Refactor hiker profile and pack APIs to enforce single-profile limit

- Removed multi-hiker profile support, enforcing a hard limit of one profile per user.
- Updated profile creation logic to prevent multiple profiles and removed related functions.
- Adjusted pack creation and update logic to eliminate the unused hiker_profile_id field.
- Introduced a new AI review endpoint for trips, providing markdown output for easier sharing with AI assistants.

Author: maplethorpej

app/api/hiker_profile.py

@@ -7,31 +7,17 @@
 
 from models.base import User, HikerProfile
 from utils.auth import authenticate
-from utils.consts import FREE_HIKER_PROFILE_LIMIT
 
 logger = logging.getLogger(__name__)
 
 route = APIRouter(dependencies=[Depends(authenticate)])
 
-# FREE_HIKER_PROFILE_LIMIT is read from the environment (see utils/consts.py)
-# and is unlimited unless set.
-
-
-def _enforce_profile_limit(user: User):
-    """Block non-subscribed users from exceeding the free profile allowance.
-
-    The first profile is always allowed, so onboarding is unaffected. Profiles
-    that already exist over the limit are untouched.
-    """
-    if user.is_subscribed:
-        return
-
-    profile_count = db.session.query(HikerProfile).filter_by(
-        user_id=user.id).count()
-
-    if profile_count >= FREE_HIKER_PROFILE_LIMIT:
-        raise HTTPException(
-            402, "Upgrade to create more hiker profiles.")
+# One profile per user. Multi-hiker profiles were removed from the product in
+# Sept 2026 (a handful of users ever assigned a pack to a second profile). The
+# table, the is_default column and pack.hiker_profile_id were left in place
+# rather than migrated; clients treat the is_default row (else the oldest) as
+# THE profile. The list/get/update/delete routes below stay for mobile builds
+# still in the wild; nothing new should be built on them.
 
 
 class HikerProfileType(BaseModel):
@@ -41,15 +27,6 @@ class HikerProfileType(BaseModel):
     year_of_birth: Optional[int] = None
     sex: Optional[str] = None
     body_type: Optional[str] = None
-    is_default: bool = False
-
-
-def _clear_other_defaults(user_id: int, exclude_id: int = None):
-    query = db.session.query(HikerProfile).filter_by(user_id=user_id, is_default=True)
-    if exclude_id:
-        query = query.filter(HikerProfile.id != exclude_id)
-    for profile in query.all():
-        profile.is_default = False
 
 
 @route.get("")
@@ -70,14 +47,12 @@ def get_profile(profile_id: int, user: User = Depends(authenticate)):
 
 @route.post("", status_code=201)
 def create_profile(payload: HikerProfileType, user: User = Depends(authenticate)):
-    _enforce_profile_limit(user)
-
     existing_count = db.session.query(HikerProfile).filter_by(user_id=user.id).count()
 
-    is_default = True if existing_count == 0 else payload.is_default
-
-    if is_default:
-        _clear_other_defaults(user.id)
+    # Hard limit of one for everyone. Old mobile builds that still offer an
+    # "Add" button surface this as their generic create-failed alert.
+    if existing_count > 0:
+        raise HTTPException(409, "You already have a hiker profile.")
 
     profile = HikerProfile(
         user_id=user.id,
@@ -87,7 +62,7 @@ def create_profile(payload: HikerProfileType, user: User = Depends(authenticate)
         year_of_birth=payload.year_of_birth,
         sex=payload.sex,
         body_type=payload.body_type,
-        is_default=is_default,
+        is_default=True,
     )
 
     try:
@@ -108,7 +83,6 @@ class HikerProfileUpdateType(BaseModel):
     year_of_birth: Optional[int] = None
     sex: Optional[str] = None
     body_type: Optional[str] = None
-    is_default: Optional[bool] = None
 
 
 @route.put("/{profile_id}")
@@ -120,9 +94,6 @@ def update_profile(profile_id: int, payload: HikerProfileUpdateType, user: User
 
     fields = payload.dict(exclude_none=True)
 
