add profile page, privacy options

.gitea/workflows/dev.yml

@@ -0,0 +1,411 @@
+name: Release
+
+on:
+  push:
+    branches:
+      - dev-other
+
+env:
+  JAVA_VERSION: "17"
+  ANDROID_SDK_ROOT: "${{ github.workspace }}/android-sdk"
+  FLUTTER_VERSION: "3.38.5"
+  BUILD_WINDOWS: "false" # Windows build disabled (no runner available)
+  GITEA_BASE_URL: https://git.tgj.services
+  WEB_IMAGE: "git.tgj.services/petegregoryy/mileograph-web"
+  REGISTRY: git.tgj.services
+
+jobs:
+  meta:
+    runs-on:
+      - tgj-arc
+    outputs:
+      base_version: ${{ steps.meta.outputs.base }}
+      release_tag: ${{ steps.meta.outputs.release_tag }}
+      dev_suffix: ${{ steps.meta.outputs.dev_suffix }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Determine version
+        id: meta
+        run: |
+          RAW_VERSION=$(awk '/^version:/{print $2}' pubspec.yaml)
+          BASE_VERSION=${RAW_VERSION%%+*}
+          VERSION="${BASE_VERSION}"
+          TAG="v${VERSION}"
+          DEV_SUFFIX=""
+
+          if [ "${GITHUB_REF}" = "refs/heads/dev" ]; then
+            DEV_ITER="${GITHUB_RUN_NUMBER:-}"
+            if [ -z "$DEV_ITER" ]; then
+              DEV_ITER=$(git rev-list --count HEAD)
+            fi
+
+            DEV_SUFFIX="-dev.${DEV_ITER}"
+            VERSION="${BASE_VERSION}${DEV_SUFFIX}"
+            TAG="v${VERSION}"
+          fi
+
+          echo "base=${BASE_VERSION}" >> "$GITHUB_OUTPUT"
+          echo "release_tag=${TAG}" >> "$GITHUB_OUTPUT"
+          echo "dev_suffix=${DEV_SUFFIX}" >> "$GITHUB_OUTPUT"
+
+      - name: Fail if release already exists
+        env:
+          TAG: ${{ steps.meta.outputs.release_tag }}
+        run: |
+          set -euo pipefail
+
+          if ! command -v curl >/dev/null 2>&1; then
+            if command -v sudo >/dev/null 2>&1; then
+              SUDO="sudo"
+            else
+              SUDO=""
+            fi
+            $SUDO apt-get update
+            $SUDO apt-get install -y curl ca-certificates
+          fi
+
+          URL="${GITEA_BASE_URL}/api/v1/repos/${{ github.repository }}/releases/tags/${TAG}"
+          CODE="$(curl -sS -o /dev/null -w "%{http_code}" -H "Authorization: token ${{ secrets.GITEA_TOKEN }}" "$URL" || true)"
+
+          if [ "$CODE" = "200" ]; then
+            echo "Release already exists for tag ${TAG}; refusing to re-release."
+            exit 1
+          fi
+          if [ "$CODE" != "404" ]; then
+            echo "Unexpected response checking existing release (${CODE}) at ${URL}"
+            exit 1
+          fi
+
+  android-build:
+    runs-on:
+      - tgj-arc
+    needs: meta
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      #
+      #      - name: Install OS deps (Android)
+      #        run: |
+      #          if command -v sudo >/dev/null 2>&1; then
+      #            SUDO="sudo"
+      #          else
+      #            SUDO=""
+      #          fi
+      #          $SUDO apt-get update
+      #          $SUDO apt-get install -y unzip xz-utils zip libstdc++6 liblzma-dev curl jq
+
+      - name: Setup Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: ${{ env.JAVA_VERSION }}
+
+      - name: Install Android SDK
+        run: |
+          mkdir -p "$ANDROID_SDK_ROOT"/cmdline-tools
+          curl -fsSL https://dl.google.com/android/repository/commandlinetools-linux-11076708_latest.zip -o /tmp/cli-tools.zip
+          unzip -q /tmp/cli-tools.zip -d "$ANDROID_SDK_ROOT"/cmdline-tools
+          mv "$ANDROID_SDK_ROOT"/cmdline-tools/cmdline-tools "$ANDROID_SDK_ROOT"/cmdline-tools/latest
+
+          # Accept licences (ignore SIGPIPE exit 141)
+          yes | "$ANDROID_SDK_ROOT"/cmdline-tools/latest/bin/sdkmanager --sdk_root="$ANDROID_SDK_ROOT" --licenses || true
+
+          # Install required packages (also ignore SIGPIPE)
+          yes | "$ANDROID_SDK_ROOT"/cmdline-tools/latest/bin/sdkmanager --sdk_root="$ANDROID_SDK_ROOT" \
+            "platform-tools" "platforms;android-33" "build-tools;33.0.2" || true
+
+          echo "ANDROID_SDK_ROOT=$ANDROID_SDK_ROOT" >> "$GITHUB_ENV"
+          echo "$ANDROID_SDK_ROOT/platform-tools" >> "$GITHUB_PATH"
+          echo "$ANDROID_SDK_ROOT/build-tools/33.0.2" >> "$GITHUB_PATH"
+
+      #      - name: Install Flutter SDK
+      #        run: |
+      #          set -euo pipefail
+      #          FLUTTER_HOME="$HOME/flutter"
+      #          # Avoid git ownership issues when Flutter checks out deps.
+      #          git config --global --add safe.directory "$FLUTTER_HOME" || true
+      #          if [ ! -x "$FLUTTER_HOME/bin/flutter" ]; then
+      #            rm -rf "$FLUTTER_HOME"
+      #            curl -fsSL -o /tmp/flutter.tar.xz "https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_${FLUTTER_VERSION}-stable.tar.xz"
+      #            tar -C "$HOME" -xf /tmp/flutter.tar.xz
+      #          fi
+      #          echo "$FLUTTER_HOME/bin" >> "$GITHUB_PATH"
+      #          "$FLUTTER_HOME/bin/flutter" --version
+
+      - name: Allow all git directories (CI)
+        run: git config --global --add safe.directory '*'
+
+      - name: Set pub cache path
+        run: echo "PUB_CACHE=${GITHUB_WORKSPACE}/.pub-cache" >> "$GITHUB_ENV"
+
+      - name: Flutter dependencies
+        run: flutter pub get
+
+      - name: Prepare Android keystore (optional)
+        if: ${{ secrets.ANDROID_KEYSTORE_BASE64 != '' }}
+        run: |
+          echo "${{ secrets.ANDROID_KEYSTORE_BASE64 }}" | base64 -d > android-release-key.jks
+          echo "ANDROID_KEYSTORE_PATH=$PWD/android-release-key.jks" >> "$GITHUB_ENV"
+          echo "ANDROID_KEYSTORE_PASSWORD=${{ secrets.ANDROID_KEYSTORE_PASSWORD }}" >> "$GITHUB_ENV"
+          echo "ANDROID_KEY_ALIAS=${{ secrets.ANDROID_KEY_ALIAS }}" >> "$GITHUB_ENV"
+          echo "ANDROID_KEY_PASSWORD=${{ secrets.ANDROID_KEY_PASSWORD }}" >> "$GITHUB_ENV"
+
+      - name: Build Android App Bundle (release)
+        run: flutter build appbundle --release
+
+      - name: Archive Android App Bundle
+        env:
+          BASE_VERSION: ${{ needs.meta.outputs.base_version }}
+        run: |
+          set -euo pipefail
+          BUNDLE_SRC="build/app/outputs/bundle/release/app-release.aab"
+          if [ ! -f "$BUNDLE_SRC" ]; then
+            echo "Bundle not found at $BUNDLE_SRC"
+            exit 1
+          fi
+          cp "$BUNDLE_SRC" "mileograph-${BASE_VERSION}.aab"
+
+      - name: Download bundletool
+        run: |
+          BUNDLETOOL_VERSION=1.15.6
+          curl -fsSL -o bundletool.jar "https://github.com/google/bundletool/releases/download/${BUNDLETOOL_VERSION}/bundletool-all-${BUNDLETOOL_VERSION}.jar"
+
+      - name: Extract universal APK from bundle
+        env:
+          BASE_VERSION: ${{ needs.meta.outputs.base_version }}
+        run: |
+          set -euo pipefail
+
+          BUNDLE="build/app/outputs/bundle/release/app-release.aab"
+          OUTPUT_APKS="app-release.apks"
+          APK_NAME="mileograph-${BASE_VERSION}.apk"
+
+          if [ ! -f "$BUNDLE" ]; then
+            echo "Bundle not found at $BUNDLE"
+            exit 1
+          fi
+
+          SIGNING_ARGS=()
+          if [ -n "${ANDROID_KEYSTORE_PATH:-}" ] && [ -f "$ANDROID_KEYSTORE_PATH" ]; then
+            SIGNING_ARGS+=(--ks="$ANDROID_KEYSTORE_PATH")
+            SIGNING_ARGS+=(--ks-pass="pass:${ANDROID_KEYSTORE_PASSWORD}")
+            SIGNING_ARGS+=(--ks-key-alias="${ANDROID_KEY_ALIAS}")
+            KEY_PASS="${ANDROID_KEY_PASSWORD:-$ANDROID_KEYSTORE_PASSWORD}"
+            SIGNING_ARGS+=(--key-pass="pass:${KEY_PASS}")
+          else
+            echo "No release keystore provided; bundletool will sign with the debug keystore."
+          fi
+
+          java -jar bundletool.jar build-apks \
+            --bundle="$BUNDLE" \
+            --output="$OUTPUT_APKS" \
+            --mode=universal \
+            "${SIGNING_ARGS[@]}"
+
+          unzip -p "$OUTPUT_APKS" universal.apk > "$APK_NAME"
+          ls -lh "$APK_NAME"
+
+      - name: Upload Android APK artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: android-apk
+          path: mileograph-${{ needs.meta.outputs.base_version }}.apk
+
+      - name: Upload Android AAB artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: android-aab
+          path: mileograph-${{ needs.meta.outputs.base_version }}.aab
+
+  linux-build:
+    runs-on:
+      - tgj-arc
+    needs: meta
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Allow all git directories (CI)
+        run: git config --global --add safe.directory '*'
+
+      - name: Set pub cache path
+        run: echo "PUB_CACHE=${GITHUB_WORKSPACE}/.pub-cache" >> "$GITHUB_ENV"
+
+      - name: Flutter dependencies
+        run: flutter pub get
+
+      - name: Enable Linux desktop
+        run: flutter config --enable-linux-desktop
+
+      - name: Build Linux binary (release)
+        run: |
+          flutter build linux --release
+          tar -C build/linux/x64/release/bundle -czf app-linux-x64.tar.gz .
+
+      - name: Upload Linux artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: linux-bundle
+          path: app-linux-x64.tar.gz
+
+  web-build:
+    runs-on:
+      - tgj-arc
+    needs: meta
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Allow all git directories (CI)
+        run: git config --global --add safe.directory '*'
+
+      - name: Set pub cache path
+        run: echo "PUB_CACHE=${GITHUB_WORKSPACE}/.pub-cache" >> "$GITHUB_ENV"
+
+      - name: Flutter dependencies
+        run: flutter pub get
+
+      - name: Enable Flutter web
+        run: flutter config --enable-web
+
+      - name: Build Flutter web (release)
+        run: |
+          flutter build web --release --base-href=/
+          tar -C build/web -czf app-web.tar.gz .
+
+      - name: Upload Web artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: web-build
+          path: app-web.tar.gz
+
+      - name: Set up docker buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Docker meta
+        id: dmeta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/petegregoryy/railframe-web
+          flavor: latest=false
+          tags: |
+            type=sha,prefix=
+            type=raw,value=${{ needs.meta.outputs.base_version }}${{ needs.meta.outputs.dev_suffix }}
+
+      - name: Login to the docker registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: petegregoryy
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Build and push
+        id: docker_build
+        uses: docker/build-push-action@v6
+        with:
+          file: Dockerfile.web
+          context: .
+          push: true
+          tags: ${{ steps.dmeta.outputs.tags }}
+          labels: ${{ steps.dmeta.outputs.labels }}
+          cache-from: type=registry,ref=${{ env.REGISTRY }}/petegregoryy/railframe-web:buildcache-dev
+          cache-to: type=registry,ref=${{ env.REGISTRY }}/petegregoryy/railframe-web:buildcache-dev,mode=max
+
+  release-dev:
+    runs-on:
+      - tgj-arc
+    needs:
+      - meta
+      - android-build
+      - linux-build
+      - web-build
+    steps:
+      - name: Download Android APK
+        if: ${{ github.ref == 'refs/heads/dev' }}
+        uses: actions/download-artifact@v3
+        with:
+          name: android-apk
+          path: artifacts
+
+      - name: Download Android AAB
+        if: ${{ github.ref == 'refs/heads/dev' }}
+        uses: actions/download-artifact@v3
+        with:
+          name: android-aab
+          path: artifacts
+
+      - name: Prepare APK and tag
+        if: ${{ github.ref == 'refs/heads/dev' }}
+        id: bundle
+        run: |
+          BASE="${{ needs.meta.outputs.base_version }}"
+          TAG="${{ needs.meta.outputs.release_tag }}"
+          DEV_SUFFIX="${{ needs.meta.outputs.dev_suffix }}"
+          if [ -z "$DEV_SUFFIX" ]; then
+            echo "dev_suffix is empty; expected '-dev.<n>'"
+            exit 1
+          fi
+
+          VERSION="${BASE}${DEV_SUFFIX}"
+          APK_NAME="mileograph-${VERSION}.apk"
+          AAB_NAME="mileograph-${VERSION}.aab"
+
+          mv "artifacts/mileograph-${BASE}.apk" "artifacts/${APK_NAME}"
+          mv "artifacts/mileograph-${BASE}.aab" "artifacts/${AAB_NAME}"
+
+          echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
+          echo "apk=artifacts/${APK_NAME}" >> "$GITHUB_OUTPUT"
+          echo "aab=artifacts/${AAB_NAME}" >> "$GITHUB_OUTPUT"
+
+      - name: Create prerelease on Gitea
+        if: ${{ github.ref == 'refs/heads/dev' }}
+        uses: ncipollo/release-action@v1
+        with:
+          tag: ${{ steps.bundle.outputs.tag }}
+          name: ${{ steps.bundle.outputs.tag }}
+          prerelease: true
+          commit: ${{ github.sha }}
+          token: ${{ secrets.GITEA_TOKEN }}
+          # NOTE: no `artifacts:` here
+
+      - name: Attach APK to Gitea release
+        if: ${{ github.ref == 'refs/heads/dev' }}
+        run: |
+          set -euo pipefail
+
+          TAG="${{ steps.bundle.outputs.tag }}"
+          APK="${{ steps.bundle.outputs.apk }}"
+
+          # 1. Find release ID by tag
+          RELEASE_JSON=$(curl -sS \
+            -H "Authorization: token ${{ secrets.GITEA_TOKEN }}" \
+            "${GITEA_BASE_URL}/api/v1/repos/${{ github.repository }}/releases/tags/${TAG}")
+
+          RELEASE_ID=$(echo "$RELEASE_JSON" | jq -r '.id')
+
+          echo "Release ID: $RELEASE_ID"
+
+          # 2. Upload APK with multipart/form-data
+          NAME=$(basename "$APK")
+          echo "Uploading $NAME"
+
+          curl -sS -X POST \
+            -H "Authorization: token ${{ secrets.GITEA_TOKEN }}" \
+            -F "attachment=@${APK}" \
+            -F "name=${NAME}" \
+            "${GITEA_BASE_URL}/api/v1/repos/${{ github.repository }}/releases/${RELEASE_ID}/assets" \
+            >/dev/null
+
+          # Attach AAB
+          AAB="${{ steps.bundle.outputs.aab }}"
+          NAME_AAB=$(basename "$AAB")
+          echo "Uploading $NAME_AAB"
+
+          curl -sS -X POST \
+            -H "Authorization: token ${{ secrets.GITEA_TOKEN }}" \
+            -F "attachment=@${AAB}" \
+            -F "name=${NAME_AAB}" \
+            "${GITEA_BASE_URL}/api/v1/repos/${{ github.repository }}/releases/${RELEASE_ID}/assets" \
+            >/dev/null

