fix(birdy): fix all reported issues - feed, follows, comments, reposts, notifications, privacy, DMs, avatars (#37)

* fix(birdy): reconnect the feed, follow lists, comments and join date (#15)

Six of the reported birdy bugs share one theme: the server work was already
done and the UI simply never reached it. This reconnects those paths rather
than building anything new.

Following tab was permanently empty
  Feed.tsx branched on `feed === 'following'` and rendered a hardcoded empty
  state that never consulted `posts`, so correctly-fetched posts were thrown
  away. store.listFeed already implements the follows join, and Birdy.tsx
  already requests it. Collapsed to a single length check with a
  tab-dependent message. The dev stub returned [] for the following tab too,
  which is presumably how the placeholder survived.

Followers / Following lists always blank
  apiFollowList calls 'sd-phone:birdy:followList', which was never proxied in
  client/apps/birdy.lua nor registered in server/birdy/init.lua - and no
  store/action existed. The screen was fully built against a callback that
  did not exist. Added store.followList (both directions, with the reciprocal
  follows_you / is_following flags resolved in SQL), actions.followList, and
  both registrations. Modelled on photogram, which has this same chain.

Comment button did nothing
  The comment ActionButton was rendered with no onClick, and ActionButton
  stopPropagation()s - so it also swallowed the card's own open handler,
  making it the one spot on a post guaranteed to do nothing. It now opens the
  post, where the reply composer already lives.

Tapping a commenter's avatar/name did nothing
  The profile SlideOver was gated on `!openPostId`. Reaching comments always
  means a post is open, so that gate suppressed it 100% of the time from
  comments (it worked from the feed, where no post is open). Dropped that
  clause; the SlideOver is z-30 over the post's z-20, so it layers correctly
  and closing it returns to the comments.

New posts invisible until you switched tabs
  actions.create only fired TriggerEvent, which is server-LOCAL (a hook for
  third-party scripts) and reaches no players. There was no broadcast, no
  polling, and no foreground refetch - and because AppDeck retains the app,
  closing and reopening does not remount it, so nothing re-ran. Added a
  TriggerClientEvent broadcast, a client relay, and a nonce the app bumps on
  that push and on background->foreground (transition only, so opening the
  app does not double-fetch).

Join date freely editable
  join_label was a client-writable string that updateProfile accepted
  verbatim, so anyone could set "January 1889". The real created_at column
  existed but was never selected. It is now read back, the label is derived
  from it in serializeProfile, updateProfile ignores the field, and the
  editor shows it as read-only text. Legacy rows fall back to the stored
  label.

Verified: tsc, eslint (0 errors) and vitest all clean. Not exercised against
a live server - no FiveM here - so the Lua paths are reasoned through rather
than run. Worth a smoke test of the follow lists and the cross-player feed
push before merge.

Still outstanding on #15, all genuinely unbuilt rather than miswired, and
each deserving its own PR: reposts (no table/action at all - the count is
hardcoded 0 server-side and the button only flips local state), private
accounts (the flag round-trips but no query or UI reads it), notification
badges (no seen/read column exists), post fan-out to followers, DM compose
(blocked by there being no handle->citizenid resolver), and avatar/banner
uploads (no columns, buttons are decorative).

* feat(birdy): persist reposts (#15)

Reposts were entirely client-side: no table, no action, no callback, and
serializePost pinned `reposts = 0` for every post. PostCard flipped a local
useState, so the count never moved for anyone else and the repost vanished
on the next refetch.

- phone_birdy_reposts, mirroring phone_birdy_likes (composite PK = idempotent).
- store add/remove/isReposted, plus repost_count and a viewer `reposted` flag
  in POST_SELECT. That makes the viewer cid params #1 AND #2, so all seven
  POST_SELECT call sites now pass it twice.
- actions.toggleRepost on the toggleLike model, notifying the post author on
  a new repost (never on undo, never for self-reposts), registered through
  withNotifyPush and proxied on the client.
- A 'repost' notification kind, rendered with the Repeat2 glyph.
- PostCard reads server truth; Birdy.tsx owns the optimistic flip like it
  already does for likes.
- deleteAccount now clears reposts, both the account's own and others' on its
  posts.

