('facts/squadcal_url.json');
     },
   ],
 
   [3, updateRolesAndPermissionsForAllThreads],
   [
     4,
     async () => {
       await dbQuery(SQL`ALTER TABLE uploads ADD INDEX container (container)`);
     },
   ],
   [
     5,
     async () => {
       await dbQuery(SQL`
         ALTER TABLE cookies
           ADD device_id varchar(255) DEFAULT NULL,
           ADD public_key varchar(255) DEFAULT NULL,
           ADD social_proof varchar(255) DEFAULT NULL;
       `);
     },
   ],
   [
     7,
     async () => {
       await dbQuery(
         SQL`
           ALTER TABLE users
             DROP COLUMN IF EXISTS public_key,
             MODIFY hash char(60) COLLATE utf8mb4_bin DEFAULT NULL;
     
           ALTER TABLE sessions 
             DROP COLUMN IF EXISTS public_key;
         `,
         { multipleStatements: true },
       );
     },
   ],
   [
     8,
     async () => {
       await dbQuery(
         SQL`
           ALTER TABLE users
             ADD COLUMN IF NOT EXISTS ethereum_address char(42) DEFAULT NULL;
         `,
       );
     },
   ],
   [
     9,
     async () => {
       await dbQuery(
         SQL`
           ALTER TABLE messages
             ADD COLUMN IF NOT EXISTS target_message bigint(20) DEFAULT NULL;
 
           ALTER TABLE messages
             ADD INDEX target_message (target_message);
         `,
         { multipleStatements: true },
       );
     },
   ],
   [
     10,
     async () => {
       await dbQuery(SQL`
         CREATE TABLE IF NOT EXISTS policy_acknowledgments (
           user bigint(20) NOT NULL,
           policy varchar(255) NOT NULL,
           date bigint(20) NOT NULL,
           confirmed tinyint(1) UNSIGNED NOT NULL DEFAULT 0,
           PRIMARY KEY (user, policy)
         ) ENGINE=InnoDB DEFAULT CHARSET=utf8;
       `);
     },
   ],
   [
     11,
     async () => {
       const time = Date.now();
       await dbQuery(SQL`
         INSERT IGNORE INTO policy_acknowledgments (policy, user, date, 
           confirmed)
         SELECT ${policyTypes.tosAndPrivacyPolicy}, id, ${time}, 1
         FROM users
       `);
     },
   ],
   [
     12,
     async () => {
       await dbQuery(SQL`
         CREATE TABLE IF NOT EXISTS siwe_nonces (
           nonce char(17) NOT NULL,
           creation_time bigint(20) NOT NULL,
           PRIMARY KEY (nonce)
         ) ENGINE=InnoDB DEFAULT CHARSET=utf8;
       `);
     },
   ],
   [
     13,
     async () => {
       await Promise.all([
         writeSquadCalRoute('facts/squadcal_url.json'),
         moveToNonApacheConfig('facts/commapp_url.json', '/comm/'),
         moveToNonApacheConfig('facts/landing_url.json', '/commlanding/'),
       ]);
     },
   ],
   [
     14,
     async () => {
       await dbQuery(SQL`
         ALTER TABLE cookies MODIFY COLUMN social_proof mediumtext CHARACTER SET utf8mb4 COLLATE utf8mb4_bin DEFAULT NULL;
       `);
     },
   ],
   [
     15,
     async () => {
       await dbQuery(
         SQL`
           ALTER TABLE uploads 
             ADD COLUMN IF NOT EXISTS thread bigint(20) DEFAULT NULL,
             ADD INDEX IF NOT EXISTS thread (thread);
           
           UPDATE uploads 
             SET thread = (
               SELECT thread FROM messages 
               WHERE messages.id = uploads.container
             );
         `,
         { multipleStatements: true },
       );
     },
   ],
   [
     16,
     async () => {
       await dbQuery(
         SQL`
           ALTER TABLE cookies
             DROP COLUMN IF EXISTS public_key;
 