.gitea/workflows/release.yml

@@ -13,6 +13,7 @@ env:
   BUILD_WINDOWS: "false" # Windows build disabled (no runner available)
   GITEA_BASE_URL: https://git.tgj.services
   WEB_IMAGE: "git.tgj.services/petegregoryy/mileograph-web"
+  REGISTRY: git.tgj.services
 
 jobs:
   meta:
@@ -43,7 +44,7 @@ jobs:
 
             DEV_SUFFIX="-dev.${DEV_ITER}"
             VERSION="${BASE_VERSION}${DEV_SUFFIX}"
-            TAG="v${VERSION}"
+            TAG="${VERSION}"
           fi
 
           echo "base=${BASE_VERSION}" >> "$GITHUB_OUTPUT"
@@ -80,21 +81,21 @@ jobs:
 
   android-build:
     runs-on:
-      - mileograph
+      - tgj-arc
     needs: meta
     steps:
       - name: Checkout
         uses: actions/checkout@v4
-
+      #
-      - name: Install OS deps (Android)
+      #      - name: Install OS deps (Android)
-        run: |
+      #        run: |
-          if command -v sudo >/dev/null 2>&1; then
+      #          if command -v sudo >/dev/null 2>&1; then
-            SUDO="sudo"
+      #            SUDO="sudo"
-          else
+      #          else
-            SUDO=""
+      #            SUDO=""
-          fi
+      #          fi
-          $SUDO apt-get update
+      #          $SUDO apt-get update
-          $SUDO apt-get install -y unzip xz-utils zip libstdc++6 liblzma-dev curl jq
+      #          $SUDO apt-get install -y unzip xz-utils zip libstdc++6 liblzma-dev curl jq
 
       - name: Setup Java
         uses: actions/setup-java@v4
@@ -120,19 +121,19 @@ jobs:
           echo "$ANDROID_SDK_ROOT/platform-tools" >> "$GITHUB_PATH"
           echo "$ANDROID_SDK_ROOT/build-tools/33.0.2" >> "$GITHUB_PATH"
 
-      - name: Install Flutter SDK
+      #      - name: Install Flutter SDK
-        run: |
+      #        run: |
-          set -euo pipefail
+      #          set -euo pipefail
-          FLUTTER_HOME="$HOME/flutter"
+      #          FLUTTER_HOME="$HOME/flutter"
-          # Avoid git ownership issues when Flutter checks out deps.
+      #          # Avoid git ownership issues when Flutter checks out deps.
-          git config --global --add safe.directory "$FLUTTER_HOME" || true
+      #          git config --global --add safe.directory "$FLUTTER_HOME" || true
-          if [ ! -x "$FLUTTER_HOME/bin/flutter" ]; then
+      #          if [ ! -x "$FLUTTER_HOME/bin/flutter" ]; then
-            rm -rf "$FLUTTER_HOME"
+      #            rm -rf "$FLUTTER_HOME"
-            curl -fsSL -o /tmp/flutter.tar.xz "https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_${FLUTTER_VERSION}-stable.tar.xz"
+      #            curl -fsSL -o /tmp/flutter.tar.xz "https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_${FLUTTER_VERSION}-stable.tar.xz"
-            tar -C "$HOME" -xf /tmp/flutter.tar.xz
+      #            tar -C "$HOME" -xf /tmp/flutter.tar.xz
-          fi
+      #          fi
-          echo "$FLUTTER_HOME/bin" >> "$GITHUB_PATH"
+      #          echo "$FLUTTER_HOME/bin" >> "$GITHUB_PATH"
-          "$FLUTTER_HOME/bin/flutter" --version
+      #          "$FLUTTER_HOME/bin/flutter" --version
 
       - name: Allow all git directories (CI)
         run: git config --global --add safe.directory '*'
@@ -221,36 +222,12 @@ jobs:
 
   linux-build:
     runs-on:
-      - mileograph
+      - tgj-arc
     needs: meta
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Install OS deps (Linux desktop)
-        run: |
-          if command -v sudo >/dev/null 2>&1; then
-            SUDO="sudo"
-          else
-            SUDO=""
-          fi
-          $SUDO apt-get update
-          $SUDO apt-get install -y unzip xz-utils zip libstdc++6 libglu1-mesa clang cmake ninja-build pkg-config libgtk-3-dev libsecret-1-dev liblzma-dev curl jq
-
-      - name: Install Flutter SDK
-        run: |
-          set -euo pipefail
-          FLUTTER_HOME="$HOME/flutter"
-          # Avoid git ownership issues when Flutter checks out deps.
-          git config --global --add safe.directory "$FLUTTER_HOME" || true
-          if [ ! -x "$FLUTTER_HOME/bin/flutter" ]; then
-            rm -rf "$FLUTTER_HOME"
-            curl -fsSL -o /tmp/flutter.tar.xz "https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_${FLUTTER_VERSION}-stable.tar.xz"
-            tar -C "$HOME" -xf /tmp/flutter.tar.xz
-          fi
-          echo "$FLUTTER_HOME/bin" >> "$GITHUB_PATH"
-          "$FLUTTER_HOME/bin/flutter" --version
-
       - name: Allow all git directories (CI)
         run: git config --global --add safe.directory '*'
 
@@ -276,38 +253,12 @@ jobs:
 
   web-build:
     runs-on:
-      - mileograph
+      - tgj-arc
     needs: meta
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Install OS deps (Web)
-        run: |
-          if command -v sudo >/dev/null 2>&1; then
-            SUDO="sudo"
-          else
-            SUDO=""
-          fi
-          $SUDO apt-get update
-          $SUDO apt-get install -y unzip xz-utils zip libstdc++6 liblzma-dev curl jq docker.io
-          if ! docker info >/dev/null 2>&1; then
-            $SUDO systemctl start docker 2>/dev/null || $SUDO service docker start 2>/dev/null || true
-          fi
-
-      - name: Install Flutter SDK
-        run: |
-          set -euo pipefail
-          FLUTTER_HOME="$HOME/flutter"
-          git config --global --add safe.directory "$FLUTTER_HOME" || true
-          if [ ! -x "$FLUTTER_HOME/bin/flutter" ]; then
-            rm -rf "$FLUTTER_HOME"
-            curl -fsSL -o /tmp/flutter.tar.xz "https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_${FLUTTER_VERSION}-stable.tar.xz"
-            tar -C "$HOME" -xf /tmp/flutter.tar.xz
-          fi
-          echo "$FLUTTER_HOME/bin" >> "$GITHUB_PATH"
-          "$FLUTTER_HOME/bin/flutter" --version
-
       - name: Allow all git directories (CI)
         run: git config --global --add safe.directory '*'
 
@@ -331,50 +282,38 @@ jobs:
           name: web-build
           path: app-web.tar.gz
 
-      - name: Compute web image tags
+      - name: Set up docker buildx
-        id: web_meta
+        uses: docker/setup-buildx-action@v3
-        env:
-          BASE_VERSION: ${{ needs.meta.outputs.base_version }}
-          DEV_SUFFIX: ${{ needs.meta.outputs.dev_suffix }}
-        run: |
-          IMAGE="${WEB_IMAGE}"
-          TAG=""
-          ALIAS=""
-          if [ "${GITHUB_REF}" = "refs/heads/dev" ]; then
-            TAG="${BASE_VERSION}${DEV_SUFFIX}"
-            ALIAS="dev"
-          elif [ "${GITHUB_REF}" = "refs/heads/master" ]; then
-            TAG="${BASE_VERSION}"
-            ALIAS="latest"
-          fi
 
-          echo "image=${IMAGE}" >> "$GITHUB_OUTPUT"
+      - name: Docker meta
-          echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
+        id: dmeta
-          echo "alias=${ALIAS}" >> "$GITHUB_OUTPUT"
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/petegregoryy/railframe-web
+          flavor: latest=false
+          tags: |
+            type=sha,prefix=
+            type=raw,value=${{ needs.meta.outputs.base_version }}${{ needs.meta.outputs.dev_suffix }}
+            type=raw,value=dev
 
-      - name: Login to registry
+      - name: Login to the docker registry
-        if: ${{ secrets.DOCKERHUB_TOKEN != '' && steps.web_meta.outputs.tag != '' }}
+        uses: docker/login-action@v3
-        env:
+        with:
-          REGISTRY_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
+          registry: ${{ env.REGISTRY }}
-        run: |
+          username: petegregoryy
-          echo "$REGISTRY_TOKEN" | docker login git.tgj.services -u petegregoryy --password-stdin
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
 
-      - name: Build and push web image
+      - name: Build and push
-        if: ${{ secrets.DOCKERHUB_TOKEN != '' && steps.web_meta.outputs.tag != '' }}
+        id: docker_build
-        env:
+        uses: docker/build-push-action@v6
-          IMAGE: ${{ steps.web_meta.outputs.image }}
+        with:
-          TAG: ${{ steps.web_meta.outputs.tag }}
+          file: Dockerfile.web
-          ALIAS: ${{ steps.web_meta.outputs.alias }}
+          context: .
-        run: |
+          push: true
-          docker buildx create --name buildx --driver=docker-container --use || docker buildx use buildx
+          tags: ${{ steps.dmeta.outputs.tags }}
-          TAG_ARGS=(-t "${IMAGE}:${TAG}")
+          labels: ${{ steps.dmeta.outputs.labels }}
-          if [ -n "$ALIAS" ]; then
+          cache-from: type=registry,ref=${{ env.REGISTRY }}/petegregoryy/railframe-web:buildcache
-            TAG_ARGS+=(-t "${IMAGE}:${ALIAS}")
+          cache-to: type=registry,ref=${{ env.REGISTRY }}/petegregoryy/railframe-web:buildcache,mode=max
-          fi
-          docker buildx build --builder buildx --platform linux/amd64 \
-            -f Dockerfile.web \
-            --push \
-            "${TAG_ARGS[@]}" .
 
   release-dev:
     runs-on:

README.md

@@ -2,6 +2,7 @@
 
 Mileograph is a Flutter client for logging and analysing railway journeys. It lets you record legs, group them into trips, track locomotive mileage, and view stats and leaderboards.
 
+
 ## Features
 - Add and edit journey legs with traction, timings, routes, notes, and delays.
 - Group legs into trips and see mileage totals and traction stats.

lib/app.dart

@@ -35,7 +35,11 @@ class App extends StatelessWidget {
           create: (context) => DataService(api: context.read<ApiService>()),
           update: (context, auth, data) {
             data ??= DataService(api: context.read<ApiService>());
-            data.handleAuthChanged(auth.userId);
+            data.handleAuthChanged(
+              auth.userId,
+              entriesVisibility: auth.entriesVisibility,
+              mileageVisibility: auth.mileageVisibility,
+            );
             return data;
           },
         ),

lib/components/calculator/calculator.dart

@@ -366,6 +366,16 @@ class _RouteCalculatorState extends State<RouteCalculator> {
             spacing: 12,
             runSpacing: 8,
             children: [
+              ElevatedButton.icon(
+                icon: const Icon(Icons.swap_horiz),
+                label: const Text('Reverse route'),
+                onPressed: () async {
+                  setState(() {
+                    data.stations = data.stations.reversed.toList();
+                  });
+                  await _calculateRoute(data.stations);
+                },
+              ),
               ElevatedButton.icon(
                 icon: const Icon(Icons.add),
                 label: const Text('Add Station'),

lib/components/dashboard/leaderboard_panel.dart

@@ -1,19 +1,31 @@
 import 'package:flutter/material.dart';
 import 'package:mileograph_flutter/services/data_service.dart';
 import 'package:mileograph_flutter/services/distance_unit_service.dart';
-
 import 'package:provider/provider.dart';
+enum _LeaderboardScope { global, friends }
 
-class LeaderboardPanel extends StatelessWidget {
+class LeaderboardPanel extends StatefulWidget {
   const LeaderboardPanel({super.key});
 
