Share player and session browsing

src/analysis.ts

@@ -62,9 +62,9 @@ export function analysisRouter(db: SupabaseClient, secret: string) {
         });
       }
       const { data: player, error: playerError } = await db.from("players")
-        .select("player_id").eq("player_id", input.playerId).maybeSingle();
+        .select("player_id").eq("player_id", input.playerId).eq("user_id", userId).maybeSingle();
       if (playerError) return res.status(503).json({ error: "Unable to verify the selected player." });
-      if (!player) return res.status(404).json({ error: "Choose a player from the available roster before starting analysis." });
+      if (!player) return res.status(404).json({ error: "Choose a player from your own roster before starting analysis." });
       const { data, error } = await db.rpc("begin_analysis", {
         p_session_id: input.clientId, p_user_id: userId,
         p_player_id: input.playerId,

src/profile-images.ts

@@ -2,7 +2,6 @@ import { randomUUID } from "node:crypto";
 import express, { type Express, type Request, type Response } from "express";
 import { z } from "zod";
 import { authenticatedUser } from "./auth.js";
-import { activeSubscriptionFor } from "./subscriptions.js";
 import { supabaseAdmin } from "./supabase.js";
 
 const BUCKET = "profile-images";
@@ -121,12 +120,9 @@ export function registerProfileImageRoutes(app: Express) {
       if (!current) return res.status(401).json({ error: "Authentication required." });
       const id = playerIdSchema.safeParse(req.params.playerId);
       if (!id.success) return res.status(404).json({ error: "Player not found." });
-      const { data, error } = await supabaseAdmin.from("players").select("user_id,image_path").eq("player_id", id.data).maybeSingle();
+      const { data, error } = await supabaseAdmin.from("players").select("image_path").eq("player_id", id.data).maybeSingle();
       if (error) throw new Error(`Unable to load player image: ${error.message}`);
       if (!data) return res.status(404).json({ error: "Player not found." });
-      if (data.user_id !== current.user.id && !await activeSubscriptionFor(current.user.id, { refresh: true })) {
-        return res.status(403).json({ error: "An active subscription is required to view shared player profiles.", code: "subscription_required" });
-      }
       return await sendImage(res, safePreviousPath("players", id.data, data?.image_path));
     } catch (error) { next(error); }
   });

src/server.ts

@@ -202,13 +202,13 @@ app.get("/api/owned-players", async (req, res, next) => {
   try {
     const current = await authenticatedUser(req, res);
     if (!current) return res.status(401).json({ error: "Authentication required." });
-    const subscribed = Boolean(await activeSubscriptionFor(current.user.id, { refresh: true }));
     const { data, error } = await supabaseAdmin.from("players")
       .select("player_id,user_id,fname,lname,position,club,gender,image_path")
       .order("fname", { ascending: true });
     if (error) throw new Error(`Unable to load players: ${error.message}`);
-    const visiblePlayers = subscribed ? (data ?? []) : (data ?? []).filter((player) => player.user_id === current.user.id);
-    return res.json({ players: visiblePlayers.map((player) => ({
+    // Analysis player choices stay scoped to the signed-in user's own roster.
+    const ownedPlayers = (data ?? []).filter((player) => player.user_id === current.user.id);
+    return res.json({ players: ownedPlayers.map((player) => ({
       playerId: player.player_id,
       name: [player.fname, player.lname].filter(Boolean).join(" "),
       isOwner: player.user_id === current.user.id,
@@ -312,24 +312,22 @@ app.put("/api/players/:playerId", async (req, res, next) => {
   } catch (error) { next(error); }
 });
 
-// Player management and analysis choices are scoped to the signed-in owner.
+// Roster overview is shared for viewing; player writes and analysis choices
+// remain limited to the signed-in player's own roster.
 app.get("/api/players-overview", async (req, res, next) => {
   try {
     const current = await authenticatedUser(req, res);
     if (!current) return res.status(401).json({ error: "Authentication required." });
 
