Merge S10 (a1): public ledger profiles v1

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

# Conflicts:
#	BUILD-STATE.md
#	CLAUDE.md

src/routes/profiles.js

@@ -0,0 +1,134 @@
+'use strict';
+
+/**
+ * /api/profiles — public ledger profiles v1 (A1 Session 10).
+ *
+ * Stage-3 seed: a user claims a handle and publishes their ENTIRE settled
+ * ledger record — wins and misses, nothing curated. Strava for betting.
+ *
+ *   GET  /me       (auth)   — own public_profiles row (or null).
+ *   POST /me       (auth)   — upsert own { handle, published }. Handle must
+ *                             match ^[a-z0-9_]{3,20}$; a handle owned by
+ *                             another user → 409. Service-role write only
+ *                             (the table has no client write policies).
+ *   GET  /:handle  (public) — the published record: the user-scoped 30d
+ *                             aggregate (same n≥20 gate as the model record)
+ *                             + settled rows, newest 50, same columns as
+ *                             /api/ledger.
+ *
+ * PRIVACY: PRIVATE BY DEFAULT — `published` only flips via the explicit
+ * toggle. NO EXISTENCE LEAK: an unknown handle and an unpublished handle
+ * return the byte-identical 404 body.
+ */
+
+const express = require('express');
+const { createRateLimit } = require('../middleware/rateLimit');
+const { requireAuth } = require('../middleware/auth');
+const ledgerService = require('../services/ledgerService');
+
+const router = express.Router();
+router.use(createRateLimit({ windowMs: 60_000, max: 60 }));
+
+const HANDLE_RE = /^[a-z0-9_]{3,20}$/;
+// Same 404 body for unknown AND unpublished — never confirm a handle exists.
+const NOT_FOUND = { error: 'Profile not found' };
+// Same columns as /api/ledger (routes/ledger.js ROW_COLUMNS).
+const ROW_COLUMNS = 'id, player_key, player_name, sport, stat, line, side, locked_odds, book, grade, edge, confidence, model_value, graded_at, game_id, game_date, closing_line, closing_odds, clv, clv_result, outcome, actual_value, settled_at, revised_from_grade';
+const ENTRY_LIMIT = 50;
+
+function sbOrNull() {
+  try {
+    if (!ledgerService.__internals.isConfigured()) return null;
+    return require('../utils/supabase').getSupabaseServiceClient();
+  } catch { return null; }
+}
+
+// Own row — the owner sees it published or not.
+router.get('/me', requireAuth, async (req, res) => {
+  const sb = sbOrNull();
+  if (!sb) return res.json({ profile: null });
+  try {
+    const { data, error } = await sb.from('public_profiles')
+      .select('handle, published, created_at')
+      .eq('user_id', req.user.id)
+      .maybeSingle();
+    if (error) throw new Error(error.message);
+    return res.json({ profile: data || null });
+  } catch (err) {
+    console.error('[profiles/me]', err.message);
+    return res.status(200).json({ profile: null });
+  }
+});
+
+// Claim/update the handle + the ONE explicit publish toggle.
+router.post('/me', requireAuth, async (req, res) => {
+  const sb = sbOrNull();
+  if (!sb) return res.status(503).json({ error: 'Profiles are unavailable right now' });
+  try {
+    const body = req.body || {};
+    const handle = String(body.handle || '').trim().toLowerCase();
+    if (!HANDLE_RE.test(handle)) {
+      return res.status(400).json({ error: 'Handle must be 3-20 characters: a-z, 0-9, underscore' });
+    }
+    // PRIVATE BY DEFAULT: published only flips when the body says true.
+    const published = body.published === true;
+    const { error } = await sb.from('public_profiles')
+      .upsert({ user_id: req.user.id, handle, published }, { onConflict: 'user_id' });
+    if (error) {
+      // Unique violation on `handle` → someone else owns it.
+      if (error.code === '23505' || /duplicate|unique/i.test(error.message || '')) {
+        return res.status(409).json({ error: 'That handle is taken' });
+      }
+      throw new Error(error.message);
+    }
+    return res.json({ ok: true, profile: { handle, published } });
+  } catch (err) {
+    console.error('[profiles/post]', err.message);
+    return res.status(503).json({ error: 'Could not save profile' });
+  }
+});
+
+// The public record. Cache lightly; the settle pass updates rows a few
+// times a day, not per-second.
+router.get('/:handle', async (req, res) => {
+  const handle = String(req.params.handle || '').trim().toLowerCase();
+  // Invalid shape can't exist (DB CHECK) → same 404, no query needed.
+  if (!HANDLE_RE.test(handle)) return res.status(404).json(NOT_FOUND);
+  const sb = sbOrNull();
+  if (!sb) return res.status(404).json(NOT_FOUND);
+  try {
+    const { data: row, error } = await sb.from('public_profiles')
+      .select('user_id, handle, published')
+      .eq('handle', handle)
+      .maybeSingle();
+    if (error) throw new Error(error.message);
+    // Unknown and unpublished are indistinguishable from outside.
+    if (!row || row.published !== true) return res.status(404).json(NOT_FOUND);
+
+    // Same aggregate machinery as the model record — same window, same
+    // n≥20 gate — scoped to this user's own rows.
+    const aggregate = await ledgerService.getModelAggregate({ userId: row.user_id, sb });
+
+    // ALL settled reads, misses included — nothing curated.
+    const { data: entries, error: entriesErr } = await sb.from('ledger_entries')
+      .select(ROW_COLUMNS)
+      .eq('user_id', row.user_id)
+      .not('outcome', 'is', null)
+      .order('graded_at', { ascending: false })
+      .limit(ENTRY_LIMIT);
+    if (entriesErr) throw new Error(entriesErr.message);
+
+    res.set('Cache-Control', 'public, max-age=60');
+    return res.json({
+      handle: row.handle,
+      aggregate,
+      entries: entries || [],
+      min_sample: ledgerService.MIN_AGG_SAMPLE,
+    });
+  } catch (err) {
+    console.error('[profiles/handle]', err.message);
+    return res.status(404).json(NOT_FOUND);
+  }
+});
+
+module.exports = router;