+  @override
+  State<LeaderboardPanel> createState() => _LeaderboardPanelState();
+}
+
+class _LeaderboardPanelState extends State<LeaderboardPanel> {
+  _LeaderboardScope _scope = _LeaderboardScope.global;
+
   @override
   Widget build(BuildContext context) {
     final data = context.watch<DataService>();
     final distanceUnits = context.watch<DistanceUnitService>();
-    final leaderboard = data.homepageStats?.leaderboard ?? [];
+    final leaderboard = _scope == _LeaderboardScope.global
+        ? (data.homepageStats?.leaderboard ?? [])
+        : data.friendsLeaderboard;
+    final loading = _scope == _LeaderboardScope.global
+        ? data.isHomepageLoading
+        : data.isFriendsLeaderboardLoading;
     final textTheme = Theme.of(context).textTheme;
-    if (data.isHomepageLoading && leaderboard.isEmpty) {
+    if (loading && leaderboard.isEmpty) {
       return const Padding(
         padding: EdgeInsets.all(16.0),
         child: Center(child: CircularProgressIndicator()),
@@ -38,7 +50,8 @@ class LeaderboardPanel extends StatelessWidget {
                     ),
                   ),
                 ),
-                if (leaderboard.isNotEmpty)
+                if (leaderboard.isNotEmpty &&
+                    MediaQuery.of(context).size.width > 600)
                   Container(
                     padding:
                         const EdgeInsets.symmetric(horizontal: 8, vertical: 4),
@@ -54,6 +67,40 @@ class LeaderboardPanel extends StatelessWidget {
               ],
             ),
             const SizedBox(height: 8),
+            Center(
+              child: SegmentedButton<_LeaderboardScope>(
+                segments: const [
+                  ButtonSegment(
+                    value: _LeaderboardScope.global,
+                    label: Text('Global'),
+                  ),
+                  ButtonSegment(
+                    value: _LeaderboardScope.friends,
+                    label: Text('Friends'),
+                  ),
+                ],
+                selected: {_scope},
+                onSelectionChanged: (vals) async {
+                  if (vals.isEmpty) return;
+                  final selected = vals.first;
+                  setState(() => _scope = selected);
+                  if (selected == _LeaderboardScope.friends &&
+                      data.friendsLeaderboard.isEmpty &&
+                      !data.isFriendsLeaderboardLoading) {
+                    await data.fetchFriendsLeaderboard();
+                  } else if (selected == _LeaderboardScope.global &&
+                      (data.homepageStats?.leaderboard.isEmpty ?? true) &&
+                      !data.isHomepageLoading) {
+                    await data.fetchHomepageStats();
+                  }
+                },
+                style: SegmentedButton.styleFrom(
+                  visualDensity: VisualDensity.compact,
+                  padding: const EdgeInsets.symmetric(horizontal: 8),
+                ),
+              ),
+            ),
+            const SizedBox(height: 8),
             if (leaderboard.isEmpty)
               const Padding(
                 padding: EdgeInsets.all(8.0),

lib/components/legs/leg_card.dart

@@ -28,6 +28,8 @@ class _LegCardState extends State<LegCard> {
   Widget build(BuildContext context) {
     final leg = widget.leg;
     final isShared = leg.legShareId != null && leg.legShareId!.isNotEmpty;
+    final sharedFrom = leg.sharedFrom;
+    final sharedTo = leg.sharedTo;
     final distanceUnits = context.watch<DistanceUnitService>();
     final routeSegments = _parseRouteSegments(leg.route);
     final textTheme = Theme.of(context).textTheme;
@@ -198,16 +200,9 @@ class _LegCardState extends State<LegCard> {
                 ],
               ],
             ),
-            if (isShared) ...[
+            if (isShared || sharedFrom != null || (sharedTo.isNotEmpty)) ...[
               const SizedBox(width: 8),
-              Tooltip(
+              _SharedIcons(sharedFrom: sharedFrom, sharedTo: sharedTo, isShared: isShared),
-                message: 'Shared entry',
-                child: Icon(
-                  Icons.share,
-                  size: 18,
-                  color: Theme.of(context).colorScheme.primary,
-                ),
-              ),
             ],
             if (widget.showEditButton) ...[
               const SizedBox(width: 8),
@@ -262,6 +257,34 @@ class _LegCardState extends State<LegCard> {
                   ..._buildTrainDetails(leg, textTheme),
                   const SizedBox(height: 12),
                 ],
+                if (sharedFrom != null)
+                  Padding(
+                    padding: const EdgeInsets.only(bottom: 8.0),
+                    child: Text(
+                      'Shared from ${sharedFrom.sharedFromDisplay.isNotEmpty ? sharedFrom.sharedFromDisplay : 'another user'}.',
+                      style: textTheme.bodyMedium,
+                    ),
+                  ),
+                if (sharedTo.isNotEmpty) ...[
+                  Text(
+                    'Shared to:',
+                    style: textTheme.bodyMedium,
+                  ),
+                  const SizedBox(height: 4),
+                  Wrap(
+                    spacing: 8,
+                    runSpacing: 4,
+                    children: sharedTo
+                        .map((s) => Chip(
+                              label: Text(s.sharedToDisplay.isNotEmpty
+                                  ? s.sharedToDisplay
+                                  : s.sharedToUserId),
+                              visualDensity: VisualDensity.compact,
+                            ))
+                        .toList(),
+                  ),
+                  const SizedBox(height: 12),
+                ],
                 if (routeSegments.isNotEmpty) ...[
                   Text('Route', style: textTheme.titleSmall),
                   const SizedBox(height: 6),
@@ -461,3 +484,61 @@ class _LegCardState extends State<LegCard> {
     return route.map((e) => e.toString()).where((e) => e.trim().isNotEmpty).toList();
   }
 }
+
+class _SharedIcons extends StatelessWidget {
+  const _SharedIcons({
+    required this.sharedFrom,
+    required this.sharedTo,
+    required this.isShared,
+  });
+
+  final LegShareMeta? sharedFrom;
+  final List<LegShareMeta> sharedTo;
+  final bool isShared;
+
+  @override
+  Widget build(BuildContext context) {
+    final icons = <Widget>[];
+    if (isShared || sharedFrom != null) {
+      final fromName = sharedFrom?.sharedFromDisplay ?? '';
+      icons.add(
+        Tooltip(
+          message: fromName.isNotEmpty ? 'Shared from $fromName' : 'Shared entry',
+          child: Icon(
+            Icons.share,
+            size: 18,
+            color: Theme.of(context).colorScheme.primary,
+          ),
+        ),
+      );
+    }
+    if (sharedTo.isNotEmpty) {
+      final names = sharedTo
+          .map((s) => s.sharedToDisplay)
+          .where((name) => name.isNotEmpty)
+          .toList();
+      final tooltip = names.isEmpty
+          ? 'Shared to others'
+          : 'Shared to: ${names.join(', ')}';
+      icons.add(
+        Tooltip(
+          message: tooltip,
+          child: Icon(
+            Icons.group,
+            size: 18,
+            color: Theme.of(context).colorScheme.tertiary,
+          ),
+        ),
+      );
+    }
+    return Row(
+      mainAxisSize: MainAxisSize.min,
+      children: [
+        for (int i = 0; i < icons.length; i++) ...[
+          if (i > 0) const SizedBox(width: 6),
+          icons[i],
+        ],
+      ],
+    );
+  }
+}

lib/components/pages/legs.dart

@@ -17,6 +17,8 @@ class _LegsPageState extends State<LegsPage> {
   DateTime? _startDate;
   DateTime? _endDate;
   bool _initialised = false;
+  bool _unallocatedOnly = false;
+  bool _showMoreFilters = false;
 
   @override
   void didChangeDependencies() {
@@ -33,6 +35,7 @@ class _LegsPageState extends State<LegsPage> {
       sortDirection: _sortDirection,
       dateRangeStart: _formatDate(_startDate),
       dateRangeEnd: _formatDate(_endDate),
+      unallocatedOnly: _unallocatedOnly,
     );
   }
 
@@ -44,6 +47,7 @@ class _LegsPageState extends State<LegsPage> {
       dateRangeEnd: _formatDate(_endDate),
       offset: data.legs.length,
       append: true,
+      unallocatedOnly: _unallocatedOnly,
     );
   }
 
@@ -84,6 +88,8 @@ class _LegsPageState extends State<LegsPage> {
       _startDate = null;
       _endDate = null;
       _sortDirection = 0;
+      _unallocatedOnly = false;
+      _showMoreFilters = false;
     });
     _refreshLegs();
   }
@@ -177,8 +183,46 @@ class _LegsPageState extends State<LegsPage> {
                               : _formatDate(_endDate!)!,
                         ),
                       ),
+                      TextButton.icon(
+                        onPressed: () => setState(
+                          () => _showMoreFilters = !_showMoreFilters,
+                        ),
+                        icon: Icon(
+                          _showMoreFilters
+                              ? Icons.expand_less
+                              : Icons.expand_more,
+                        ),
+                        label: Text(
+                          _showMoreFilters ? 'Hide filters' : 'More filters',
+                        ),
+                      ),
                     ],
                   ),
+                  AnimatedCrossFade(
+                    crossFadeState: _showMoreFilters
+                        ? CrossFadeState.showFirst
+                        : CrossFadeState.showSecond,
+                    duration: const Duration(milliseconds: 200),
+                    firstChild: Padding(
+                      padding: const EdgeInsets.only(top: 12.0),
+                      child: Wrap(
+                        spacing: 12,
+                        runSpacing: 12,
+                        children: [
+                          FilterChip(
+                            avatar: const Icon(Icons.flash_off),
+                            label: const Text('Unallocated only'),
+                            selected: _unallocatedOnly,
+                            onSelected: (selected) async {
+                              setState(() => _unallocatedOnly = selected);
+                              await _refreshLegs();
+                            },
+                          ),
+                        ],
+                      ),
+                    ),
+                    secondChild: const SizedBox.shrink(),
+                  ),
                 ],
               ),
             ),