Typecheck and lint clean. Not exercised against a live server.

* feat(birdy): notification badges, post fan-out, private accounts, DM compose, avatars (#15)

Completes the remaining #15 items, all previously unbuilt.

Notification badges
  phone_birdy_notifications gains a `seen` column (historic rows backfilled
  as seen so nobody logs in to a giant badge) plus an unseen index. Opening
  the Bell tab marks everything seen; a notificationCount callback feeds the
  in-app Bell badge, birdy is registered in the springboard badge snapshot,
  and SERVER_BADGE_APPS gains 'birdy' so the server owns the app-icon count.
  The web app finally listens to the existing notification push instead of
  letting it fire into the void.

Post fan-out
  Posting now writes a 'post' notification for every follower and, for the
  ones online, sends the app nudge, a phone banner, and a badge push - birdy
  previously never sent a phone banner for anything.

Private accounts (the toggle now does what it says)
  The All feed hides protected authors from non-followers in SQL, profile
  post tabs return empty + protected for non-followers, follow lists of a
  protected account are hidden, and the profile page shows a lock state.
  Followers and the account itself see everything as before.

DM compose
  dmSend accepts a handle (resolved server-side) and rejects self-DMs; a new
  dmResolve callback maps handle -> conversation id so the UI can open a
  thread with someone never messaged. Messages gains a compose button with a
  people search, and other profiles gain a Message button.

Avatars and banners
  avatar/banner VARCHAR(512) columns, validated with the photogram idiom
  (http prefix, 512 cap, false clears). serializeAuthor/serializeProfile and
  every profile-card query now carry them; the previously-dead camera
  buttons in Edit Profile open the shared MediaPickerSheet; the Avatar
  component (which already took src) now receives it across the app.

Typecheck, lint, tests all clean. Not exercised against a live server.

---------

Co-authored-by: Samuel Nicol <99494967+Github-Samuel@users.noreply.github.com>

Author: Epixx1337

client/apps/birdy.lua

@@ -19,7 +19,11 @@ proxyCallback('sd-phone:birdy:create',        'sd-phone:server:birdy:create')
 proxyCallback('sd-phone:birdy:reply',         'sd-phone:server:birdy:reply')
 proxyCallback('sd-phone:birdy:toggleLike',    'sd-phone:server:birdy:toggleLike')
 proxyCallback('sd-phone:birdy:toggleFollow',  'sd-phone:server:birdy:toggleFollow')
+proxyCallback('sd-phone:birdy:toggleRepost', 'sd-phone:server:birdy:toggleRepost')
+proxyCallback('sd-phone:birdy:followList',    'sd-phone:server:birdy:followList')
 proxyCallback('sd-phone:birdy:notifications', 'sd-phone:server:birdy:notifications')
+proxyCallback('sd-phone:birdy:notificationCount', 'sd-phone:server:birdy:notificationCount')
+proxyCallback('sd-phone:birdy:dmResolve',     'sd-phone:server:birdy:dmResolve')
 proxyCallback('sd-phone:birdy:dmList',        'sd-phone:server:birdy:dmList')
 proxyCallback('sd-phone:birdy:dmThread',      'sd-phone:server:birdy:dmThread')
 proxyCallback('sd-phone:birdy:dmSend',        'sd-phone:server:birdy:dmSend')
@@ -42,3 +46,9 @@ end)
 RegisterNetEvent('sd-phone:client:birdy:notification', function(data)
     SendNUIMessage({ action = 'sd-phone:birdy:notification', data = data })
 end)
+
+---Server push: somebody posted, so any open feed is now stale.
+---@param data table empty payload from server/birdy/actions.lua
+RegisterNetEvent('sd-phone:client:birdy:feedChanged', function(data)
+    SendNUIMessage({ action = 'sd-phone:birdy:feedChanged', data = data or {} })
+end)

server/badges/init.lua

@@ -12,6 +12,8 @@ local groupStore     = require 'server.groups.store'
 local acctStore      = require 'server.accounts.store'
 ---@type table Photogram persistence layer (server.photogram.store): notification/DM counts.
 local photogramStore = require 'server.photogram.store'
+---@type table Birdy persistence layer (server.birdy.store): unseen-notification counts.
+local birdyStore     = require 'server.birdy.store'
 
