Take a look in api/src/lib/auth.js for the getCurrentUser() function. It lists what fields are included in currentUser. Make sure you don’t add hashedPassword or salt to that list!
If there is an avatar field in User Model,
Should I stored it as base64 or an image link?
Which one will be better if I need to call this field in Cell?
Using their Gravatar is a great option! If you really want to let them upload their own, but aren’t using Supabase, we have a how-to article on file uploads with Filestack: https://redwoodjs.com/docs/how-to/file-uploads