lib/components/pages/more/user_profile_page.dart

@@ -0,0 +1,515 @@
+import 'package:flutter/material.dart';
+import 'package:go_router/go_router.dart';
+import 'package:provider/provider.dart';
+import 'package:mileograph_flutter/components/legs/leg_card.dart';
+import 'package:mileograph_flutter/objects/objects.dart';
+import 'package:mileograph_flutter/services/authservice.dart';
+import 'package:mileograph_flutter/services/data_service.dart';
+
+class UserProfilePage extends StatefulWidget {
+  const UserProfilePage({super.key, this.userId, this.initialUser});
+
+  final String? userId;
+  final UserSummary? initialUser;
+
+  @override
+  State<UserProfilePage> createState() => _UserProfilePageState();
+}
+
+class _UserProfilePageState extends State<UserProfilePage> {
+  UserProfileDetail? _profile;
+  List<Leg> _legs = const [];
+  bool _loading = false;
+  bool _loadingMore = false;
+  bool _hasMore = false;
+  Friendship? _friendship;
+  bool _actionsLoading = false;
+
+  String? get _userId => widget.initialUser?.userId ?? widget.userId;
+
+  @override
+  void initState() {
+    super.initState();
+    WidgetsBinding.instance.addPostFrameCallback((_) {
+      _loadProfile();
+    });
+  }
+
+  Future<void> _loadProfile() async {
+    final userId = _userId;
+    if (userId == null || userId.isEmpty) {
+      if (mounted) {
+        ScaffoldMessenger.of(context).showSnackBar(
+          const SnackBar(content: Text('No user selected.')),
+        );
+        context.pop();
+      }
+      return;
+    }
+    setState(() {
+      _loading = true;
+      _hasMore = false;
+      _legs = const [];
+    });
+    final data = context.read<DataService>();
+    try {
+      final profile = await data.fetchUserProfileDetail(userId);
+      final friendship = await data.fetchFriendshipStatus(userId);
+      if (!mounted) return;
+      if (profile == null) {
+        ScaffoldMessenger.of(context).showSnackBar(
+          const SnackBar(content: Text('Failed to load user profile.')),
+        );
+        return;
+      }
+      final legs = profile.legs;
+      setState(() {
+        _profile = profile;
+        _legs = legs;
+        _hasMore = legs.length >= 25;
+        _friendship = friendship;
+      });
+    } finally {
+      if (mounted) setState(() => _loading = false);
+    }
+  }
+
+  Future<void> _loadMore() async {
+    final userId = _userId;
+    if (userId == null || userId.isEmpty || _loadingMore || !_hasMore) return;
+    setState(() => _loadingMore = true);
+    final data = context.read<DataService>();
+    try {
+      final more = await data.fetchUserLegs(
+        userId: userId,
+        offset: _legs.length,
+      );
+      if (!mounted) return;
+      setState(() {
+        _legs = [..._legs, ...more];
+        _hasMore = more.length >= 25;
+      });
+    } finally {
+      if (mounted) setState(() => _loadingMore = false);
+    }
+  }
+
+  void _handleBack() {
+    final router = GoRouter.of(context);
+    if (router.canPop()) {
+      router.pop();
+    } else {
+      router.go('/more/profile');
+    }
+  }
+
+  Widget _buildProfileHeader(ThemeData theme) {
+    final profile = _profile;
+    final username = profile?.username ?? widget.initialUser?.username ?? '';
+    final fullName = profile?.fullName ?? widget.initialUser?.fullName ?? '';
+    final mileage = profile?.mileage;
+    final privacy = profile?.privacyInfo;
+    final mileageHidden =
+        (mileage == null || mileage == 0) && privacy != null && privacy.isNotEmpty;
+    return Card(
+      child: Padding(
+        padding: const EdgeInsets.all(12.0),
+        child: Column(
+          crossAxisAlignment: CrossAxisAlignment.start,
+          children: [
+            Row(
+              children: [
+                const CircleAvatar(child: Icon(Icons.person)),
+                const SizedBox(width: 12),
+                Column(
+                  crossAxisAlignment: CrossAxisAlignment.start,
+                  children: [
+                    Text(
+                      fullName.isNotEmpty ? fullName : username,
+                      style: theme.textTheme.titleMedium,
+                    ),
+                    if (username.isNotEmpty)
+                      Text('@$username', style: theme.textTheme.bodySmall),
+                  ],
+                ),
+              ],
+            ),
+            const SizedBox(height: 12),
+            Text(
+              mileageHidden
+                  ? 'Mileage hidden'
+                  : 'Mileage: ${(mileage ?? 0).toStringAsFixed(1)}',
+            ),
+          ],
+        ),
+      ),
+    );
+  }
+
+  Widget _buildTopLocos() {
+    final profile = _profile;
+    if (profile == null || profile.topLocos.isEmpty) {
+      return const SizedBox.shrink();
+    }
+    final topTen = [...profile.topLocos]
+      ..sort(
+        (a, b) => (b.mileage ?? 0).compareTo(a.mileage ?? 0),
+      );
+    final displayLocos = topTen.take(10).toList();
+    return Card(
+      child: Padding(
+        padding: const EdgeInsets.all(12.0),
+        child: Column(
+          crossAxisAlignment: CrossAxisAlignment.start,
+          children: [
+            Text(
+              'Top locos by mileage',
+              style: Theme.of(context).textTheme.titleMedium,
+            ),
+            const SizedBox(height: 8),
+            ListView.separated(
+              physics: const NeverScrollableScrollPhysics(),
+              shrinkWrap: true,
+              itemCount: displayLocos.length,
+              separatorBuilder: (context, index) => const Divider(height: 1),
+              itemBuilder: (context, index) {
+                final loco = displayLocos[index];
+                final mileage = loco.mileage ?? 0;
+                return ListTile(
+                  leading: CircleAvatar(
+                    backgroundColor: Theme.of(context)
+                        .colorScheme
+                        .primary
+                        .withValues(alpha: 0.1),
+                    child: Text(
+                      '${index + 1}',
+                      style: Theme.of(context).textTheme.bodyMedium?.copyWith(
+                            fontWeight: FontWeight.bold,
+                          ),
+                    ),
+                  ),
+                  title: Text(
+                    loco.number.isNotEmpty ? loco.number : 'Unknown',
+                    style: Theme.of(context).textTheme.bodyLarge,
+                  ),
+                  subtitle: Text(loco.locoClass),
+                  trailing: Text(
+                    '${mileage.toStringAsFixed(1)} mi',
+                    style: Theme.of(context)
+                        .textTheme
+                        .bodyMedium
+                        ?.copyWith(fontWeight: FontWeight.w700),
+                  ),
+                );
+              },
+            ),
+          ],
+        ),
+      ),
+    );
+  }
+
+  List<Widget> _buildLegsWithDividers(
+    BuildContext context,
+    List<Leg> legs,
+  ) {
+    final widgets = <Widget>[];
+    String? currentDate;
+    final dayLegs = <Leg>[];
+
+    void flushDay() {
+      final date = currentDate;
+      if (date == null) return;
+      widgets.add(
+        Padding(
+          padding: const EdgeInsets.symmetric(vertical: 8.0),
+          child: Text(
+            date,
+            style: Theme.of(context).textTheme.labelMedium?.copyWith(
+                  fontWeight: FontWeight.w700,
+                ),
+          ),
+        ),
+      );
+      widgets.add(const Divider());
+      widgets.addAll(
+        dayLegs.map((leg) => LegCard(leg: leg, showDate: false)),
+      );
+      dayLegs.clear();
+    }
+
+    for (final leg in legs) {
+      final dateStr = _formatDate(leg.beginTime) ?? '';
+      if (currentDate != null && dateStr != currentDate) {
+        flushDay();
+      }
+      currentDate = dateStr;
+      dayLegs.add(leg);
+    }
+
+    flushDay();
+    return widgets;
+  }
+
+  String? _formatDate(DateTime? date) {
+    if (date == null) return null;
+    return '${date.year.toString().padLeft(4, '0')}-${date.month.toString().padLeft(2, '0')}-${date.day.toString().padLeft(2, '0')}';
+  }
+
+  Widget _buildFriendSection(AuthService auth) {
+    final friendship = _friendship;
+    if (friendship == null) {
+      return const SizedBox.shrink();
+    }
+    return Card(
+      child: Padding(
+        padding: const EdgeInsets.all(12.0),
+        child: Column(
+          crossAxisAlignment: CrossAxisAlignment.start,
+          children: [
+            Row(
+              children: [
+                Text(
+                  'Friendship',
+                  style: Theme.of(context).textTheme.titleMedium,
+                ),
+                const SizedBox(width: 8),
+                _buildStatusChip(friendship, auth),
+              ],
+            ),
+            const SizedBox(height: 8),
+            _buildActions(friendship, auth),
+          ],
+        ),
+      ),
+    );
+  }
+
+  Widget _buildStatusChip(Friendship status, AuthService auth) {
+    String label = status.status;
+    Color color = Colors.grey;
+    switch (status.status.toLowerCase()) {
+      case 'accepted':
+        label = 'Friends';
+        color = Colors.green;
+        break;
+      case 'pending':
+        final isRequester = status.requesterId == auth.userId;
+        label = isRequester ? 'Pending (you sent)' : 'Pending (needs your reply)';
+        color = Colors.orange;
+        break;
+      case 'blocked':
+        color = Colors.red;
+        label = 'Blocked';
+        break;
+      case 'declined':
+      case 'rejected':
+        label = 'Declined';
+        break;
+      default:
+        label = 'Not friends';
+    }
+    final bg = Color.alphaBlend(
+      color.withValues(alpha: 0.15),
+      Theme.of(context).colorScheme.surface,
+    );
+    return Container(
+      margin: const EdgeInsets.only(left: 6),
+      padding: const EdgeInsets.symmetric(horizontal: 10, vertical: 6),
+      decoration: BoxDecoration(
+        color: bg,
+        borderRadius: BorderRadius.circular(20),
+      ),
+      child: Text(label),
+    );
+  }
+
+  Widget _buildActions(Friendship status, AuthService auth) {
+    final isSelf = status.addresseeId == auth.userId || status.requesterId == auth.userId;
+    if (isSelf) {
+      return const Text('This is you.');
+    }
+    final isRequester = status.requesterId == auth.userId;
+    final id = status.id;
+    final buttons = <Widget>[];
+
+    Future<void> run(Future<void> Function() action) async {
+      setState(() => _actionsLoading = true);
+      try {
+        await action();
+      } finally {
+        if (mounted) setState(() => _actionsLoading = false);
+      }
+    }
+
+    final data = context.read<DataService>();
+
+    if (status.isNone || status.isDeclined) {
+      buttons.add(
+        ElevatedButton.icon(
+          onPressed: _actionsLoading
+              ? null
+              : () => run(() async {
+                    final updated = await data.requestFriendship(status.addresseeId);
+                    if (!mounted) return;
+                    setState(() => _friendship = updated);
+                  }),
+          icon: const Icon(Icons.person_add),
+          label: const Text('Send friend request'),
+        ),
+      );
+    } else if (status.isPending) {
+      if (isRequester) {
+        buttons.add(
+          OutlinedButton(
+            onPressed: _actionsLoading || id == null || id.isEmpty
+                ? null
+                : () => run(() async {
+                      await data.cancelFriendship(id);
+                      if (!mounted) return;
+                      setState(() => _friendship = status.copyWith(status: 'none'));
+                    }),
+            child: const Text('Cancel request'),
+          ),
+        );
+      } else {
+        buttons.add(
+          ElevatedButton(
+            onPressed: _actionsLoading || id == null || id.isEmpty
+                ? null
+                : () => run(() async {
+                      final updated = await data.acceptFriendship(id);
+                      if (!mounted) return;
+                      setState(() => _friendship = updated);
+                    }),
+            child: const Text('Accept'),
+          ),
+        );
+        buttons.add(
+          OutlinedButton(
+            onPressed: _actionsLoading || id == null || id.isEmpty
+                ? null
+                : () => run(() async {
+                      final updated = await data.rejectFriendship(id);
+                      if (!mounted) return;
+                      setState(() => _friendship = updated);
+                    }),
+            child: const Text('Reject'),
+          ),
+        );
+      }
+    } else if (status.isAccepted) {
+      buttons.add(
+        ElevatedButton.icon(
+          onPressed: _actionsLoading || id == null || id.isEmpty
+              ? null
+              : () => run(() async {
+                    await data.deleteFriendship(id);
+                    if (!mounted) return;
+                    setState(() => _friendship = status.copyWith(status: 'none'));
+                  }),
+          icon: const Icon(Icons.person_remove),
+          label: const Text('Unfriend'),
+        ),
+      );
+    }
+
+    if (buttons.isEmpty) return const SizedBox.shrink();
+
+    return Wrap(
+      spacing: 8,
+      runSpacing: 8,
+      children: buttons,
+    );
+  }
+
+  @override
+  Widget build(BuildContext context) {
+    final auth = context.watch<AuthService>();
+    final theme = Theme.of(context);
+    return Scaffold(
+      appBar: AppBar(
+        title: const Text('User profile'),
+        leading: IconButton(
+          icon: const Icon(Icons.arrow_back),
+          onPressed: _handleBack,
+        ),
+      ),
+      body: RefreshIndicator(
+        onRefresh: _loadProfile,
+        child: ListView(
+          padding: const EdgeInsets.all(16),
+          children: [
+            _buildProfileHeader(theme),
+            const SizedBox(height: 12),
+            _buildFriendSection(auth),
+            const SizedBox(height: 12),
+            _buildTopLocos(),
+            const SizedBox(height: 12),
+            Card(
+              child: Padding(
+                padding: const EdgeInsets.all(12.0),
+                child: Column(
+                  crossAxisAlignment: CrossAxisAlignment.start,
+                  children: [
+                    Row(
+                      mainAxisAlignment: MainAxisAlignment.spaceBetween,
+                      children: [
+                        Text(
+                          'Entries',
+                          style: theme.textTheme.titleMedium,
+                        ),
+                        if (_loading)
+                          const SizedBox(
+                            width: 16,
+                            height: 16,
+                            child: CircularProgressIndicator(strokeWidth: 2),
+                          ),
+                      ],
+                    ),
+                    const SizedBox(height: 8),
+                    if (_loading && _legs.isEmpty)
+                      const Center(
+                        child: Padding(
+                          padding: EdgeInsets.symmetric(vertical: 16.0),
+                          child: CircularProgressIndicator(),
+                        ),
+                      )
+                    else if (_legs.isEmpty)
+                      Text(
+                        (_profile?.privacyInfo.isNotEmpty ?? false)
+                            ? 'Legs hidden due to privacy settings.'
+                            : 'No entries found.',
+                      )
+                    else ...[
+                      ..._buildLegsWithDividers(context, _legs),
+                      const SizedBox(height: 8),
+                      if (_hasMore || _loadingMore)
+                        Align(
+                          alignment: Alignment.center,
+                          child: OutlinedButton.icon(
+                            onPressed: _loadingMore ? null : _loadMore,
+                            icon: _loadingMore
+                                ? const SizedBox(
+                                    height: 14,
+                                    width: 14,
+                                    child:
+                                        CircularProgressIndicator(strokeWidth: 2),
+                                  )
+                                : const Icon(Icons.expand_more),
+                            label: Text(
+                              _loadingMore ? 'Loading...' : 'Load more',
+                            ),
+                          ),
+                        ),
+                    ],
+                  ],
+                ),
+              ),
+            ),
+          ],
+        ),
+      ),
+    );
+  }
+}

lib/components/pages/new_entry/new_entry_draft_logic.dart

@@ -9,10 +9,19 @@ extension _NewEntryDraftLogic on _NewEntryPageState {
     if (_activeDraftId != null && !_draftChangedFromBaseline()) {
       return true;
     }
+    final currentSnapshot = _currentSubmissionSnapshot();
+    if (_lastSubmittedSnapshot != null &&
+        _snapshotEquality.equals(_lastSubmittedSnapshot, currentSnapshot)) {
+      return true;
+    }
     final choice = await _promptSaveDraft();
     if (choice == _ExitChoice.cancel) return false;
     if (choice == _ExitChoice.save) {
+      try {
         await _saveDraftEntry(draftId: _activeDraftId);
+      } catch (_) {
+        return true;
+      }
     } else if (choice == _ExitChoice.discard) {
       // Delay reset to avoid setState during the dialog/build phase.
       await Future<void>.delayed(Duration.zero);
@@ -54,6 +63,7 @@ extension _NewEntryDraftLogic on _NewEntryPageState {
 
   Future<_ExitChoice> _promptSaveDraft() async {
     if (!mounted) return _ExitChoice.cancel;
+    try {
       final result = await showDialog<_ExitChoice>(
         context: context,
         barrierDismissible: false,
@@ -79,7 +89,11 @@ extension _NewEntryDraftLogic on _NewEntryPageState {
           ],
         ),
       );
+      if (!mounted) return _ExitChoice.cancel;
       return result ?? _ExitChoice.cancel;
+    } catch (_) {
+      return _ExitChoice.cancel;
+    }
   }
 
   Future<void> _openDrafts() async {
@@ -174,6 +188,14 @@ extension _NewEntryDraftLogic on _NewEntryPageState {
               "distance": _routeResult!.distance,
             },
       "tractionItems": _serializeTractionItems(),
+      "shareUserIds": _shareUserIds.toList(),
+      "shareUsers": _shareUsers
+          .map((u) => {
+                "user_id": u.userId,
+                "username": u.username,
+                "full_name": u.fullName,
+              })
+          .toList(),
     };
     await prefs.setString(_kDraftPrefsKey, jsonEncode(draft));
   }
@@ -302,6 +324,14 @@ extension _NewEntryDraftLogic on _NewEntryPageState {
               "distance": _routeResult!.distance,
             },
       "tractionItems": _serializeTractionItems(),
+      "shareUserIds": _shareUserIds.toList(),
+      "shareUsers": _shareUsers
+          .map((u) => {
+                "user_id": u.userId,
+                "username": u.username,
+                "full_name": u.fullName,
+              })
+          .toList(),
     };
   }
 
@@ -449,6 +479,19 @@ extension _NewEntryDraftLogic on _NewEntryPageState {
           ..clear()
           ..add(_TractionItem.marker());
       }
+      final shareIdsRaw = data['shareUserIds'];
+      final shareUsersRaw = data['shareUsers'];
+      _shareUserIds = shareIdsRaw is List
+          ? shareIdsRaw.map((e) => e.toString()).toSet()
+          : {};
+      _shareUsers = shareUsersRaw is List
+          ? shareUsersRaw
+              .whereType<Map>()
+              .map((e) => UserSummary.fromJson(
+                    e.map((k, v) => MapEntry(k.toString(), v)),
+                  ))
+              .toList()
+          : [];
       _lastSubmittedSnapshot = null;
       final idRaw = data['id'];
       if (idRaw != null) {

lib/components/pages/new_entry/new_entry_page.dart

@@ -58,6 +58,7 @@ class _NewEntryPageState extends State<NewEntryPage> {
   LegShareData? _activeLegShare;
   String? _sharedFromUser;
   int? _shareNotificationId;
+  bool _routeReversedFlag = false;
 
   bool get _isEditing => widget.editLegId != null;
   bool get _draftPersistenceEnabled =>
@@ -147,6 +148,48 @@ class _NewEntryPageState extends State<NewEntryPage> {
     }
   }
 
