moving helper functions to scripts folder

api/app.py

@@ -3,6 +3,15 @@ from database import *
 from werkzeug.utils import secure_filename
 
 app = Flask(__name__)
+app.config['UPLOAD_FOLDER'] = os.path.join(app.root_path, 'photos')
+app.config['URL_PREFIX'] = '/uploads'          # public URL prefix
+
+# make sure the folder exists
+os.makedirs(app.config['UPLOAD_FOLDER'], exist_ok=True)
+
+# helper to build a public URL
+def public_url(filename: str) -> str:
+    return f"{app.config['URL_PREFIX']}/{filename}"
 
 # Initialise database on startup
 initialize_db()
@@ -179,29 +188,60 @@ def setting_detail(name: str):
 
 # ----------------------------- Photos -----------------------------
 
-@app.route('/api/providers/<provider_id>/photos', methods=['POST'])
+# photo upload endpoint
+@app.route('/api/providers/<int:provider_id>/photos', methods=['POST'])
 def upload_photos(provider_id):
     if 'photos' not in request.files:
         return jsonify({'error': 'No files uploaded'}), 400
-    
-    # Secure filename + save to persistent storage
-    upload_folder = f'{os.path.dirname(__file__)}/photos'
-    os.makedirs(upload_folder, exist_ok=True)
-    
-    photo_paths = []
-    for file in request.files.getlist('photos'):
-        if file.filename == '':
+
+    files = request.files.getlist('photos')
+    if not files:
+        return jsonify({'error': 'No files in list'}), 400
+
+    allowed_ext = {'.jpg', '.jpeg', '.png', '.gif'}
+    saved_filenames = []
+
+    for f in files:
+        if f.filename == '':
             continue
-            
-        filename = secure_filename(file.filename)
-        file.save(os.path.join(upload_folder, filename))
-        photo_paths.append(f"/uploads/{filename}")
-    
-    # Store paths in DB (e.g., PostgreSQL JSON field)
-    db.execute("UPDATE providers SET photos = %s WHERE id = %s", 
-               (json.dumps(photo_paths), provider_id))
-    
-    return jsonify({'success': True, 'paths': photo_paths}), 200
+        filename = secure_filename(f.filename)
+        ext = os.path.splitext(filename)[1].lower()
+        if ext not in allowed_ext:
+            return jsonify({'error': f'Unsupported file type: {ext}'}), 400
+        # rename to avoid collisions
+        new_name = f"{uuid.uuid4().hex}{ext}"
+        f.save(os.path.join(app.config['UPLOAD_FOLDER'], new_name))
+        saved_filenames.append(public_url(new_name))
+
+    # Merge with any pre‑existing photos
+    existing = db.fetch(f"SELECT photos FROM providers WHERE id=?", (provider_id,))[0][0]
+    try:
+        photos = json.loads(existing)
+    except Exception:
+        photos = []
+    photos.extend(saved_filenames)
+
+    db.execute("UPDATE providers SET photos = %s WHERE id = %s",
+               (json.dumps(photos), provider_id))
+
+    return jsonify({'success': True, 'photos': photos}), 200
+
+# Endpoint to change the main photo
+@app.route('/api/providers/<int:provider_id>/main_photo', methods=['PUT'])
+def set_main_photo(provider_id):
+    data = request.get_json()
+    url = data.get('url')
+    if not url:
+        return jsonify({'error': 'Missing url'}), 400
+
+    # Validate that the URL belongs to this provider
+    photos = db.fetch(f"SELECT photos FROM providers WHERE id=?", (provider_id,))[0][0]
+    if json.loads(photos).count(url) == 0:
+        return jsonify({'error': 'URL not part of this provider'}), 400
+
+    db.execute("UPDATE providers SET main_photo = %s WHERE id = %s",
+               (url, provider_id))
+    return jsonify({'success': True, 'main_photo': url})
 
 # Run the app if this file is executed directly
 if __name__ == "__main__":

api/database.py

@@ -52,7 +52,9 @@ def initialize_db() -> None:
                 age INTEGER,
                 photo TEXT,
                 rates TEXT,
-                private INTEGER NOT NULL DEFAULT 0
+                private INTEGER NOT NULL DEFAULT 0,
+                photos TEXT DEFAULT '[]',
+                main_photo TEXT
             );
             """
         )