# Profile: avatar, about and timezone (contract between workers)

The global rules from `docs/m1-interfaces.md` apply: latest dependencies in root `[workspace.dependencies]`, no unwrap in non-test code, clippy `-D warnings` clean, no inline styles and no JS.

## Storage: migration `crates/forge-core/migrations/0002_profile.sql`
```sql
ALTER TABLE users ADD COLUMN about TEXT NOT NULL DEFAULT '';
ALTER TABLE users ADD COLUMN timezone TEXT NOT NULL DEFAULT 'UTC';
CREATE TABLE avatars (
    user_id     TEXT PRIMARY KEY REFERENCES users(id) ON DELETE CASCADE,
    data        BLOB NOT NULL,          -- re-encoded PNG, 256x256
    hash        TEXT NOT NULL,          -- hex sha256 of data (first 16 chars), used as ETag and as ?v=
    updated_at  TEXT NOT NULL
);
```
Avatars live in the DB, not on disk, so the standby replica and the backups carry them automatically. Each one is about 30–80 KB.

## forge-core
```rust
// model.rs: User gains
pub about: String,      // raw markdown, at most 2000 chars
pub timezone: String,   // IANA name, e.g. "Europe/Istanbul"; "UTC" by default

// store
pub async fn set_profile(&self, user_id: &str, about: &str, timezone: &str) -> Result<()>;
pub async fn set_avatar(&self, user_id: &str, png: &[u8], hash: &str) -> Result<()>;   // upsert
pub async fn delete_avatar(&self, user_id: &str) -> Result<()>;
pub async fn avatar_hash(&self, user_id: &str) -> Result<Option<String>>;
pub async fn avatar(&self, user_id: &str) -> Result<Option<(Vec<u8>, String /*hash*/)>>;

// tz.rs (jiff, latest; bundled tzdb so it doesn't depend on the host)
pub fn validate_timezone(name: &str) -> Result<()>;   // must be a known IANA name
pub fn all_timezones() -> Vec<String>;                // sorted, for the <select>
pub fn format_in_tz(unix: i64, tz: &str) -> String;   // "2026-10-15 14:05 +03"; falls back to UTC on error
pub fn local_time_now(tz: &str, now_unix: i64) -> String; // "14:05 (UTC+03:00)"

// avatar.rs (image, latest, only the png/jpeg/webp/gif decoders)
pub const MAX_UPLOAD_BYTES: usize = 5 * 1024 * 1024;
pub struct ProcessedAvatar { pub png: Vec<u8>, pub hash: String }
/// Decode with limits (max 4096x4096, image::Limits), center-crop to a square, resize to 256x256
/// (Lanczos3), re-encode as PNG. Metadata (EXIF/GPS) is dropped by re-encoding. SVG, unknown
/// formats, too-large input or a decode failure give Error::InvalidInput.
pub fn process_avatar(bytes: &[u8]) -> Result<ProcessedAvatar>;
```
`about` is limited to 2000 chars. Validation is in the store or the page (either is fine); the page shows the error.

## forge-web
- `GET /avatars/{username}` (route, cacheable):
  - Serves the PNG with `Content-Type: image/png`, `X-Content-Type-Options: nosniff`, `Content-Security-Policy: default-src 'none'`, `ETag: "<hash>"`, and `Cache-Control: public, max-age=31536000, immutable` when `?v=<hash>` matches; otherwise `max-age=300`. `If-None-Match` gives a 304.
  - **No avatar:** generated SVG with the first letter of the username on a color derived from the user id. It's built by our own code, the letter is XML-escaped, and it's still served with nosniff and the CSP above.
  - Unknown user: 404.
- Helper `views::avatar_url(username, hash: Option<&str>) -> String` gives `/avatars/<username>?v=<hash or "default">`. It's used in the nav, the profile page and the settings page.
- `/settings/profile`: the existing username-case form, plus:
  - avatar upload (`multipart/form-data`) and remove
  - an "about" textarea
  - a timezone `<select>` that lists every timezone
  - every POST has CSRF
- `GET /{username}`: the public profile page, showing:
  - avatar
  - display username
  - about, through `render_markdown(about, None)`
  - "Local time: 14:05 (UTC+03:00)"
  - repos visible to the viewer
  - 404 for an unknown user
  - Fixed routes (`/new`, `/login`, `/setup`, `/settings/*`, `/admin/*`, `/assets/*`, `/avatars/*`) must keep winning; reserved names guarantee no user owns those paths.
- **Absolute times** (the `title`/absolute text on commit, commits, tree and refs pages) use the logged-in viewer's timezone via `tz::format_in_tz`, or UTC for anonymous viewers. Relative times stay as they are.