Optimize profile image caching

README.md

@@ -54,7 +54,7 @@ Node health: `GET /health`. AI health is internal at `http://127.0.0.1:8000/heal
 
 Run one container with one Python worker: analysis jobs and retry payloads are in memory and are lost on restart. Temporary local files are ephemeral. Completed videos and `results.json` are stored in the private HF dataset; Node stores session metadata and frame indices in Supabase. Model constants are in `app.py`.
 
-The production database must have the analysis functions and action-review structures used by secret-protected `/internal/analysis` routes. The database also needs the profile columns shown in `../Database/schema.sql` and a private `profile-images` Supabase Storage bucket for JPG, PNG, and WEBP files up to 4 MB. The backend reads and writes images through its service-role client; browsers access them through authenticated API routes.
+The production database must have the analysis functions and action-review structures used by secret-protected `/internal/analysis` routes. The database also needs the profile columns shown in `../Database/schema.sql` and a private `profile-images` Supabase Storage bucket for JPG, PNG, and WEBP files up to 4 MB. The frontend resizes profile photos to at most 1280 pixels and encodes them as WebP before upload. The backend reads and writes images through its service-role client; browsers access them through authenticated API routes with private, versioned browser caching.
 
 Before deploying access-control or deletion changes, run [`../Database/updates/access-permissions.sql`](../Database/updates/access-permissions.sql) in the Supabase SQL Editor. This update adds the admin-origin flag, nullable owner references for retained records, cascading action deletion, and the service-role RPCs used for quota refunds and analysis completion. All service-role reads and writes must remain behind the ownership and admin checks in the API. The full policy is documented in [`../Database/access-permissions.md`](../Database/access-permissions.md).
 

src/profile-images.ts

@@ -48,7 +48,8 @@ async function sendImage(res: Response, path: string | null | undefined) {
   const type = path.endsWith(".png") ? "image/png" : path.endsWith(".webp") ? "image/webp" : "image/jpeg";
   res.set({
     "Content-Type": type,
-    "Cache-Control": "private, max-age=3600",
+    // Each upload gets a new UUID path, so this response never needs revalidation.
+    "Cache-Control": "private, max-age=31536000, immutable",
     "Cross-Origin-Resource-Policy": "cross-origin",
     "X-Content-Type-Options": "nosniff",
   });
@@ -65,7 +66,7 @@ async function uploadImage(req: Request, res: Response, owner: Owner, id: string
   const path = `${owner}/${id}/${randomUUID()}.${type.extension}`;
   const { error: uploadError } = await supabaseAdmin.storage.from(BUCKET).upload(path, bytes, {
     contentType: type.mime,
-    cacheControl: "3600",
+    cacheControl: "31536000",
     upsert: false,
   });
   if (uploadError) throw new Error(`Unable to upload profile image: ${uploadError.message}`);