Add profile images and plan billing API

README.md

@@ -43,7 +43,7 @@ Node health: `GET /health`. AI health is internal at `http://127.0.0.1:8000/heal
 
 Run one container with one Python worker: analysis jobs and retry payloads are in memory and are lost on restart. Temporary local files are ephemeral. Completed videos and `results.json` are stored in the private HF dataset; Node stores session metadata and frame indices in Supabase. Model constants are in `app.py`.
 
-Apply `../Database/migrations/20261016_node_analysis.sql` before analyses. It assumes the legacy actions table is empty. Apply `../Database/migrations/20261016_action_reviews.sql` to enable saving coach scores and per-action annotation notes. Secret-protected `/internal/analysis` routes authorize sessions and persist completion/failure.
+The production database must have the analysis functions and action-review structures used by secret-protected `/internal/analysis` routes. The database also needs the profile columns shown in `../Database/schema.sql` and a private `profile-images` Supabase Storage bucket for JPG, PNG, and WEBP files up to 4 MB. The backend reads and writes images through its service-role client; browsers access them through authenticated API routes.
 
 ## Supabase dashboard setup
 
@@ -102,10 +102,14 @@ Brevo credentials stay in Supabase SMTP settings and are not added to the browse
 - `GET /api/auth/me` — verifies the session and refreshes it when necessary.
 - `POST /api/auth/logout` — clears the session cookies.
 - `GET /api/auth/profile` and `PATCH /api/auth/profile` — read and update the signed-in user's profile.
+- `GET`, `POST`, and `DELETE /api/auth/image` — view, upload, or remove the signed-in user's profile image. POST sends raw JPG, PNG, or WEBP bytes with the matching `Content-Type`.
+- `GET`, `POST`, and `DELETE /api/players/:playerId/image` — view, upload, or remove a player profile image.
+- `PUT /api/players/:playerId` — update a player's profile, including gender.
+- `GET /api/plan-billing` — current plan assignment, period and status, plus the signed-in user's player and session counts. Billing history is unavailable until a payment provider is integrated.
 - `POST /api/auth/password` — change or set the signed-in user's password.
 - `DELETE /api/auth/account` — delete the signed-in user's Supabase Auth account and profile row.
 
-To allow profiles with no selected role, apply `Database/migrations/20261015_user_role_optional.sql` to the Supabase database once. New accounts start with a `NULL` role and academy; users can complete both from `/labs/profile`.
+New accounts start with a `NULL` role and academy; users can complete both from `/labs/profile`.
 
 ## Subscription activation flow
 
@@ -131,4 +135,4 @@ The Pages proxy streams uploads and media without buffering. Cloudflare's reques
 
 `/api/auth/me` returns identity and subscription access together. The frontend keeps that UI snapshot in tab-scoped sessionStorage for 60 seconds, including across reloads, and shares concurrent checks. Logout, account deletion, and starting Google sign-in clear the snapshot. No access or refresh token is stored in browser storage; HttpOnly cookies and backend authorization remain authoritative.
 
-The backend caches subscription lookup results per user for at most 30 seconds (never beyond UTC midnight), with concurrent lookup deduplication and a 1,000-entry bound. Assigning a subscription through `assignPaidSubscription` invalidates that user's entry immediately. Direct database changes can take up to 30 seconds to affect backend authorization; the UI snapshot can take up to 60 seconds to refresh. Authentication is still verified for protected API requests.
+The backend caches subscription lookup results per user for at most 30 seconds (never beyond UTC midnight), with concurrent lookup deduplication and a 1,000-entry bound. Assigning a subscription through `assignPaidSubscription` invalidates that user's entry immediately. The access-status endpoint bypasses that cache, and Labs polls it every 10 seconds while access is locked, so directly assigned plans unlock without another login. Protected API requests can use a cached result for up to 30 seconds; authentication is still verified for every request.

