feat: add avatar upload support (MinIO bucket, PocketBase field, SvelteKit API, iOS ProfileView)

ios/LibNovel/LibNovel.xcodeproj/project.pbxproj

@@ -14,6 +14,7 @@
 		2A15157AD2AE2271675C3485 /* ChapterReaderViewModel.swift in Sources */ = {isa = PBXBuildFile; fileRef = 8995E667B3DD9CFCAD8A91D7 /* ChapterReaderViewModel.swift */; };
 		3521DFD5FCBBED7B90368829 /* LibraryViewModel.swift in Sources */ = {isa = PBXBuildFile; fileRef = FC338B05EA6DB22900712000 /* LibraryViewModel.swift */; };
 		367C88FFC11701D2BAD8CCD0 /* RootTabView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 2D5C115992F1CE2326236765 /* RootTabView.swift */; };
+		41FB51553F1F1AEBFEA91C0A /* String+App.swift in Sources */ = {isa = PBXBuildFile; fileRef = FEC6F837FF2E902E334ED72E /* String+App.swift */; };
 		4BB2C76262D5BD5DAD0D5D28 /* LibNovelTests.swift in Sources */ = {isa = PBXBuildFile; fileRef = B4C918833E173D6B44D06955 /* LibNovelTests.swift */; };
 		58E440CE4360D755401D1672 /* ProfileViewModel.swift in Sources */ = {isa = PBXBuildFile; fileRef = 937A589F84FD412BBB6FBC45 /* ProfileViewModel.swift */; };
 		5D8D783259EF54C773788AAB /* AuthStore.swift in Sources */ = {isa = PBXBuildFile; fileRef = F219788AE5ACBD6F240674F5 /* AuthStore.swift */; };
@@ -29,7 +30,6 @@
 		CFDAA4776344B075A1E3CD6B /* Kingfisher in Frameworks */ = {isa = PBXBuildFile; productRef = 09584EAB68A07B47F876A062 /* Kingfisher */; };
 		E1F564399D1325F6A1B2B84F /* LibraryView.swift in Sources */ = {isa = PBXBuildFile; fileRef = C21107BECA55C07416E0CB8B /* LibraryView.swift */; };
 		E2572692178FD17145FDAF77 /* Color+App.swift in Sources */ = {isa = PBXBuildFile; fileRef = 9D83BB88C4306BE7A4F947CB /* Color+App.swift */; };
-		A1B2C3D4E5F6789012345678 /* String+App.swift in Sources */ = {isa = PBXBuildFile; fileRef = B2C3D4E5F67890123456789A /* String+App.swift */; };
 		EF3C57C400BF05CBEAC1F7FE /* HomeView.swift in Sources */ = {isa = PBXBuildFile; fileRef = D6268D60803940CBD38FB921 /* HomeView.swift */; };
 		F2AF05B9C8C23132A73ACDD3 /* CommonViews.swift in Sources */ = {isa = PBXBuildFile; fileRef = 8E89FD8F46747CA653C5203D /* CommonViews.swift */; };
 		F4FDA3C44752EB979235C042 /* NavDestination.swift in Sources */ = {isa = PBXBuildFile; fileRef = 7CAFB96D2500F34F0B0C860C /* NavDestination.swift */; };
@@ -67,7 +67,6 @@
 		937A589F84FD412BBB6FBC45 /* ProfileViewModel.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = ProfileViewModel.swift; sourceTree = "<group>"; };
 		9812F5FE30ED657FB40ABD7A /* BrowseViewModel.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = BrowseViewModel.swift; sourceTree = "<group>"; };
 		9D83BB88C4306BE7A4F947CB /* Color+App.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = "Color+App.swift"; sourceTree = "<group>"; };
-		B2C3D4E5F67890123456789A /* String+App.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = "String+App.swift"; sourceTree = "<group>"; };
 		B4C918833E173D6B44D06955 /* LibNovelTests.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = LibNovelTests.swift; sourceTree = "<group>"; };
 		B593F179EC3E9112126B540B /* APIClient.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = APIClient.swift; sourceTree = "<group>"; };
 		C0B17D50389C6C98FC78BDBC /* ProfileView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = ProfileView.swift; sourceTree = "<group>"; };
@@ -77,6 +76,7 @@
 		DF49C3AEF9D010F9FEDAB1FC /* PlayerViews.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = PlayerViews.swift; sourceTree = "<group>"; };
 		F219788AE5ACBD6F240674F5 /* AuthStore.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = AuthStore.swift; sourceTree = "<group>"; };
 		FC338B05EA6DB22900712000 /* LibraryViewModel.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = LibraryViewModel.swift; sourceTree = "<group>"; };
+		FEC6F837FF2E902E334ED72E /* String+App.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = "String+App.swift"; sourceTree = "<group>"; };
 /* End PBXFileReference section */
 