           ALTER TABLE cookies 
             ADD COLUMN IF NOT EXISTS signed_identity_keys mediumtext 
               CHARACTER SET utf8mb4 
               COLLATE utf8mb4_bin 
               DEFAULT NULL;
         `,
         { multipleStatements: true },
       );
     },
   ],
   [
     17,
     async () => {
       await dbQuery(
         SQL`
           ALTER TABLE cookies 
             DROP INDEX device_token,
             DROP INDEX user_device_token;
 
           ALTER TABLE cookies
             MODIFY device_token mediumtext 
               CHARACTER SET utf8mb4 COLLATE utf8mb4_bin DEFAULT NULL,
             ADD UNIQUE KEY device_token (device_token(512)),
             ADD KEY user_device_token (user,device_token(512));
         `,
         { multipleStatements: true },
       );
     },
   ],
   [18, updateRolesAndPermissionsForAllThreads],
   [19, updateRolesAndPermissionsForAllThreads],
   [
     20,
     async () => {
       await dbQuery(SQL`
         ALTER TABLE threads
           ADD COLUMN IF NOT EXISTS avatar varchar(191)
             COLLATE utf8mb4_bin
             DEFAULT NULL;
       `);
     },
   ],
   [
     21,
     async () => {
       await dbQuery(SQL`
         ALTER TABLE reports
           DROP INDEX IF EXISTS user,
           ADD INDEX IF NOT EXISTS user_type_platform_creation_time
             (user, type, platform, creation_time);
       `);
     },
   ],
   [
     22,
     async () => {
       await dbQuery(
         SQL`
           ALTER TABLE cookies
             MODIFY user varchar(255) CHARSET latin1 COLLATE latin1_bin;
           ALTER TABLE entries
             MODIFY creator varchar(255) CHARSET latin1 COLLATE latin1_bin;
           ALTER TABLE focused
             MODIFY user varchar(255) CHARSET latin1 COLLATE latin1_bin;
           ALTER TABLE memberships
             MODIFY user varchar(255) CHARSET latin1 COLLATE latin1_bin;
           ALTER TABLE messages
             MODIFY user varchar(255) CHARSET latin1 COLLATE latin1_bin;
           ALTER TABLE notifications
             MODIFY user varchar(255) CHARSET latin1 COLLATE latin1_bin;
           ALTER TABLE reports
             MODIFY user varchar(255) CHARSET latin1 COLLATE latin1_bin;
           ALTER TABLE revisions
             MODIFY author varchar(255) CHARSET latin1 COLLATE latin1_bin;
           ALTER TABLE sessions
             MODIFY user varchar(255) CHARSET latin1 COLLATE latin1_bin;
           ALTER TABLE threads
             MODIFY creator varchar(255) CHARSET latin1 COLLATE latin1_bin;
           ALTER TABLE updates
             MODIFY user varchar(255) CHARSET latin1 COLLATE latin1_bin;
           ALTER TABLE uploads
             MODIFY uploader varchar(255) CHARSET latin1 COLLATE latin1_bin;
           ALTER TABLE users
             MODIFY id varchar(255) CHARSET latin1 COLLATE latin1_bin;
           ALTER TABLE relationships_undirected
             MODIFY user1 varchar(255) CHARSET latin1 COLLATE latin1_bin,
             MODIFY user2 varchar(255) CHARSET latin1 COLLATE latin1_bin;
           ALTER TABLE relationships_directed
             MODIFY user1 varchar(255) CHARSET latin1 COLLATE latin1_bin,
             MODIFY user2 varchar(255) CHARSET latin1 COLLATE latin1_bin;
           ALTER TABLE user_messages
             MODIFY recipient varchar(255) CHARSET latin1 COLLATE latin1_bin;
           ALTER TABLE settings
             MODIFY user varchar(255) CHARSET latin1 COLLATE latin1_bin;
           ALTER TABLE policy_acknowledgments
             MODIFY user varchar(255) CHARSET latin1 COLLATE latin1_bin;
         `,
         { multipleStatements: true },
       );
     },
   ],
   [23, updateRolesAndPermissionsForAllThreads],
+  [24, updateRolesAndPermissionsForAllThreads],
 ]);
 const newDatabaseVersion: number = Math.max(...migrations.keys());
 
