OCP API: Contacts photos format

Describe the bug

I'm trying to process contact photos in an app. Sometimes the photos I get from OCP\IAddressBook#search are binary blobs, sometimes they are links, that are Basic Auth protected. Is this intended?

Steps to reproduce

1. Write a Nextcloud App
2. OCP\Contacts\IManager#getUserAddressBooks()
3. $cards = OCP\IAddressBook#search()
4. file_get_contents($card['PHOTO'])

Expected behavior

Consistent data formatting, either all photos as blobs or all photos as URLs. Additionally it would be nice if those URLs didn't have Basic Auth protection, which makes it quite hard to process the photos on the server (I assume I would need to create an app password.)

Actual behavior

Sometimes PHOTO entries are URLs with Basic Auth protection, sometimes they are blobs.

Contact version

Not sure

Operating system

Not sure

PHP engine version

PHP 7.4

Web server

Apache (supported)

Database

Other

Operating system

Not sure

List of activated Apps

This is generated from third-party reports, I don't have access.

Nextcloud Signing status

No response

Configuration report

No response

Additional info

This info is generated from third-party reports, I don't have access. See the original issue on my repo: https://github.com/marcelklehr/recognize/issues/139

Start by inspecting OCP\Contacts\IManager#getUserAddressBooks() and OCP\IAddressBook#search(), then reproduce the reported PHOTO values using file_get_contents($card['PHOTO']). Determine where blobs and Basic Auth-protected URLs are produced; done means the API returns a consistent, usable photo format or clearly documents the behavior.