Update apps/aura_measure.js

apps/aura_measure.js

@@ -8,9 +8,10 @@ import { supabase } from '../config/supabaseClient.js';
 const router = express.Router();
 
 const TEMP_DIR = path.join(process.cwd(), 'tmp_scans');
-const tempScans = new Map(); 
+const tempScans = new Map();
 fs.mkdir(TEMP_DIR, { recursive: true }).catch(console.error);
 
+// Clean up expired temp scans every 5 minutes
 setInterval(async () => {
     const now = Date.now();
     for (const [tempId, data] of tempScans.entries()) {
@@ -22,20 +23,23 @@ setInterval(async () => {
 }, 5 * 60 * 1000);
 
 const cache = {
-    feed_page_1: { data: null, expires: 0 },
-    leaderboard_all: { data: null, expires: 0 },
-    leaderboard_session: { data: null, expires: 0 },
-    leaderboard_grade: { data: null, expires: 0 },
-    challenges_active: { data: null, expires: 0 }
+    feed_page_1:        { data: null, expires: 0 },
+    leaderboard_all:    { data: null, expires: 0 },
+    leaderboard_session:{ data: null, expires: 0 },
+    leaderboard_grade:  { data: null, expires: 0 },
+    challenges_active:  { data: null, expires: 0 }
 };
-const CACHE_TTL = 60 * 1000; 
+const CACHE_TTL = 60 * 1000; // 1 minute
 
 function invalidateCaches(type) {
-    if (type === 'feed') cache.feed_page_1.expires = 0;
+    if (type === 'feed') {
+        cache.feed_page_1.expires = 0;
+        cache.feed_page_1.data = null;
+    }
     if (type === 'leaderboard') {
-        cache.leaderboard_all.expires = 0;
-        cache.leaderboard_session.expires = 0;
-        cache.leaderboard_grade.expires = 0;
+        cache.leaderboard_all.expires = 0;     cache.leaderboard_all.data = null;
+        cache.leaderboard_session.expires = 0;  cache.leaderboard_session.data = null;
+        cache.leaderboard_grade.expires = 0;    cache.leaderboard_grade.data = null;
     }
 }
 
@@ -68,28 +72,55 @@ Image 1: The Reference Image
 Image 2: The Submission
 Evaluate Image 2 strictly based on how well it matched the vibe and quality of Image 1. ${BASE_RULES}`;
 
+// ─── POST /analyze ─────────────────────────────────────────────────────────────
+
 router.post('/analyze', async (req, res) => {
     try {
-        const { device_id, username, avatar, media_base64, context_type = 'standalone', context_id = null, reference_data = null } = req.body;
-        if (!media_base64 || !device_id) throw new Error("Missing media or device_id.");
+        const {
+            device_id,
+            username,
+            avatar,
+            media_base64,
+            context_type = 'standalone',
+            context_id = null,
+            reference_data = null
+        } = req.body;
+
+        if (!media_base64 || !device_id) {
+            return res.status(400).json({ success: false, error: 'Missing media or device_id.' });
+        }
 
-        let { data: profile } = await supabase
+        // Upsert profile
+        const { data: profile, error: profileError } = await supabase
             .from('aura_profiles')
             .upsert({ device_id, username, avatar }, { onConflict: 'device_id' })
-            .select('id').single();
+            .select('id')
+            .single();
+
+        if (profileError) throw profileError;
+
+        // Get or create active session
+        let { data: session } = await supabase
+            .from('aura_sessions')
+            .select('id')
+            .eq('is_active', true)
+            .maybeSingle();
 
-        // FIX: Used maybeSingle() instead of single() to prevent PGRST116 crashes
-        let { data: session } = await supabase.from('aura_sessions').select('id').eq('is_active', true).maybeSingle();
         if (!session) {
             const start = new Date();
             const end = new Date(start.getTime() + (3 * 24 * 60 * 60 * 1000));
-            const { data: newSession } = await supabase.from('aura_sessions')
-                .insert({ start_time: start, end_time: end, is_active: true }).select('id').single();
+            const { data: newSession, error: sessionError } = await supabase
+                .from('aura_sessions')
+                .insert({ start_time: start, end_time: end, is_active: true })
+                .select('id')
+                .single();
+            if (sessionError) throw sessionError;
             session = newSession;
         }
 