src/profile-images.ts

@@ -0,0 +1,152 @@
+import { randomUUID } from "node:crypto";
+import express, { type Express, type Request, type Response } from "express";
+import { z } from "zod";
+import { authenticatedUser } from "./auth.js";
+import { supabaseAdmin } from "./supabase.js";
+
+const BUCKET = "profile-images";
+const MAX_BYTES = 4 * 1024 * 1024;
+const uploadBody = express.raw({ type: ["image/jpeg", "image/png", "image/webp"], limit: MAX_BYTES });
+const playerIdSchema = z.string().uuid();
+
+type Owner = "players" | "users";
+type ImageType = { mime: string; extension: string };
+
+function inspectImage(bytes: Buffer): ImageType | null {
+  if (bytes.length < 12 || bytes.length > MAX_BYTES) return null;
+  if (bytes[0] === 0xff && bytes[1] === 0xd8 && bytes[2] === 0xff) return { mime: "image/jpeg", extension: "jpg" };
+  if (bytes.subarray(0, 8).equals(Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]))) return { mime: "image/png", extension: "png" };
+  if (bytes.toString("ascii", 0, 4) === "RIFF" && bytes.toString("ascii", 8, 12) === "WEBP") return { mime: "image/webp", extension: "webp" };
+  return null;
+}
+
+function safePreviousPath(owner: Owner, id: string, path: string | null | undefined) {
+  const prefix = `${owner}/${id}/`;
+  if (!path?.startsWith(prefix)) return null;
+  const filename = path.slice(prefix.length);
+  return /^[0-9a-f-]{36}\.(jpg|png|webp)$/.test(filename) ? path : null;
+}
+
+async function removeStoredImage(path: string) {
+  const { error } = await supabaseAdmin.storage.from(BUCKET).remove([path]);
+  if (error) throw new Error(`Unable to remove profile image: ${error.message}`);
+}
+
+async function sendImage(res: Response, path: string | null | undefined) {
+  if (!path) return res.status(404).json({ error: "Profile image not found." });
+  const { data, error } = await supabaseAdmin.storage.from(BUCKET).download(path);
+  if (error || !data) return res.status(404).json({ error: "Profile image not found." });
+  const type = path.endsWith(".png") ? "image/png" : path.endsWith(".webp") ? "image/webp" : "image/jpeg";
+  res.set({
+    "Content-Type": type,
+    "Cache-Control": "private, max-age=3600",
+    "Cross-Origin-Resource-Policy": "cross-origin",
+    "X-Content-Type-Options": "nosniff",
+  });
+  return res.send(Buffer.from(await data.arrayBuffer()));
+}
+
+async function uploadImage(req: Request, res: Response, owner: Owner, id: string, previousPath: string | null | undefined) {
+  const bytes = req.body;
+  if (!Buffer.isBuffer(bytes)) return res.status(415).json({ error: "Choose a JPG, PNG or WEBP image." });
+  const type = inspectImage(bytes);
+  if (!type || req.headers["content-type"]?.split(";")[0] !== type.mime) {
+    return res.status(415).json({ error: "Choose a valid JPG, PNG or WEBP image up to 4 MB." });
+  }
+  const path = `${owner}/${id}/${randomUUID()}.${type.extension}`;
+  const { error: uploadError } = await supabaseAdmin.storage.from(BUCKET).upload(path, bytes, {
+    contentType: type.mime,
+    cacheControl: "3600",
+    upsert: false,
+  });
+  if (uploadError) throw new Error(`Unable to upload profile image: ${uploadError.message}`);
+
+  const table = owner === "players" ? "players" : "users";
+  const idColumn = owner === "players" ? "player_id" : "user_id";
+  const { data: saved, error: saveError } = await supabaseAdmin.from(table).update({ image_path: path }).eq(idColumn, id).select(idColumn).maybeSingle();
+  if (saveError || !saved) {
+    await removeStoredImage(path).catch((cleanupError) => console.error(cleanupError));
+    throw new Error(`Unable to save profile image: ${saveError?.message ?? "Profile not found."}`);
+  }
+  const oldPath = safePreviousPath(owner, id, previousPath);
+  if (oldPath) await removeStoredImage(oldPath).catch((cleanupError) => console.error(cleanupError));
+  return res.json({ imagePath: path });
+}
+
+async function deleteImage(res: Response, owner: Owner, id: string, previousPath: string | null | undefined) {
+  const table = owner === "players" ? "players" : "users";
+  const idColumn = owner === "players" ? "player_id" : "user_id";
+  const { data: saved, error } = await supabaseAdmin.from(table).update({ image_path: null }).eq(idColumn, id).select(idColumn).maybeSingle();