+  void _reverseRouteAndEndpoints() {
+    setState(() {
+      // Swap start/end and origin/destination fields
+      final startText = _startController.text;
+      final endText = _endController.text;
+      _startController.text = endText;
+      _endController.text = startText;
+
+      final originText = _originController.text;
+      final destText = _destinationController.text;
+      _originController.text = destText;
+      _destinationController.text = originText;
+
+      // Reverse route result if present
+      if (_routeResult != null) {
+        final reversedInput = _routeResult!.inputRoute.reversed.toList();
+        final reversedCalc = _routeResult!.calculatedRoute.reversed.toList();
+        final reversedCosts = _routeResult!.costs.reversed.toList();
+        _routeResult = RouteResult(
+          inputRoute: reversedInput,
+          calculatedRoute: reversedCalc,
+          costs: reversedCosts,
+          distance: _routeResult!.distance,
+        );
+        final units = _distanceUnits(context);
+        _mileageController.text = _formatDistance(
+          units,
+          _routeResult!.distance,
+          decimals: 2,
+          includeUnit: false,
+        );
+        _useManualMileage = false;
+      } else if (_useManualMileage &&
+          _mileageController.text.trim().isNotEmpty) {
+        // keep manual mileage, just swap endpoints
+      }
+      _routeReversedFlag = !_routeReversedFlag;
+    });
+    _saveDraft();
+    _scheduleMatchUpdate();
+  }
+
   double _milesFromInputWithUnit(DistanceUnit unit) {
     return DistanceFormatter(unit)
             .parseInputMiles(_mileageController.text.trim()) ??
@@ -664,7 +707,7 @@ class _NewEntryPageState extends State<NewEntryPage> {
     final enabled = value ?? false;
     setState(() {
       _matchDestinationToEntry = enabled;
-      if (enabled) _hasDestinationTime = true;
+      if (enabled && _hasEndTime) _hasDestinationTime = true;
     });
     _scheduleMatchUpdate();
     _saveDraft();
@@ -1084,7 +1127,7 @@ class _NewEntryPageState extends State<NewEntryPage> {
         if (_destinationController.text != endVal) {
           _destinationController.text = endVal;
         }
-        if (_hasDestinationTime) {
+        if (_hasDestinationTime && _hasEndTime) {
           final endTime = _legEndDateTime ?? _legDateTime;
           _selectedDestinationDate = DateTime(
             endTime.year,
@@ -1241,7 +1284,7 @@ class _NewEntryPageState extends State<NewEntryPage> {
             _buildSharedBanner(),
           ],
               _buildTripSelector(context),
-          const SizedBox(height: 12),
+              const SizedBox(height: 8),
               if (_activeLegShare == null) _buildShareSection(context),
           _dateTimeGroup(
                 context,
@@ -1323,6 +1366,7 @@ class _NewEntryPageState extends State<NewEntryPage> {
                   border: OutlineInputBorder(),
                 ),
               ),
+              const Divider(height: 24),
               _trainLocationBlock(
                 label: 'Origin',
                 controller: _originController,
@@ -1341,6 +1385,7 @@ class _NewEntryPageState extends State<NewEntryPage> {
                   singleColumn: true,
                 ),
               ),
+              const Divider(height: 24),
               _trainLocationBlock(
                 label: 'Destination',
                 controller: _destinationController,
@@ -1360,6 +1405,7 @@ class _NewEntryPageState extends State<NewEntryPage> {
                   singleColumn: true,
                 ),
               ),
+              const Divider(height: 24),
               TextFormField(
                 controller: _networkController,
                 textCapitalization: TextCapitalization.characters,
@@ -1391,17 +1437,53 @@ class _NewEntryPageState extends State<NewEntryPage> {
               _buildTractionList(),
             ], minHeight: balancedHeight);
 
+            final routeStart = _routeResult?.calculatedRoute.isNotEmpty == true
+                ? _routeResult!.calculatedRoute.first
+                : (_routeResult?.inputRoute.isNotEmpty == true
+                    ? _routeResult!.inputRoute.first
+                    : _startController.text.trim());
+            final routeEnd = _routeResult?.calculatedRoute.isNotEmpty == true
+                ? _routeResult!.calculatedRoute.last
+                : (_routeResult?.inputRoute.isNotEmpty == true
+                    ? _routeResult!.inputRoute.last
+                    : _endController.text.trim());
+
             final mileagePanel = _section(
-              'Mileage',
+              'Your Journey',
               [
                 if (!_useManualMileage)
-                  Align(
+                  Wrap(
-                    alignment: Alignment.centerLeft,
+                    spacing: 12,
-                    child: ElevatedButton.icon(
+                    runSpacing: 8,
+                    children: [
+                      ElevatedButton.icon(
                         onPressed: _openCalculator,
                         icon: const Icon(Icons.calculate, size: 18),
                         label: const Text('Open mileage calculator'),
                       ),
+                      OutlinedButton.icon(
+                        onPressed: _reverseRouteAndEndpoints,
+                        icon: const Icon(Icons.swap_horiz),
+                        label: const Text('Reverse route'),
+                      ),
+                    ],
+                  )
+                else
+                  Align(
+                    alignment: Alignment.centerLeft,
+                    child: OutlinedButton.icon(
+                      onPressed: _reverseRouteAndEndpoints,
+                      icon: const Icon(Icons.swap_horiz),
+                      label: const Text('Reverse route'),
+                    ),
+                  ),
+                if (routeStart.isNotEmpty || routeEnd.isNotEmpty)
+                  ListTile(
+                    contentPadding: EdgeInsets.zero,
+                    title: const Text('Route'),
+                    subtitle: Text(
+                      '${routeStart.isEmpty ? 'Start' : routeStart} → ${routeEnd.isEmpty ? 'End' : routeEnd}',
+                    ),
                   ),
                 if (_useManualMileage)
                   TextFormField(
@@ -1467,22 +1549,25 @@ class _NewEntryPageState extends State<NewEntryPage> {
                 children: [
                   entryPanel,
                   const SizedBox(height: 16),
+                  if (twoCol) ...[
                     trainPanel,
                     const SizedBox(height: 16),
-                  twoCol
+                    Row(
-                      ? Row(
                       crossAxisAlignment: CrossAxisAlignment.start,
                       children: [
                         Expanded(child: tractionPanel),
                         const SizedBox(width: 16),
                         Expanded(child: mileagePanel),
                       ],
-                        )
+                    ),
-                      : Column(
+                  ] else
+                    Column(
                       children: [
-                            tractionPanel,
-                            const SizedBox(height: 16),
                         mileagePanel,
+                        const SizedBox(height: 16),
+                        trainPanel,
+                        const SizedBox(height: 16),
+                        tractionPanel,
                       ],
                     ),
                   const SizedBox(height: 12),

lib/components/pages/new_entry/new_entry_submit_logic.dart

@@ -71,12 +71,14 @@ extension _NewEntrySubmitLogic on _NewEntryPageState {
     final beginDelay = _parseDelayMinutes(_beginDelayController.text);
     final endDelay =
         _hasEndTime ? _parseDelayMinutes(_endDelayController.text) : 0;
-    final snapshot = _buildSubmissionSnapshot(
+    final snapshot = _currentSubmissionSnapshot(
       routeStations: routeStations,
       startVal: startVal,
       endVal: endVal,
       mileageVal: mileageVal,
       tractionPayload: tractionPayload,
+      beginDelay: beginDelay,
+      endDelay: endDelay,
     );
     if (_lastSubmittedSnapshot != null &&
         _snapshotEquality.equals(_lastSubmittedSnapshot, snapshot)) {
@@ -161,16 +163,35 @@ extension _NewEntrySubmitLogic on _NewEntryPageState {
     }
   }
 
-  Map<String, dynamic> _buildSubmissionSnapshot({
+  Map<String, dynamic> _currentSubmissionSnapshot({
-    required List<String> routeStations,
+    List<String>? routeStations,
-    required String startVal,
+    String? startVal,
-    required String endVal,
+    String? endVal,
-    required double mileageVal,
+    double? mileageVal,
-    required List<Map<String, dynamic>> tractionPayload,
+    List<Map<String, dynamic>>? tractionPayload,
+    int? beginDelay,
+    int? endDelay,
   }) {
-    final beginDelay = _parseDelayMinutes(_beginDelayController.text);
+    final stations = routeStations ?? (_routeResult?.calculatedRoute ?? []);
-    final endDelay =
+    final start = startVal ??
-        _hasEndTime ? _parseDelayMinutes(_endDelayController.text) : 0;
+        (_useManualMileage
+            ? _startController.text.trim()
+            : (stations.isNotEmpty ? stations.first : ''));
+    final end = endVal ??
+        (_useManualMileage
+            ? _endController.text.trim()
+            : (stations.isNotEmpty ? stations.last : ''));
+    final mileage = mileageVal ??
+        (_useManualMileage
+            ? (_distanceUnits(context)
+                    .milesFromInput(_mileageController.text.trim()) ??
+                0)
+            : (_routeResult?.distance ?? 0));
+    final traction = tractionPayload ?? _buildTractionPayload();
+    final begin = beginDelay ?? _parseDelayMinutes(_beginDelayController.text);
+    final endDelayVal =
+        endDelay ?? (_hasEndTime ? _parseDelayMinutes(_endDelayController.text) : 0);
+
     return {
       "legId": widget.editLegId,
       "useManualMileage": _useManualMileage,
@@ -182,20 +203,20 @@ extension _NewEntrySubmitLogic on _NewEntryPageState {
       "hasOriginTime": _hasOriginTime,
       "legDestinationTime": _destinationDateTime?.toIso8601String(),
       "hasDestinationTime": _hasDestinationTime,
-      "start": startVal,
+      "start": start,
-      "end": endVal,
+      "end": end,
       "origin": _originController.text.trim(),
       "destination": _destinationController.text.trim(),
-      "routeStations": routeStations,
+      "routeStations": stations,
-      "mileage": mileageVal,
+      "mileage": mileage,
       "network": _networkController.text.trim(),
       "notes": _notesController.text.trim(),
       "headcode": _headcodeController.text.trim(),
-      "beginDelay": beginDelay,
+      "beginDelay": begin,
-      "endDelay": endDelay,
+      "endDelay": endDelayVal,
       "legShareId": _activeLegShare?.id,
       "shareUserIds": _shareUserIds.toList(),
-      "locos": tractionPayload,
+      "locos": traction,
       "routeResult": _routeResult == null
           ? null
           : {

lib/components/pages/profile.dart

@@ -1,6 +1,8 @@
 import 'package:flutter/material.dart';
+import 'package:go_router/go_router.dart';
 import 'package:provider/provider.dart';
 import 'package:mileograph_flutter/objects/objects.dart';
+import 'package:mileograph_flutter/services/api_service.dart';
 import 'package:mileograph_flutter/services/authservice.dart';
 import 'package:mileograph_flutter/services/data_service.dart';
 
@@ -13,15 +15,29 @@ class ProfilePage extends StatefulWidget {
 
 class _ProfilePageState extends State<ProfilePage> {
   final TextEditingController _searchController = TextEditingController();
+  final TextEditingController _currentPasswordController =
+      TextEditingController();
+  final TextEditingController _newPasswordController = TextEditingController();
+  final TextEditingController _confirmPasswordController =
+      TextEditingController();
+  final _passwordFormKey = GlobalKey<FormState>();
   List<UserSummary> _searchResults = [];
   bool _searching = false;
   String? _searchError;
   bool _fetched = false;
+  bool _privacyLoaded = false;
+  String? _privacyForUserId;
+  bool _privacyDirty = false;
+  bool _showAccountSettings = false;
+  bool _changingPassword = false;
+  static const List<String> _visibilityOptions = ['private', 'friends', 'public'];
 
   UserSummary? _selectedUser;
   Friendship? _status;
   bool _statusLoading = false;
   bool _actionLoading = false;
+  String _entriesVisibility = 'private';
+  String _mileageVisibility = 'private';
 
   @override
   void initState() {
@@ -35,9 +51,23 @@ class _ProfilePageState extends State<ProfilePage> {
     });
   }
 
+  @override
+  void didChangeDependencies() {
+    super.didChangeDependencies();
+    final auth = context.watch<AuthService>();
+    final userId = auth.userId;
+    if (userId != null && userId != _privacyForUserId) {
+      _privacyForUserId = userId;
+      _loadPrivacySettings();
+    }
+  }
+
   @override
   void dispose() {
     _searchController.dispose();
+    _currentPasswordController.dispose();
+    _newPasswordController.dispose();
+    _confirmPasswordController.dispose();
     super.dispose();
   }
 
@@ -188,6 +218,134 @@ class _ProfilePageState extends State<ProfilePage> {
     }
   }
 
+  Future<void> _loadPrivacySettings() async {
+    final data = context.read<DataService>();
+    final auth = context.read<AuthService>();
+    setState(() {
+      _entriesVisibility = auth.entriesVisibility.isNotEmpty
+          ? auth.entriesVisibility
+          : data.userEntriesVisibility;
+      _mileageVisibility = auth.mileageVisibility.isNotEmpty
+          ? auth.mileageVisibility
+          : data.userMileageVisibility;
+      _privacyDirty = false;
+      _privacyLoaded = true;
+    });
+    await data.fetchPrivacySettings();
+    if (!mounted) return;
+    setState(() {
+      _entriesVisibility = data.userEntriesVisibility;
+      _mileageVisibility = data.userMileageVisibility;
+      _privacyDirty = false;
+      _privacyLoaded = true;
+    });
+  }
+
+  int _visibilityRank(String value) {
+    switch (value.toLowerCase()) {
+      case 'public':
+        return 2;
+      case 'friends':
+        return 1;
+      default:
+        return 0;
+    }
+  }
+
+  String _visibilityLabel(String value) {
+    switch (value) {
+      case 'friends':
+        return 'Friends';
+      case 'public':
+        return 'Public';
+      default:
+        return 'Private';
+    }
+  }
+
+  void _setEntriesVisibility(String value) {
+    setState(() {
+      _entriesVisibility = value;
+      if (_visibilityRank(_mileageVisibility) < _visibilityRank(value)) {
+        _mileageVisibility = value;
+      }
+      _privacyDirty = true;
+    });
+  }
+
+  void _setMileageVisibility(String value) {
+    if (_visibilityRank(value) < _visibilityRank(_entriesVisibility)) {
+      value = _entriesVisibility;
+    }
+    setState(() {
+      _mileageVisibility = value;
+      _privacyDirty = true;
+    });
+  }
+
+  Future<void> _savePrivacy() async {
+    final messenger = ScaffoldMessenger.of(context);
+    final data = context.read<DataService>();
+    final entries = _entriesVisibility;
+    final mileage = _mileageVisibility;
+
+    try {
+      await data.updatePrivacySettings(
+        entriesVisibility: entries,
+        mileageVisibility: mileage,
+      );
+      if (!mounted) return;
+      setState(() {
+        _entriesVisibility = data.userEntriesVisibility;
+        _mileageVisibility = data.userMileageVisibility;
+        _privacyDirty = false;
+      });
+      messenger.showSnackBar(
+        const SnackBar(content: Text('Privacy settings updated.')),
+      );
+    } catch (e) {
+      if (!mounted) return;
+      setState(() => _privacyDirty = true);
+      messenger.showSnackBar(
+        SnackBar(content: Text('Failed to update privacy settings: $e')),
+      );
+    }
+  }
+
+  Future<void> _changePassword() async {
+    final messenger = ScaffoldMessenger.of(context);
+    final formState = _passwordFormKey.currentState;
+    if (formState == null || !formState.validate()) return;
+
+    FocusScope.of(context).unfocus();
+    setState(() => _changingPassword = true);
+    try {
+      final api = context.read<ApiService>();
+      await api.post('/user/password/change', {
+        'old_password': _currentPasswordController.text,
+        'new_password': _newPasswordController.text,
+      });
+      if (!mounted) return;
+      messenger.showSnackBar(
+        const SnackBar(content: Text('Password updated successfully.')),
+      );
+      formState.reset();
+      _currentPasswordController.clear();
+      _newPasswordController.clear();
+      _confirmPasswordController.clear();
+    } catch (e) {
+      if (mounted) {
+        messenger.showSnackBar(
+          SnackBar(content: Text('Failed to change password: $e')),
+        );
+      }
+    } finally {
+      if (mounted) {
+        setState(() => _changingPassword = false);
+      }
+    }
+  }
+
   void _showSnack(String message) {
     ScaffoldMessenger.of(context).showSnackBar(SnackBar(content: Text(message)));
   }
@@ -211,6 +369,7 @@ class _ProfilePageState extends State<ProfilePage> {
         onRefresh: () async {
           await data.fetchFriendships();
           await data.fetchPendingFriendships();
+          await _loadPrivacySettings();
           if (_selectedUser != null) {
             await _loadStatus(_selectedUser!);
           }
@@ -225,6 +384,8 @@ class _ProfilePageState extends State<ProfilePage> {
             _buildSelectedUserSection(auth),
             const SizedBox(height: 16),
             _buildFriendsList(auth),
+            const SizedBox(height: 16),
+            _buildAccountSection(),
           ],
         ),
       ),
@@ -304,7 +465,11 @@ class _ProfilePageState extends State<ProfilePage> {
                     subtitle:
                         user.username.isNotEmpty ? Text('@${user.username}') : null,
                   trailing: TextButton(
-                    onPressed: () => _loadStatus(user),
+                    onPressed: () => context.goNamed(
+                      'user-profile',
+                      extra: user,
+                      queryParameters: {'user_id': user.userId},
+                    ),
                     child: const Text('View'),
                   ),
                   ),
@@ -596,6 +761,241 @@ class _ProfilePageState extends State<ProfilePage> {
     );
   }
 