+        // Build prompt
         let systemPrompt = AURA_PROMPT_STANDALONE;
-        let promptText = "Analyze this image and calculate my Aura. Return JSON.";
+        let promptText = 'Analyze this image and calculate my Aura. Return JSON.';
         let imagesToProcess = [media_base64];
 
         if ((context_type === 'challenge' || context_type === 'thread') && reference_data) {
@@ -99,186 +130,410 @@ router.post('/analyze', async (req, res) => {
         }
 
         const aiResult = await generateCompletion({
-            model: "qwen-vl-max", 
+            model: 'qwen-vl-max',
             prompt: promptText,
             system_prompt: systemPrompt,
-            images: imagesToProcess 
+            images: imagesToProcess
         });
 
         if (!aiResult.success) throw new Error(aiResult.error);
-        const cleanJsonStr = aiResult.data.replace(/```json/gi, '').replace(/```/gi, '').trim();
-        const parsedData = JSON.parse(cleanJsonStr);
 
-        await supabase.rpc('aura_increment_points', {
-            p_user_id: profile.id, p_session_id: session.id, p_score_to_add: parsedData.score, p_is_challenge: context_type === 'challenge'
+        const cleanJsonStr = aiResult.data
+            .replace(/```json/gi, '')
+            .replace(/```/gi, '')
+            .trim();
+
+        let parsedData;
+        try {
+            parsedData = JSON.parse(cleanJsonStr);
+        } catch (parseErr) {
+            throw new Error(`AI returned invalid JSON: ${cleanJsonStr.substring(0, 100)}`);
+        }
+
+        if (typeof parsedData.score !== 'number') {
+            throw new Error('AI response missing valid score field.');
+        }
+
+        // Increment aura points via RPC
+        const { error: rpcError } = await supabase.rpc('aura_increment_points', {
+            p_user_id: profile.id,
+            p_session_id: session.id,
+            p_score_to_add: parsedData.score,
+            p_is_challenge: context_type === 'challenge'
         });
+        if (rpcError) throw rpcError;
 
+        // Store temp scan for optional publish
         const tempId = crypto.randomUUID();
         const filepath = path.join(TEMP_DIR, `${tempId}.jpg`);
         await fs.writeFile(filepath, Buffer.from(media_base64, 'base64'));
 
         tempScans.set(tempId, {
-            filepath, timestamp: Date.now(), user_id: profile.id, session_id: session.id,
-            score: parsedData.score, analysis: parsedData.analysis_markdown, context_type, context_id
+            filepath,
+            timestamp: Date.now(),
+            user_id: profile.id,
+            session_id: session.id,
+            score: parsedData.score,
+            analysis: parsedData.analysis_markdown,
+            context_type,
+            context_id
         });
 
         invalidateCaches('leaderboard');
-        res.json({ success: true, score: parsedData.score, analysis: parsedData.analysis_markdown, temp_scan_id: tempId });
+
+        res.json({
+            success: true,
+            score: parsedData.score,
+            analysis: parsedData.analysis_markdown,
+            temp_scan_id: tempId
+        });
+
     } catch (err) {
+        console.error('[Analyze] Error:', err);
         res.status(500).json({ success: false, error: err.message });
     }
 });
 
+// ─── POST /publish ─────────────────────────────────────────────────────────────
+
 router.post('/publish', async (req, res) => {
     try {
         const { temp_scan_id } = req.body;
-        if (!temp_scan_id || !tempScans.has(temp_scan_id)) return res.status(400).json({ success: false, error: "Scan expired." });
+
+        if (!temp_scan_id || !tempScans.has(temp_scan_id)) {
+            return res.status(400).json({ success: false, error: 'Scan expired or not found.' });
+        }
 
         const scanData = tempScans.get(temp_scan_id);
         const fileName = `${scanData.user_id}/${Date.now()}_${temp_scan_id}.jpg`;
         const fileBuffer = await fs.readFile(scanData.filepath);
 
-        await supabase.storage.from('aura_media').upload(fileName, fileBuffer, { contentType: 'image/jpeg' });
-        const { data: publicUrlData } = supabase.storage.from('aura_media').getPublicUrl(fileName);
+        const { error: uploadError } = await supabase.storage
+            .from('aura_media')
+            .upload(fileName, fileBuffer, { contentType: 'image/jpeg' });
 