 async function writeJSONToFile(data: any, filePath: string): Promise<void> {
   console.warn(`updating ${filePath} to ${JSON.stringify(data)}`);
   const fileHandle = await fs.promises.open(filePath, 'w');
   await fileHandle.writeFile(JSON.stringify(data, null, '  '), 'utf8');
   await fileHandle.close();
 }
 
 async function makeSureBaseRoutePathExists(filePath: string): Promise<void> {
   let readFile, json;
   try {
     readFile = await fs.promises.open(filePath, 'r');
     const contents = await readFile.readFile('utf8');
     json = JSON.parse(contents);
   } catch {
     return;
   } finally {
     if (readFile) {
       await readFile.close();
     }
   }
   if (json.baseRoutePath) {
     return;
   }
   let baseRoutePath;
   if (json.baseDomain === 'http://localhost') {
     baseRoutePath = json.basePath;
   } else if (filePath.endsWith('commapp_url.json')) {
     baseRoutePath = '/commweb/';
   } else {
     baseRoutePath = '/';
   }
   const newJSON = { ...json, baseRoutePath };
   console.warn(`updating ${filePath} to ${JSON.stringify(newJSON)}`);
   await writeJSONToFile(newJSON, filePath);
 }
 
 async function fixBaseRoutePathForLocalhost(filePath: string): Promise<void> {
   let readFile, json;
   try {
     readFile = await fs.promises.open(filePath, 'r');
     const contents = await readFile.readFile('utf8');
     json = JSON.parse(contents);
   } catch {
     return;
   } finally {
     if (readFile) {
       await readFile.close();
     }
   }
   if (json.baseDomain !== 'http://localhost') {
     return;
   }
   const baseRoutePath = '/';
   json = { ...json, baseRoutePath };
   console.warn(`updating ${filePath} to ${JSON.stringify(json)}`);
   await writeJSONToFile(json, filePath);
 }
 
 async function moveToNonApacheConfig(
   filePath: string,
   routePath: string,
 ): Promise<void> {
   if (process.env.COMM_DATABASE_HOST) {
     return;
   }
   // Since the non-Apache config is so opinionated, just write expected config
   const newJSON = {
     baseDomain: 'http://localhost:3000',
     basePath: routePath,
     baseRoutePath: routePath,
     https: false,
     proxy: 'none',
   };
 
   await writeJSONToFile(newJSON, filePath);
 }
 
 async function writeSquadCalRoute(filePath: string): Promise<void> {
   if (process.env.COMM_DATABASE_HOST) {
     return;
   }
   // Since the non-Apache config is so opinionated, just write expected config
   const newJSON = {
     baseDomain: 'http://localhost:3000',
     basePath: '/comm/',
     baseRoutePath: '/',
     https: false,
     proxy: 'apache',
   };
 
   await writeJSONToFile(newJSON, filePath);
 }
 
 export { migrations, newDatabaseVersion };
diff --git a/lib/types/thread-types.js b/lib/types/thread-types.js
index 408ef1214..307a6617c 100644
--- a/lib/types/thread-types.js
+++ b/lib/types/thread-types.js
@@ -1,487 +1,489 @@
 // @flow
 
 import invariant from 'invariant';
 
 import type { ClientAvatar } from './avatar-types.js';
 import type { Shape } from './core.js';
 import type { CalendarQuery, RawEntryInfo } from './entry-types.js';
 import type { Media } from './media-types.js';
 import type {
   RawMessageInfo,
   MessageTruncationStatuses,
 } from './message-types.js';
 import type { ThreadSubscription } from './subscription-types.js';
 import type { ServerUpdateInfo, ClientUpdateInfo } from './update-types.js';
 import type { UserInfo, UserInfos } from './user-types.js';
 import type { ThreadEntity } from '../utils/entity-text.js';
 
