feat(dares): optional photo/audio proof of completion

The sender can require photo or audio proof when sending any dare,
catalogue or custom. The recipient captures and uploads the proof as a
new couple-scoped 'dare_proof' media kind and attaches it on submit;
the server enforces ownership, kind, couple, and MIME-type match.
The proof renders inline on the dare card for the sender to review
before confirming completion.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

apps/api/drizzle/0021_dare_proof.sql

@@ -0,0 +1,16 @@
+-- Optional proof-of-completion for dares. The sender picks a requirement
+-- ('none', 'photo', 'audio') at send time for both catalogue and custom dares;
+-- the recipient attaches a media object when submitting.
+ALTER TABLE sent_dares ADD COLUMN IF NOT EXISTS proof_type text NOT NULL DEFAULT 'none';
+--> statement-breakpoint
+ALTER TABLE sent_dares DROP CONSTRAINT IF EXISTS sent_dares_proof_type_check;
+ALTER TABLE sent_dares ADD CONSTRAINT sent_dares_proof_type_check
+  CHECK (proof_type IN ('none', 'photo', 'audio'));
+--> statement-breakpoint
+ALTER TABLE sent_dares ADD COLUMN IF NOT EXISTS proof_media_id uuid REFERENCES media_objects(id) ON DELETE SET NULL;
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS sent_dares_proof_media_idx ON sent_dares(proof_media_id) WHERE proof_media_id IS NOT NULL;
+--> statement-breakpoint
+ALTER TABLE media_objects DROP CONSTRAINT IF EXISTS media_objects_kind_check;
+ALTER TABLE media_objects ADD CONSTRAINT media_objects_kind_check
+  CHECK (kind IN ('avatar', 'response', 'chat', 'feedback', 'dare_proof'));

apps/api/src/domains/dares/repository.ts

@@ -4,6 +4,11 @@ import { closeResolvedPool, resolvePool, type DatabaseConnection } from '../../d
 export type DareStatus =
   | 'pending' | 'active' | 'submitted' | 'completed' | 'expired' | 'declined' | 'cancelled';
 
+/** Sender-chosen proof of completion; 'none' means a plain "I did it" suffices. */
+export type DareProofType = 'none' | 'photo' | 'audio';
+
+export const DARE_PROOF_TYPES: readonly DareProofType[] = ['none', 'photo', 'audio'];
+
 /** Free senders get a rolling weekly allowance; receiving and responding are never gated. */
 export const FREE_WEEKLY_SEND_LIMIT = 3;
 
@@ -45,6 +50,8 @@ export interface SentDare {
   direction: 'incoming' | 'outgoing';
   status: DareStatus;
   sender_notes: string | null;
+  proof_type: DareProofType;
+  proof_media_id: string | null;
   sent_at: string;
   accepted_at: string | null;
   submitted_at: string | null;
@@ -79,6 +86,7 @@ export interface SendDareInput {
   custom_dare_intensity?: number | null;
   duration_hours?: number | null;
   sender_notes?: string | null;
+  proof_type?: DareProofType | null;
 }
 
 export class DaresError extends Error {
@@ -111,6 +119,8 @@ interface SentDareRecord extends QueryResultRow {
   recipient_id: string;
   status: DareStatus;
   sender_notes: string | null;
+  proof_type: DareProofType;
+  proof_media_id: string | null;
   sent_at: Date;
   accepted_at: Date | null;
   submitted_at: Date | null;
@@ -124,7 +134,7 @@ export interface DaresRepository {
   listDares(userId: string, filter: 'active' | 'history'): Promise<SentDare[]>;
   send(userId: string, input: SendDareInput): Promise<SentDare>;
   respond(userId: string, dareId: string, action: 'accept' | 'decline'): Promise<SentDare>;
-  submit(userId: string, dareId: string): Promise<SentDare>;
+  submit(userId: string, dareId: string, proofMediaId?: string | null): Promise<SentDare>;
   complete(userId: string, dareId: string): Promise<SentDare>;
   cancel(userId: string, dareId: string): Promise<SentDare>;
   stats(userId: string): Promise<DareStats>;
@@ -132,7 +142,7 @@ export interface DaresRepository {
 }
 