-        await supabase.from('aura_public_scans').insert({
-            user_id: scanData.user_id, session_id: scanData.session_id, image_url: publicUrlData.publicUrl,
-            score: scanData.score, analysis_json: scanData.analysis, context_type: scanData.context_type, context_id: scanData.context_id
-        });
+        if (uploadError) throw uploadError;
+
+        const { data: publicUrlData } = supabase.storage
+            .from('aura_media')
+            .getPublicUrl(fileName);
+
+        const { error: insertError } = await supabase
+            .from('aura_public_scans')
+            .insert({
+                user_id: scanData.user_id,
+                session_id: scanData.session_id,
+                image_url: publicUrlData.publicUrl,
+                score: scanData.score,
+                analysis_json: scanData.analysis,
+                context_type: scanData.context_type,
+                context_id: scanData.context_id
+            });
+
+        if (insertError) throw insertError;
 
         await fs.unlink(scanData.filepath);
         tempScans.delete(temp_scan_id);
         invalidateCaches('feed');
-        res.json({ success: true, message: "Published." });
+
+        res.json({ success: true, message: 'Published.' });
+
     } catch (err) {
+        console.error('[Publish] Error:', err);
         res.status(500).json({ success: false, error: err.message });
     }
 });
 
+// ─── GET /feed ─────────────────────────────────────────────────────────────────
+
 router.get('/feed', async (req, res) => {
     try {
-        const { cursor, limit = 20 } = req.query; 
+        const { cursor, limit = 20 } = req.query;
+        const parsedLimit = parseInt(limit, 10);
+
+        // Serve cache only for first page
         if (!cursor && cache.feed_page_1.expires > Date.now() && cache.feed_page_1.data) {
             return res.json({ success: true, data: cache.feed_page_1.data, cached: true });
         }
 
-        let query = supabase.from('aura_public_scans')
-            .select(`id, image_url, score, context_type, context_id, created_at, aura_profiles ( username, avatar, current_grade )`)
-            .order('created_at', { ascending: false }).limit(parseInt(limit));
+        let query = supabase
+            .from('aura_public_scans')
+            .select(`
+                id,
+                image_url,
+                score,
+                context_type,
+                context_id,
+                created_at,
+                aura_profiles ( username, avatar, current_grade )
+            `)
+            .order('created_at', { ascending: false })
+            .limit(parsedLimit);
+
+        if (cursor) {
+            query = query.lt('created_at', cursor);
+        }
 
-        if (cursor) query = query.lt('created_at', cursor); 
         const { data, error } = await query;
         if (error) throw error;
 
-        const nextCursor = data.length === parseInt(limit) ? data[data.length - 1].created_at : null;
+        const nextCursor = data.length === parsedLimit
+            ? data[data.length - 1].created_at
+            : null;
+
         const responseData = { items: data, nextCursor };
 
-        if (!cursor) cache.feed_page_1 = { data: responseData, expires: Date.now() + CACHE_TTL };
+        if (!cursor) {
+            cache.feed_page_1 = { data: responseData, expires: Date.now() + CACHE_TTL };
+        }
+
         res.json({ success: true, data: responseData });
+
     } catch (err) {
+        console.error('[Feed] Error:', err);
         res.status(500).json({ success: false, error: err.message });
     }
 });
 
+// ─── GET /leaderboard ──────────────────────────────────────────────────────────
+
 router.get('/leaderboard', async (req, res) => {
     try {
-        const { view = 'all_time' } = req.query; 
+        const { view = 'all_time' } = req.query;
+
+        // Validate view param to prevent cache poisoning
+        const validViews = ['all_time', 'session', 'grade'];
+        if (!validViews.includes(view)) {
+            return res.status(400).json({ success: false, error: 'Invalid view parameter.' });
+        }
+
         const cacheKey = `leaderboard_${view}`;
+
         if (cache[cacheKey]?.expires > Date.now() && cache[cacheKey]?.data) {
             return res.json({ success: true, data: cache[cacheKey].data, cached: true });
         }
 
