Profile and login security

Prerequisites: a signed-in user and apiRequest. All operations here apply to the caller's own account.

Read and update your profile

getMyProfile returns the profile. updateMyProfile rejects unknown fields and requires at least one editable field:

const profile = await apiRequest("/v1/me", {
  method: "PATCH",
  body: JSON.stringify({ display_name: "Example Player", visibility: "private" }),
});
console.log(profile.display_name, profile.visibility);

Editable fields include username, names, bio, visibility, locale and timezone. Username has its own pattern/length requirements; visibility is public, friends, or private. Use the avatar workflow rather than PATCHing an avatar storage path.

Login sessions and devices

listMyAuthSessions lists authentication sessions. revokeMyAuthSession returns 204 on deletion:

await apiRequest(`/v1/me/sessions/${encodeURIComponent(loginSessionId)}`, {
  method: "DELETE",
});

Use an ID from the login-session list, not a game-session ID. GET /v1/me/sessions manages login sessions; POST /v1/me/sessions starts a game. Stopping a game uses its dedicated session lifecycle flow.

listDeviceAuthorizations and revokeDeviceAuthorization manage device grants. A grant's pending/approved/claimed/consumed status is not a game lifecycle state.

Refresh and recover

On an expired access token, use supabase.auth.refreshSession(), obtain the new access_token, and retry a read. If refreshing fails, sign in again. Avoid blindly replaying a write after a transport error; check the endpoint's idempotency behavior. A 204 has no JSON body. Revoking the current login session can require reauthentication.

Account deletion limitation

requestAccountDeletion currently stores a confirmation token and returns expiresInSeconds (900), but the implementation does not deliver the token to the user. confirmAccountDeletion expects that token and rejects invalid/expired tokens. There is no supported complete client walkthrough until token delivery is implemented. Do not assume an email was sent or attempt to read server-side Redis. This is a backend dependency, not an undocumented client parameter.