 export const threadTypes = Object.freeze({
   //OPEN: 0,   (DEPRECATED)
   //CLOSED: 1, (DEPRECATED)
   //SECRET: 2, (DEPRECATED)
   // has parent, not top-level (appears under parent in inbox), and visible to
   // all members of parent
   SIDEBAR: 5,
   // canonical thread for each pair of users. represents the friendship
   PERSONAL: 6,
   // canonical thread for each single user
   PRIVATE: 7,
   // local "thick" thread (outside of community). no parent, can only have
   // sidebar children. currently a proxy for COMMUNITY_SECRET_SUBTHREAD until we
   // launch actual E2E
   LOCAL: 4,
   // aka "org". no parent, top-level, has admin
   COMMUNITY_ROOT: 8,
   // like COMMUNITY_ROOT, but members aren't voiced
   COMMUNITY_ANNOUNCEMENT_ROOT: 9,
   // an open subthread. has parent, top-level (not sidebar), and visible to all
   // members of parent. root ancestor is a COMMUNITY_ROOT
   COMMUNITY_OPEN_SUBTHREAD: 3,
   // like COMMUNITY_SECRET_SUBTHREAD, but members aren't voiced
   COMMUNITY_OPEN_ANNOUNCEMENT_SUBTHREAD: 10,
   // a secret subthread. optional parent, top-level (not sidebar), visible only
   // to its members. root ancestor is a COMMUNITY_ROOT
   COMMUNITY_SECRET_SUBTHREAD: 4,
   // like COMMUNITY_SECRET_SUBTHREAD, but members aren't voiced
   COMMUNITY_SECRET_ANNOUNCEMENT_SUBTHREAD: 11,
   // like COMMUNITY_SECRET_ANNOUNCEMENT_SUBTHREAD, but you can't leave
   GENESIS: 12,
 });
 export type ThreadType = $Values<typeof threadTypes>;
 export function assertThreadType(threadType: number): ThreadType {
   invariant(
     threadType === 3 ||
       threadType === 4 ||
       threadType === 5 ||
       threadType === 6 ||
       threadType === 7 ||
       threadType === 8 ||
       threadType === 9 ||
       threadType === 10 ||
       threadType === 11 ||
       threadType === 12,
     'number is not ThreadType enum',
   );
   return threadType;
 }
 export const communityThreadTypes: $ReadOnlyArray<number> = Object.freeze([
   threadTypes.COMMUNITY_ROOT,
   threadTypes.COMMUNITY_ANNOUNCEMENT_ROOT,
   threadTypes.GENESIS,
 ]);
 
 export const communitySubthreads: $ReadOnlyArray<number> = Object.freeze([
   threadTypes.COMMUNITY_OPEN_SUBTHREAD,
   threadTypes.COMMUNITY_OPEN_ANNOUNCEMENT_SUBTHREAD,
   threadTypes.COMMUNITY_SECRET_SUBTHREAD,
   threadTypes.COMMUNITY_SECRET_ANNOUNCEMENT_SUBTHREAD,
 ]);
 
 export function threadTypeIsCommunityRoot(threadType: ThreadType): boolean {
   return communityThreadTypes.includes(threadType);
 }
 
 export const threadPermissions = Object.freeze({
   KNOW_OF: 'know_of',
   MEMBERSHIP_DEPRECATED: 'membership',
   VISIBLE: 'visible',
   VOICED: 'voiced',
   EDIT_ENTRIES: 'edit_entries',
   EDIT_THREAD_NAME: 'edit_thread',
   EDIT_THREAD_DESCRIPTION: 'edit_thread_description',
   EDIT_THREAD_COLOR: 'edit_thread_color',
   DELETE_THREAD: 'delete_thread',
   CREATE_SUBCHANNELS: 'create_subthreads',
   CREATE_SIDEBARS: 'create_sidebars',
   JOIN_THREAD: 'join_thread',
   EDIT_PERMISSIONS: 'edit_permissions',
   ADD_MEMBERS: 'add_members',
   REMOVE_MEMBERS: 'remove_members',
   CHANGE_ROLE: 'change_role',
   LEAVE_THREAD: 'leave_thread',
   REACT_TO_MESSAGE: 'react_to_message',
   EDIT_MESSAGE: 'edit_message',
+  EDIT_THREAD_AVATAR: 'edit_thread_avatar',
 });
 export type ThreadPermission = $Values<typeof threadPermissions>;
 export function assertThreadPermissions(
   ourThreadPermissions: string,
 ): ThreadPermission {
   invariant(
     ourThreadPermissions === 'know_of' ||
       ourThreadPermissions === 'membership' ||
       ourThreadPermissions === 'visible' ||
       ourThreadPermissions === 'voiced' ||
       ourThreadPermissions === 'edit_entries' ||
       ourThreadPermissions === 'edit_thread' ||
       ourThreadPermissions === 'edit_thread_description' ||
       ourThreadPermissions === 'edit_thread_color' ||
       ourThreadPermissions === 'delete_thread' ||
       ourThreadPermissions === 'create_subthreads' ||
       ourThreadPermissions === 'create_sidebars' ||
       ourThreadPermissions === 'join_thread' ||
       ourThreadPermissions === 'edit_permissions' ||
       ourThreadPermissions === 'add_members' ||
       ourThreadPermissions === 'remove_members' ||
       ourThreadPermissions === 'change_role' ||
       ourThreadPermissions === 'leave_thread' ||
       ourThreadPermissions === 'react_to_message' ||
-      ourThreadPermissions === 'edit_message',
+      ourThreadPermissions === 'edit_message' ||
+      ourThreadPermissions === 'edit_thread_avatar',
     'string is not threadPermissions enum',
   );
   return ourThreadPermissions;
 }
 