-    const subscription = await activeSubscriptionFor(current.user.id, { refresh: true });
-    let playersQuery = supabaseAdmin.from("players")
+    const playersQuery = supabaseAdmin.from("players")
       .select("player_id,user_id,fname,lname,bdate,height,weight,position,club,gender,image_path")
       .order("fname", { ascending: true });
-    if (!subscription) playersQuery = playersQuery.eq("user_id", current.user.id);
     const { data: rows, error } = await playersQuery;
     if (error) throw new Error(`Unable to load players: ${error.message}`);
 
     const playerIds = (rows ?? []).map((row) => row.player_id);
     let sessionsQuery = supabaseAdmin.from("sessions").select("session_id,player_id,name,created_at")
       .in("player_id", playerIds).order("created_at", { ascending: false });
-    if (!subscription) sessionsQuery = sessionsQuery.eq("user_id", current.user.id);
     const { data: sessions, error: sessionsError } = playerIds.length
       ? await sessionsQuery
       : { data: [], error: null };
@@ -396,22 +394,18 @@ app.get("/api/players-overview/:playerId", async (req, res, next) => {
     if (!current) return res.status(401).json({ error: "Authentication required." });
     const playerId = z.string().uuid().safeParse(req.params.playerId);
     if (!playerId.success) return res.status(404).json({ error: "Player not found." });
-    const subscription = await activeSubscriptionFor(current.user.id, { refresh: true });
-    let playerQuery = supabaseAdmin.from("players").select("player_id,user_id")
+    const playerQuery = supabaseAdmin.from("players").select("player_id,user_id")
       .eq("player_id", playerId.data);
-    if (!subscription) playerQuery = playerQuery.eq("user_id", current.user.id);
     const { data, error } = await playerQuery.maybeSingle();
     if (error) throw new Error(`Unable to load player: ${error.message}`);
     if (!data) return res.status(404).json({ error: "Player not found." });
 
-    let overviewQuery = supabaseAdmin.from("players")
+    const overviewQuery = supabaseAdmin.from("players")
       .select("player_id,user_id,fname,lname,bdate,height,weight,position,club,gender,image_path")
       .order("fname", { ascending: true });
-    if (!subscription) overviewQuery = overviewQuery.eq("user_id", current.user.id);
     const { data: overview, error: overviewError } = await overviewQuery;
     if (overviewError) throw new Error(`Unable to load players: ${overviewError.message}`);
-    let sessionsQuery = supabaseAdmin.from("sessions").select("session_id,player_id,name,created_at");
-    if (!subscription) sessionsQuery = sessionsQuery.eq("user_id", current.user.id);
+    const sessionsQuery = supabaseAdmin.from("sessions").select("session_id,player_id,name,created_at,user_id");
     const { data: sessions, error: sessionsError } = await sessionsQuery;
     if (sessionsError) throw new Error(`Unable to load sessions: ${sessionsError.message}`);
     const { data: actions, error: actionsError } = (sessions ?? []).length
@@ -447,8 +441,7 @@ app.get("/api/players-overview/:playerId", async (req, res, next) => {
       const values = sessionActions.map((action) => scoreMap.get(action.action_id)).filter((score): score is number => score != null && Number.isFinite(score));
       return { sessionId: row.session_id, createdAt: Date.parse(row.created_at) || 0, score: meanPlayerScore(values), actionCount: sessionActions.length, scoredCount: values.length };
     });
-    let peersQuery = supabaseAdmin.from("players").select("player_id");
-    if (!subscription) peersQuery = peersQuery.eq("user_id", current.user.id);
+    const peersQuery = supabaseAdmin.from("players").select("player_id");
     const { data: peers, error: peersError } = await peersQuery;
     if (peersError) throw new Error(`Unable to load roster: ${peersError.message}`);
     const playerScores = new Map<string, number[]>();
@@ -482,11 +475,9 @@ app.get("/api/sessions-overview", async (req, res, next) => {
     const current = await authenticatedUser(req, res);
     if (!current) return res.status(401).json({ error: "Authentication required." });
 
-    const subscription = await activeSubscriptionFor(current.user.id, { refresh: true });
-    let sessionsQuery = supabaseAdmin.from("sessions")
+    const sessionsQuery = supabaseAdmin.from("sessions")
       .select("session_id,player_id,user_id,name,path,created_at,status")
       .order("created_at", { ascending: false });
-    if (!subscription) sessionsQuery = sessionsQuery.eq("user_id", current.user.id);
     const { data: sessions, error } = await sessionsQuery;
     if (error) throw new Error(`Unable to load sessions: ${error.message}`);
     const playerIds = [...new Set((sessions ?? []).flatMap((row) => row.player_id ? [row.player_id] : []))];