 ---@type table Badges module; the table returned at end of file.
 local badges = {}
@@ -29,14 +31,15 @@ end
 ---Per-app unread counts for one character, keyed by home-screen app id, computed straight from
 ---the database on every call.
 ---@param cid string framework per-character id
----@return { messages: number, phone: number, mail: number, groups: number, photogram: number }
+---@return { messages: number, phone: number, mail: number, groups: number, photogram: number, birdy: number }
 function badges.snapshot(cid)
     return {
         messages  = messageStore.unreadCount(cid),
         phone     = contactStore.unreadMissedCount(cid),
         mail      = mailStore.unreadCount(cid),
         groups    = groupStore.pendingInviteCount(cid),
         photogram = photogramCount(cid),
+        birdy     = birdyStore.unseenNotificationCount(cid),
     }
 end
 
@@ -54,7 +57,7 @@ end
 ---Read-only.
 lib.callback.register('sd-phone:server:badges:get', function(src)
     local cid = player.getIdentifier(src)
-    if not cid then return { messages = 0, phone = 0, mail = 0, groups = 0, photogram = 0 } end
+    if not cid then return { messages = 0, phone = 0, mail = 0, groups = 0, photogram = 0, birdy = 0 } end
     return badges.snapshot(cid)
 end)
 
@@ -69,7 +72,7 @@ end)
 ---A player's current per-app unread counts without pushing them. Nil when the source doesn't
 ---resolve to a loaded character.
 ---@param source number player server id
----@return { messages: number, phone: number, mail: number, groups: number, photogram: number }|nil counts
+---@return { messages: number, phone: number, mail: number, groups: number, photogram: number, birdy: number }|nil counts
 exports('getBadgeCounts', function(source)
     if type(source) ~= 'number' then return nil end
     local cid = player.getIdentifier(source)

server/birdy/actions.lua

@@ -12,6 +12,8 @@ local acctActions = require 'server.accounts.actions'
 local settings = require 'server.settings.store'
 ---@type table Banking actions (server.banking.actions): authoritative money transfer for money DMs.
 local banking = require 'server.banking.actions'
+---@type table Badges module (server.badges.init): server-authoritative unread-badge pushes.
+local badges = require 'server.badges.init'
 ---@type table Admin mute registry (server.admin.moderation): scope guards for posting/DMing.
 local moderation = require 'server.admin.moderation'
 
@@ -114,9 +116,9 @@ end
 
 ---Public author shape embedded in posts, notifications and conversation heads.
 ---@param profile table
----@return { name: string, handle: string, verified: boolean }
+---@return { name: string, handle: string, verified: boolean, avatar?: string }
 local function serializeAuthor(profile)
-    return { name = profile.displayName, handle = profile.handle, verified = profile.verified }
+    return { name = profile.displayName, handle = profile.handle, verified = profile.verified, avatar = profile.avatar }
 end
 
 ---Shapes a full profile (with live follow counts) for the profile page.
@@ -128,26 +130,30 @@ local function serializeProfile(profile)
         handle    = profile.handle,
         verified  = profile.verified,
         bio       = profile.bio or '',
-        joined    = profile.joinLabel or '',
+        -- Derived from created_at; join_label was client-writable.
+        joined    = profile.createdTs and os.date('%B %Y', profile.createdTs) or (profile.joinLabel or ''),
         protected = profile.protected == true,
+        avatar    = profile.avatar,
+        banner    = profile.banner,
         following = store.countFollowing(profile.citizenid),
         followers = store.countFollowers(profile.citizenid),
     }
 end
 
