fix: auto-create profile for users missing profiles row

Users who signed in via Google OAuth or edge cases had auth.users rows
but no profiles row, causing "Profile not found" 400 errors on daily
reward claims and profile fetches. Now profile.php, auth.php (login),
and daily-reward.php all auto-create the profile if missing.

Also backfilled 4 missing profiles directly in the database.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

api/auth.php

@@ -95,6 +95,27 @@ function handleLogin(array $input): void {
         jsonError($result['error'], $result['code'] ?? 401);
     }
 
+    // Ensure profile exists (covers Google sign-in and other providers)
+    if (isset($result['user']['id'])) {
+        $sdb = supabaseService();
+        $existing = $sdb->get('profiles', ['id' => 'eq.' . $result['user']['id'], 'select' => 'id', 'limit' => 1]);
+        if (empty($existing) || isset($existing['error'])) {
+            $meta = $result['user']['user_metadata'] ?? [];
+            $name = $meta['display_name'] ?? $meta['full_name'] ?? $meta['name'] ?? explode('@', $email)[0];
+            $sdb->insert('profiles', [
+                'id' => $result['user']['id'],
+                'display_name' => $name,
+                'username' => $name,
+                'avatar_url' => $meta['avatar_url'] ?? $meta['picture'] ?? null,
+                'coins' => 0,
+                'gems' => 0,
+                'xp' => 0,
+                'level' => 1,
+                'daily_streak' => 0,
+            ]);
+        }
+    }
+
     jsonResponse([
         'access_token' => $result['access_token'],
         'refresh_token' => $result['refresh_token'],

api/daily-reward.php

@@ -20,9 +20,14 @@ $sdb = supabaseService();
 $DAY_REWARDS = [50, 75, 100, 125, 150, 200, 300];
 
 if ($method === 'GET') {
+    $profiles = $db->get('profiles', ['id' => 'eq.' . $userId, 'select' => 'daily_streak,last_daily_reward,coins', 'limit' => 1]);
+    $profile = is_array($profiles) && !empty($profiles) && !isset($profiles['error']) ? $profiles[0] : null;
+    if (!$profile) {
+        ensureProfile($sdb, $userId, $token);
         $profiles = $db->get('profiles', ['id' => 'eq.' . $userId, 'select' => 'daily_streak,last_daily_reward,coins', 'limit' => 1]);
         $profile = is_array($profiles) && !empty($profiles) && !isset($profiles['error']) ? $profiles[0] : null;
         if (!$profile) jsonError('Profile not found');
+    }
 
     $streak = $profile['daily_streak'] ?? 0;
     $lastClaim = $profile['last_daily_reward'] ?? null;
@@ -54,9 +59,14 @@ if ($method === 'POST') {
 
     if ($action !== 'claim') jsonError('Invalid action');
 
+    $profiles = $db->get('profiles', ['id' => 'eq.' . $userId, 'select' => 'daily_streak,last_daily_reward,coins', 'limit' => 1]);
+    $profile = is_array($profiles) && !empty($profiles) && !isset($profiles['error']) ? $profiles[0] : null;
+    if (!$profile) {
+        ensureProfile($sdb, $userId, $token);
         $profiles = $db->get('profiles', ['id' => 'eq.' . $userId, 'select' => 'daily_streak,last_daily_reward,coins', 'limit' => 1]);
         $profile = is_array($profiles) && !empty($profiles) && !isset($profiles['error']) ? $profiles[0] : null;
         if (!$profile) jsonError('Profile not found');
+    }
 
     $streak = $profile['daily_streak'] ?? 0;
     $lastClaim = $profile['last_daily_reward'] ?? null;
@@ -115,6 +125,21 @@ if ($method === 'POST') {
 
 jsonError('Method not allowed', 405);
 
+function ensureProfile($sdb, string $userId, string $token): void {
+    $user = verifyToken($token);
+    $email = $user['email'] ?? '';
+    $name = $user['user_metadata']['display_name'] ?? $user['user_metadata']['full_name'] ?? explode('@', $email)[0] ?? 'Player';
+    $sdb->insert('profiles', [
+        'id' => $userId,
+        'display_name' => $name,
+        'coins' => 0,
+        'gems' => 0,
+        'xp' => 0,
+        'level' => 1,
+        'daily_streak' => 0,
+    ]);
+}
+
 function checkAchievements($sdb, string $userId, string $type, int $value): void {
     $achievements = $sdb->get('achievements', ['select' => 'id,condition,coins_reward,xp_reward']);
     if (!is_array($achievements) || isset($achievements['error'])) return;

api/profile.php

@@ -36,9 +36,29 @@ if ($method === 'GET') {
 
     $profiles = $db->get('profiles', ['id' => 'eq.' . $targetId, 'select' => '*', 'limit' => 1]);
 
+    if (!is_array($profiles) || isset($profiles['error']) || empty($profiles)) {
+        // Auto-create profile for own user (covers Google sign-in, guest-upgrade)
+        if ($targetId === $userId) {
+            $user = verifyToken($token);
+            $meta = $user['user_metadata'] ?? [];
+            $name = $meta['display_name'] ?? $meta['full_name'] ?? $meta['name'] ?? explode('@', $user['email'] ?? '')[0] ?? 'Player';
+            $sdb->insert('profiles', [
+                'id' => $userId,
+                'display_name' => $name,
+                'username' => $name,
+                'avatar_url' => $meta['avatar_url'] ?? $meta['picture'] ?? null,
+                'coins' => 0,
+                'gems' => 0,
+                'xp' => 0,
+                'level' => 1,
+                'daily_streak' => 0,
+            ]);
+            $profiles = $db->get('profiles', ['id' => 'eq.' . $targetId, 'select' => '*', 'limit' => 1]);
+        }
         if (!is_array($profiles) || isset($profiles['error']) || empty($profiles)) {
             jsonError('Profile not found', 404);
         }
+    }
 
     $profile = $profiles[0];
     $ratings = $db->get('player_game_ratings', ['player_id' => 'eq.' . $targetId, 'select' => 'game_key,time_control,rating,games_played,wins,losses,draws']);