 /* Begin PBXFrameworksBuildPhase section */
@@ -274,7 +274,7 @@
 			children = (
 				9D83BB88C4306BE7A4F947CB /* Color+App.swift */,
 				7CAFB96D2500F34F0B0C860C /* NavDestination.swift */,
-				B2C3D4E5F67890123456789A /* String+App.swift */,
+				FEC6F837FF2E902E334ED72E /* String+App.swift */,
 			);
 			path = Extensions;
 			sourceTree = "<group>";
@@ -397,7 +397,6 @@
 				FEFB5FDC2424D22914458001 /* ChapterReaderView.swift in Sources */,
 				2A15157AD2AE2271675C3485 /* ChapterReaderViewModel.swift in Sources */,
 				E2572692178FD17145FDAF77 /* Color+App.swift in Sources */,
-				A1B2C3D4E5F6789012345678 /* String+App.swift in Sources */,
 				F2AF05B9C8C23132A73ACDD3 /* CommonViews.swift in Sources */,
 				94D0C4B15734B4056BF3B127 /* ContentView.swift in Sources */,
 				EF3C57C400BF05CBEAC1F7FE /* HomeView.swift in Sources */,
@@ -411,6 +410,7 @@
 				64D80AACB8E1967B17921EE3 /* ProfileView.swift in Sources */,
 				58E440CE4360D755401D1672 /* ProfileViewModel.swift in Sources */,
 				367C88FFC11701D2BAD8CCD0 /* RootTabView.swift in Sources */,
+				41FB51553F1F1AEBFEA91C0A /* String+App.swift in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -435,7 +435,7 @@
 					"@executable_path/Frameworks",
 					"@loader_path/Frameworks",
 				);
-				PRODUCT_BUNDLE_IDENTIFIER = cc.kalekber.libnovel.tests;
+				PRODUCT_BUNDLE_IDENTIFIER = com.kalekber.LibNovel.tests;
 				SDKROOT = iphoneos;
 				TARGETED_DEVICE_FAMILY = "1,2";
 				TEST_HOST = "$(BUILT_PRODUCTS_DIR)/LibNovel.app/LibNovel";
@@ -452,7 +452,7 @@
 					"@executable_path/Frameworks",
 					"@loader_path/Frameworks",
 				);
-				PRODUCT_BUNDLE_IDENTIFIER = cc.kalekber.libnovel.tests;
+				PRODUCT_BUNDLE_IDENTIFIER = com.kalekber.LibNovel.tests;
 				SDKROOT = iphoneos;
 				TARGETED_DEVICE_FAMILY = "1,2";
 				TEST_HOST = "$(BUILT_PRODUCTS_DIR)/LibNovel.app/LibNovel";
@@ -463,16 +463,21 @@
 			isa = XCBuildConfiguration;
 			buildSettings = {
 				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
-				CODE_SIGN_IDENTITY = "iPhone Developer";
+				CODE_SIGN_IDENTITY = "Apple Development";
+				CODE_SIGN_STYLE = Automatic;
+				CURRENT_PROJECT_VERSION = 1;
 				DEVELOPMENT_TEAM = GHZXC6FVMU;
 				GENERATE_INFOPLIST_FILE = NO;
 				INFOPLIST_FILE = LibNovel/Resources/Info.plist;
+				INFOPLIST_KEY_LSApplicationCategoryType = "public.app-category.books";
 				IPHONEOS_DEPLOYMENT_TARGET = 17.0;
 				LD_RUNPATH_SEARCH_PATHS = (
 					"$(inherited)",
 					"@executable_path/Frameworks",
 				);
-				PRODUCT_BUNDLE_IDENTIFIER = cc.kalekber.libnovel;
+				MARKETING_VERSION = 1.0.1;
+				PRODUCT_BUNDLE_IDENTIFIER = com.kalekber.LibNovel;
+				PROVISIONING_PROFILE_SPECIFIER = "";
 				SDKROOT = iphoneos;
 				TARGETED_DEVICE_FAMILY = "1,2";
 			};
@@ -512,7 +517,7 @@
 				CLANG_WARN_UNREACHABLE_CODE = YES;
 				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
 				COPY_PHASE_STRIP = NO;
-				CURRENT_PROJECT_VERSION = 1;
+				CURRENT_PROJECT_VERSION = 1000;
 				DEBUG_INFORMATION_FORMAT = dwarf;
 				ENABLE_PREVIEWS = YES;
 				ENABLE_STRICT_OBJC_MSGSEND = YES;
@@ -549,16 +554,24 @@
 			isa = XCBuildConfiguration;
 			buildSettings = {
 				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
-				CODE_SIGN_IDENTITY = "iPhone Developer";
+				CODE_SIGN_IDENTITY = "Apple Distribution";
+				"CODE_SIGN_IDENTITY[sdk=iphoneos*]" = "iPhone Distribution";
+				CODE_SIGN_STYLE = Manual;
+				CURRENT_PROJECT_VERSION = 1;
 				DEVELOPMENT_TEAM = GHZXC6FVMU;
+				"DEVELOPMENT_TEAM[sdk=iphoneos*]" = GHZXC6FVMU;
 				GENERATE_INFOPLIST_FILE = NO;
 				INFOPLIST_FILE = LibNovel/Resources/Info.plist;
+				INFOPLIST_KEY_LSApplicationCategoryType = "public.app-category.books";
 				IPHONEOS_DEPLOYMENT_TARGET = 17.0;
 				LD_RUNPATH_SEARCH_PATHS = (
 					"$(inherited)",
 					"@executable_path/Frameworks",
 				);
-				PRODUCT_BUNDLE_IDENTIFIER = cc.kalekber.libnovel;
+				MARKETING_VERSION = 1.0.1;
+				PRODUCT_BUNDLE_IDENTIFIER = com.kalekber.LibNovel;
+				PROVISIONING_PROFILE = "af592c3a-f60b-4ac1-a14f-30b8a206017f";
+				"PROVISIONING_PROFILE_SPECIFIER[sdk=iphoneos*]" = "LibNovel Distribution";
 				SDKROOT = iphoneos;
 				TARGETED_DEVICE_FAMILY = "1,2";
 			};
@@ -598,7 +611,7 @@
 				CLANG_WARN_UNREACHABLE_CODE = YES;
 				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
 				COPY_PHASE_STRIP = NO;
-				CURRENT_PROJECT_VERSION = 1;
+				CURRENT_PROJECT_VERSION = 1000;
 				DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym";
 				ENABLE_NS_ASSERTIONS = NO;
 				ENABLE_PREVIEWS = YES;

ios/LibNovel/LibNovel.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved

@@ -1,5 +1,5 @@
 {
-  "originHash" : "18350c2bfa3935125b6f4e9817e7ed4508588c07142d420b8b8ee00640a57853",
+  "originHash" : "ad75ae2d3b8d8b80d99635f65213a3c1092464aa54a86354f850b8317b6fa240",
   "pins" : [
     {
       "identity" : "kingfisher",