 const BARE_COLUMNS = `id, couple_id, dare_id, dare_text_snapshot, dare_intensity_snapshot,
-  custom_dare_text, sender_id, recipient_id, status, sender_notes,
+  custom_dare_text, sender_id, recipient_id, status, sender_notes, proof_type, proof_media_id,
   sent_at, accepted_at, submitted_at, completed_at, expires_at`;
 
 const SENT_COLUMNS = BARE_COLUMNS.split(',').map((column) => `sd.${column.trim()}`).join(', ');
@@ -172,6 +182,8 @@ function toSentDare(row: SentDareRecord, viewerId: string): SentDare {
     direction: row.recipient_id === viewerId ? 'incoming' : 'outgoing',
     status: row.status,
     sender_notes: row.sender_notes,
+    proof_type: row.proof_type,
+    proof_media_id: row.proof_media_id,
     sent_at: row.sent_at.toISOString(),
     accepted_at: iso(row.accepted_at),
     submitted_at: iso(row.submitted_at),
@@ -323,6 +335,11 @@ export class PostgresDaresRepository implements DaresRepository {
       throw new DaresError('invalid_duration', 'Duration must be one of the offered presets', 400);
     }
 
+    const proofType = input.proof_type ?? 'none';
+    if (!DARE_PROOF_TYPES.includes(proofType)) {
+      throw new DaresError('invalid_proof_type', 'Proof must be none, photo, or audio', 400);
+    }
+
     let text: string;
     let intensity: number;
     let dareId: string | null = null;
@@ -376,15 +393,15 @@ export class PostgresDaresRepository implements DaresRepository {
         `insert into sent_dares (
            couple_id, dare_id, custom_dare_text, custom_dare_intensity,
            dare_text_snapshot, dare_intensity_snapshot,
-           sender_id, recipient_id, sender_notes, expires_at
+           sender_id, recipient_id, sender_notes, proof_type, expires_at
          ) values (
-           $1, $2, $3, $4, $5, $6, $7, $8, $9,
-           case when $10::integer is null then null else now() + ($10::integer * interval '1 hour') end
+           $1, $2, $3, $4, $5, $6, $7, $8, $9, $10,
+           case when $11::integer is null then null else now() + ($11::integer * interval '1 hour') end
          )
          returning ${BARE_COLUMNS}`,
         [
           context.couple_id, dareId, customText, customIntensity, text, intensity,
-          userId, context.partner_id, input.sender_notes?.trim() || null, duration,
+          userId, context.partner_id, input.sender_notes?.trim() || null, proofType, duration,
         ],
       );
       return toSentDare(result.rows[0]!, userId);
@@ -438,8 +455,59 @@ export class PostgresDaresRepository implements DaresRepository {
       : this.transition(userId, dareId, 'recipient', ['pending'], 'declined', null);
   }
 