+  Widget _buildAccountSection() {
+    final data = context.watch<DataService>();
+    final theme = Theme.of(context);
+    final privacySaving = data.isPrivacySaving;
+    final showPrivacySpinner = data.isPrivacyLoading && !_privacyLoaded;
+    final privacyInputsDisabled = privacySaving || showPrivacySpinner;
+
+    return Card(
+      child: Padding(
+        padding: const EdgeInsets.all(12.0),
+        child: Column(
+          crossAxisAlignment: CrossAxisAlignment.start,
+          children: [
+            Row(
+              mainAxisAlignment: MainAxisAlignment.spaceBetween,
+              children: [
+                Text(
+                  'Account & privacy',
+                  style: theme.textTheme.titleMedium,
+                ),
+                TextButton.icon(
+                  onPressed: () => setState(
+                    () => _showAccountSettings = !_showAccountSettings,
+                  ),
+                  icon: Icon(
+                    _showAccountSettings ? Icons.expand_less : Icons.expand_more,
+                  ),
+                  label: Text(
+                    _showAccountSettings ? 'Hide settings' : 'More settings',
+                  ),
+                ),
+              ],
+            ),
+            AnimatedCrossFade(
+              crossFadeState: _showAccountSettings
+                  ? CrossFadeState.showFirst
+                  : CrossFadeState.showSecond,
+              duration: const Duration(milliseconds: 200),
+              firstChild: Column(
+                crossAxisAlignment: CrossAxisAlignment.start,
+                children: [
+                  if (showPrivacySpinner)
+                    const Padding(
+                      padding: EdgeInsets.symmetric(vertical: 8.0),
+                      child: Center(
+                        child: CircularProgressIndicator(strokeWidth: 2),
+                      ),
+                    )
+                  else ...[
+                    Text(
+                      'Privacy settings',
+                      style: theme.textTheme.titleMedium
+                          ?.copyWith(fontWeight: FontWeight.w700),
+                    ),
+                    const SizedBox(height: 8),
+                    DropdownButtonFormField<String>(
+                      value: _entriesVisibility,
+                      decoration: const InputDecoration(
+                        labelText: 'Entry privacy',
+                        border: OutlineInputBorder(),
+                      ),
+                      items: _visibilityOptions
+                          .map(
+                            (option) => DropdownMenuItem(
+                              value: option,
+                              child: Text(_visibilityLabel(option)),
+                            ),
+                          )
+                          .toList(),
+                      onChanged: privacyInputsDisabled
+                          ? null
+                          : (value) {
+                              if (value == null) return;
+                              _setEntriesVisibility(value);
+                            },
+                    ),
+                    const SizedBox(height: 12),
+                    DropdownButtonFormField<String>(
+                      value: _mileageVisibility,
+                      decoration: const InputDecoration(
+                        labelText: 'Mileage privacy',
+                        border: OutlineInputBorder(),
+                      ),
+                      items: _visibilityOptions
+                          .map((option) {
+                            final enabled = _visibilityRank(option) >=
+                                _visibilityRank(_entriesVisibility);
+                            final textColor = enabled
+                                ? null
+                                : theme.disabledColor;
+                            return DropdownMenuItem(
+                              value: option,
+                              enabled: enabled,
+                              child: Text(
+                                _visibilityLabel(option),
+                                style: textColor == null
+                                    ? null
+                                    : TextStyle(color: textColor),
+                              ),
+                            );
+                          })
+                          .toList(),
+                      onChanged: privacyInputsDisabled
+                          ? null
+                          : (value) {
+                              if (value == null) return;
+                              _setMileageVisibility(value);
+                            },
+                    ),
+                    const SizedBox(height: 6),
+                    Text(
+                      'Mileage visibility cannot be more restrictive than entry visibility.',
+                      style: theme.textTheme.bodySmall,
+                    ),
+                    const SizedBox(height: 12),
+                    FilledButton.icon(
+                      onPressed: (privacySaving || !_privacyDirty || showPrivacySpinner)
+                          ? null
+                          : _savePrivacy,
+                      icon: privacySaving
+                          ? const SizedBox(
+                              width: 18,
+                              height: 18,
+                              child: CircularProgressIndicator(strokeWidth: 2),
+                            )
+                          : const Icon(Icons.save),
+                      label: Text(
+                        privacySaving ? 'Saving...' : 'Save privacy',
+                      ),
+                    ),
+                  ],
+                  const Divider(height: 28),
+                  Text(
+                    'Change password',
+                    style: theme.textTheme.titleMedium
+                        ?.copyWith(fontWeight: FontWeight.w700),
+                  ),
+                  const SizedBox(height: 8),
+                  Text(
+                    'Change your password for this account.',
+                    style: theme.textTheme.bodySmall,
+                  ),
+                  const SizedBox(height: 12),
+                  Form(
+                    key: _passwordFormKey,
+                    child: Column(
+                      crossAxisAlignment: CrossAxisAlignment.start,
+                      children: [
+                        TextFormField(
+                          controller: _currentPasswordController,
+                          decoration: const InputDecoration(
+                            labelText: 'Current password',
+                            border: OutlineInputBorder(),
+                          ),
+                          obscureText: true,
+                          enableSuggestions: false,
+                          autocorrect: false,
+                          autofillHints: const [AutofillHints.password],
+                          validator: (value) {
+                            if (value == null || value.isEmpty) {
+                              return 'Please enter your current password.';
+                            }
+                            return null;
+                          },
+                        ),
+                        const SizedBox(height: 12),
+                        TextFormField(
+                          controller: _newPasswordController,
+                          decoration: const InputDecoration(
+                            labelText: 'New password',
+                            border: OutlineInputBorder(),
+                          ),
+                          obscureText: true,
+                          enableSuggestions: false,
+                          autocorrect: false,
+                          autofillHints: const [AutofillHints.newPassword],
+                          validator: (value) {
+                            if (value == null || value.isEmpty) {
+                              return 'Please enter a new password.';
+                            }
+                            return null;
+                          },
+                        ),
+                        const SizedBox(height: 12),
+                        TextFormField(
+                          controller: _confirmPasswordController,
+                          decoration: const InputDecoration(
+                            labelText: 'Confirm new password',
+                            border: OutlineInputBorder(),
+                          ),
+                          obscureText: true,
+                          enableSuggestions: false,
+                          autocorrect: false,
+                          autofillHints: const [AutofillHints.newPassword],
+                          validator: (value) {
+                            if (value == null || value.isEmpty) {
+                              return 'Please confirm the new password.';
+                            }
+                            if (value != _newPasswordController.text) {
+                              return 'New passwords do not match.';
+                            }
+                            return null;
+                          },
+                        ),
+                        const SizedBox(height: 16),
+                        FilledButton.icon(
+                          onPressed:
+                              _changingPassword ? null : _changePassword,
+                          icon: _changingPassword
+                              ? const SizedBox(
+                                  width: 18,
+                                  height: 18,
+                                  child:
+                                      CircularProgressIndicator(strokeWidth: 2),
+                                )
+                              : const Icon(Icons.lock_reset),
+                          label: Text(
+                            _changingPassword
+                                ? 'Updating...'
+                                : 'Change password',
+                          ),
+                        ),
+                      ],
+                    ),
+                  ),
+                ],
+              ),
+              secondChild: const SizedBox.shrink(),
+            ),
+          ],
+        ),
+      ),
+    );
+  }
+
   UserSummary? _otherUser(Friendship friendship, String? currentUserId) {
     final selfId = currentUserId ?? '';
     if (friendship.requester?.userId == selfId) return friendship.addressee;

lib/components/pages/settings.dart

@@ -3,8 +3,6 @@ import 'dart:convert';
 import 'package:flutter/material.dart';
 import 'package:go_router/go_router.dart';
 import 'package:http/http.dart' as http;
-import 'package:mileograph_flutter/services/authservice.dart';
-import 'package:mileograph_flutter/services/api_service.dart';
 import 'package:mileograph_flutter/services/distance_unit_service.dart';
 import 'package:mileograph_flutter/services/endpoint_service.dart';
 import 'package:mileograph_flutter/services/data_service.dart';
@@ -20,27 +18,16 @@ class SettingsPage extends StatefulWidget {
 class _SettingsPageState extends State<SettingsPage> {
   late final TextEditingController _endpointController;
   bool _saving = false;
-  bool _changingPassword = false;
-  final _passwordFormKey = GlobalKey<FormState>();
-  late final TextEditingController _currentPasswordController;
-  late final TextEditingController _newPasswordController;
-  late final TextEditingController _confirmPasswordController;
 
   @override
   void initState() {
     super.initState();
     final endpoint = context.read<EndpointService>().baseUrl;
     _endpointController = TextEditingController(text: endpoint);
-    _currentPasswordController = TextEditingController();
-    _newPasswordController = TextEditingController();
-    _confirmPasswordController = TextEditingController();
   }
 
   @override
   void dispose() {
-    _currentPasswordController.dispose();
-    _newPasswordController.dispose();
-    _confirmPasswordController.dispose();
     _endpointController.dispose();
     super.dispose();
   }
@@ -139,47 +126,10 @@ class _SettingsPageState extends State<SettingsPage> {
     }
   }
 
-  Future<void> _changePassword() async {
-    final messenger = ScaffoldMessenger.of(context);
-    final formState = _passwordFormKey.currentState;
-    if (formState == null || !formState.validate()) return;
-
-    FocusScope.of(context).unfocus();
-    setState(() => _changingPassword = true);
-    try {
-      final api = context.read<ApiService>();
-      await api.post('/user/password/change', {
-        'old_password': _currentPasswordController.text,
-        'new_password': _newPasswordController.text,
-      });
-      if (!mounted) return;
-      messenger.showSnackBar(
-        const SnackBar(content: Text('Password updated successfully.')),
-      );
-      formState.reset();
-      _currentPasswordController.clear();
-      _newPasswordController.clear();
-      _confirmPasswordController.clear();
-    } catch (e) {
-      if (mounted) {
-        messenger.showSnackBar(
-          SnackBar(content: Text('Failed to change password: $e')),
-        );
-      }
-    } finally {
-      if (mounted) {
-        setState(() => _changingPassword = false);
-      }
-    }
-  }
-
   @override
   Widget build(BuildContext context) {
     final endpointService = context.watch<EndpointService>();
     final distanceUnitService = context.watch<DistanceUnitService>();
-    final loggedIn = context.select<AuthService, bool>(
-      (auth) => auth.isLoggedIn,
-    );
     if (!endpointService.isLoaded || !distanceUnitService.isLoaded) {
       return const Scaffold(
         body: Center(child: CircularProgressIndicator()),
@@ -285,99 +235,6 @@ class _SettingsPageState extends State<SettingsPage> {
               'Current: ${endpointService.baseUrl}',
               style: Theme.of(context).textTheme.labelSmall,
             ),
-            if (loggedIn) ...[
-              const SizedBox(height: 32),
-              Text(
-                'Account',
-                style: Theme.of(context).textTheme.titleMedium?.copyWith(
-                      fontWeight: FontWeight.w700,
-                    ),
-              ),
-              const SizedBox(height: 8),
-              Text(
-                'Change your password for this account.',
-                style: Theme.of(context).textTheme.bodySmall,
-              ),
-              const SizedBox(height: 12),
-              Form(
-                key: _passwordFormKey,
-                child: Column(
-                  crossAxisAlignment: CrossAxisAlignment.start,
-                  children: [
-                    TextFormField(
-                      controller: _currentPasswordController,
-                      decoration: const InputDecoration(
-                        labelText: 'Current password',
-                        border: OutlineInputBorder(),
-                      ),
-                      obscureText: true,
-                      enableSuggestions: false,
-                      autocorrect: false,
-                      autofillHints: const [AutofillHints.password],
-                      validator: (value) {
-                        if (value == null || value.isEmpty) {
-                          return 'Please enter your current password.';
-                        }
-                        return null;
-                      },
-                    ),
-                    const SizedBox(height: 12),
-                    TextFormField(
-                      controller: _newPasswordController,
-                      decoration: const InputDecoration(
-                        labelText: 'New password',
-                        border: OutlineInputBorder(),
-                      ),
-                      obscureText: true,
-                      enableSuggestions: false,
-                      autocorrect: false,
-                      autofillHints: const [AutofillHints.newPassword],
-                      validator: (value) {
-                        if (value == null || value.isEmpty) {
-                          return 'Please enter a new password.';
-                        }
-                        return null;
-                      },
-                    ),
-                    const SizedBox(height: 12),
-                    TextFormField(
-                      controller: _confirmPasswordController,
-                      decoration: const InputDecoration(
-                        labelText: 'Confirm new password',
-                        border: OutlineInputBorder(),
-                      ),
-                      obscureText: true,
-                      enableSuggestions: false,
-                      autocorrect: false,
-                      autofillHints: const [AutofillHints.newPassword],
-                      validator: (value) {
-                        if (value == null || value.isEmpty) {
-                          return 'Please confirm the new password.';
-                        }
-                        if (value != _newPasswordController.text) {
-                          return 'New passwords do not match.';
-                        }
-                        return null;
-                      },
-                    ),
-                    const SizedBox(height: 16),
-                    FilledButton.icon(
-                      onPressed: _changingPassword ? null : _changePassword,
-                      icon: _changingPassword
-                          ? const SizedBox(
-                              width: 18,
-                              height: 18,
-                              child: CircularProgressIndicator(strokeWidth: 2),
-                            )
-                          : const Icon(Icons.lock_reset),
-                      label: Text(
-                        _changingPassword ? 'Updating...' : 'Change password',
-                      ),
-                    ),
-                  ],
-                ),
-              ),
-            ],
           ],
         ),
       ),

lib/components/pages/traction/traction.dart

@@ -7,6 +7,7 @@ import 'package:mileograph_flutter/components/traction/traction_card.dart';
 import 'package:mileograph_flutter/objects/objects.dart';
 import 'package:mileograph_flutter/services/data_service.dart';
 import 'package:mileograph_flutter/services/distance_unit_service.dart';
+import 'package:mileograph_flutter/services/authservice.dart';
 import 'package:provider/provider.dart';
 import 'package:shared_preferences/shared_preferences.dart';
 

lib/components/pages/traction/traction_page.dart

@@ -569,6 +569,7 @@ class _TractionPageState extends State<TractionPage> {
   }
 
   Widget _buildHeaderActions(BuildContext context, bool isMobile) {
+    final isElevated = context.read<AuthService>().isElevated;
     final refreshButton = IconButton(
       tooltip: 'Refresh',
       onPressed: _refreshTraction,
@@ -587,7 +588,9 @@ class _TractionPageState extends State<TractionPage> {
             ),
           );
 