+  if (error || !saved) throw new Error(`Unable to remove profile image: ${error?.message ?? "Profile not found."}`);
+  const oldPath = safePreviousPath(owner, id, previousPath);
+  if (oldPath) await removeStoredImage(oldPath).catch((cleanupError) => console.error(cleanupError));
+  return res.json({ imagePath: null });
+}
+
+export function registerProfileImageRoutes(app: Express) {
+  app.get("/api/auth/image", async (req, res, next) => {
+    try {
+      const current = await authenticatedUser(req, res);
+      if (!current) return res.status(401).json({ error: "Authentication required." });
+      const { data, error } = await supabaseAdmin.from("users").select("image_path").eq("user_id", current.user.id).maybeSingle();
+      if (error) throw new Error(`Unable to load user image: ${error.message}`);
+      return await sendImage(res, safePreviousPath("users", current.user.id, data?.image_path));
+    } catch (error) { next(error); }
+  });
+
+  app.post("/api/auth/image", uploadBody, async (req, res, next) => {
+    try {
+      const current = await authenticatedUser(req, res);
+      if (!current) return res.status(401).json({ error: "Authentication required." });
+      const { data, error } = await supabaseAdmin.from("users").select("image_path").eq("user_id", current.user.id).maybeSingle();
+      if (error || !data) return res.status(404).json({ error: "User profile not found." });
+      return await uploadImage(req, res, "users", current.user.id, data.image_path);
+    } catch (error) { next(error); }
+  });
+
+  app.delete("/api/auth/image", async (req, res, next) => {
+    try {
+      const current = await authenticatedUser(req, res);
+      if (!current) return res.status(401).json({ error: "Authentication required." });
+      const { data, error } = await supabaseAdmin.from("users").select("image_path").eq("user_id", current.user.id).maybeSingle();
+      if (error || !data) return res.status(404).json({ error: "User profile not found." });
+      return await deleteImage(res, "users", current.user.id, data.image_path);
+    } catch (error) { next(error); }
+  });
+
+  app.get("/api/players/:playerId/image", async (req, res, next) => {
+    try {
+      const current = await authenticatedUser(req, res);
+      if (!current) return res.status(401).json({ error: "Authentication required." });
+      const id = playerIdSchema.safeParse(req.params.playerId);
+      if (!id.success) return res.status(404).json({ error: "Player not found." });
+      const { data, error } = await supabaseAdmin.from("players").select("image_path").eq("player_id", id.data).maybeSingle();
+      if (error) throw new Error(`Unable to load player image: ${error.message}`);
+      return await sendImage(res, safePreviousPath("players", id.data, data?.image_path));
+    } catch (error) { next(error); }
+  });
+
+  app.post("/api/players/:playerId/image", uploadBody, async (req, res, next) => {
+    try {
+      const current = await authenticatedUser(req, res);
+      if (!current) return res.status(401).json({ error: "Authentication required." });
+      const id = playerIdSchema.safeParse(req.params.playerId);
+      if (!id.success) return res.status(404).json({ error: "Player not found." });
+      const { data, error } = await supabaseAdmin.from("players").select("image_path").eq("player_id", id.data).maybeSingle();
+      if (error || !data) return res.status(404).json({ error: "Player not found." });
+      return await uploadImage(req, res, "players", id.data, data.image_path);
+    } catch (error) { next(error); }
+  });
+
+  app.delete("/api/players/:playerId/image", async (req, res, next) => {
+    try {
+      const current = await authenticatedUser(req, res);
+      if (!current) return res.status(401).json({ error: "Authentication required." });
+      const id = playerIdSchema.safeParse(req.params.playerId);
+      if (!id.success) return res.status(404).json({ error: "Player not found." });
+      const { data, error } = await supabaseAdmin.from("players").select("image_path").eq("player_id", id.data).maybeSingle();
+      if (error || !data) return res.status(404).json({ error: "Player not found." });
+      return await deleteImage(res, "players", id.data, data.image_path);
+    } catch (error) { next(error); }
+  });
+}