 export const threadPermissionPropagationPrefixes = Object.freeze({
   DESCENDANT: 'descendant_',
   CHILD: 'child_',
 });
 export type ThreadPermissionPropagationPrefix = $Values<
   typeof threadPermissionPropagationPrefixes,
 >;
 
 export const threadPermissionFilterPrefixes = Object.freeze({
   // includes only SIDEBAR, COMMUNITY_OPEN_SUBTHREAD,
   // COMMUNITY_OPEN_ANNOUNCEMENT_SUBTHREAD
   OPEN: 'open_',
   // excludes only SIDEBAR
   TOP_LEVEL: 'toplevel_',
   // includes only COMMUNITY_OPEN_SUBTHREAD,
   // COMMUNITY_OPEN_ANNOUNCEMENT_SUBTHREAD
   OPEN_TOP_LEVEL: 'opentoplevel_',
 });
 export type ThreadPermissionFilterPrefix = $Values<
   typeof threadPermissionFilterPrefixes,
 >;
 
 export type ThreadPermissionInfo =
   | { +value: true, +source: string }
   | { +value: false, +source: null };
 
 export type ThreadPermissionsBlob = {
   +[permission: string]: ThreadPermissionInfo,
 };
 export type ThreadRolePermissionsBlob = { +[permission: string]: boolean };
 
 export type ThreadPermissionsInfo = {
   +[permission: ThreadPermission]: ThreadPermissionInfo,
 };
 
 export type MemberInfo = {
   +id: string,
   +role: ?string,
   +permissions: ThreadPermissionsInfo,
   +isSender: boolean,
 };
 
 export type RelativeMemberInfo = {
   ...MemberInfo,
   +username: ?string,
   +isViewer: boolean,
 };
 
 export type RoleInfo = {
   +id: string,
   +name: string,
   +permissions: ThreadRolePermissionsBlob,
   +isDefault: boolean,
 };
 
 export type ThreadCurrentUserInfo = {
   +role: ?string,
   +permissions: ThreadPermissionsInfo,
   +subscription: ThreadSubscription,
   +unread: ?boolean,
 };
 
 export type RawThreadInfo = {
   +id: string,
   +type: ThreadType,
   +name: ?string,
   +avatar?: ?ClientAvatar,
   +description: ?string,
   +color: string, // hex, without "#" or "0x"
   +creationTime: number, // millisecond timestamp
   +parentThreadID: ?string,
   +containingThreadID: ?string,
   +community: ?string,
   +members: $ReadOnlyArray<MemberInfo>,
   +roles: { [id: string]: RoleInfo },
   +currentUser: ThreadCurrentUserInfo,
   +sourceMessageID?: string,
   +repliesCount: number,
 };
 
 export type ThreadInfo = {
   +id: string,
   +type: ThreadType,
   +name: ?string,
   +uiName: string | ThreadEntity,
   +avatar?: ?ClientAvatar,
   +description: ?string,
   +color: string, // hex, without "#" or "0x"
   +creationTime: number, // millisecond timestamp
   +parentThreadID: ?string,
   +containingThreadID: ?string,
   +community: ?string,
   +members: $ReadOnlyArray<RelativeMemberInfo>,
   +roles: { [id: string]: RoleInfo },
   +currentUser: ThreadCurrentUserInfo,
   +sourceMessageID?: string,
   +repliesCount: number,
 };
 