-    final newTractionButton = FilledButton.icon(
+    final newTractionButton = !isElevated
+        ? null
+        : FilledButton.icon(
             onPressed: () async {
               final createdClass = await context.push<String>(
                 '/traction/new',
@@ -608,11 +611,11 @@ class _TractionPageState extends State<TractionPage> {
     final desktopActions = [
       refreshButton,
       if (classStatsButton != null) classStatsButton,
-      newTractionButton,
+      if (newTractionButton != null) newTractionButton,
     ];
 
     final mobileActions = [
-      newTractionButton,
+      if (newTractionButton != null) newTractionButton,
       if (classStatsButton != null) classStatsButton,
       refreshButton,
     ];

lib/objects/objects.dart

@@ -109,15 +109,21 @@ class UserData {
     required this.fullName,
     required this.userId,
     required this.email,
+    String? entriesVisibility,
+    String? mileageVisibility,
     bool? elevated,
     bool? disabled,
-  })  : elevated = elevated ?? false,
+  })  : entriesVisibility = entriesVisibility ?? 'private',
+        mileageVisibility = mileageVisibility ?? 'private',
+        elevated = elevated ?? false,
         disabled = disabled ?? false;
 
   final String userId;
   final String username;
   final String fullName;
   final String email;
+  final String entriesVisibility;
+  final String mileageVisibility;
   final bool elevated;
   final bool disabled;
 }
@@ -128,6 +134,8 @@ class AuthenticatedUserData extends UserData {
     required super.username,
     required super.fullName,
     required super.email,
+    super.entriesVisibility,
+    super.mileageVisibility,
     bool? elevated,
     bool? isElevated,
     bool? disabled,
@@ -148,6 +156,8 @@ class UserSummary extends UserData {
     required super.fullName,
     required super.userId,
     required super.email,
+    super.entriesVisibility,
+    super.mileageVisibility,
     super.elevated = false,
     super.disabled = false,
   });
@@ -159,11 +169,71 @@ class UserSummary extends UserData {
         fullName: _asString(json['full_name'] ?? json['name']),
         userId: _asString(json['user_id'] ?? json['id']),
         email: _asString(json['email']),
+        entriesVisibility: _asString(
+          json['user_entries_visibility'] ?? json['entries_visibility'],
+          'private',
+        ),
+        mileageVisibility: _asString(
+          json['user_mileage_visibility'] ?? json['mileage_visibility'],
+          'private',
+        ),
         elevated: _asBool(json['elevated'] ?? json['is_elevated'], false),
         disabled: _asBool(json['disabled'], false),
       );
 }
 
+class UserProfileDetail {
+  final String username;
+  final String fullName;
+  final double mileage;
+  final List<LocoSummary> topLocos;
+  final List<Leg> legs;
+  final Map<String, dynamic> privacyInfo;
+  final String friendshipStatus;
+
+  UserProfileDetail({
+    required this.username,
+    required this.fullName,
+    required this.mileage,
+    required this.topLocos,
+    required this.legs,
+    this.privacyInfo = const {},
+    this.friendshipStatus = 'none',
+  });
+
+  factory UserProfileDetail.fromJson(Map<String, dynamic> json) {
+    List<dynamic>? topLocosRaw;
+    final tl = json['top_locos'];
+    if (tl is List) {
+      topLocosRaw = tl;
+    }
+    List<dynamic>? legsRaw;
+    final legData = json['user_legs'];
+    if (legData is List) {
+      legsRaw = legData;
+    }
+    return UserProfileDetail(
+      username: _asString(json['username']),
+      fullName: _asString(json['full_name']),
+      mileage: _asDouble(json['mileage']),
+      topLocos: (topLocosRaw ?? const [])
+          .whereType<Map>()
+          .map((e) => LocoSummary.fromJson(
+                e.map((k, v) => MapEntry(k.toString(), v)),
+              ))
+          .toList(),
+      legs: (legsRaw ?? const [])
+          .whereType<Map>()
+          .map((e) => Leg.fromJson(e.map((k, v) => MapEntry(k.toString(), v))))
+          .toList(),
+      privacyInfo: json['privacy_info'] is Map
+          ? Map<String, dynamic>.from(json['privacy_info'] as Map)
+          : const {},
+      friendshipStatus: _asString(json['friendship_status'], 'none'),
+    );
+  }
+}
+
 class Friendship {
   final String? id;
   final String status;
@@ -350,6 +420,7 @@ class HomepageStats {
   final List<YearlyMileage> yearlyMileage;
   final List<LocoSummary> topLocos;
   final List<LeaderboardEntry> leaderboard;
+  final List<LeaderboardEntry> friendsLeaderboard;
   final List<TripSummary> trips;
   final int legCount;
   final UserData? user;
@@ -359,6 +430,7 @@ class HomepageStats {
     required this.yearlyMileage,
     required this.topLocos,
     required this.leaderboard,
+    required this.friendsLeaderboard,
     required this.trips,
     required this.legCount,
     this.user,
@@ -370,6 +442,17 @@ class HomepageStats {
     final totalMileage = mileageData is Map && mileageData['mileage'] != null
         ? (mileageData['mileage'] as num).toDouble()
         : 0.0;
+    List<LeaderboardEntry> parseLeaderboard(dynamic raw) {
+      if (raw is List) {
+        return raw
+            .whereType<Map>()
+            .map((e) => LeaderboardEntry.fromJson(
+                  e.map((k, v) => MapEntry(k.toString(), v)),
+                ))
+            .toList();
+      }
+      return const [];
+    }
     return HomepageStats(
       totalMileage: totalMileage,
       yearlyMileage: (json['yearly_mileage'] as List? ?? [])
@@ -378,9 +461,9 @@ class HomepageStats {
       topLocos: (json['top_locos'] as List? ?? [])
           .map((e) => LocoSummary.fromJson(e))
           .toList(),
-      leaderboard: (json['leaderboard_data'] as List? ?? [])
+      leaderboard: parseLeaderboard(json['leaderboard_data'] ?? json['leaderboard']),
-          .map((e) => LeaderboardEntry.fromJson(e))
+      friendsLeaderboard:
-          .toList(),
+          parseLeaderboard(json['friends_leaderboard'] ?? json['friendsLeaderboard']),
       trips: (json['trip_data'] as List? ?? [])
           .map((e) => TripSummary.fromJson(e))
           .toList(),
@@ -395,6 +478,16 @@ class HomepageStats {
               fullName: userData['full_name'] ?? '',
               userId: userData['user_id'] ?? '',
               email: userData['email'] ?? '',
+              entriesVisibility: _asString(
+                userData['user_entries_visibility'] ??
+                    userData['entries_visibility'],
+                'private',
+              ),
+              mileageVisibility: _asString(
+                userData['user_mileage_visibility'] ??
+                    userData['mileage_visibility'],
+                'private',
+              ),
               elevated:
                   _asBool(userData['elevated'] ?? userData['is_elevated'], false),
               disabled: _asBool(userData['disabled'], false),
@@ -1061,6 +1154,8 @@ class Leg {
   final String origin, destination;
   final List<String> route;
   final String? legShareId;
+  final LegShareMeta? sharedFrom;
+  final List<LegShareMeta> sharedTo;
   final DateTime beginTime;
   final DateTime? endTime;
   final DateTime? originTime;
@@ -1092,6 +1187,8 @@ class Leg {
     this.origin = '',
     this.destination = '',
     this.legShareId,
+    this.sharedFrom,
+    this.sharedTo = const [],
   });
 
   factory Leg.fromJson(Map<String, dynamic> json) {
@@ -1099,6 +1196,25 @@ class Leg {
     final parsedEndTime = (endTimeRaw == null || '$endTimeRaw'.isEmpty)
         ? null
         : _asDateTime(endTimeRaw);
+    LegShareMeta? sharedFrom;
+    final sharedFromJson = json['shared_from'];
+    if (sharedFromJson is Map) {
+      sharedFrom = LegShareMeta.fromJson(
+        sharedFromJson.map((k, v) => MapEntry(k.toString(), v)),
+      );
+    }
+    List<LegShareMeta> sharedTo = const [];
+    final sharedToJson = json['shared_to'];
+    if (sharedToJson is List) {
+      sharedTo = sharedToJson
+          .whereType<Map>()
+          .map(
+            (e) => LegShareMeta.fromJson(
+              e.map((k, v) => MapEntry(k.toString(), v)),
+            ),
+          )
+          .toList();
+    }
     return Leg(
       id: _asInt(json['leg_id']),
       tripId: _asInt(json['leg_trip']),
@@ -1133,10 +1249,73 @@ class Leg {
       origin: _asString(json['leg_origin']),
       destination: _asString(json['leg_destination']),
       legShareId: _asString(json['leg_share_id']),
+      sharedFrom: sharedFrom,
+      sharedTo: sharedTo,
     );
   }
 }
 
+class LegShareMeta {
+  final int? legShareId;
+  final int? legId;
+  final String sharedToUserId;
+  final String sharedByUserId;
+  final String status;
+  final DateTime? respondedAt;
+  final bool? acceptedEdits;
+  final DateTime? sharedAt;
+  final String sharedToUsername;
+  final String sharedToFullName;
+  final String sharedByUsername;
+  final String sharedByFullName;
+
+  LegShareMeta({
+    this.legShareId,
+    this.legId,
+    required this.sharedToUserId,
+    required this.sharedByUserId,
+    required this.status,
+    this.respondedAt,
+    this.acceptedEdits,
+    this.sharedAt,
+    this.sharedToUsername = '',
+    this.sharedToFullName = '',
+    this.sharedByUsername = '',
+    this.sharedByFullName = '',
+  });
+
+  factory LegShareMeta.fromJson(Map<String, dynamic> json) {
+    DateTime? parseDate(dynamic raw) {
+      if (raw == null) return null;
+      if (raw is DateTime) return raw;
+      return DateTime.tryParse(raw.toString());
+    }
+
+    return LegShareMeta(
+      legShareId: _asInt(json['leg_share_id']),
+      legId: _asInt(json['leg_id']),
+      sharedToUserId: _asString(json['shared_to_user_id']),
+      sharedByUserId: _asString(json['shared_by_user_id']),
+      status: _asString(json['status'], 'pending'),
+      respondedAt: parseDate(json['responded_at']),
+      acceptedEdits: json['accepted_edits'] == null
+          ? null
+          : _asBool(json['accepted_edits'], false),
+      sharedAt: parseDate(json['shared_at']),
+      sharedToUsername: _asString(json['shared_to_username']),
+      sharedToFullName: _asString(json['shared_to_full_name']),
+      sharedByUsername: _asString(json['shared_by_username']),
+      sharedByFullName: _asString(json['shared_by_full_name']),
+    );
+  }
+
+  String get sharedFromDisplay =>
+      sharedByFullName.isNotEmpty ? sharedByFullName : sharedByUsername;
+
+  String get sharedToDisplay =>
+      sharedToFullName.isNotEmpty ? sharedToFullName : sharedToUsername;
+}
+
 class LegShareData {
   final String id;
   final Leg entry;

lib/services/authservice.dart

@@ -21,6 +21,8 @@ class AuthService extends ChangeNotifier {
   String? get userId => _user?.userId;
   String? get username => _user?.username;
   String? get fullName => _user?.fullName;
+  String get entriesVisibility => _user?.entriesVisibility ?? 'private';
+  String get mileageVisibility => _user?.mileageVisibility ?? 'private';
   bool get isElevated => _user?.isElevated ?? false;
   bool get isAdmin => isElevated; // alias for old name
   bool get isDisabled => _user?.disabled ?? false;
@@ -31,6 +33,8 @@ class AuthService extends ChangeNotifier {
     required String fullName,
     required String accessToken,
     required String email,
+    String entriesVisibility = 'private',
+    String mileageVisibility = 'private',
     bool isElevated = false,
     bool isDisabled = false,
   }) {
@@ -40,6 +44,8 @@ class AuthService extends ChangeNotifier {
       fullName: fullName,
       accessToken: accessToken,
       email: email,
+      entriesVisibility: entriesVisibility,
+      mileageVisibility: mileageVisibility,
       isElevated: isElevated,
       disabled: isDisabled,
     );
@@ -77,6 +83,14 @@ class AuthService extends ChangeNotifier {
       fullName: userResponse['full_name'],
       accessToken: accessToken,
       email: userResponse['email'],
+      entriesVisibility: _parseVisibility(
+        userResponse['user_entries_visibility'] ?? userResponse['entries_visibility'],
+        'private',
+      ),
+      mileageVisibility: _parseVisibility(
+        userResponse['user_mileage_visibility'] ?? userResponse['mileage_visibility'],
+        'private',
+      ),
       isElevated: _parseIsElevated(userResponse),
       isDisabled: _parseIsDisabled(userResponse),
     );
@@ -104,6 +118,14 @@ class AuthService extends ChangeNotifier {
       fullName: userResponse['full_name'],
       accessToken: token,
       email: userResponse['email'],
+      entriesVisibility: _parseVisibility(
+        userResponse['user_entries_visibility'] ?? userResponse['entries_visibility'],
+        'private',
+      ),
+      mileageVisibility: _parseVisibility(
+        userResponse['user_mileage_visibility'] ?? userResponse['mileage_visibility'],
+        'private',
+      ),
       isElevated: _parseIsElevated(userResponse),
       isDisabled: _parseIsDisabled(userResponse),
     );
@@ -224,4 +246,11 @@ class AuthService extends ChangeNotifier {
     if (str == null || str.isEmpty) return false;
     return ['1', 'true', 'yes', 'y', 'disabled'].contains(str);
   }
+
+  String _parseVisibility(dynamic value, String fallback) {
+    const allowed = ['private', 'friends', 'public'];
+    final str = value?.toString().toLowerCase().trim();
+    if (str != null && allowed.contains(str)) return str;
+    return fallback;
+  }
 }

lib/services/data_service/data_service_core.dart

@@ -6,6 +6,7 @@ class _LegFetchOptions {
   final int sortDirection;
   final String? dateRangeStart;
   final String? dateRangeEnd;
+  final bool unallocatedOnly;
 
   const _LegFetchOptions({
     this.limit = 100,
@@ -13,6 +14,7 @@ class _LegFetchOptions {
     this.sortDirection = 0,
     this.dateRangeStart,
     this.dateRangeEnd,
+    this.unallocatedOnly = false,
   });
 }
 
