Creates a new local account. The request is rejected if another user already has the same username or the same email. A Stripe customer is created for the new user and its id is stored as `stripeCustomerId`. New users receive the default `member` role. If `referralCode` matches an active affiliate code, a referral record is created for the new user (a failure to record the referral never blocks signup). A welcome email is sent asynchronously after the response. The response contains a JWT for immediate use.

Looks the user up by `identifier`, which is matched against both the username and the email fields, then verifies the password. On success returns a JWT plus a summary of the user. `profilePicture` is a presigned S3 URL (valid for 1 hour) when the user has uploaded a picture, otherwise the picture URL from their Google account, otherwise `null`.

Returns the full user document of the authenticated user with the `password` field removed. If the user has an uploaded profile picture (`profilePictureKey`), `profilePicture` is replaced with a presigned S3 URL valid for 1 hour; otherwise it keeps the URL from the Google account, if any.

Uploads an image to S3 under `profile-pictures/` and stores its key on the user. If the user already had an uploaded picture, the old S3 object is deleted. The response contains a presigned URL for the new picture, valid for 1 hour. Only JPEG, PNG, GIF and WebP images up to 5 MB are accepted.

Send the body as multipart/form-data.

Deletes the uploaded picture from S3 (if there is one) and clears it from the user. The response returns the picture the account falls back to: the Google account picture URL if the user has one, otherwise `null`.

Looks up the account by the lower-cased email. If one exists, a reset token valid for 1 hour is generated, stored on the user, and emailed as a link of the form `https://sharhapp.com/reset-password?token=<token>`. The response is identical whether or not an account exists, so the endpoint does not reveal which emails are registered.

Verifies the reset token from the password reset email. The token must be a valid, unexpired password-reset token, must match the token currently stored on the user, and the stored expiry must not have passed. On success the password is replaced and the stored token is cleared, so each token can be used only once.

Browser-navigation endpoint, not a JSON API. It packs the query parameters below into a base64url-encoded JSON `state` value and redirects the browser to Google's consent screen requesting the `profile` and `email` scopes. After the user approves, Google redirects the browser to `GET /user/auth/google/callback`, which finishes the sign-in and redirects back to the frontend (or to `redirectUrl` for the extension flow) with the token. Because the callback hands the session token to the redirect target, both redirect parameters are validated: `redirect` must be a path on the Sharh site, and `redirectUrl` is only accepted when it is a Chrome extension identity URL (`https://<32-character-extension-id>.chromiumapp.org/...`, as returned by `chrome.identity.getRedirectURL()`); any other `redirectUrl` is rejected with a 400 before the redirect to Google.

Called by Google, via browser redirect, after the consent screen; clients do not call it directly. The Google profile is resolved to a Sharh user in this order: an existing user with the same Google id; otherwise an existing user with the same email, whose account is then linked to Google (`authMethod` becomes `both` for a local account); otherwise a new user is created with a username derived from the email local part (a numeric suffix is added if taken), a new Stripe customer and the `member` role. A JWT is issued and the `state` value is decoded to recover `redirectTo`, `source`, `redirectUrl` and the referral code. Because the state round-trips through the browser unsigned, its values are re-validated exactly as in `GET /user/auth/google`: a `redirectTo` that is not a same-site path (starting with a single "/") is replaced with "/", and a `redirectUrl` that is not an allowed `https://<extension-id>.chromiumapp.org/...` URL is discarded. If the user was newly created and the referral code matches an active affiliate, a referral is recorded. The browser is then redirected. If `source` is `extension` and a valid `redirectUrl` was supplied, the redirect goes to `<redirectUrl>?token=<jwt>&user=<url-encoded JSON>`. Otherwise — including when the `redirectUrl` in the state was invalid — the normal web flow is used and it goes to `<FRONTEND_URL>/auth/callback?token=<jwt>&user=<url-encoded JSON>&redirect=<url-encoded redirect path>`, where the frontend base URL defaults to `https://sharhapp.com`. The `user` parameter is a URL-encoded JSON object with the fields `id`, `username`, `email`, `stripeCustomerId`, `roles`, `authMethod` and `profilePicture` (a presigned S3 URL if the user uploaded a picture, else the Google picture URL). If Google authentication fails, the browser is redirected to `<FRONTEND_URL>/login?error=oauth_failed`. If an error occurs while completing sign-in, it is redirected to `<FRONTEND_URL>/login?error=auth_error`.

Requires a valid Bearer token, then redirects to Google's consent screen requesting the `profile` and `email` scopes. No `state` is sent, so the flow finishes in `GET /user/auth/google/callback` with the default web behaviour (redirect to `<FRONTEND_URL>/auth/callback?token=...&user=...&redirect=%2F`). The callback resolves the account from the Google profile only: a Google account is linked to an existing Sharh account when their email addresses match.

Removes the Google id from the authenticated user and sets `authMethod` to `local`. Refused when the account was created through Google and has no password, since the user would be left with no way to log in; set a password first (for example through the password reset flow).

For native apps that obtain a Google ID token from the Google Sign-In SDK. The token is verified against the server's Google client id, then the Google profile is resolved to a Sharh user exactly as in the browser flow: match by Google id, else match by email and link the account, else create a new user (with a Stripe customer and the `member` role). Returns a JWT and a summary of the user. `profilePicture` is a presigned S3 URL (valid 1 hour) if the user uploaded a picture, otherwise the Google picture URL.