src/server.ts

@@ -11,6 +11,7 @@ import { authPublicOrigin, env } from "./config.js";
 import { analysisRouter } from "./analysis.js";
 import { authenticatedUser, clearPasswordRecoveryCookie, clearSessionCookies, hasPasswordRecoveryCookie, safeRedirect, setPasswordRecoveryCookie, setSessionCookies } from "./auth.js";
 import { hashPassword, oauthClient, supabaseAdmin, supabaseAuth, syncProfile, userHasPassword, userPayload } from "./supabase.js";
+import { registerProfileImageRoutes } from "./profile-images.js";
 
 const app = express();
 app.disable("x-powered-by");
@@ -67,6 +68,28 @@ const actionReviewSchema = z.object({
   coachScore: z.number().int().min(0).max(10).nullable(),
   feedback: z.array(z.string().trim().min(1).max(2000)).max(30),
 }).strict();
+const playerProfileSchema = z.object({
+  name: z.string().trim().min(1).max(200),
+  age: z.string().regex(/^(|\d{1,2})$/),
+  heightCm: z.string().regex(/^(|\d{2,3}(?:\.\d{1,2})?)$/),
+  weightKg: z.string().regex(/^(|\d{1,3}(?:\.\d{1,2})?)$/),
+  club: z.string().trim().max(150),
+  position: z.string().trim().max(50),
+  gender: z.union([z.enum(["male", "female"]), z.literal("")]),
+  dominantFoot: z.union([z.enum(["left", "right", "both"]), z.literal("")]),
+  notes: z.string().trim().max(5000),
+}).strict();
+
+function ageFromBirthday(birthday: string | null): string {
+  if (!birthday) return "";
+  const today = new Date();
+  const [year, month, day] = birthday.slice(0, 10).split("-").map(Number);
+  if (!year || !month || !day) return "";
+  const beforeBirthday = today.getUTCMonth() + 1 < month || (today.getUTCMonth() + 1 === month && today.getUTCDate() < day);
+  return String(Math.max(0, today.getUTCFullYear() - year - Number(beforeBirthday)));
+}
+
+registerProfileImageRoutes(app);
 
 // Stored coach ratings use a 0–10 scale. Player dashboards use a 0–100 scale.
 const meanPlayerScore = (values: number[]) => values.length
@@ -122,11 +145,91 @@ app.get("/api/subscription/access", async (req, res, next) => {
   try {
     const current = await authenticatedUser(req, res);
     if (!current) return res.status(401).json({ error: "Authentication required." });
-    const subscription = await activeSubscriptionFor(current.user.id);
+    const subscription = await activeSubscriptionFor(current.user.id, { refresh: true });
     return res.json({ active: Boolean(subscription), subscription });
   } catch (error) { next(error); }
 });
 