 export type ResolvedThreadInfo = {
   +id: string,
   +type: ThreadType,
   +name: ?string,
   +uiName: string,
   +avatar?: ?ClientAvatar,
   +description: ?string,
   +color: string, // hex, without "#" or "0x"
   +creationTime: number, // millisecond timestamp
   +parentThreadID: ?string,
   +containingThreadID: ?string,
   +community: ?string,
   +members: $ReadOnlyArray<RelativeMemberInfo>,
   +roles: { [id: string]: RoleInfo },
   +currentUser: ThreadCurrentUserInfo,
   +sourceMessageID?: string,
   +repliesCount: number,
 };
 
 export type ServerMemberInfo = {
   +id: string,
   +role: ?string,
   +permissions: ThreadPermissionsInfo,
   +subscription: ThreadSubscription,
   +unread: ?boolean,
   +isSender: boolean,
 };
 
 export type ServerThreadInfo = {
   +id: string,
   +type: ThreadType,
   +name: ?string,
   +description: ?string,
   +color: string, // hex, without "#" or "0x"
   +creationTime: number, // millisecond timestamp
   +parentThreadID: ?string,
   +containingThreadID: ?string,
   +community: ?string,
   +depth: number,
   +members: $ReadOnlyArray<ServerMemberInfo>,
   +roles: { [id: string]: RoleInfo },
   +sourceMessageID?: string,
   +repliesCount: number,
 };
 
 export type ThreadStore = {
   +threadInfos: { +[id: string]: RawThreadInfo },
 };
 
 export type RemoveThreadOperation = {
   +type: 'remove',
   +payload: { +ids: $ReadOnlyArray<string> },
 };
 
 export type RemoveAllThreadsOperation = {
   +type: 'remove_all',
 };
 
 export type ReplaceThreadOperation = {
   +type: 'replace',
   +payload: { +id: string, +threadInfo: RawThreadInfo },
 };
 
 export type ThreadStoreOperation =
   | RemoveThreadOperation
   | RemoveAllThreadsOperation
   | ReplaceThreadOperation;
 
 export type ClientDBThreadInfo = {
   +id: string,
   +type: number,
   +name: ?string,
   +avatar?: ?string,
   +description: ?string,
   +color: string,
   +creationTime: string,
   +parentThreadID: ?string,
   +containingThreadID: ?string,
   +community: ?string,
   +members: string,
   +roles: string,
   +currentUser: string,
   +sourceMessageID?: string,
   +repliesCount: number,
 };
 
 export type ClientDBReplaceThreadOperation = {
   +type: 'replace',
   +payload: ClientDBThreadInfo,
 };
 
 export type ClientDBThreadStoreOperation =
   | RemoveThreadOperation
   | RemoveAllThreadsOperation
   | ClientDBReplaceThreadOperation;
 
 export type ThreadDeletionRequest = {
   +threadID: string,
   +accountPassword: ?string,
 };
 
 export type RemoveMembersRequest = {
   +threadID: string,
   +memberIDs: $ReadOnlyArray<string>,
 };
 
 export type RoleChangeRequest = {
   +threadID: string,
   +memberIDs: $ReadOnlyArray<string>,
   +role: string,
 };
 
 export type ChangeThreadSettingsResult = {
   +threadInfo?: RawThreadInfo,
   +threadInfos?: { +[id: string]: RawThreadInfo },
   +updatesResult: {
     +newUpdates: $ReadOnlyArray<ServerUpdateInfo>,
   },
   +newMessageInfos: $ReadOnlyArray<RawMessageInfo>,
 };
 
 export type ChangeThreadSettingsPayload = {
   +threadID: string,
   +updatesResult: {
     +newUpdates: $ReadOnlyArray<ClientUpdateInfo>,
   },
   +newMessageInfos: $ReadOnlyArray<RawMessageInfo>,
 };
 