ios/LibNovel/LibNovel.xcodeproj/xcshareddata/xcschemes/LibNovel.xcscheme

@@ -79,7 +79,7 @@
       <EnvironmentVariables>
          <EnvironmentVariable
             key = "LIBNOVEL_BASE_URL"
-            value = "[&quot;isEnabled&quot;: true, &quot;value&quot;: &quot;https://v2.libnovel.kalekber.cc&quot;]"
+            value = "[&quot;value&quot;: &quot;https://v2.libnovel.kalekber.cc&quot;, &quot;isEnabled&quot;: true]"
             isEnabled = "YES">
          </EnvironmentVariable>
       </EnvironmentVariables>

ios/LibNovel/LibNovel/Models/Models.swift

@@ -190,15 +190,22 @@ struct AppUser: Codable, Identifiable {
     let username: String
     let role: String
     let created: String
+    let avatarURL: String?
 
     var isAdmin: Bool { role == "admin" }
 
+    enum CodingKeys: String, CodingKey {
+        case id, username, role, created
+        case avatarURL = "avatar_url"
+    }
+
     init(from decoder: Decoder) throws {
         let c = try decoder.container(keyedBy: CodingKeys.self)
         id        = try c.decode(String.self, forKey: .id)
         username  = try c.decode(String.self, forKey: .username)
         role      = try c.decodeIfPresent(String.self, forKey: .role) ?? "user"
         created   = try c.decodeIfPresent(String.self, forKey: .created) ?? ""
+        avatarURL = try c.decodeIfPresent(String.self, forKey: .avatarURL)
     }
 }
 

ios/LibNovel/LibNovel/Networking/APIClient.swift

@@ -283,6 +283,45 @@ actor APIClient {
     func revokeSession(id: String) async throws {
         let _: EmptyResponse = try await fetch("/api/sessions/\(id)", method: "DELETE")
     }
+
+    // MARK: - Avatar
+
+    struct AvatarResponse: Decodable {
+        let avatarURL: String?
+        enum CodingKeys: String, CodingKey { case avatarURL = "avatar_url" }
+    }
+
+    /// Upload a JPEG image as the user's profile avatar.
+    /// Returns the presigned URL for the uploaded avatar.
+    func uploadAvatar(_ imageData: Data, mimeType: String = "image/jpeg") async throws -> String? {
+        let boundary = "Boundary-\(UUID().uuidString)"
+        let urlString = baseURL.absoluteString.trimmingCharacters(in: CharacterSet(charactersIn: "/"))
+            + "/api/profile/avatar"
+        guard let url = URL(string: urlString) else { throw APIError.invalidResponse }
+
+        var req = URLRequest(url: url)
+        req.httpMethod = "POST"
+        req.setValue("multipart/form-data; boundary=\(boundary)", forHTTPHeaderField: "Content-Type")
+        req.setValue("application/json", forHTTPHeaderField: "Accept")
+
+        var body = Data()
+        let ext = mimeType.contains("png") ? "png" : mimeType.contains("webp") ? "webp" : "jpg"
+        body.append("--\(boundary)\r\n".data(using: .utf8)!)
+        body.append("Content-Disposition: form-data; name=\"file\"; filename=\"avatar.\(ext)\"\r\n".data(using: .utf8)!)
+        body.append("Content-Type: \(mimeType)\r\n\r\n".data(using: .utf8)!)
+        body.append(imageData)
+        body.append("\r\n--\(boundary)--\r\n".data(using: .utf8)!)
+        req.httpBody = body
+
+        let (data, response) = try await session.data(for: req)
+        guard let http = response as? HTTPURLResponse else { throw APIError.invalidResponse }
+        guard (200..<300).contains(http.statusCode) else {
+            let raw = String(data: data, encoding: .utf8) ?? ""
+            throw APIError.httpError(http.statusCode, raw)
+        }
+        let result = try JSONDecoder.iso8601.decode(AvatarResponse.self, from: data)
+        return result.avatarURL
+    }
 }
 
 // MARK: - Response types

ios/LibNovel/LibNovel/Resources/Info.plist

@@ -2,22 +2,30 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
-	<key>CFBundleExecutable</key>
-	<string>$(EXECUTABLE_NAME)</string>
-	<key>CFBundleName</key>
-	<string>LibNovel</string>
 	<key>CFBundleDisplayName</key>
 	<string>LibNovel</string>
+	<key>CFBundleExecutable</key>
+	<string>$(EXECUTABLE_NAME)</string>
 	<key>CFBundleIdentifier</key>
-	<string>com.kalekber.LibNovel</string>
+	<string>$(PRODUCT_BUNDLE_IDENTIFIER)</string>
-	<key>CFBundleVersion</key>
+	<key>CFBundleName</key>
-	<string>1000</string>
+	<string>LibNovel</string>
-	<key>CFBundleShortVersionString</key>
-	<string>$(MARKETING_VERSION)</string>
 	<key>CFBundlePackageType</key>
 	<string>APPL</string>
+	<key>CFBundleShortVersionString</key>
+	<string>$(MARKETING_VERSION)</string>
+	<key>CFBundleVersion</key>
+	<string>1000</string>
+	<key>LIBNOVEL_BASE_URL</key>
+	<string>$(LIBNOVEL_BASE_URL)</string>
 	<key>LSRequiresIPhoneOS</key>
 	<true/>
+	<key>UIBackgroundModes</key>
+	<array>
+		<string>audio</string>
+	</array>
+	<key>UILaunchScreen</key>
+	<dict/>
 	<key>UISupportedInterfaceOrientations</key>
 	<array>
 		<string>UIInterfaceOrientationPortrait</string>
@@ -31,13 +39,5 @@
 		<string>UIInterfaceOrientationLandscapeLeft</string>
 		<string>UIInterfaceOrientationLandscapeRight</string>
 	</array>
-	<key>UILaunchScreen</key>
-	<dict/>
-	<key>UIBackgroundModes</key>
-	<array>
-		<string>audio</string>
-	</array>
-	<key>LIBNOVEL_BASE_URL</key>
-	<string>$(LIBNOVEL_BASE_URL)</string>
 </dict>
 </plist>

ios/LibNovel/LibNovel/Views/ChapterReader/ChapterReaderView.swift

@@ -66,17 +66,17 @@ struct ChapterReaderView: View {
                 bottomChrome(content: content)
             }
 
