Update routes.py

routes.py

@@ -4618,12 +4618,14 @@ def register_routes(app, ctx):
                 role,
                 status,
                 restricted_until,
-                    created_at
+                created_at,
+                last_login_at
             FROM users
             WHERE id = ?
             """,
             (user["id"],),
         ).fetchone()
+
         profile_row = db.execute(
             """
             SELECT
@@ -4634,39 +4636,59 @@ def register_routes(app, ctx):
                 bio_mode,
                 website,
                 location,
+                status_message,
+                banner_attachment_id,
                 updated_at
             FROM user_profiles
             WHERE user_id = ?
             """,
             (user["id"],),
         ).fetchone()
+
         settings_row = db.execute(
             """
             SELECT
-                    name_color
+                name_color,
+                profile_background_color,
+                profile_banner_color,
+                profile_visibility,
+                last_active_visibility,
+                presence_mode
             FROM user_settings
             WHERE user_id = ?
             """,
             (user["id"],),
         ).fetchone()
 
-        return jsonify({"profile": profile_payload(html_module, user_payload, user_row, profile_row, settings_row, user)})
+    return jsonify({
+        "profile": profile_payload(
+            html_module,
+            user_payload,
+            user_row,
+            profile_row,
+            settings_row,
+            user,
+        )
+    })
+
 
 @app.route("/api/profile", methods=["PATCH"])
 def api_update_my_profile():
     if not csrf_valid():
         return jsonify({"error": "Security token expired.", "code": "csrf"}), 403
+
     limited = rate_limited("profile")
     if limited:
         return limited
+
     user, error = require_writable_user()
     if error:
         return error
 
     try:
         data = safe_json()
-        except ValueError as error:
+    except ValueError as exc:
-            return jsonify({"error": str(error)}), 400
+        return jsonify({"error": str(exc)}), 400
 
     display_name = str(data.get("display_name", "")).strip()
     badge_text = str(data.get("badge_text", "")).strip()
@@ -4674,6 +4696,8 @@ def register_routes(app, ctx):
     bio_mode = str(data.get("bio_mode", "txt")).strip().lower()
     website = str(data.get("website", "")).strip()
     location = str(data.get("location", "")).strip()
+    status_message = str(data.get("status_message", "")).strip()
+    banner_attachment_id = data.get("banner_attachment_id")
 
     if len(display_name) > MAX_DISPLAY_NAME_LENGTH:
         return jsonify({"error": "Display name is too long."}), 400
@@ -4687,6 +4711,33 @@ def register_routes(app, ctx):
         return jsonify({"error": "Website is too long."}), 400
     if len(location) > MAX_LOCATION_LENGTH:
         return jsonify({"error": "Location is too long."}), 400
+    if len(status_message) > constants["MAX_STATUS_MESSAGE_LENGTH"]:
+        return jsonify({"error": "Status message is too long."}), 400
+
+    if banner_attachment_id in ("", None):
+        banner_attachment_id = None
+    else:
+        try:
+            banner_attachment_id = int(banner_attachment_id)
+        except (TypeError, ValueError):
+            return jsonify({"error": "Invalid banner attachment."}), 400
+
+        with get_db() as db:
+            attachment = db.execute(
+                """
+                SELECT
+                    id,
+                    uploader_user_id
+                FROM attachments
+                WHERE id = ?
+                """,
+                (banner_attachment_id,),
+            ).fetchone()
+
+        if not attachment:
+            return jsonify({"error": "Banner attachment not found."}), 404
+        if int(attachment["uploader_user_id"]) != int(user["id"]):
+            return jsonify({"error": "You can only use your own uploaded image as banner."}), 403
 