 ---Shapes a hydrated post row into the React `BirdyPost` form. `images` is nil or the
----store-decoded array of up to 3 URLs; the repost count is pinned at 0.
+---store-decoded array of up to 3 URLs.
 ---@param p table
 ---@return table
 local function serializePost(p)
     return {
         id        = p.id,
-        author    = { name = p.displayName, handle = p.handle, verified = p.verified },
+        author    = { name = p.displayName, handle = p.handle, verified = p.verified, avatar = p.avatar },
         body      = p.body,
         images    = p.images,
         createdAt = p.createdMs,
         replies   = p.replies,
-        reposts   = 0,
+        reposts   = p.reposts,
+        reposted  = p.reposted,
         likes     = p.likes,
         liked     = p.liked,
         views     = p.views,
@@ -313,6 +319,14 @@ function actions.profilePosts(source, payload)
     if not targetCid then return fail('Profile not found') end
     local kind = (payload and payload.kind) or 'posts'
 
+    -- Protected profiles expose posts only to themselves and their followers.
+    if targetCid ~= viewerCid then
+        local tp = store.getProfile(targetCid)
+        if tp and tp.protected and not (viewerCid ~= '' and store.isFollowing(viewerCid, targetCid)) then
+            return ok({ posts = {}, protected = true })
+        end
+    end
+
     local rows
     if kind == 'likes' then
         rows = store.listLikedBy(targetCid, viewerCid, birdyCfg.FeedLimit)
@@ -346,7 +360,7 @@ end
 ---Updates the signed-in user's editable profile fields. Missing fields keep their current
 ---value; everything is trimmed and bounds-checked.
 ---@param source number player server id
----@param payload { name?: string, bio?: string, joinLabel?: string, protected?: boolean }|nil
+---@param payload { name?: string, bio?: string, protected?: boolean, avatar?: string|false, banner?: string|false }|nil
 ---@return table envelope
 function actions.updateProfile(source, payload)
     local prof = viewer(source); if not prof then return fail('Not signed in') end
@@ -359,9 +373,17 @@ function actions.updateProfile(source, payload)
     local bio = trimmed(payload.bio) or ''
     if #bio > birdyCfg.MaxBioLength then return fail('Bio is too long') end
 
-    local joinLabel = (trimmed(payload.joinLabel) or prof.joinLabel or ''):sub(1, 32)
+    local function imageUrl(v, fallback)
+        local u = trimmed(v)
+        if u and u:sub(1, 4) == 'http' then return u:sub(1, 512) end
+        if v == false then return nil end
+        return fallback
+    end
+    local avatar = imageUrl(payload.avatar, prof.avatar)
+    local banner = imageUrl(payload.banner, prof.banner)
 
-    store.updateProfileFields(prof.citizenid, name, bio, joinLabel, payload.protected == true)
+    -- joinLabel is ignored; the join date is derived from created_at.
+    store.updateProfileFields(prof.citizenid, name, bio, prof.joinLabel or '', payload.protected == true, avatar, banner)
     return ok({ profile = serializeProfile(store.getProfile(prof.citizenid)) })
 end
 
@@ -462,6 +484,25 @@ function actions.create(source, payload)
         username = prof.handle, displayName = prof.displayName,
         body = body, images = images,
     })
+
+    -- The TriggerEvent above is server-local; this is what reaches players.
+    TriggerClientEvent('sd-phone:client:birdy:feedChanged', -1, {})
+
+    local preview = body ~= '' and body:sub(1, 80) or 'shared a photo'
+    for _, cid in ipairs(store.followerCids(prof.citizenid)) do
+        store.insertNotification(store.newId(), cid, 'post', prof.citizenid, id)
+        local src = player.getSourceByIdentifier(cid)
+        if src then
+            TriggerClientEvent('sd-phone:client:birdy:notification', src, {})
+            TriggerClientEvent('sd-phone:client:notify', src, {
+                app = 'birdy', appId = 'birdy', title = 'Birdy',
+                body = ('%s posted: %s'):format(prof.displayName, preview),
+                time = 'now', quietInApp = true,
+            })
+            badges.push(src)
+        end
+    end
+
     return ok({ post = serializePost(store.getPost(id, prof.citizenid)) })
 end
 