 export type LeaveThreadRequest = {
   +threadID: string,
 };
 export type LeaveThreadResult = {
   +threadInfos?: { +[id: string]: RawThreadInfo },
   +updatesResult: {
     +newUpdates: $ReadOnlyArray<ServerUpdateInfo>,
   },
 };
 
 export type LeaveThreadPayload = {
   +updatesResult: {
     +newUpdates: $ReadOnlyArray<ClientUpdateInfo>,
   },
 };
 
 export type ThreadChanges = Shape<{
   +type: ThreadType,
   +name: string,
   +description: string,
   +color: string,
   +parentThreadID: ?string,
   +newMemberIDs: $ReadOnlyArray<string>,
 }>;
 
 export type UpdateThreadRequest = {
   +threadID: string,
   +changes: ThreadChanges,
 };
 
 export type BaseNewThreadRequest = {
   +id?: ?string,
   +name?: ?string,
   +description?: ?string,
   +color?: ?string,
   +parentThreadID?: ?string,
   +initialMemberIDs?: ?$ReadOnlyArray<string>,
   +ghostMemberIDs?: ?$ReadOnlyArray<string>,
 };
 type NewThreadRequest =
   | {
       +type: 3 | 4 | 6 | 7 | 8 | 9 | 10 | 11 | 12,
       ...BaseNewThreadRequest,
     }
   | {
       +type: 5,
       +sourceMessageID: string,
       ...BaseNewThreadRequest,
     };
 
 export type ClientNewThreadRequest = {
   ...NewThreadRequest,
   +calendarQuery: CalendarQuery,
 };
 export type ServerNewThreadRequest = {
   ...NewThreadRequest,
   +calendarQuery?: ?CalendarQuery,
 };
 
 export type NewThreadResponse = {
   +updatesResult: {
     +newUpdates: $ReadOnlyArray<ServerUpdateInfo>,
   },
   +newMessageInfos: $ReadOnlyArray<RawMessageInfo>,
   +newThreadInfo?: RawThreadInfo,
   +userInfos: UserInfos,
   +newThreadID?: string,
 };
 export type NewThreadResult = {
   +updatesResult: {
     +newUpdates: $ReadOnlyArray<ClientUpdateInfo>,
   },
   +newMessageInfos: $ReadOnlyArray<RawMessageInfo>,
   +userInfos: UserInfos,
   +newThreadID: string,
 };
 
 export type ServerThreadJoinRequest = {
   +threadID: string,
   +calendarQuery?: ?CalendarQuery,
 };
 export type ClientThreadJoinRequest = {
   +threadID: string,
   +calendarQuery: CalendarQuery,
 };
 export type ThreadJoinResult = {
   threadInfos?: { +[id: string]: RawThreadInfo },
   updatesResult: {
     newUpdates: $ReadOnlyArray<ServerUpdateInfo>,
   },
   rawMessageInfos: $ReadOnlyArray<RawMessageInfo>,
   truncationStatuses: MessageTruncationStatuses,
   userInfos: UserInfos,
   rawEntryInfos?: ?$ReadOnlyArray<RawEntryInfo>,
 };
 export type ThreadJoinPayload = {
   +updatesResult: {
     newUpdates: $ReadOnlyArray<ClientUpdateInfo>,
   },
   +rawMessageInfos: $ReadOnlyArray<RawMessageInfo>,
   +truncationStatuses: MessageTruncationStatuses,
   +userInfos: $ReadOnlyArray<UserInfo>,
 };
 
 export type ThreadFetchMediaResult = {
   +media: $ReadOnlyArray<Media>,
 };
 export type ThreadFetchMediaRequest = {
   +threadID: string,
   +limit: number,
   +offset: number,
 };
 
 export type SidebarInfo = {
   +threadInfo: ThreadInfo,
   +lastUpdatedTime: number,
   +mostRecentNonLocalMessage: ?string,
 };
 
 // We can show a max of 3 sidebars inline underneath their parent in the chat
 // tab. If there are more, we show a button that opens a modal to see the rest
 export const maxReadSidebars = 3;
 
 // We can show a max of 5 sidebars inline underneath their parent
 // in the chat tab if every one of the displayed sidebars is unread
 export const maxUnreadSidebars = 5;