Import OpenProfile from CoinPay

apps/site/app/_components/profile-form.tsx

@@ -63,6 +63,7 @@ export function ProfileForm() {
         defaultValues={values}
         errors={errors}
         idPrefix="account-"
+        importOpenProfile
       />
       <button className="button button--primary" type="submit" disabled={busy}>
         {busy ? "Saving…" : "Save details"}

apps/site/package.json

@@ -15,7 +15,7 @@
     "@nightcell7/game-core": "workspace:*",
     "@nightcell7/ui": "workspace:*",
     "@profullstack/footer": "latest",
-    "@profullstack/profile": "0.1.6",
+    "@profullstack/profile": "0.1.7",
     "better-auth": "1.7.13",
     "next": "16.4.3",
     "react": "^19.3.1",

packages/auth/package.json

@@ -18,6 +18,7 @@
     "@nightcell7/database": "workspace:*",
     "@simplewebauthn/server": "13.3.3",
     "better-auth": "^1.7.13",
+    "@profullstack/profile": "0.1.7",
     "zod": "^4.6.7"
   }
 }

packages/auth/src/server.ts

@@ -5,6 +5,7 @@ import { genericOAuth } from "better-auth/plugins/generic-oauth";
 import { passkey } from "@better-auth/passkey";
 import type { Database } from "@nightcell7/database";
 import { accounts, passkeys, sessions, users, verifications } from "@nightcell7/database";
+import { saveOpenProfileContact, type ProfileStore } from "@profullstack/profile";
 import { DISPLAY_NAME_MAX, DISPLAY_NAME_MIN } from "./index.js";
 
 /**
@@ -36,6 +37,8 @@ export interface AuthConfig {
    * not registered and the site hides its buttons.
    */
   coinpay?: CoinpaySignInConfig | null;
+  /** Shared private contact profile; used to import CoinPay's OpenProfile claim. */
+  profiles?: ProfileStore;
   /** Tests only: a Better Auth adapter in place of the Drizzle one over `db`. */
   adapter?: BetterAuthOptions["database"];
 }
@@ -101,6 +104,25 @@ export function coinpayProvider(config: CoinpaySignInConfig) {
   };
 }
 
+/**
+ * CoinPay's OpenProfile URL is also present in its verified OIDC ID token.
+ * Better Auth verifies that token against the discovered JWKS before its
+ * account database hooks run, so the claim can be used for this import.
+ */
+function openProfileUrlFromVerifiedToken(idToken: unknown): string | null {
+  if (typeof idToken !== "string") return null;
+  try {
+    const [, encoded] = idToken.split(".");
+    if (!encoded) return null;
+    const claims = JSON.parse(Buffer.from(encoded, "base64url").toString("utf8")) as {
+      openprofile_url?: unknown;
+    };
+    return typeof claims.openprofile_url === "string" ? claims.openprofile_url : null;
+  } catch {
+    return null;
+  }
+}
+
 export type AuthEmail =
   | { kind: "verify-email"; to: string; verifyUrl: string }
   | { kind: "password-reset"; to: string; resetUrl: string }
@@ -179,7 +201,21 @@ export function createAuth(config: AuthConfig) {
       account: {
         // Never persist social-login provider tokens (see stripOAuthTokens).
         create: {
-          before: async (account) => ({ data: stripOAuthTokens(account) }),
+          before: async (account) => {
+            if (account.providerId === COINPAY_PROVIDER_ID && config.profiles) {
+              const openProfileUrl = openProfileUrlFromVerifiedToken(account.idToken);
+              if (openProfileUrl) {
+                await saveOpenProfileContact(config.profiles, account.userId, openProfileUrl).catch(
+                  (error) =>
+                    console.warn(
+                      "[auth] CoinPay OpenProfile import failed:",
+                      error instanceof Error ? error.message : error,
+                    ),
+                );
+              }
+            }
+            return { data: stripOAuthTokens(account) };
+          },
         },
         update: {
           before: async (account) => ({ data: stripOAuthTokens(account) }),

services/api/package.json

@@ -23,7 +23,7 @@
     "@nightcell7/multiplayer-protocol": "workspace:*",
     "@nightcell7/observability": "workspace:*",
     "@profullstack/affiliates": "0.3.0",
-    "@profullstack/profile": "0.1.6",
+    "@profullstack/profile": "0.1.7",
     "@profullstack/redeem-credits": "0.2.0",
     "bullmq": "^6.4.2",
     "disposable-email-domains": "1.0.62",

services/api/src/index.ts

@@ -37,6 +37,7 @@ const health = new HealthReporter("api", env.BUILD_VERSION, PROTOCOL_VERSION);
 
 const redis = new Redis(env.REDIS_URL, { maxRetriesPerRequest: null });
 const database = getDatabase({ url: env.DATABASE_URL });
+const profiles = createProfileStore(getPool(), { keyType: "text" });
 
 const queues = new Map<string, Queue>();
 function queueFor(name: string): Queue {
@@ -81,6 +82,7 @@ const auth = createAuth({
           clientSecret: env.COINPAY_OAUTH_CLIENT_SECRET,
         }
       : null,
+  profiles,
   // Verification and reset mail goes through the same queue as everything
   // else, so a mail outage delays sign-ups rather than failing them outright.
   sendEmail: async (job) => {
@@ -117,7 +119,7 @@ const app = createApp({
   health,
   repos: createRepositories(database),
   // user_profiles, created by the drizzle migration 0002_profile_fields.
-  profiles: createProfileStore(getPool(), { keyType: "text" }),
+  profiles,
   credits,
   rateLimiter: new RedisRateLimiter(redis),
   coinpay,