@@ -527,6 +568,77 @@ function actions.toggleLike(source, payload)
     return ok({ liked = nowLiked, notifyCid = notifyCid })
 end
 
+---Toggles a repost of a post. Mirrors toggleLike: idempotent per (post, citizen), and notifies
+---the post's author on a new repost (never on un-repost, never for self-reposts).
+---@param source number player server id
+---@param payload { id?: string }|nil
+---@return table envelope
+function actions.toggleRepost(source, payload)
+    local prof = viewer(source); if not prof then return fail('Player not found') end
+    payload = tbl(payload)
+    local id = payload and payload.id
+    if type(id) ~= 'string' or id == '' then return fail('Missing post') end
+
+    local author = store.getPostAuthor(id)
+    if not author then return fail('Post not found') end
+
+    local nowReposted
+    if store.isReposted(id, prof.citizenid) then
+        store.removeRepost(id, prof.citizenid)
+        nowReposted = false
+    else
+        store.addRepost(id, prof.citizenid)
+        nowReposted = true
+    end
+
+    local notifyCid = nil
+    if nowReposted and author ~= prof.citizenid then
+        store.insertNotification(store.newId(), author, 'repost', prof.citizenid, id)
+        notifyCid = author
+    end
+
+    return ok({ reposted = nowReposted, notifyCid = notifyCid })
+end
+
+---Followers or following for a handle (defaulting to the viewer's own profile), shaped for the
+---FollowList screen. Read-only.
+---@param source number player server id
+---@param payload { kind?: 'followers'|'following', handle?: string }|nil
+---@return table envelope
+function actions.followList(source, payload)
+    local prof = viewer(source); if not prof then return fail('Player not found') end
+    payload = tbl(payload)
+
+    local kind = payload.kind == 'following' and 'following' or 'followers'
+
+    -- No handle means own list; an unknown handle is empty, not an error.
+    local targetCid = prof.citizenid
+    local handle = payload.handle and normalizeHandle(payload.handle)
+    if handle and handle ~= '' and handle ~= prof.handle then
+        local tp = store.getProfileByHandle(handle)
+        if not tp then return ok({ users = {} }) end
+        -- Protected profiles hide their follow graph from non-followers.
+        if tp.protected and not store.isFollowing(prof.citizenid, tp.citizenid) then
+            return ok({ users = {} })
+        end
+        targetCid = tp.citizenid
+    end
+
+    local users = {}
+    for _, row in ipairs(store.followList(prof.citizenid, targetCid, kind)) do
+        users[#users + 1] = {
+            name        = row.display_name,
+            handle      = row.handle,
+            verified    = tonumber(row.verified) == 1,
+            bio         = row.bio or '',
+            avatar      = row.avatar,
+            followsYou  = tonumber(row.follows_you) == 1,
+            isFollowing = tonumber(row.is_following) == 1,
+        }
+    end
+    return ok({ users = users })
+end
+
 ---Toggles following another account, addressed by handle (preferred) or citizenid. Self-follows
 ---are rejected. Returns the target to notify on a new follow (not on unfollow).
 ---@param source number player server id
@@ -590,15 +702,31 @@ function actions.notifications(source)
             local user = ap and serializeAuthor(ap) or { name = 'Someone', handle = 'someone', verified = false }
             if r.kind == 'like' then
                 items[#items + 1] = { id = r.id, kind = 'like', user = user, text = 'liked your post' }
+            elseif r.kind == 'repost' then
+                items[#items + 1] = { id = r.id, kind = 'repost', user = user, text = 'reposted your post' }
+            elseif r.kind == 'post' then
+                items[#items + 1] = { id = r.id, kind = 'post', user = user, text = 'shared a new post' }
             elseif r.kind == 'follow' then
                 items[#items + 1] = { id = r.id, kind = 'follow', user = user }
             end
         end
     end
 
+    store.markNotificationsSeen(prof.citizenid)
+    badges.push(source)
+
     return ok({ notifications = items })
 end
 
