feat: profile picture

packages/db/seed.sql

@@ -712,4 +712,41 @@ FOR ALL
 TO authenticated
 USING (
   "createdBy" = auth.uid()
-);
+);
+
+/* BUCKETS */
+insert into storage.buckets
+  (id, name, public)
+values
+  ('avatars', 'avatars', true);
+
+alter table storage.objects enable row level security;
+
+CREATE POLICY "Users can upload their own avatar"
+ON storage.objects FOR INSERT
+TO authenticated
+WITH CHECK (
+  bucket_id = 'avatars' AND
+  (storage.foldername(name))[1] = auth.uid()::text
+);
+
+CREATE POLICY "Users can update their own avatar"
+ON storage.objects FOR UPDATE
+TO authenticated
+USING (
+  bucket_id = 'avatars' AND
+  (storage.foldername(name))[1] = auth.uid()::text
+);
+
+CREATE POLICY "Users can delete their own avatar"
+ON storage.objects FOR DELETE
+TO authenticated
+USING (
+  bucket_id = 'avatars' AND
+  (storage.foldername(name))[1] = auth.uid()::text
+);
+
+CREATE POLICY "Avatar images are publicly accessible"
+ON storage.objects FOR SELECT
+TO anon, authenticated
+USING (bucket_id = 'avatars');

packages/db/src/repository/user.repo.ts

@@ -5,7 +5,7 @@ import type { Database } from "@kan/db/types/database.types";
 export const getById = async (db: SupabaseClient<Database>, userId: string) => {
   const { data } = await db
     .from("user")
-    .select(`id, name, email, stripeCustomerId`)
+    .select(`id, name, email, image, stripeCustomerId`)
     .eq("id", userId)
     .limit(1)
     .single();
@@ -44,3 +44,18 @@ export const create = async (
 
   return data;
 };
+
+export const update = async (
+  db: SupabaseClient<Database>,
+  userId: string,
+  updates: { image: string | null },
+) => {
+  const { data } = await db
+    .from("user")
+    .update({ image: updates.image })
+    .eq("id", userId)
+    .select(`image`)
+    .single();
+
+  return data;
+};