From c78237a1dd71ffbf58db458ddc6292b414226498 Mon Sep 17 00:00:00 2001
From: seb <sebgreenbus@gmail.com>
Date: Wed, 5 Aug 2026 11:04:44 +0200
Subject: [PATCH] Persist Google picture and sub on login via setProfile.

Store profile fields from the verified ID token and read picture from the DB on authenticated requests.
---
 src/api/middleware/auth.js   | 2 +-
 src/api/routes/auth/login.js | 7 +++++++
 src/db/googleAuth.js         | 5 +++++
 3 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/src/api/middleware/auth.js b/src/api/middleware/auth.js
index 9d99288..fd9d405 100644
--- a/src/api/middleware/auth.js
+++ b/src/api/middleware/auth.js
@@ -76,7 +76,7 @@ export const authMiddleware = async (req, res, next) => {
             id: user.id,
             email: user.email,
             selectedCompanyId: user.selectedCompanyId,
-            ...(decoded.picture && { picture: decoded.picture }),
+            ...(user.picture && { picture: user.picture }),
         };
 
         const now = Math.floor(Date.now() / 1000);
diff --git a/src/api/routes/auth/login.js b/src/api/routes/auth/login.js
index 1108348..e488efe 100644
--- a/src/api/routes/auth/login.js
+++ b/src/api/routes/auth/login.js
@@ -2,6 +2,7 @@ import jwt from 'jsonwebtoken';
 import { OAuth2Client } from 'google-auth-library';
 import env from '../../../config/env.js';
 import * as db from '../../../db/googleAuth.js';
+import { clearCachedUser } from '../../middleware/auth.js';
 
 const googleClient = new OAuth2Client(env.googleClientId);
 
@@ -108,6 +109,12 @@ export function register(app, basePath = '') {
                 return res.status(403).json({ error: 'Email is not authorized' });
             }
 
+            await db.setProfile(allowed.id, {
+                picture: payload.picture ?? null,
+                sub: payload.sub ?? null,
+            });
+            clearCachedUser(email);
+
             const user = {
                 id: allowed.id,
                 email: allowed.email,
diff --git a/src/db/googleAuth.js b/src/db/googleAuth.js
index 37d6f98..cc9221b 100644
--- a/src/db/googleAuth.js
+++ b/src/db/googleAuth.js
@@ -31,3 +31,8 @@ export async function setSelectedCompany(authId, companyId) {
     const store = await getStore();
     await store.google_auth.setSelectedCompany(authId, companyId);
 }
+
+export async function setProfile(authId, { picture = null, sub = null } = {}) {
+    const store = await getStore();
+    await store.google_auth.setProfile(authId, { picture, sub });
+}