-            // Reading settings panel slides up from bottom
-            if showSettingsPanel {
-                ReaderSettingsPanel(store: readerSettings, isPresented: $showSettingsPanel)
-                    .transition(.move(edge: .bottom).combined(with: .opacity))
-                    .zIndex(10)
-            }
         }
         .navigationBarHidden(true)   // we draw our own chrome
         .ignoresSafeArea(edges: .top)
         .preferredColorScheme(readerSettings.settings.theme.colorScheme)
         .task(id: currentChapter) { await vm.load() }
+        .sheet(isPresented: $showSettingsPanel) {
+            ReaderSettingsPanel(store: readerSettings, isPresented: $showSettingsPanel)
+                .presentationDetents([.height(380)])
+                .presentationDragIndicator(.visible)
+                .presentationCornerRadius(20)
+        }
         .sheet(isPresented: $showToCSheet) {
             if let content = vm.content {
                 ChaptersListSheet(
@@ -806,15 +806,8 @@ struct ReaderSettingsPanel: View {
     @Binding var isPresented: Bool
 
     var body: some View {
-        VStack(spacing: 0) {
-            Spacer()
-
         VStack(spacing: 24) {
-                // Handle
+                // Font size row
-                Capsule()
-                    .fill(Color(.systemGray4))
-                    .frame(width: 36, height: 4)
-                    .padding(.top, 12)
 
                 // Font size row
                 HStack(spacing: 0) {
@@ -913,22 +906,7 @@ struct ReaderSettingsPanel: View {
                 Color.clear.frame(height: 16)
         }
         .padding(.horizontal, 24)
-            .background(
+        .padding(.top, 8)
-                RoundedRectangle(cornerRadius: 20)
-                    .fill(.regularMaterial)
-                    .ignoresSafeArea(edges: .bottom)
-            )
-        }
-        .ignoresSafeArea(edges: .bottom)
-        .background(
-            Color.black.opacity(0.25)
-                .ignoresSafeArea()
-                .onTapGesture {
-                    withAnimation(.spring(response: 0.35, dampingFraction: 0.8)) {
-                        isPresented = false
-                    }
-                }
-        )
     }
 
     private func adjustFontSize(_ delta: CGFloat) {

ios/LibNovel/LibNovel/Views/Profile/ProfileView.swift

@@ -1,31 +1,99 @@
 import SwiftUI
+import PhotosUI
+import Kingfisher
 
 struct ProfileView: View {
     @EnvironmentObject var authStore: AuthStore
     @StateObject private var vm = ProfileViewModel()
     @State private var showChangePassword = false
 
+    // Avatar upload state
+    @State private var photoPickerItem: PhotosPickerItem?
+    @State private var avatarURL: String? = nil
+    @State private var avatarUploading = false
+    @State private var avatarError: String?
+
     var body: some View {
         NavigationStack {
             List {
-                // User header
+                // ── User header ────────────────────────────────────────────
                 Section {
-                    HStack(spacing: 14) {
+                    HStack(spacing: 16) {
+                        // Tappable avatar circle
+                        PhotosPicker(selection: $photoPickerItem,
+                                     matching: .images,
+                                     photoLibrary: .shared()) {
+                            ZStack {
+                                Circle()
+                                    .fill(Color(.systemGray5))
+                                    .frame(width: 72, height: 72)
+
+                                if avatarUploading {
+                                    ProgressView()
+                                        .frame(width: 72, height: 72)
+                                } else if let urlStr = avatarURL ?? authStore.user?.avatarURL,
+                                          let url = URL(string: urlStr) {
+                                    KFImage(url)
+                                        .placeholder {
                                             Image(systemName: "person.circle.fill")
-                            .font(.system(size: 48))
+                                                .font(.system(size: 52))
                                                 .foregroundStyle(.amber)
-                        VStack(alignment: .leading, spacing: 2) {
+                                        }
+                                        .resizable()
+                                        .scaledToFill()
+                                        .frame(width: 72, height: 72)
+                                        .clipShape(Circle())
+                                } else {
+                                    Image(systemName: "person.circle.fill")
+                                        .font(.system(size: 52))
+                                        .foregroundStyle(.amber)
+                                        .frame(width: 72, height: 72)
+                                }
+
+                                // Camera overlay badge
+                                if !avatarUploading {
+                                    VStack {
+                                        Spacer()
+                                        HStack {
+                                            Spacer()
+                                            ZStack {
+                                                Circle()
+                                                    .fill(Color.amber)
+                                                    .frame(width: 22, height: 22)
+                                                Image(systemName: "camera.fill")
+                                                    .font(.system(size: 10, weight: .semibold))
+                                                    .foregroundStyle(.black)
+                                            }
+                                            .offset(x: 2, y: 2)
+                                        }
+                                    }
+                                    .frame(width: 72, height: 72)
+                                }
+                            }
+                        }
+                        .buttonStyle(.plain)
+                        .onChange(of: photoPickerItem) { _, item in
+                            guard let item else { return }
+                            Task { await uploadPickedPhoto(item) }
+                        }
+
+                        VStack(alignment: .leading, spacing: 3) {
                             Text(authStore.user?.username ?? "")
                                 .font(.headline)
                             Text(authStore.user?.role.capitalized ?? "")
                                 .font(.caption)
                                 .foregroundStyle(.secondary)
+                            if let err = avatarError {
+                                Text(err)
+                                    .font(.caption2)
+                                    .foregroundStyle(.red)
+                            }
                         }
                     }
                     .padding(.vertical, 6)
                 }
 