-    if fields.get("is_default"):
-        _clear_other_defaults(user.id, exclude_id=profile.id)
-
     for key, value in fields.items():
         setattr(profile, key, value)
 

app/api/pack.py

@@ -3,7 +3,7 @@
 from fastapi import APIRouter, Depends, HTTPException
 from fastapi_sqlalchemy import db
 from pydantic import BaseModel
-from typing import List, Optional
+from typing import List
 
 from models.base import User, Pack, PackItem, Trip
 from utils.auth import authenticate
@@ -126,7 +126,6 @@ class PackItemType(BaseModel):
 class PackType(BaseModel):
     title: str
     trip_id: int = None
-    hiker_profile_id: Optional[int] = None
     items: List[PackItemType] = None
 
 
@@ -135,7 +134,7 @@ def create_pack(pack: PackType, user: User = Depends(authenticate)):
     _require_own_trip(user, pack.trip_id)
     _enforce_pack_limit(user, pack.trip_id)
 
-    new_pack = Pack(title=pack.title, trip_id=pack.trip_id, hiker_profile_id=pack.hiker_profile_id, user_id=user.id)
+    new_pack = Pack(title=pack.title, trip_id=pack.trip_id, user_id=user.id)
 
     try:
         db.session.add(new_pack)
@@ -185,7 +184,6 @@ def update_pack(id: int, payload: PackType, user: User = Depends(authenticate)):
     try:
         pack.title = payload.title
         pack.trip_id = new_trip_id
-        pack.hiker_profile_id = payload.hiker_profile_id
         pack.items = [
             PackItem(pack_id=pack.id,
                      item_id=item.item_id,

app/api/trip.py

@@ -3,12 +3,14 @@
 import uuid as uuid_module
 
 from fastapi import APIRouter, Depends, HTTPException
+from fastapi.responses import Response
 from fastapi_sqlalchemy import db
 from pydantic import BaseModel
 from sqlalchemy.orm import joinedload
 
 from models.base import User, Trip, Pack, PackItem
 from tasks.enrich_trip import enrich_trip
+from utils.ai_review import build_ai_review_markdown
 from utils.auth import authenticate
 from utils.utils import clone_model
 
@@ -104,6 +106,46 @@ def fetch_meta(trip_id: str):
     }
 
 
+def _resolve_trip(trip_id: str) -> Trip:
+    """Look up a trip by public uuid or numeric id, as the share URLs do."""
+    try:
+        uuid_val = uuid_module.UUID(trip_id)
+        trip = db.session.query(Trip).filter_by(uuid=uuid_val).first()
+    except ValueError:
+        try:
+            trip = db.session.query(Trip).filter_by(id=int(trip_id)).first()
+        except (ValueError, TypeError):
+            raise HTTPException(400, "Invalid trip identifier.")
+
+    if not trip or trip.removed:
+        raise HTTPException(404, "Trip not found.")
+    return trip
+
+
+@route.get("/{trip_id}/ai-review")
+def fetch_ai_review(trip_id: str):
+    """Trip + packs + totals as one markdown document for pasting into an AI
+    assistant. Same visibility as /info and /meta (anyone with the link).
+    Backs the "Copy for AI" button on the public pack page.
+    """
+    trip = _resolve_trip(trip_id)
+
+    user = db.session.query(User.unit_distance,
+                            User.unit_temperature).filter_by(id=trip.user_id).first()
+    if not user:
+        raise HTTPException(404, "Trip owner not found.")
+
+    packs = db.session.query(Pack).filter_by(trip_id=trip.id).order_by(Pack.id).all()
+    public_url = f"https://packstack.io/pack/{trip.uuid or trip.id}"
+    markdown = build_ai_review_markdown(trip, packs, user, public_url=public_url)
+
+    return Response(
+        content=markdown,
+        media_type="text/markdown; charset=utf-8",
+        headers={"Cache-Control": "no-store"},
+    )
+
+
 @route.get("/sitemap")
 def get_sitemap():
     trips = db.session.query(Trip.id, Trip.title, Trip.updated_at).filter_by(
@@ -226,7 +268,9 @@ def clone(trip_id: int, user: User = Depends(authenticate)):
         # it was grandfathered in.
         packs = db.session.query(Pack).filter_by(trip_id=trip.id).all()
         for pack in packs:
-            cloned_pack_data = clone_model(pack, ['trip_id'])
+            # hiker_profile_id is a dead column (single-profile product); don't
+            # carry stale assignments into the clone.
+            cloned_pack_data = clone_model(pack, ['trip_id', 'hiker_profile_id'])
             cloned_pack = Pack(**cloned_pack_data, trip_id=cloned_trip.id)
             db.session.add(cloned_pack)
             db.session.flush()