Update app/routes.py

app/routes.py

@@ -590,3 +590,120 @@ def ping_db():
     except Exception as e:
         return f" DB Error: {e}"
 
+
+
+
+@auth.route('/settings')
+def settings():
+    user, redirect_response = get_current_user()
+    if redirect_response:
+        return redirect_response
+
+    return render_template('settings.html', user=user)
+
+
+@auth.route('/update_profile', methods=['POST'])
+def update_profile():
+    user, redirect_response = get_current_user()
+    if redirect_response:
+        return redirect_response
+
+    new_email = request.form.get('email')
+    # username = request.form.get('username') # Username is read-only, not updated here
+
+    if not new_email:
+        flash('Email cannot be empty.', 'error')
+        return redirect(url_for('auth.settings'))
+
+    # Update email in Supabase. Assuming 'users' table or Supabase Auth update.
+    # For Supabase Auth, you'd use the client library or the /auth/v1/users endpoint
+    # For a custom 'users' table, it would be a PATCH request:
+    update_payload = {"email": new_email}
+    update_res = requests.patch(
+        f"{SUPABASE_URL}/rest/v1/users?id=eq.{user['id']}",
+        headers=HEADERS,
+        json=update_payload
+    )
+
+    if update_res.status_code == 200 or update_res.status_code == 204: # 200 OK or 204 No Content
+        flash('Profile updated successfully!', 'success')
+    else:
+        flash(f'Failed to update profile. Error: {update_res.text}', 'error')
+
+    return redirect(url_for('auth.settings'))
+
+
+@auth.route('/change_password', methods=['POST'])
+def change_password():
+    user, redirect_response = get_current_user()
+    if redirect_response:
+        return redirect_response
+
+    current_password = request.form.get('current_password')
+    new_password = request.form.get('new_password')
+    confirm_new_password = request.form.get('confirm_new_password')
+
+    if not current_password or not new_password or not confirm_new_password:
+        flash('All password fields are required.', 'error')
+        return redirect(url_for('auth.settings'))
+
+    if new_password != confirm_new_password:
+        flash('New password and confirmation do not match.', 'error')
+        return redirect(url_for('auth.settings'))
+
+    # In a real app, you would verify current_password first:
+    # 1. Fetch user from Supabase Auth based on their email or ID.
+    # 2. Use `check_password_hash(user.hashed_password, current_password)`
+    #    If you're using Supabase's built-in auth, you'd typically re-authenticate
+    #    or use their client's `updateUser` function which handles password changes.
+    #    Direct patching to a 'users' table password field is generally insecure
+    #    unless you are doing the hashing yourself.
+
+    # Example using a mock check for demonstration
+    if current_password != 'TestPass123': # Replace with actual password verification
+        flash('Incorrect current password.', 'error')
+        return redirect(url_for('auth.settings'))
+
+    # Update password in Supabase Auth (conceptual)
+    # This typically involves a call to Supabase's auth client or API endpoint for password change.
+    # E.g., `supabase.auth.updateUser({ password: new_password })`
+    # For direct database table if not using Supabase Auth for passwords:
+    hashed_new_password = generate_password_hash(new_password)
+    update_payload = {"password_hash": hashed_new_password} # Assuming a column for hashed password
+    update_res = requests.patch(
+        f"{SUPABASE_URL}/rest/v1/users?id=eq.{user['id']}",
+        headers=HEADERS,
+        json=update_payload
+    )
+    if update_res.status_code == 200 or update_res.status_code == 204:
+        flash('Password changed successfully!', 'success')
+    else:
+        flash(f'Failed to change password. Error: {update_res.text}', 'error')
+
+    flash('Password change simulated successfully!', 'success') # Placeholder
+    return redirect(url_for('auth.settings'))
+
+
+@auth.route('/delete_account', methods=['POST'])
+def delete_account():
+    user, redirect_response = get_current_user()
+    if redirect_response:
+        return redirect_response
+
+    # In a real app, confirm with a password or MFA
+    # Then delete the user from Supabase Auth and any related tables (via RLS or triggers)
+    # Example for deleting from a custom 'users' table:
+    delete_res = requests.delete(
+        f"{SUPABASE_URL}/rest/v1/users?id=eq.{user['id']}",
+        headers=HEADERS
+    )
+
+    if delete_res.status_code == 204: # 204 No Content for successful delete
+        session.pop('user_id', None) # Clear session after account deletion
+        flash('Your account has been successfully deleted.', 'success')
+        return redirect(url_for('auth.login'))
+    else:
+        flash(f'Failed to delete account. Error: {delete_res.text}', 'error')
+        return redirect(url_for('auth.settings'))
+
+