-                // Reading settings
+                // ── Reading settings ───────────────────────────────────────
                 Section("Reading Settings") {
                     voicePicker
                     speedSlider
@@ -42,7 +110,7 @@ struct ProfileView: View {
                     .tint(.amber)
                 }
 
-                // Sessions
+                // ── Sessions ───────────────────────────────────────────────
                 Section("Active Sessions") {
                     if vm.sessionsLoading {
                         ProgressView()
@@ -55,7 +123,7 @@ struct ProfileView: View {
                     }
                 }
 
-                // Account
+                // ── Account ────────────────────────────────────────────────
                 Section("Account") {
                     Button("Change Password") { showChangePassword = true }
                     Button("Sign Out", role: .destructive) {
@@ -64,7 +132,9 @@ struct ProfileView: View {
                 }
             }
             .navigationTitle("Profile")
-            .task { await vm.loadSessions() }
+            .task {
+                await vm.loadSessions()
+            }
             .sheet(isPresented: $showChangePassword) {
                 ChangePasswordView()
             }
@@ -72,6 +142,39 @@ struct ProfileView: View {
         }
     }
 
+    // MARK: - Avatar upload
+
+    private func uploadPickedPhoto(_ item: PhotosPickerItem) async {
+        avatarUploading = true
+        avatarError = nil
+        defer { avatarUploading = false }
+
+        do {
+            guard let data = try await item.loadTransferable(type: Data.self) else {
+                avatarError = "Could not read image"
+                return
+            }
+            // Compress to JPEG for consistent handling
+            let mimeType: String
+            let uploadData: Data
+            if let uiImage = UIImage(data: data),
+               let jpeg = uiImage.jpegData(compressionQuality: 0.85) {
+                uploadData = jpeg
+                mimeType = "image/jpeg"
+            } else {
+                uploadData = data
+                mimeType = "image/png"
+            }
+
+            let url = try await APIClient.shared.uploadAvatar(uploadData, mimeType: mimeType)
+            avatarURL = url
+            // Refresh user record so the new avatar persists across sessions
+            await authStore.validateToken()
+        } catch {
+            avatarError = "Upload failed: \(error.localizedDescription)"
+        }
+    }
+
     // MARK: - Voice picker
 
     @ViewBuilder

scraper/cmd/scraper/main.go

@@ -95,6 +95,7 @@ func run(log *slog.Logger) error {
 		BucketChapters: envOr("MINIO_BUCKET_CHAPTERS", "libnovel-chapters"),
 		BucketAudio:    envOr("MINIO_BUCKET_AUDIO", "libnovel-audio"),
 		BucketBrowse:   envOr("MINIO_BUCKET_BROWSE", "libnovel-browse"),
+		BucketAvatars:  envOr("MINIO_BUCKET_AVATARS", "libnovel-avatars"),
 	}
 	pbCfg := storage.PocketBaseConfig{
 		BaseURL:       envOr("POCKETBASE_URL", "http://localhost:8090"),

scraper/internal/storage/minio.go

@@ -23,6 +23,7 @@ type MinioConfig struct {
 	BucketChapters string // e.g. "libnovel-chapters"
 	BucketAudio    string // e.g. "libnovel-audio"
 	BucketBrowse   string // e.g. "libnovel-browse"
+	BucketAvatars  string // e.g. "libnovel-avatars"
 }
 
 // MinioClient wraps a minio.Client and exposes object operations for
@@ -59,7 +60,7 @@ func NewMinioClient(ctx context.Context, cfg MinioConfig) (*MinioClient, error)
 	}
 
 	mc := &MinioClient{c: c, pub: pub, cfg: cfg}
-	for _, bucket := range []string{cfg.BucketChapters, cfg.BucketAudio, cfg.BucketBrowse} {
+	for _, bucket := range []string{cfg.BucketChapters, cfg.BucketAudio, cfg.BucketBrowse, cfg.BucketAvatars} {
 		if bucket == "" {
 			continue
 		}
@@ -336,3 +337,61 @@ func sanitiseVoice(voice string) string {
 		return '_'
 	}, voice)
 }
+
+// ─── Avatar objects ───────────────────────────────────────────────────────────
+
+// avatarKey returns the MinIO object key for a user avatar.
+// Layout: avatars/{userId}.{ext}
+func avatarKey(userID, ext string) string {
+	return fmt.Sprintf("avatars/%s.%s", userID, ext)
+}
+
+// PutAvatar stores an avatar image in the avatars bucket.
+// ext should be "jpg", "png", or "webp".
+func (m *MinioClient) PutAvatar(ctx context.Context, userID, ext string, data []byte, contentType string) error {
+	if m.cfg.BucketAvatars == "" {
+		return fmt.Errorf("minio: avatars bucket not configured")
+	}
+	key := avatarKey(userID, ext)
+	_, err := m.c.PutObject(ctx, m.cfg.BucketAvatars, key,
+		bytes.NewReader(data), int64(len(data)),
+		minio.PutObjectOptions{ContentType: contentType})
+	if err != nil {
+		return fmt.Errorf("minio: put avatar %s: %w", key, err)
+	}
+	return nil
+}
+
+// PresignAvatarURL returns a presigned GET URL for a user avatar.
+// Returns ("", false, nil) when no avatar exists for the given userID.
+func (m *MinioClient) PresignAvatarURL(ctx context.Context, userID string) (string, bool, error) {
+	if m.cfg.BucketAvatars == "" {
+		return "", false, nil
+	}
+	// Try common extensions in order of preference.
+	for _, ext := range []string{"jpg", "png", "webp", "gif"} {
+		key := avatarKey(userID, ext)
+		_, statErr := m.c.StatObject(ctx, m.cfg.BucketAvatars, key, minio.StatObjectOptions{})
+		if statErr != nil {
+			continue
+		}
+		u, err := m.pub.PresignedGetObject(ctx, m.cfg.BucketAvatars, key, 24*time.Hour, nil)
+		if err != nil {
+			return "", false, fmt.Errorf("minio: presign avatar %s: %w", key, err)
+		}
+		return u.String(), true, nil
+	}
+	return "", false, nil
+}
+
+// DeleteAvatar removes any existing avatar for the given userID (all extensions).
+func (m *MinioClient) DeleteAvatar(ctx context.Context, userID string) error {
+	if m.cfg.BucketAvatars == "" {
+		return nil
+	}
+	for _, ext := range []string{"jpg", "png", "webp", "gif"} {
+		key := avatarKey(userID, ext)
+		_ = m.c.RemoveObject(ctx, m.cfg.BucketAvatars, key, minio.RemoveObjectOptions{})
+	}
+	return nil
+}