         let data, error;
+
         if (view === 'all_time') {
-            ({ data, error } = await supabase.from('aura_profiles')
-                .select('id, username, avatar, current_grade, cumulative_aura as score')
-                .order('cumulative_aura', { ascending: false }).limit(50));
-        } 
+            // NOTE: Supabase does not support "col as alias" in .select() strings.
+            // Fetch raw column then map to { score } client-side.
+            ({ data, error } = await supabase
+                .from('aura_profiles')
+                .select('id, username, avatar, current_grade, cumulative_aura')
+                .order('cumulative_aura', { ascending: false })
+                .limit(50));
+
+            if (data) {
+                data = data.map(row => ({
+                    id: row.id,
+                    username: row.username,
+                    avatar: row.avatar,
+                    current_grade: row.current_grade,
+                    score: row.cumulative_aura ?? 0
+                }));
+            }
+        }
         else if (view === 'session') {
-            // FIX: maybeSingle()
-            const { data: activeSession } = await supabase.from('aura_sessions').select('id').eq('is_active', true).maybeSingle();
-            if (!activeSession) return res.json({ success: true, data: [] });
-
-            ({ data, error } = await supabase.from('aura_user_session_stats')
-                .select(`session_aura as score, aura_profiles ( id, username, avatar, current_grade )`)
-                .eq('session_id', activeSession.id).order('session_aura', { ascending: false }).limit(50));
-            if (data) data = data.map(d => ({ ...d.aura_profiles, score: d.score }));
+            const { data: activeSession } = await supabase
+                .from('aura_sessions')
+                .select('id')
+                .eq('is_active', true)
+                .maybeSingle();
+
+            if (!activeSession) {
+                return res.json({ success: true, data: [] });
+            }
+
+            ({ data, error } = await supabase
+                .from('aura_user_session_stats')
+                .select('session_aura, aura_profiles ( id, username, avatar, current_grade )')
+                .eq('session_id', activeSession.id)
+                .order('session_aura', { ascending: false })
+                .limit(50));
+
+            if (data) {
+                data = data.map(d => ({
+                    id: d.aura_profiles?.id,
+                    username: d.aura_profiles?.username,
+                    avatar: d.aura_profiles?.avatar,
+                    current_grade: d.aura_profiles?.current_grade,
+                    score: d.session_aura ?? 0
+                }));
+            }
         }
         else if (view === 'grade') {
-            ({ data, error } = await supabase.from('aura_profiles')
-                .select('id, username, avatar, current_grade, cumulative_aura as score')
-                .order('current_grade', { ascending: false }).order('cumulative_aura', { ascending: false }).limit(50));
+            ({ data, error } = await supabase
+                .from('aura_profiles')
+                .select('id, username, avatar, current_grade, cumulative_aura')
+                .order('current_grade', { ascending: false })
+                .order('cumulative_aura', { ascending: false })
+                .limit(50));
+
+            if (data) {
+                data = data.map(row => ({
+                    id: row.id,
+                    username: row.username,
+                    avatar: row.avatar,
+                    current_grade: row.current_grade,
+                    score: row.cumulative_aura ?? 0
+                }));
+            }
         }
 
         if (error) throw error;
+
         cache[cacheKey] = { data, expires: Date.now() + CACHE_TTL };
         res.json({ success: true, data });
+
     } catch (err) {
+        console.error('[Leaderboard] Error:', err);
         res.status(500).json({ success: false, error: err.message });
     }
 });
 
+// ─── GET /challenges ───────────────────────────────────────────────────────────
+
 router.get('/challenges', async (req, res) => {
     try {
-        const { status = 'active' } = req.query; 
-        if (status === 'active' && cache.challenges_active.expires > Date.now()) {
-            return res.json({ success: true, data: cache.challenges_active.data, cached: true });
+        const { status = 'active' } = req.query;
+
+        // Fix: guard both expires AND data before serving cache
+        if (
+            status === 'active' &&
+            cache.challenges_active.expires > Date.now() &&
+            cache.challenges_active.data
+        ) {
+            return res.json({
+                success: true,
+                data: cache.challenges_active.data,
+                cached: true
+            });
         }
 
-        const { data: session } = await supabase.from('aura_sessions').select('id').eq('is_active', true).maybeSingle();
-        let query = supabase.from('aura_challenges').select('*').order('created_at', { ascending: false });
-        if (status === 'active' && session) query = query.eq('session_id', session.id);
-        if (status === 'archive' && session) query = query.neq('session_id', session.id);
+        const { data: session } = await supabase
+            .from('aura_sessions')
+            .select('id')
+            .eq('is_active', true)
+            .maybeSingle();
+
+        let query = supabase
+            .from('aura_challenges')
+            .select('*')
+            .order('created_at', { ascending: false });
+
+        if (status === 'active' && session) {
+            query = query.eq('session_id', session.id);
+        } else if (status === 'archive' && session) {
+            query = query.neq('session_id', session.id);
+        }
 
         const { data, error } = await query;
         if (error) throw error;
 
