Persist Google picture and sub on login via setProfile.

Store profile fields from the verified ID token and read picture from the DB on authenticated requests.

src/api/middleware/auth.js

@@ -76,7 +76,7 @@ export const authMiddleware = async (req, res, next) => {
             id: user.id,
             email: user.email,
             selectedCompanyId: user.selectedCompanyId,
-            ...(decoded.picture && { picture: decoded.picture }),
+            ...(user.picture && { picture: user.picture }),
         };
 
         const now = Math.floor(Date.now() / 1000);

src/api/routes/auth/login.js

@@ -2,6 +2,7 @@ import jwt from 'jsonwebtoken';
 import { OAuth2Client } from 'google-auth-library';
 import env from '../../../config/env.js';
 import * as db from '../../../db/googleAuth.js';
+import { clearCachedUser } from '../../middleware/auth.js';
 
 const googleClient = new OAuth2Client(env.googleClientId);
 
@@ -108,6 +109,12 @@ export function register(app, basePath = '') {
                 return res.status(403).json({ error: 'Email is not authorized' });
             }
 
+            await db.setProfile(allowed.id, {
+                picture: payload.picture ?? null,
+                sub: payload.sub ?? null,
+            });
+            clearCachedUser(email);
+
             const user = {
                 id: allowed.id,
                 email: allowed.email,

src/db/googleAuth.js

@@ -31,3 +31,8 @@ export async function setSelectedCompany(authId, companyId) {
     const store = await getStore();
     await store.google_auth.setSelectedCompany(authId, companyId);
 }
+
+export async function setProfile(authId, { picture = null, sub = null } = {}) {
+    const store = await getStore();
+    await store.google_auth.setProfile(authId, { picture, sub });
+}