scraper/internal/storage/pocketbase.go

@@ -458,6 +458,8 @@ type migration struct {
 var migrations = []migration{
 	// user_id was added to progress after initial deploy.
 	{"progress", "user_id", "text"},
+	// avatar_url stores the MinIO presign path for the user's profile picture.
+	{"app_users", "avatar_url", "text"},
 }
 
 // EnsureMigrations idempotently adds any fields that are missing from existing

ui/package.json

@@ -25,6 +25,8 @@
 		"vite": "^7.3.1"
 	},
 	"dependencies": {
+		"@aws-sdk/client-s3": "^3.1005.0",
+		"@aws-sdk/s3-request-presigner": "^3.1005.0",
 		"marked": "^17.0.3",
 		"pocketbase": "^0.26.8"
 	}

ui/src/lib/server/minio.ts

@@ -9,12 +9,101 @@
 import { env } from '$env/dynamic/private';
 import { env as pubEnv } from '$env/dynamic/public';
 import { log } from '$lib/server/logger';
+import { S3Client, PutObjectCommand, DeleteObjectCommand, HeadObjectCommand, GetObjectCommand } from '@aws-sdk/client-s3';
+import { getSignedUrl } from '@aws-sdk/s3-request-presigner';
 
 const SCRAPER_URL = env.SCRAPER_API_URL ?? 'http://localhost:8080';
 // Public MinIO URL — used to rewrite presigned URLs so the browser can reach MinIO directly.
 // In docker-compose this would differ from the internal endpoint.
 const MINIO_PUBLIC_URL = pubEnv.PUBLIC_MINIO_PUBLIC_URL ?? 'http://localhost:9000';
 
+// MinIO direct client (for avatar uploads — not routed through Go scraper)
+const MINIO_ENDPOINT = env.MINIO_ENDPOINT ?? 'localhost:9000';
+const MINIO_ACCESS_KEY = env.MINIO_ACCESS_KEY ?? 'admin';
+const MINIO_SECRET_KEY = env.MINIO_SECRET_KEY ?? 'changeme123';
+const MINIO_USE_SSL = (env.MINIO_USE_SSL ?? 'false').toLowerCase() === 'true';
+const BUCKET_AVATARS = env.MINIO_BUCKET_AVATARS ?? 'libnovel-avatars';
+
+function makeS3Client(): S3Client {
+	return new S3Client({
+		endpoint: `${MINIO_USE_SSL ? 'https' : 'http'}://${MINIO_ENDPOINT}`,
+		region: 'us-east-1', // MinIO ignores region but SDK requires one
+		credentials: { accessKeyId: MINIO_ACCESS_KEY, secretAccessKey: MINIO_SECRET_KEY },
+		forcePathStyle: true // MinIO requires path-style URLs
+	});
+}
+
+// ─── Avatar helpers ───────────────────────────────────────────────────────────
+
+const AVATAR_EXTS = ['jpg', 'png', 'webp', 'gif'] as const;
+type AvatarExt = (typeof AVATAR_EXTS)[number];
+
+function avatarKey(userId: string, ext: AvatarExt): string {
+	return `avatars/${userId}.${ext}`;
+}
+
+function extFromMime(mime: string): AvatarExt {
+	if (mime.includes('png')) return 'png';
+	if (mime.includes('webp')) return 'webp';
+	if (mime.includes('gif')) return 'gif';
+	return 'jpg';
+}
+
+/**
+ * Upload an avatar image buffer to MinIO.
+ * Deletes any existing avatar for this user first, then stores the new one.
+ * Returns the MinIO object key (e.g. "avatars/abc123.jpg").
+ */
+export async function putAvatar(userId: string, data: Uint8Array, mimeType: string): Promise<string> {
+	const ext = extFromMime(mimeType);
+	const s3 = makeS3Client();
+
+	// Delete old avatars (all extensions) to avoid stale objects
+	await Promise.all(
+		AVATAR_EXTS.map((e) =>
+			s3.send(new DeleteObjectCommand({ Bucket: BUCKET_AVATARS, Key: avatarKey(userId, e) })).catch(() => {})
+		)
+	);
+
+	const key = avatarKey(userId, ext);
+	await s3.send(
+		new PutObjectCommand({
+			Bucket: BUCKET_AVATARS,
+			Key: key,
+			Body: data,
+			ContentType: mimeType
+		})
+	);
+	log.info('minio', 'avatar uploaded', { userId, key });
+	return key;
+}
+
+/**
+ * Returns a presigned GET URL for a user's avatar, rewritten to the public URL.
+ * Returns null if no avatar exists.
+ */
+export async function presignAvatarUrl(userId: string): Promise<string | null> {
+	const s3 = makeS3Client();
+	for (const ext of AVATAR_EXTS) {
+		const key = avatarKey(userId, ext);
+		try {
+			await s3.send(new HeadObjectCommand({ Bucket: BUCKET_AVATARS, Key: key }));
+			// Object exists — generate presigned URL using public endpoint
+			const pubS3 = new S3Client({
+				endpoint: MINIO_PUBLIC_URL,
+				region: 'us-east-1',
+				credentials: { accessKeyId: MINIO_ACCESS_KEY, secretAccessKey: MINIO_SECRET_KEY },
+				forcePathStyle: true
+			});
+			const url = await getSignedUrl(pubS3, new GetObjectCommand({ Bucket: BUCKET_AVATARS, Key: key }), { expiresIn: 86400 });
+			return url;
+		} catch {
+			// not found or error — try next extension
+		}
+	}
+	return null;
+}
+
 /**
  * Rewrites the MinIO host in a presigned URL to the public-facing URL.
  * The presigned URL is signed against the internal endpoint (e.g. minio:9000),