+app.get("/api/plan-billing", async (req, res, next) => {
+  try {
+    const current = await authenticatedUser(req, res);
+    if (!current) return res.status(401).json({ error: "Authentication required." });
+    const userId = current.user.id;
+    const [assignmentResult, playersResult, sessionsResult] = await Promise.all([
+      supabaseAdmin.from("users_subscriptions").select("subscription_id,startdate,enddate").eq("user_id", userId).maybeSingle(),
+      supabaseAdmin.from("players").select("player_id", { count: "exact", head: true }).eq("user_id", userId),
+      supabaseAdmin.from("sessions").select("session_id", { count: "exact", head: true }).eq("user_id", userId),
+    ]);
+    if (assignmentResult.error) throw new Error(`Unable to load plan assignment: ${assignmentResult.error.message}`);
+    if (playersResult.error) throw new Error(`Unable to count players: ${playersResult.error.message}`);
+    if (sessionsResult.error) throw new Error(`Unable to count sessions: ${sessionsResult.error.message}`);
+    const assignment = assignmentResult.data;
+    let subscription = null;
+    if (assignment?.subscription_id) {
+      const { data: plan, error } = await supabaseAdmin.from("subscriptions")
+        .select("subscription_id,plan,price").eq("subscription_id", assignment.subscription_id).maybeSingle();
+      if (error) throw new Error(`Unable to load plan: ${error.message}`);
+      if (plan) {
+        const today = new Date().toISOString().slice(0, 10);
+        subscription = {
+          subscriptionId: plan.subscription_id,
+          name: plan.plan,
+          price: Number(plan.price),
+          startDate: assignment.startdate,
+          endDate: assignment.enddate,
+          status: today < assignment.startdate ? "scheduled" : today > assignment.enddate ? "expired" : "active",
+        };
+      }
+    }
+    res.set("Cache-Control", "no-store");
+    return res.json({ subscription, usage: { players: playersResult.count ?? 0, sessions: sessionsResult.count ?? 0 }, billingHistoryAvailable: false });
+  } catch (error) { next(error); }
+});
+
+app.put("/api/players/:playerId", async (req, res, next) => {
+  try {
+    const current = await authenticatedUser(req, res);
+    if (!current) return res.status(401).json({ error: "Authentication required." });
+    const id = z.string().uuid().safeParse(req.params.playerId);
+    if (!id.success) return res.status(404).json({ error: "Player not found." });
+    const input = playerProfileSchema.parse(req.body);
+    const age = input.age ? Number(input.age) : null;
+    const height = input.heightCm ? Number(input.heightCm) : null;
+    const weight = input.weightKg ? Number(input.weightKg) : null;
+    if ((age !== null && (age < 4 || age > 60)) || (height !== null && (height < 100 || height > 230)) || (weight !== null && (weight < 20 || weight > 150))) {
+      return res.status(400).json({ error: "Check the player's age, height and weight." });
+    }
+    const { data: existing, error: readError } = await supabaseAdmin.from("players")
+      .select("player_id,bdate").eq("player_id", id.data).maybeSingle();
+    if (readError) throw new Error(`Unable to load player: ${readError.message}`);
+    if (!existing) return res.status(404).json({ error: "Player not found." });
+    const [fname, ...lastParts] = input.name.split(/\s+/);
+    const lname = lastParts.join(" ");
+    if (fname.length > 100 || lname.length > 100) return res.status(400).json({ error: "Player first and last names must be 100 characters or fewer." });
+    let birthday = existing.bdate;
+    if (age === null) birthday = null;
+    else if (ageFromBirthday(existing.bdate) !== String(age)) {
+      const date = new Date();
+      date.setUTCFullYear(date.getUTCFullYear() - age);
+      birthday = date.toISOString().slice(0, 10);
+    }
+    const { error } = await supabaseAdmin.from("players").update({
+      fname,
+      lname,
+      bdate: birthday,
+      height,
+      weight,
+      club: input.club || null,
+      position: input.position || null,
+      gender: input.gender || null,
+      dominant_foot: input.dominantFoot || null,
+      notes: input.notes || null,
+    }).eq("player_id", id.data);
+    if (error) throw new Error(`Unable to update player: ${error.message}`);
+    return res.json({ ok: true });
+  } catch (error) { next(error); }
+});
+
 // Players and sessions are currently a shared workspace: all signed-in users
 // can read the common catalogue. Revisit these read scopes if per-user data is
 // introduced later. The service-role client bypasses RLS, so keep this explicit.
@@ -136,7 +239,7 @@ app.get("/api/players-overview", async (req, res, next) => {
     if (!current) return res.status(401).json({ error: "Authentication required." });
 
     const { data: rows, error } = await supabaseAdmin.from("players")
-      .select("player_id,user_id,fname,lname,bdate,height,weight,position,club")
+      .select("player_id,user_id,fname,lname,bdate,height,weight,position,club,gender,image_path,dominant_foot,notes")
       .order("fname", { ascending: true });
     if (error) throw new Error(`Unable to load players: ${error.message}`);
 
@@ -180,10 +283,11 @@ app.get("/api/players-overview", async (req, res, next) => {
       return {
         playerId: row.player_id,
         name: [row.fname, row.lname].filter(Boolean).join(" "),
-        age: row.bdate ? String(Math.max(0, new Date().getFullYear() - new Date(row.bdate).getFullYear())) : "",
+        age: ageFromBirthday(row.bdate),
         heightCm: row.height == null ? "" : String(row.height),
         weightKg: row.weight == null ? "" : String(row.weight),
-        club: row.club ?? "", position: row.position ?? "", dominantFoot: "", notes: "", avatarPath: "",
+        club: row.club ?? "", position: row.position ?? "", gender: row.gender ?? null,
+        dominantFoot: row.dominant_foot ?? "", notes: row.notes ?? "", imagePath: row.image_path ?? null,
         createdAt: "", updatedAt: "", hasProfile: true,
         sessionCount: playerSessions.length, actionCount: playerActions.length,
         lastSessionAt: playerScoreSessions[0]?.createdAt ?? 0,
@@ -212,7 +316,7 @@ app.get("/api/players-overview/:playerId", async (req, res, next) => {
     if (!data) return res.status(404).json({ error: "Player not found." });
 
