H

app/api/profile.py

@@ -21,6 +21,10 @@ class AvatarUpdateResponse(BaseModel):
     avatar_url: str
 
 
+class AvatarUrlPayload(BaseModel):
+    url: str
+
+
 @router.get("", response_model=AvatarResponse)
 async def get_profile(
     user: dict = Depends(get_current_user),
@@ -48,6 +52,29 @@ async def get_profile(
     )
 
 
+@router.post("/avatar-url", response_model=AvatarUpdateResponse)
+async def set_avatar_url(
+    payload: AvatarUrlPayload,
+    user: dict = Depends(get_current_user),
+    request: Request = None,
+):
+    """Save an external avatar URL (e.g. from Google OAuth) to the user's profile."""
+    user_id = user["user_id"]
+    user_token = extract_token_from_request(request) or SUPABASE_ANON_KEY
+    update_url = f"{SUPABASE_URL}/rest/v1/users?id=eq.{user_id}"
+    async with httpx.AsyncClient(timeout=15) as client:
+        await client.patch(
+            update_url,
+            json={"avatar_url": payload.url},
+            headers={
+                "apikey": SUPABASE_ANON_KEY,
+                "Authorization": f"Bearer {user_token}",
+                "Content-Type": "application/json",
+            },
+        )
+    return AvatarUpdateResponse(avatar_url=payload.url)
+
+
 @router.post("/avatar", response_model=AvatarUpdateResponse)
 async def upload_avatar(
     file: UploadFile = File(...),
@@ -125,3 +152,39 @@ async def upload_avatar(
         pass  # Non-critical; the file is already uploaded
 
     return AvatarUpdateResponse(avatar_url=public_url)
+
+
+@router.get("/public/{user_id}")
+async def get_public_profile(user_id: str):
+    """Fetch a public user profile (no auth required)."""
+    headers = {
+        "apikey": SUPABASE_ANON_KEY,
+        "Authorization": f"Bearer {SUPABASE_ANON_KEY}",
+        "Content-Type": "application/json",
+    }
+    async with httpx.AsyncClient(timeout=15) as client:
+        url = f"{SUPABASE_URL}/rest/v1/leaderboard?id=eq.{user_id}&select=id,name,xp,completed_trainings,avatar_url&limit=1"
+        resp = await client.get(url, headers=headers)
+        user_data = {}
+        if resp.status_code == 200 and resp.json():
+            user_data = resp.json()[0]
+        else:
+            url2 = f"{SUPABASE_URL}/rest/v1/users?id=eq.{user_id}&select=id,name,avatar_url&limit=1"
+            resp2 = await client.get(url2, headers=headers)
+            if resp2.status_code == 200 and resp2.json():
+                u = resp2.json()[0]
+                user_data = {**u, "xp": 0, "completed_trainings": 0}
+        cert_url = f"{SUPABASE_URL}/rest/v1/certificates?user_id=eq.{user_id}&select=id,category,issue_date,verify_code,title&order=issue_date.desc"
+        cert_resp = await client.get(cert_url, headers=headers)
+        certificates = cert_resp.json() if cert_resp.status_code == 200 else []
+    return {
+        "user": {
+            "id": user_data.get("id", user_id),
+            "name": user_data.get("name") or "مستخدم",
+            "xp": int(user_data.get("xp") or 0),
+            "completed_trainings": int(user_data.get("completed_trainings") or 0),
+            "avatar_url": user_data.get("avatar_url") or "",
+        },
+        "certificates": certificates,
+        "total_certificates": len(certificates),
+    }