+---Unseen-notification count for the in-app Bell badge. Read-only.
+---@param source number player server id
+---@return table envelope
+function actions.notificationCount(source)
+    local prof = viewer(source)
+    if not prof then return ok({ count = 0 }) end
+    return ok({ count = store.unseenNotificationCount(prof.citizenid) })
+end
+
 -- Rich DM messages (text / image / gif / money / location / voice).
 ---@type table<string, boolean> Whitelist of DM kinds a client may send; anything else sends as text.
 local VALID_DM_KINDS = { text = true, image = true, gif = true, money = true, location = true, voice = true }
@@ -770,6 +898,20 @@ function actions.markRead(source, payload)
     return ok()
 end
 
+---Resolves a handle to its DM conversation id (the other party's cid) plus their author card,
+---so the UI can open a thread with someone it has never messaged. Read-only.
+---@param source number player server id
+---@param payload { handle?: string }|nil
+---@return table envelope
+function actions.dmResolve(source, payload)
+    local prof = viewer(source); if not prof then return fail('Player not found') end
+    payload = tbl(payload)
+    local tp = store.getProfileByHandle(normalizeHandle(payload.handle or '') or '')
+    if not tp then return fail('Account not found') end
+    if tp.citizenid == prof.citizenid then return fail('You cannot message yourself') end
+    return ok({ id = tp.citizenid, user = serializeAuthor(tp) })
+end
+
 ---Sends a DM of any kind. Returns the sender's own message + the recipient's copy + the routing
 ---data init needs. Money clears through banking.send before the row is stored.
 ---@param source number player server id
@@ -780,7 +922,13 @@ function actions.dmSend(source, payload)
     local muted = moderation.guard(prof.citizenid, 'birdy'); if muted then return muted end
     payload = tbl(payload)
     local toCid = payload.toCid
+    -- Discovery surfaces only expose handles, so accept one and resolve it here.
+    if (type(toCid) ~= 'string' or toCid == '') and payload.toHandle then
+        local tp = store.getProfileByHandle(normalizeHandle(payload.toHandle) or '')
+        toCid = tp and tp.citizenid
+    end
     if type(toCid) ~= 'string' or toCid == '' or #toCid > 64 then return fail('Missing recipient') end
+    if toCid == prof.citizenid then return fail('You cannot message yourself') end
 
     local kind = VALID_DM_KINDS[payload.kind] and payload.kind or 'text'
     local body = (trimmed(payload.body) or ''):sub(1, birdyCfg.MaxDmLength)

server/birdy/init.lua

@@ -53,7 +53,11 @@ lib.callback.register('sd-phone:server:birdy:create',         function(src, payl
 lib.callback.register('sd-phone:server:birdy:reply',          function(src, payload) return withNotifyPush(actions.reply(src, payload)) end)
 lib.callback.register('sd-phone:server:birdy:toggleLike',     function(src, payload) return withNotifyPush(actions.toggleLike(src, payload)) end)
 lib.callback.register('sd-phone:server:birdy:toggleFollow',   function(src, payload) return withNotifyPush(actions.toggleFollow(src, payload)) end)
+lib.callback.register('sd-phone:server:birdy:toggleRepost',   function(src, payload) return withNotifyPush(actions.toggleRepost(src, payload)) end)
+lib.callback.register('sd-phone:server:birdy:followList',     function(src, payload) return actions.followList(src, payload) end)
 lib.callback.register('sd-phone:server:birdy:notifications',  function(src)          return actions.notifications(src) end)
+lib.callback.register('sd-phone:server:birdy:notificationCount', function(src)        return actions.notificationCount(src) end)
+lib.callback.register('sd-phone:server:birdy:dmResolve',      function(src, payload) return actions.dmResolve(src, payload) end)
 lib.callback.register('sd-phone:server:birdy:dmList',         function(src)          return actions.dmList(src) end)
 lib.callback.register('sd-phone:server:birdy:dmThread',       function(src, payload) return actions.dmThread(src, payload) end)
 lib.callback.register('sd-phone:server:birdy:dmMarkRead',     function(src, payload) return actions.markRead(src, payload) end)