     const { data: overview, error: overviewError } = await supabaseAdmin.from("players")
-      .select("player_id,user_id,fname,lname,bdate,height,weight,position,club")
+      .select("player_id,user_id,fname,lname,bdate,height,weight,position,club,gender,image_path,dominant_foot,notes")
       .order("fname", { ascending: true });
     if (overviewError) throw new Error(`Unable to load players: ${overviewError.message}`);
     const { data: sessions, error: sessionsError } = await supabaseAdmin.from("sessions")
@@ -266,9 +370,10 @@ app.get("/api/players-overview/:playerId", async (req, res, next) => {
     const squadAverage = { byQuality: [], byAction: squadByAction };
     return res.json({
       playerId: player.player_id, name: [player.fname, player.lname].filter(Boolean).join(" "),
-      age: player.bdate ? String(Math.max(0, new Date().getFullYear() - new Date(player.bdate).getFullYear())) : "",
+      age: ageFromBirthday(player.bdate),
       heightCm: player.height == null ? "" : String(player.height), weightKg: player.weight == null ? "" : String(player.weight),
-      club: player.club ?? "", position: player.position ?? "", dominantFoot: "", notes: "", avatarPath: "",
+      club: player.club ?? "", position: player.position ?? "", gender: player.gender ?? null,
+      dominantFoot: player.dominant_foot ?? "", notes: player.notes ?? "", imagePath: player.image_path ?? null,
       createdAt: "", updatedAt: "", hasProfile: true, sessionCount: ownSessions.length, actionCount: ownActions.length,
       lastSessionAt: sessionsForPlayer[0]?.createdAt ?? 0,
       scores: { playerId: player.player_id, rubricVersion: "database", totalActions: ownActions.length, scoredActions: ownScores.length, byAction, byQuality: [], overall: meanPlayerScore(ownScores), sessions: sessionsForPlayer },
@@ -288,7 +393,7 @@ app.get("/api/sessions-overview", async (req, res, next) => {
     if (error) throw new Error(`Unable to load sessions: ${error.message}`);
     const playerIds = [...new Set((sessions ?? []).flatMap((row) => row.player_id ? [row.player_id] : []))];
     const { data: players, error: playersError } = playerIds.length
-      ? await supabaseAdmin.from("players").select("player_id,fname,lname").in("player_id", playerIds)
+      ? await supabaseAdmin.from("players").select("player_id,fname,lname,gender,image_path").in("player_id", playerIds)
       : { data: [], error: null };
     if (playersError) throw new Error(`Unable to load session players: ${playersError.message}`);
     const sessionIds = (sessions ?? []).map((row) => row.session_id);
@@ -297,6 +402,7 @@ app.get("/api/sessions-overview", async (req, res, next) => {
       : { data: [], error: null };
     if (actionsError) throw new Error(`Unable to load session actions: ${actionsError.message}`);
     const playerNames = new Map((players ?? []).map((row) => [row.player_id, [row.fname, row.lname].filter(Boolean).join(" ")]));
+    const playerImages = new Map((players ?? []).map((row) => [row.player_id, { gender: row.gender, imagePath: row.image_path }]));
     const breakdownBySession = new Map<string, Record<string, number>>();
     for (const action of actions ?? []) {
       const breakdown = breakdownBySession.get(action.session_id) ?? {};
@@ -307,6 +413,8 @@ app.get("/api/sessions-overview", async (req, res, next) => {
       const actionBreakdown = breakdownBySession.get(row.session_id) ?? {};
       return {
         sessionId: row.session_id, playerId: row.player_id ?? "", playerName: row.player_id ? playerNames.get(row.player_id) ?? "" : "",
+        playerGender: row.player_id ? playerImages.get(row.player_id)?.gender ?? null : null,
+        playerImagePath: row.player_id ? playerImages.get(row.player_id)?.imagePath ?? null : null,
         name: row.name, createdAt: Date.parse(row.created_at) || 0,
         actionCount: Object.values(actionBreakdown).reduce((sum, count) => sum + count, 0),
         cameraCount: 0, actionBreakdown, path: row.path, status: row.status,
@@ -550,12 +658,12 @@ app.get("/api/auth/profile", async (req, res, next) => {
     if (!current) return res.status(401).json({ error: "Authentication required." });
     await syncProfile(current.user);
     const { data, error } = await supabaseAdmin.from("users")
-      .select("fname,lname,email,academy,role")
+      .select("fname,lname,email,academy,role,image_path")
       .eq("user_id", current.user.id)
       .single();
     if (error || !data) throw new Error(`Unable to load user profile: ${error?.message ?? "Profile not found"}`);
     const hasPassword = userHasPassword(current.user);
-    return res.json({ profile: { ...data, emailVerified: Boolean(current.user.email_confirmed_at), hasPassword } });
+    return res.json({ profile: { ...data, imagePath: data.image_path, emailVerified: Boolean(current.user.email_confirmed_at), hasPassword } });
   } catch (error) { next(error); }
 });
 