-  async submit(userId: string, dareId: string): Promise<SentDare> {
-    return this.transition(userId, dareId, 'recipient', ['active'], 'submitted', 'submitted_at');
+  /**
+   * Submission enforces the sender's proof requirement: a proof-required dare
+   * cannot be marked done without media of the matching type. Proof is also
+   * accepted voluntarily on 'none' dares. Media ownership, kind, and couple are
+   * re-checked here so a submit cannot reference someone else's upload.
+   */
+  async submit(userId: string, dareId: string, proofMediaId?: string | null): Promise<SentDare> {
+    return transaction(this.pool, async (client) => {
+      const existing = await client.query<{
+        sender_id: string; recipient_id: string; status: DareStatus;
+        proof_type: DareProofType; couple_id: string;
+      }>(
+        'select sender_id, recipient_id, status, proof_type, couple_id from sent_dares where id = $1 for update',
+        [dareId],
+      );
+      const dare = existing.rows[0];
+      if (!dare || (dare.sender_id !== userId && dare.recipient_id !== userId)) {
+        throw new DaresError('dare_not_found', 'Dare not found', 404);
+      }
+      if (dare.recipient_id !== userId) {
+        throw new DaresError('not_permitted', 'Only the recipient can do that', 403);
+      }
+      if (dare.status !== 'active') {
+        throw new DaresError('invalid_transition', `A ${dare.status} dare cannot change to submitted`, 409);
+      }
+      if (dare.proof_type !== 'none' && !proofMediaId) {
+        throw new DaresError('proof_required', `This dare requires ${dare.proof_type} proof`, 400);
+      }
+      if (proofMediaId) {
+        const media = await client.query<{ kind: string; mime_type: string; owner_id: string; couple_id: string | null }>(
+          'select kind, mime_type, owner_id, couple_id from media_objects where id = $1 and deleted_at is null',
+          [proofMediaId],
+        );
+        const proof = media.rows[0];
+        if (!proof || proof.owner_id !== userId || proof.kind !== 'dare_proof' || proof.couple_id !== dare.couple_id) {
+          throw new DaresError('proof_not_found', 'Proof media not found', 404);
+        }
+        const category = dare.proof_type === 'none'
+          ? (proof.mime_type.startsWith('image/') || proof.mime_type.startsWith('audio/'))
+          : proof.mime_type.startsWith(dare.proof_type === 'photo' ? 'image/' : 'audio/');
+        if (!category) {
+          throw new DaresError('proof_type_mismatch', `This dare requires ${dare.proof_type} proof`, 400);
+        }
+      }
+      const result = await client.query<SentDareRecord>(
+        `update sent_dares
+            set status = 'submitted', submitted_at = now(), proof_media_id = $2::uuid
+          where id = $1
+          returning ${BARE_COLUMNS}`,
+        [dareId, proofMediaId ?? null],
+      );
+      return toSentDare(result.rows[0]!, userId);
+    });
   }
 
   async complete(userId: string, dareId: string): Promise<SentDare> {

apps/api/src/domains/dares/routes.ts

@@ -15,6 +15,7 @@ const sendBody = z
     custom_dare_intensity: z.number().int().min(1).max(5).nullish(),
     duration_hours: z.union([z.literal(1), z.literal(6), z.literal(12), z.literal(24), z.literal(72), z.literal(168)]).nullish(),
     sender_notes: z.string().trim().max(500).nullish(),
+    proof_type: z.enum(['none', 'photo', 'audio']).nullish(),
   })
   .strict()
   .refine((value) => Boolean(value.dare_id) !== Boolean(value.custom_dare_text), {
@@ -23,6 +24,8 @@ const sendBody = z
 
 const respondBody = z.object({ action: z.enum(['accept', 'decline']) }).strict();
 
+const submitBody = z.object({ proof_media_id: id.nullish() }).strict();
+
 function error(code: string, message: string): ApiErrorResponse {
   return { error: { code, message } };
 }
@@ -93,8 +96,20 @@ export function registerDareRoutes(app: DaresApp, repository: DaresRepository):
       : c.json(error(response.cause.code, response.cause.message), response.cause.status);
   });
 
+  app.post('/v1/dares/:dareId/submit', async (c) => {
+    const dareId = id.safeParse(c.req.param('dareId'));
+    if (!dareId.success) return c.json(error('invalid_dare_id', 'A valid dare ID is required'), 400);
+    // Body is optional: dares without a proof requirement submit with no payload.
+    const body = submitBody.safeParse(await c.req.json().catch(() => ({})));
+    if (!body.success) return c.json(error('invalid_proof', 'proof_media_id must be a valid media ID'), 400);
+    const response = await result(() =>
+      repository.submit(c.get('identity').id, dareId.data, body.data.proof_media_id ?? null));
+    return response.ok
+      ? c.json({ dare: response.value })
+      : c.json(error(response.cause.code, response.cause.message), response.cause.status);
+  });
+
   for (const [path, method] of [
-    ['submit', 'submit'],
     ['complete', 'complete'],
     ['cancel', 'cancel'],
   ] as const) {