     db_write(
         """
@@ -4698,6 +4749,8 @@ def register_routes(app, ctx):
             bio_mode = ?,
             website = ?,
             location = ?,
+            status_message = ?,
+            banner_attachment_id = ?,
             updated_at = ?
         WHERE user_id = ?
         """,
@@ -4708,6 +4761,8 @@ def register_routes(app, ctx):
             bio_mode,
             website,
             location,
+            status_message,
+            banner_attachment_id,
             now_iso(),
             user["id"],
         ),
@@ -4722,12 +4777,14 @@ def register_routes(app, ctx):
                 role,
                 status,
                 restricted_until,
-                    created_at
+                created_at,
+                last_login_at
             FROM users
             WHERE id = ?
             """,
             (user["id"],),
         ).fetchone()
+
         profile_row = db.execute(
             """
             SELECT
@@ -4738,23 +4795,49 @@ def register_routes(app, ctx):
                 bio_mode,
                 website,
                 location,
+                status_message,
+                banner_attachment_id,
                 updated_at
             FROM user_profiles
             WHERE user_id = ?
             """,
             (user["id"],),
         ).fetchone()
+
         settings_row = db.execute(
-                "SELECT name_color FROM user_settings WHERE user_id = ?",
+            """
+            SELECT
+                name_color,
+                profile_background_color,
+                profile_banner_color,
+                profile_visibility,
+                last_active_visibility,
+                presence_mode
+            FROM user_settings
+            WHERE user_id = ?
+            """,
             (user["id"],),
         ).fetchone()
 
     audit("profile_updated", user["id"], "user", str(user["id"]))
-        return jsonify({"profile": profile_payload(html_module, user_payload, user_row, profile_row, settings_row, user)})
+
+    return jsonify({
+        "profile": profile_payload(
+            html_module,
+            user_payload,
+            user_row,
+            profile_row,
+            settings_row,
+            user,
+        )
+    })
+
 
 @app.route("/api/profiles/<string:username>")
 def api_get_public_profile(username: str):
     normalized = normalize_username(username)
+    viewer = current_user()
+
     with get_db() as db:
         user_row = db.execute(
             """
@@ -4764,14 +4847,17 @@ def register_routes(app, ctx):
                 role,
                 status,
                 restricted_until,
-                    created_at
+                created_at,
+                last_login_at
             FROM users
             WHERE username = ?
             """,
             (normalized,),
         ).fetchone()
+
         if not user_row:
             return jsonify({"error": "Profile not found."}), 404
+
         profile_row = db.execute(
             """
             SELECT
@@ -4782,17 +4868,56 @@ def register_routes(app, ctx):
                 bio_mode,
                 website,
                 location,
+                status_message,
+                banner_attachment_id,
                 updated_at
             FROM user_profiles
             WHERE user_id = ?
             """,
             (user_row["id"],),
         ).fetchone()
+
         settings_row = db.execute(
-                "SELECT name_color FROM user_settings WHERE user_id = ?",
+            """
+            SELECT
+                name_color,
+                profile_background_color,
+                profile_banner_color,
+                profile_visibility,
+                last_active_visibility,
+                presence_mode
+            FROM user_settings
+            WHERE user_id = ?
+            """,
             (user_row["id"],),
         ).fetchone()
-        return jsonify({"profile": profile_payload(html_module, user_payload, user_row, profile_row, settings_row, current_user())})
+
+    profile_visibility = (
+        settings_row["profile_visibility"]
+        if settings_row and "profile_visibility" in settings_row.keys()
+        else "public"
+    )
+
+    is_self = bool(viewer and int(viewer["id"]) == int(user_row["id"]))
+
+    if profile_visibility == "private":
+        if not is_self and not (viewer and viewer["role"] in {"moderator", "admin"}):
+            return jsonify({"error": "Profile not available."}), 403
+
+    if profile_visibility == "members":
+        if not is_self and not viewer:
+            return jsonify({"error": "Profile not available."}), 403
+
+    return jsonify({
+        "profile": profile_payload(
+            html_module,
+            user_payload,
+            user_row,
+            profile_row,
+            settings_row,
+            viewer,
+        )
+    })
     
     @app.route("/api/settings")
     def api_get_settings():