@@ -108,6 +110,10 @@ class DataService extends ChangeNotifier {
   bool get isHomepageLoading => _isHomepageLoading;
   bool _isOnThisDayLoading = false;
   bool get isOnThisDayLoading => _isOnThisDayLoading;
+  List<LeaderboardEntry> _friendsLeaderboard = [];
+  List<LeaderboardEntry> get friendsLeaderboard => _friendsLeaderboard;
+  bool _isFriendsLeaderboardLoading = false;
+  bool get isFriendsLeaderboardLoading => _isFriendsLeaderboardLoading;
 
   // Notifications
   List<UserNotification> _notifications = [];
@@ -115,6 +121,16 @@ class DataService extends ChangeNotifier {
   bool _isNotificationsLoading = false;
   bool get isNotificationsLoading => _isNotificationsLoading;
 
+  // Privacy
+  String _userEntriesVisibility = 'private';
+  String _userMileageVisibility = 'private';
+  bool _isPrivacyLoading = false;
+  bool _isPrivacySaving = false;
+  String get userEntriesVisibility => _userEntriesVisibility;
+  String get userMileageVisibility => _userMileageVisibility;
+  bool get isPrivacyLoading => _isPrivacyLoading;
+  bool get isPrivacySaving => _isPrivacySaving;
+
   // Badges
   List<BadgeAward> _badgeAwards = [];
   List<BadgeAward> get badgeAwards => _badgeAwards;
@@ -157,6 +173,127 @@ class DataService extends ChangeNotifier {
     });
   }
 
+  int _visibilityRank(String value) {
+    switch (value.toLowerCase()) {
+      case 'public':
+        return 2;
+      case 'friends':
+        return 1;
+      default:
+        return 0;
+    }
+  }
+
+  String _normaliseVisibility(
+    dynamic value, {
+    required String fallback,
+  }) {
+    const allowed = ['private', 'friends', 'public'];
+    final str = value?.toString().toLowerCase().trim();
+    if (str != null && allowed.contains(str)) return str;
+    return fallback;
+  }
+
+  String _clampMileageVisibility(String entries, String mileage) {
+    return _visibilityRank(mileage) < _visibilityRank(entries)
+        ? entries
+        : mileage;
+  }
+
+  void _applyPrivacy(dynamic source) {
+    String entries = _userEntriesVisibility;
+    String mileage = _userMileageVisibility;
+    if (source is Map) {
+      entries = _normaliseVisibility(
+        source['user_entries_visibility'] ?? source['entries_visibility'],
+        fallback: entries,
+      );
+      mileage = _normaliseVisibility(
+        source['user_mileage_visibility'] ?? source['mileage_visibility'],
+        fallback: mileage,
+      );
+    } else if (source is UserData) {
+      entries = _normaliseVisibility(
+        source.entriesVisibility,
+        fallback: entries,
+      );
+      mileage = _normaliseVisibility(
+        source.mileageVisibility,
+        fallback: mileage,
+      );
+    }
+    _userEntriesVisibility = entries;
+    _userMileageVisibility = _clampMileageVisibility(entries, mileage);
+  }
+
+  Future<void> fetchPrivacySettings({String? targetUserId}) async {
+    _isPrivacyLoading = true;
+    _notifyAsync();
+    try {
+      Map<String, dynamic>? payload;
+      final hasTarget = targetUserId?.isNotEmpty ?? false;
+      if (!hasTarget) {
+        try {
+          final json = await api.get('/users/me');
+          if (json is Map<String, dynamic>) {
+            payload = json;
+          } else if (json is Map) {
+            payload = json.map((k, v) => MapEntry(k.toString(), v));
+          }
+        } catch (e) {
+          debugPrint('Failed to fetch /users/me: $e');
+        }
+      }
+      if (payload == null) {
+        final query = hasTarget ? '?target_user_id=$targetUserId' : '';
+        try {
+          final json = await api.get('/users/privacy$query');
+          if (json is Map<String, dynamic>) {
+            payload = json;
+          } else if (json is Map) {
+            payload = json.map((k, v) => MapEntry(k.toString(), v));
+          }
+        } catch (e) {
+          debugPrint('Failed to fetch /users/privacy: $e');
+        }
+      }
+      if (payload != null) {
+        _applyPrivacy(payload);
+      }
+    } catch (e) {
+      debugPrint('Failed to fetch privacy settings: $e');
+    } finally {
+      _isPrivacyLoading = false;
+      _notifyAsync();
+    }
+  }
+
+  Future<void> updatePrivacySettings({
+    required String entriesVisibility,
+    required String mileageVisibility,
+    String? targetUserId,
+  }) async {
+    _isPrivacySaving = true;
+    _notifyAsync();
+    try {
+      final query = (targetUserId?.isNotEmpty ?? false)
+          ? '?target_user_id=$targetUserId'
+          : '';
+      await api.post('/users/privacy$query', {
+        'user_entries_visibility': entriesVisibility,
+        'user_mileage_visibility': mileageVisibility,
+      });
+      _userEntriesVisibility = entriesVisibility;
+      _userMileageVisibility = mileageVisibility;
+    } catch (e) {
+      debugPrint('Failed to update privacy settings: $e');
+      rethrow;
+    } finally {
+      _isPrivacySaving = false;
+      _notifyAsync();
+    }
+  }
+
   Future<void> fetchHomepageStats() async {
     _isHomepageLoading = true;
 
@@ -165,16 +302,68 @@ class DataService extends ChangeNotifier {
       _homepageStats = HomepageStats.fromJson(json);
       _trips = [...(_homepageStats?.trips ?? const [])]
         ..sort(TripSummary.compareByDateDesc);
+      _friendsLeaderboard = _homepageStats?.friendsLeaderboard ?? [];
+      if (_homepageStats?.user != null) {
+        _applyPrivacy(_homepageStats!.user!);
+      }
     } catch (e) {
       debugPrint('Failed to fetch homepage stats: $e');
       _homepageStats = null;
       _trips = [];
+      _friendsLeaderboard = [];
     } finally {
       _isHomepageLoading = false;
       _notifyAsync();
     }
   }
 
+  Future<UserProfileDetail?> fetchUserProfileDetail(String userId) async {
+    try {
+      final json = await api.get('/user/$userId');
+      if (json is Map) {
+        return UserProfileDetail.fromJson(
+          json.map((k, v) => MapEntry(k.toString(), v)),
+        );
+      }
+    } catch (e) {
+      debugPrint('Failed to fetch user profile for $userId: $e');
+    }
+    return null;
+  }
+
+  Future<List<Leg>> fetchUserLegs({
+    required String userId,
+    int offset = 0,
+    int limit = 25,
+  }) async {
+    try {
+      final json =
+          await api.get('/legs/user/$userId?offset=$offset&limit=$limit');
+      List<dynamic>? list;
+      if (json is List) {
+        list = json;
+      } else if (json is Map) {
+        for (final key in ['legs', 'data', 'results', 'items']) {
+          final value = json[key];
+          if (value is List) {
+            list = value;
+            break;
+          }
+        }
+      }
+      if (list == null) return const [];
+      return list
+          .whereType<Map>()
+          .map((e) => Leg.fromJson(
+                e.map((k, v) => MapEntry(k.toString(), v)),
+              ))
+          .toList();
+    } catch (e) {
+      debugPrint('Failed to fetch user legs for $userId: $e');
+      return const [];
+    }
+  }
+
   Future<void> fetchLegs({
     int offset = 0,
     int limit = 100,
@@ -183,6 +372,7 @@ class DataService extends ChangeNotifier {
     String? dateRangeStart,
     String? dateRangeEnd,
     bool append = false,
+    bool unallocatedOnly = false,
   }) async {
     _isLegsLoading = true;
     if (!append) {
@@ -192,6 +382,7 @@ class DataService extends ChangeNotifier {
         sortDirection: sortDirection,
         dateRangeStart: dateRangeStart,
         dateRangeEnd: dateRangeEnd,
+        unallocatedOnly: unallocatedOnly,
       );
     }
     final buffer = StringBuffer(
@@ -203,6 +394,9 @@ class DataService extends ChangeNotifier {
     if (dateRangeEnd != null && dateRangeEnd.isNotEmpty) {
       buffer.write('&date_range_end=$dateRangeEnd');
     }
+    if (unallocatedOnly) {
+      buffer.write('&unallocated_only=true');
+    }
     try {
       final json = await api.get('/user/legs${buffer.toString()}');
 
@@ -231,6 +425,7 @@ class DataService extends ChangeNotifier {
       sortDirection: _lastLegsFetch.sortDirection,
       dateRangeStart: _lastLegsFetch.dateRangeStart,
       dateRangeEnd: _lastLegsFetch.dateRangeEnd,
+      unallocatedOnly: _lastLegsFetch.unallocatedOnly,
     );
   }
 
@@ -425,6 +620,10 @@ class DataService extends ChangeNotifier {
     _stationFiltersFetchedAt = null;
     _notifications = [];
     _isNotificationsLoading = false;
+    _userEntriesVisibility = 'private';
+    _userMileageVisibility = 'private';
+    _isPrivacyLoading = false;
+    _isPrivacySaving = false;
     _badgeAwards = [];
     _badgeAwardsHasMore = false;
     _isBadgeAwardsLoading = false;
@@ -437,12 +636,25 @@ class DataService extends ChangeNotifier {
     _notifyAsync();
   }
 
-  void handleAuthChanged(String? userId) {
+  void handleAuthChanged(
-    if (_currentUserId == userId) return;
+    String? userId, {
+    String? entriesVisibility,
+    String? mileageVisibility,
+  }) {
+    final sameUser = _currentUserId == userId;
     _currentUserId = userId;
+    if (!sameUser) {
       clear();
       _currentUserId = userId;
     }
+    if (entriesVisibility != null || mileageVisibility != null) {
+      _applyPrivacy({
+        'user_entries_visibility': entriesVisibility,
+        'user_mileage_visibility': mileageVisibility,
+      });
+      _notifyAsync();
+    }
+  }
 
   double getMileageForCurrentYear() {
     final currentYear = DateTime.now().year;

lib/services/data_service/data_service_stats.dart

@@ -25,4 +25,38 @@ extension DataServiceStats on DataService {
       _notifyAsync();
     }
   }
+
+  Future<void> fetchFriendsLeaderboard() async {
+    if (_isFriendsLeaderboardLoading) return;
+    _isFriendsLeaderboardLoading = true;
+    _notifyAsync();
+    try {
+      final json = await api.get('/stats/leaderboard/friends');
+      List<dynamic>? list;
+      if (json is List) {
+        list = json;
+      } else if (json is Map) {
+        for (final key in ['leaderboard', 'data', 'items', 'results']) {
+          final value = json[key];
+          if (value is List) {
+            list = value;
+            break;
+          }
+        }
+      }
+      _friendsLeaderboard = list
+              ?.whereType<Map>()
+              .map((e) => LeaderboardEntry.fromJson(
+                    e.map((k, v) => MapEntry(k.toString(), v)),
+                  ))
+              .toList() ??
+          const [];
+    } catch (e) {
+      debugPrint('Failed to fetch friends leaderboard: $e');
+      _friendsLeaderboard = [];
+    } finally {
+      _isFriendsLeaderboardLoading = false;
+      _notifyAsync();
+    }
+  }
 }

lib/ui/app_shell.dart

@@ -20,6 +20,7 @@ import 'package:mileograph_flutter/components/pages/profile.dart';
 import 'package:mileograph_flutter/components/pages/settings.dart';
 import 'package:mileograph_flutter/components/pages/stats.dart';
 import 'package:mileograph_flutter/components/pages/traction.dart';
+import 'package:mileograph_flutter/components/pages/more/user_profile_page.dart';
 import 'package:mileograph_flutter/components/widgets/friend_request_notification_card.dart';
 import 'package:mileograph_flutter/components/widgets/leg_share_notification_card.dart';
 import 'package:mileograph_flutter/objects/objects.dart';
@@ -227,6 +228,28 @@ class _MyAppState extends State<MyApp> {
               path: '/more/profile',
               builder: (context, state) => const ProfilePage(),
             ),
+            GoRoute(
+              path: '/more/user-profile',
+              name: 'user-profile',
+              builder: (context, state) {
+                final extra = state.extra;
+                UserSummary? user;
+                String? userId;
+                if (extra is UserSummary) {
+                  user = extra;
+                  userId = extra.userId;
+                } else if (extra is Map) {
+                  final value = extra['user'];
+                  if (value is UserSummary) user = value;
+                  userId = extra['userId']?.toString();
+                }
+                userId ??= state.uri.queryParameters['user_id'];
+                return UserProfilePage(
+                  userId: userId,
+                  initialUser: user,
+                );
+              },
+            ),
             GoRoute(
               path: '/more/badges',
               builder: (context, state) => const BadgesPage(),

pubspec.yaml

@@ -16,7 +16,7 @@ publish_to: "none" # Remove this line if you wish to publish to pub.dev
 # https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Articles/CoreFoundationKeys.html
 # In Windows, build-name is used as the major, minor, and patch parts
 # of the product and file versions while build-number is used as the build suffix.
-version: 0.6.0+3
+version: 0.6.4+7
 
 environment:
   sdk: ^3.8.1