ui/src/lib/server/pocketbase.ts

@@ -62,6 +62,7 @@ export interface User {
 	password_hash: string;
 	role: string;
 	created: string;
+	avatar_url?: string;
 }
 
 // ─── Auth token cache ─────────────────────────────────────────────────────────
@@ -794,3 +795,15 @@ export async function revokeAllUserSessions(userId: string): Promise<void> {
 		)
 	);
 }
+
+/**
+ * Update the avatar_url field for a user record.
+ */
+export async function updateUserAvatarUrl(userId: string, avatarUrl: string): Promise<void> {
+	const token = await getToken();
+	await fetch(`${PB_URL}/api/collections/app_users/records/${userId}`, {
+		method: 'PATCH',
+		headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
+		body: JSON.stringify({ avatar_url: avatarUrl })
+	});
+}

ui/src/routes/api/auth/me/+server.ts

@@ -1,5 +1,6 @@
 import { json, error } from '@sveltejs/kit';
 import type { RequestHandler } from './$types';
+import { getUserByUsername } from '$lib/server/pocketbase';
 
 /**
  * GET /api/auth/me
@@ -10,9 +11,12 @@ export const GET: RequestHandler = async ({ locals }) => {
 	if (!locals.user) {
 		error(401, 'Not authenticated');
 	}
+	// Fetch full record from PocketBase to get avatar_url
+	const record = await getUserByUsername(locals.user.username).catch(() => null);
 	return json({
 		id: locals.user.id,
 		username: locals.user.username,
-		role: locals.user.role
+		role: locals.user.role,
+		avatar_url: record?.avatar_url ?? null
 	});
 };

ui/src/routes/api/profile/avatar/+server.ts

@@ -0,0 +1,67 @@
+import { json, error } from '@sveltejs/kit';
+import type { RequestHandler } from './$types';
+import { putAvatar, presignAvatarUrl } from '$lib/server/minio';
+import { updateUserAvatarUrl, getUserByUsername } from '$lib/server/pocketbase';
+
+const MAX_SIZE = 5 * 1024 * 1024; // 5 MB
+const ALLOWED_TYPES = ['image/jpeg', 'image/png', 'image/webp', 'image/gif'];
+
+/**
+ * POST /api/profile/avatar
+ * Accepts multipart/form-data with a "file" field.
+ * Uploads to MinIO libnovel-avatars bucket, stores the key in app_users.avatar_url.
+ * Returns { avatar_url: <presigned-url> }.
+ */
+export const POST: RequestHandler = async ({ request, locals }) => {
+	if (!locals.user) error(401, 'Not authenticated');
+
+	const contentType = request.headers.get('content-type') ?? '';
+	if (!contentType.includes('multipart/form-data')) {
+		error(400, 'Expected multipart/form-data');
+	}
+
+	let formData: FormData;
+	try {
+		formData = await request.formData();
+	} catch {
+		error(400, 'Failed to parse form data');
+	}
+
+	const file = formData.get('file');
+	if (!(file instanceof File)) error(400, 'Missing "file" field');
+
+	if (!ALLOWED_TYPES.includes(file.type)) {
+		error(400, `Unsupported image type: ${file.type}. Allowed: jpeg, png, webp, gif`);
+	}
+
+	if (file.size > MAX_SIZE) {
+		error(413, 'Image too large (max 5 MB)');
+	}
+
+	const buffer = new Uint8Array(await file.arrayBuffer());
+	const key = await putAvatar(locals.user.id, buffer, file.type);
+
+	// Persist key in PocketBase so we can look it up later
+	await updateUserAvatarUrl(locals.user.id, key);
+
+	// Return a fresh presigned URL for immediate use
+	const avatarUrl = await presignAvatarUrl(locals.user.id);
+	return json({ avatar_url: avatarUrl });
+};
+
+/**
+ * GET /api/profile/avatar
+ * Returns a presigned URL for the current user's avatar, or null if none set.
+ */
+export const GET: RequestHandler = async ({ locals }) => {
+	if (!locals.user) error(401, 'Not authenticated');
+
+	// First try to get from PocketBase record (the stored key acts as a flag)
+	const record = await getUserByUsername(locals.user.username).catch(() => null);
+	if (!record?.avatar_url) {
+		return json({ avatar_url: null });
+	}
+
+	const avatarUrl = await presignAvatarUrl(locals.user.id);
+	return json({ avatar_url: avatarUrl });
+};

ui/src/routes/profile/+page.server.ts

@@ -1,6 +1,7 @@
 import { fail, redirect } from '@sveltejs/kit';
 import type { Actions, PageServerLoad } from './$types';
-import { changePassword, listUserSessions } from '$lib/server/pocketbase';
+import { changePassword, listUserSessions, getUserByUsername } from '$lib/server/pocketbase';
+import { presignAvatarUrl } from '$lib/server/minio';
 import { log } from '$lib/server/logger';
 
 export const load: PageServerLoad = async ({ locals }) => {
@@ -15,8 +16,20 @@ export const load: PageServerLoad = async ({ locals }) => {
 		log.warn('profile', 'listUserSessions failed (non-fatal)', { err: String(e) });
 	}
 
