fix: auto-create profile for users missing profiles row

Users who signed in via Google OAuth or edge cases had auth.users rows
but no profiles row, causing "Profile not found" 400 errors on daily
reward claims and profile fetches. Now profile.php, auth.php (login),
and daily-reward.php all auto-create the profile if missing.

Also backfilled 4 missing profiles directly in the database.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

api/auth.php

@@ -95,6 +95,27 @@ function handleLogin(array $input): void {
         jsonError($result['error'], $result['code'] ?? 401);
     }
 
+    // Ensure profile exists (covers Google sign-in and other providers)
+    if (isset($result['user']['id'])) {
+        $sdb = supabaseService();
+        $existing = $sdb->get('profiles', ['id' => 'eq.' . $result['user']['id'], 'select' => 'id', 'limit' => 1]);
+        if (empty($existing) || isset($existing['error'])) {
+            $meta = $result['user']['user_metadata'] ?? [];
+            $name = $meta['display_name'] ?? $meta['full_name'] ?? $meta['name'] ?? explode('@', $email)[0];
+            $sdb->insert('profiles', [
+                'id' => $result['user']['id'],
+                'display_name' => $name,
+                'username' => $name,
+                'avatar_url' => $meta['avatar_url'] ?? $meta['picture'] ?? null,
+                'coins' => 0,
+                'gems' => 0,
+                'xp' => 0,
+                'level' => 1,
+                'daily_streak' => 0,
+            ]);
+        }
+    }
+
     jsonResponse([
         'access_token' => $result['access_token'],
         'refresh_token' => $result['refresh_token'],

api/daily-reward.php

@@ -22,7 +22,12 @@ $DAY_REWARDS = [50, 75, 100, 125, 150, 200, 300];
 if ($method === 'GET') {
     $profiles = $db->get('profiles', ['id' => 'eq.' . $userId, 'select' => 'daily_streak,last_daily_reward,coins', 'limit' => 1]);
     $profile = is_array($profiles) && !empty($profiles) && !isset($profiles['error']) ? $profiles[0] : null;
-    if (!$profile) jsonError('Profile not found');
+    if (!$profile) {
+        ensureProfile($sdb, $userId, $token);
+        $profiles = $db->get('profiles', ['id' => 'eq.' . $userId, 'select' => 'daily_streak,last_daily_reward,coins', 'limit' => 1]);
+        $profile = is_array($profiles) && !empty($profiles) && !isset($profiles['error']) ? $profiles[0] : null;
+        if (!$profile) jsonError('Profile not found');
+    }
 
     $streak = $profile['daily_streak'] ?? 0;
     $lastClaim = $profile['last_daily_reward'] ?? null;
@@ -56,7 +61,12 @@ if ($method === 'POST') {
 
     $profiles = $db->get('profiles', ['id' => 'eq.' . $userId, 'select' => 'daily_streak,last_daily_reward,coins', 'limit' => 1]);
     $profile = is_array($profiles) && !empty($profiles) && !isset($profiles['error']) ? $profiles[0] : null;
-    if (!$profile) jsonError('Profile not found');
+    if (!$profile) {
+        ensureProfile($sdb, $userId, $token);
+        $profiles = $db->get('profiles', ['id' => 'eq.' . $userId, 'select' => 'daily_streak,last_daily_reward,coins', 'limit' => 1]);
+        $profile = is_array($profiles) && !empty($profiles) && !isset($profiles['error']) ? $profiles[0] : null;
+        if (!$profile) jsonError('Profile not found');
+    }
 
     $streak = $profile['daily_streak'] ?? 0;
     $lastClaim = $profile['last_daily_reward'] ?? null;
@@ -115,6 +125,21 @@ if ($method === 'POST') {
 
 jsonError('Method not allowed', 405);
 
+function ensureProfile($sdb, string $userId, string $token): void {
+    $user = verifyToken($token);
+    $email = $user['email'] ?? '';
+    $name = $user['user_metadata']['display_name'] ?? $user['user_metadata']['full_name'] ?? explode('@', $email)[0] ?? 'Player';
+    $sdb->insert('profiles', [
+        'id' => $userId,
+        'display_name' => $name,
+        'coins' => 0,
+        'gems' => 0,
+        'xp' => 0,
+        'level' => 1,
+        'daily_streak' => 0,
+    ]);
+}
+
 function checkAchievements($sdb, string $userId, string $type, int $value): void {
     $achievements = $sdb->get('achievements', ['select' => 'id,condition,coins_reward,xp_reward']);
     if (!is_array($achievements) || isset($achievements['error'])) return;

api/profile.php

@@ -37,7 +37,27 @@ if ($method === 'GET') {
     $profiles = $db->get('profiles', ['id' => 'eq.' . $targetId, 'select' => '*', 'limit' => 1]);
 
     if (!is_array($profiles) || isset($profiles['error']) || empty($profiles)) {
-        jsonError('Profile not found', 404);
+        // Auto-create profile for own user (covers Google sign-in, guest-upgrade)
+        if ($targetId === $userId) {
+            $user = verifyToken($token);
+            $meta = $user['user_metadata'] ?? [];
+            $name = $meta['display_name'] ?? $meta['full_name'] ?? $meta['name'] ?? explode('@', $user['email'] ?? '')[0] ?? 'Player';
+            $sdb->insert('profiles', [
+                'id' => $userId,
+                'display_name' => $name,
+                'username' => $name,
+                'avatar_url' => $meta['avatar_url'] ?? $meta['picture'] ?? null,
+                'coins' => 0,
+                'gems' => 0,
+                'xp' => 0,
+                'level' => 1,
+                'daily_streak' => 0,
+            ]);
+            $profiles = $db->get('profiles', ['id' => 'eq.' . $targetId, 'select' => '*', 'limit' => 1]);
+        }
+        if (!is_array($profiles) || isset($profiles['error']) || empty($profiles)) {
+            jsonError('Profile not found', 404);
+        }
     }
 
     $profile = $profiles[0];