-        if (status === 'active') cache.challenges_active = { data, expires: Date.now() + CACHE_TTL };
+        if (status === 'active') {
+            cache.challenges_active = { data, expires: Date.now() + CACHE_TTL };
+        }
+
         res.json({ success: true, data });
+
     } catch (err) {
+        console.error('[Challenges] Error:', err);
         res.status(500).json({ success: false, error: err.message });
     }
 });
 
+// ─── GET /threads/:context_id ──────────────────────────────────────────────────
+
 router.get('/threads/:context_id', async (req, res) => {
     try {
         const { context_id } = req.params;
         const { limit = 20, offset = 0 } = req.query;
-        const { data, error } = await supabase.from('aura_thread_summaries')
-            .select(`collection_aura, submission_count, top_image_url, aura_profiles ( id, username, avatar, current_grade )`)
-            .eq('context_id', context_id).order('collection_aura', { ascending: false }).range(offset, parseInt(offset) + parseInt(limit) - 1);
+        const parsedLimit = parseInt(limit, 10);
+        const parsedOffset = parseInt(offset, 10);
+
+        const { data, error } = await supabase
+            .from('aura_thread_summaries')
+            .select(`
+                collection_aura,
+                submission_count,
+                top_image_url,
+                aura_profiles ( id, username, avatar, current_grade )
+            `)
+            .eq('context_id', context_id)
+            .order('collection_aura', { ascending: false })
+            .range(parsedOffset, parsedOffset + parsedLimit - 1);
 
         if (error) throw error;
-        const items = data.map(d => ({ ...d.aura_profiles, collection_aura: d.collection_aura, submission_count: d.submission_count, top_image_url: d.top_image_url }));
+
+        const items = data.map(d => ({
+            ...d.aura_profiles,
+            collection_aura: d.collection_aura,
+            submission_count: d.submission_count,
+            top_image_url: d.top_image_url
+        }));
+
         res.json({ success: true, data: items });
+
     } catch (err) {
+        console.error('[Threads] Error:', err);
         res.status(500).json({ success: false, error: err.message });
     }
 });
 
+// ─── POST /tag ─────────────────────────────────────────────────────────────────
+
 router.post('/tag', async (req, res) => {
     try {
         const { tagger_scan_id, tagged_scan_id } = req.body;
-        const { error } = await supabase.from('aura_thread_tags').insert({ tagger_scan_id, tagged_scan_id });
-        if (error && error.code !== '23505') throw error; 
-        res.json({ success: true, message: "Tagged successfully" });
+
+        if (!tagger_scan_id || !tagged_scan_id) {
+            return res.status(400).json({ success: false, error: 'Missing scan IDs.' });
+        }
+
+        const { error } = await supabase
+            .from('aura_thread_tags')
+            .insert({ tagger_scan_id, tagged_scan_id });
+
+        // Ignore duplicate tag (unique constraint violation)
+        if (error && error.code !== '23505') throw error;
+
+        res.json({ success: true, message: 'Tagged successfully.' });
+
     } catch (err) {
+        console.error('[Tag] Error:', err);
         res.status(500).json({ success: false, error: err.message });
     }
 });
 
+// ─── GET /profile/:username ────────────────────────────────────────────────────
+
 router.get('/profile/:username', async (req, res) => {
     try {
         const { username } = req.params;
-        const { data: profile, error: profErr } = await supabase.from('aura_profiles')
-            .select('id, username, avatar, current_grade, cumulative_aura').eq('username', username).single();
-            
-        if (profErr || !profile) throw new Error("Sorcerer not found.");
-        const { data: scans, error: scansErr } = await supabase.from('aura_public_scans')
-            .select('id, image_url, score, context_type, created_at').eq('user_id', profile.id).order('created_at', { ascending: false });
+
+        const { data: profile, error: profErr } = await supabase
+            .from('aura_profiles')
+            .select('id, username, avatar, current_grade, cumulative_aura')
+            .eq('username', username)
+            .single();
+
+        if (profErr || !profile) {
+            return res.status(404).json({ success: false, error: 'Sorcerer not found.' });
+        }
+
+        const { data: scans, error: scansErr } = await supabase
+            .from('aura_public_scans')
+            .select('id, image_url, score, context_type, created_at')
+            .eq('user_id', profile.id)
+            .order('created_at', { ascending: false });
+
+        if (scansErr) throw scansErr;
 
         res.json({ success: true, data: { profile, scans } });
+
     } catch (err) {
+        console.error('[Profile] Error:', err);
         res.status(500).json({ success: false, error: err.message });
     }
 });