+	// Fetch avatar presigned URL if user has one
+	let avatarUrl: string | null = null;
+	try {
+		const record = await getUserByUsername(locals.user.username);
+		if (record?.avatar_url) {
+			avatarUrl = await presignAvatarUrl(locals.user.id);
+		}
+	} catch (e) {
+		log.warn('profile', 'avatar fetch failed (non-fatal)', { err: String(e) });
+	}
+
 	return {
 		user: locals.user,
+		avatarUrl,
 		sessions: sessions.map((s) => ({
 			id: s.id,
 			user_agent: s.user_agent,

ui/src/routes/profile/+page.svelte

@@ -6,6 +6,38 @@
 
 	let { data, form }: { data: PageData; form: ActionData } = $props();
 
+	// ── Avatar ───────────────────────────────────────────────────────────────────
+	let avatarUrl = $state<string | null>(data.avatarUrl ?? null);
+	let avatarUploading = $state(false);
+	let avatarError = $state('');
+	let fileInput: HTMLInputElement | null = null;
+
+	async function handleAvatarChange(e: Event) {
+		const input = e.target as HTMLInputElement;
+		const file = input.files?.[0];
+		if (!file) return;
+
+		avatarUploading = true;
+		avatarError = '';
+		try {
+			const fd = new FormData();
+			fd.append('file', file);
+			const res = await fetch('/api/profile/avatar', { method: 'POST', body: fd });
+			if (!res.ok) {
+				const body = await res.json().catch(() => ({})) as { message?: string };
+				avatarError = body.message ?? `Upload failed (${res.status})`;
+				return;
+			}
+			const result = await res.json() as { avatar_url: string | null };
+			avatarUrl = result.avatar_url;
+		} catch {
+			avatarError = 'Network error during upload';
+		} finally {
+			avatarUploading = false;
+			if (fileInput) fileInput.value = '';
+		}
+	}
+
 	// ── Settings ────────────────────────────────────────────────────────────────
 	let voices = $state<string[]>([]);
 	let voicesLoaded = $state(false);
@@ -145,9 +177,57 @@
 <form id="logout-form" method="POST" action="/logout" class="hidden"></form>
 
 <div class="max-w-xl mx-auto space-y-10">
+	<div class="flex items-center gap-5">
+		<!-- Avatar -->
+		<div class="relative shrink-0">
+			<button
+				onclick={() => fileInput?.click()}
+				class="group relative w-20 h-20 rounded-full overflow-hidden ring-2 ring-zinc-600 hover:ring-amber-400 transition-all focus:outline-none focus:ring-amber-400"
+				title="Change profile picture"
+				disabled={avatarUploading}
+			>
+				{#if avatarUrl}
+					<img src={avatarUrl} alt="Profile" class="w-full h-full object-cover" />
+				{:else}
+					<div class="w-full h-full bg-zinc-700 flex items-center justify-center">
+						<svg class="w-10 h-10 text-zinc-400" fill="currentColor" viewBox="0 0 24 24">
+							<path d="M12 12c2.7 0 4.8-2.1 4.8-4.8S14.7 2.4 12 2.4 7.2 4.5 7.2 7.2 9.3 12 12 12zm0 2.4c-3.2 0-9.6 1.6-9.6 4.8v2.4h19.2v-2.4c0-3.2-6.4-4.8-9.6-4.8z"/>
+						</svg>
+					</div>
+				{/if}
+				<!-- Hover overlay -->
+				<div class="absolute inset-0 bg-black/50 flex items-center justify-center opacity-0 group-hover:opacity-100 transition-opacity">
+					{#if avatarUploading}
+						<svg class="w-5 h-5 text-white animate-spin" fill="none" viewBox="0 0 24 24">
+							<circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"></circle>
+							<path class="opacity-75" fill="currentColor" d="M4 12a8 8 0 018-8v8H4z"></path>
+						</svg>
+					{:else}
+						<svg class="w-5 h-5 text-white" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+							<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M3 9a2 2 0 012-2h.93a2 2 0 001.664-.89l.812-1.22A2 2 0 0110.07 4h3.86a2 2 0 011.664.89l.812 1.22A2 2 0 0018.07 7H19a2 2 0 012 2v9a2 2 0 01-2 2H5a2 2 0 01-2-2V9z"/>
+							<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M15 13a3 3 0 11-6 0 3 3 0 016 0z"/>
+						</svg>
+					{/if}
+				</div>
+			</button>
+			<input
+				bind:this={fileInput}
+				type="file"
+				accept="image/jpeg,image/png,image/webp,image/gif"
+				class="hidden"
+				onchange={handleAvatarChange}
+			/>
+		</div>
+
 		<div>
-		<h1 class="text-2xl font-bold text-zinc-100">Profile</h1>
+			<h1 class="text-2xl font-bold text-zinc-100">{data.user.username}</h1>
-		<p class="text-zinc-400 text-sm mt-1">Signed in as <span class="text-zinc-200 font-medium">{data.user.username}</span></p>
+			<p class="text-zinc-400 text-sm mt-0.5 capitalize">{data.user.role}</p>
+			{#if avatarError}
+				<p class="text-red-400 text-xs mt-1">{avatarError}</p>
+			{:else}
+				<p class="text-zinc-500 text-xs mt-1">Click avatar to change photo</p>
+			{/if}
+		</div>
 	</div>
 
 	<!-- ── Reading settings ─────────────────────────────────────────────────── -->