@@ -568,7 +676,7 @@ app.patch("/api/auth/profile", async (req, res, next) => {
     const { data, error } = await supabaseAdmin.from("users")
       .update(profile)
       .eq("user_id", current.user.id)
-      .select("fname,lname,email,academy,role")
+      .select("fname,lname,email,academy,role,image_path")
       .single();
     if (error || !data) throw new Error(`Unable to save user profile: ${error?.message ?? "Profile not found"}`);
 
@@ -577,7 +685,7 @@ app.patch("/api/auth/profile", async (req, res, next) => {
       user_metadata: { ...current.user.user_metadata, ...profile },
     });
     if (metadataError) console.error("Unable to sync profile metadata", { code: metadataError.code, message: metadataError.message });
-    return res.json({ profile: { ...data, emailVerified: Boolean(current.user.email_confirmed_at), hasPassword: userHasPassword(current.user) } });
+    return res.json({ profile: { ...data, imagePath: data.image_path, emailVerified: Boolean(current.user.email_confirmed_at), hasPassword: userHasPassword(current.user) } });
   } catch (error) { next(error); }
 });
 
@@ -610,12 +718,19 @@ app.delete("/api/auth/account", async (req, res, next) => {
     const current = await authenticatedUser(req, res);
     if (!current) return res.status(401).json({ error: "Authentication required." });
     if (req.body?.confirmation !== "DELETE") return res.status(400).json({ error: "Confirm account deletion by typing DELETE." });
+    const { data: imageRow, error: imageReadError } = await supabaseAdmin.from("users")
+      .select("image_path").eq("user_id", current.user.id).maybeSingle();
+    if (imageReadError) throw new Error(`Unable to load account image: ${imageReadError.message}`);
     const { error: authError } = await supabaseAdmin.auth.admin.deleteUser(current.user.id);
     if (authError) return res.status(500).json({ error: "Unable to delete your account. Please try again." });
     const { error: profileError } = await supabaseAdmin.from("users").delete().eq("user_id", current.user.id);
     clearSessionCookies(res);
     clearPasswordRecoveryCookie(res);
     if (profileError) throw new Error(`Account deleted but profile cleanup failed: ${profileError.message}`);
+    if (imageRow?.image_path?.startsWith(`users/${current.user.id}/`)) {
+      const { error: imageError } = await supabaseAdmin.storage.from("profile-images").remove([imageRow.image_path]);
+      if (imageError) console.error("Account deleted but image cleanup failed", imageError);
+    }
     return res.status(204).send();
   } catch (error) { next(error); }
 });
@@ -681,6 +796,9 @@ app.use((_req, res) => res.status(404).json({ error: "Route not found." }));
 app.use((error: unknown, _req: Request, res: Response, _next: NextFunction) => {
   console.error(error);
   if (error instanceof z.ZodError) return res.status(400).json({ error: "Please check the submitted fields." });
+  if (typeof error === "object" && error !== null && "type" in error && error.type === "entity.too.large") {
+    return res.status(413).json({ error: "Profile images must be 4 MB or smaller." });
+  }
   return res.status(500).json({ error: "Something went wrong. Please try again." });
 });
 

src/subscriptions.ts

@@ -54,9 +54,9 @@ async function loadActiveSubscription(userId: string) {
 // Brief, per-user cache shared by polling, media and session requests.
 const accessCache = new Map<string, { value: Awaited<ReturnType<typeof loadActiveSubscription>>; expires: number }>();
 const accessRequests = new Map<string, Promise<Awaited<ReturnType<typeof loadActiveSubscription>>>>();
-export async function activeSubscriptionFor(userId: string) {
+export async function activeSubscriptionFor(userId: string, options: { refresh?: boolean } = {}) {
   const cached = accessCache.get(userId);
-  if (cached && cached.expires > Date.now()) return cached.value;
+  if (!options.refresh && cached && cached.expires > Date.now()) return cached.value;
   const existing = accessRequests.get(userId);
   if (existing) return existing;
   const pending = loadActiveSubscription(userId).then((value) => {