apps/api/src/domains/media/repository.ts

@@ -39,7 +39,7 @@ export class PostgresMediaRepository implements MediaRepository {
       const profile = await client.query<{ couple_id: string | null }>('select couple_id from profiles where id=$1 for update', [userId]);
       if (!profile.rows[0]) throw new MediaError('profile_not_found', 'Profile not found', 404);
       const coupleId = profile.rows[0].couple_id;
-      if ((kind === 'response' || kind === 'chat') && !coupleId) throw new MediaError('couple_required', 'Join a couple before sharing media', 409);
+      if ((kind === 'response' || kind === 'chat' || kind === 'dare_proof') && !coupleId) throw new MediaError('couple_required', 'Join a couple before sharing media', 409);
       if (kind === 'response') {
         if (!context.questionId) throw new MediaError('question_required', 'A question ID is required', 400);
         const question = await client.query('select 1 from questions where id=$1 and deleted_at is null', [context.questionId]);
@@ -84,7 +84,7 @@ export class PostgresMediaRepository implements MediaRepository {
          from media_objects mo join profiles viewer on viewer.id=$1
         where mo.id=$2 and mo.deleted_at is null and (mo.expires_at is null or mo.expires_at>now())
           and not exists(select 1 from messages m where m.media_path='media:'||mo.id::text and (m.media_expired or m.media_expires_at<=now()))
-          and (mo.owner_id=$1 or (mo.kind in ('avatar','response','chat') and mo.couple_id is not null and mo.couple_id=viewer.couple_id))`,
+          and (mo.owner_id=$1 or (mo.kind in ('avatar','response','chat','dare_proof') and mo.couple_id is not null and mo.couple_id=viewer.couple_id))`,
       [userId, mediaId],
     );
     if (!result.rows[0]) throw new MediaError('media_not_found', 'Media not found', 404);

apps/api/src/domains/media/storage.ts

@@ -8,8 +8,9 @@ const allowed: Record<MediaKind, ReadonlySet<string>> = {
   response: new Set(['image/jpeg', 'image/png', 'image/webp', 'image/gif', 'audio/mp4', 'audio/m4a', 'audio/x-m4a', 'audio/mpeg', 'audio/wav', 'audio/webm', 'audio/aac', 'audio/x-caf']),
   chat: new Set(['image/jpeg', 'image/png', 'image/webp', 'image/gif', 'video/mp4', 'video/quicktime', 'video/webm']),
   feedback: new Set(['image/jpeg', 'image/png', 'image/webp']),
+  dare_proof: new Set(['image/jpeg', 'image/png', 'image/webp', 'audio/mp4', 'audio/m4a', 'audio/x-m4a', 'audio/mpeg', 'audio/wav', 'audio/webm', 'audio/aac', 'audio/x-caf']),
 };
-const limits: Record<MediaKind, number> = { avatar: 10*1024*1024, response: 25*1024*1024, chat: 50*1024*1024, feedback: 10*1024*1024 };
+const limits: Record<MediaKind, number> = { avatar: 10*1024*1024, response: 25*1024*1024, chat: 50*1024*1024, feedback: 10*1024*1024, dare_proof: 25*1024*1024 };
 const extensions: Record<string, string> = { 'image/jpeg':'.jpg','image/png':'.png','image/webp':'.webp','image/gif':'.gif','video/mp4':'.mp4','video/quicktime':'.mov','video/webm':'.webm','audio/mp4':'.m4a','audio/m4a':'.m4a','audio/x-m4a':'.m4a','audio/mpeg':'.mp3','audio/wav':'.wav','audio/webm':'.webm','audio/aac':'.aac','audio/x-caf':'.caf' };
 
 export class FilesystemMediaStorage {

apps/api/src/domains/media/types.ts

@@ -1,4 +1,4 @@
-export const mediaKinds = ['avatar', 'response', 'chat', 'feedback'] as const;
+export const mediaKinds = ['avatar', 'response', 'chat', 'feedback', 'dare_proof'] as const;
 export type MediaKind = typeof mediaKinds[number];
 
 export interface MediaObject {

apps/api/test/dares.integration.test.ts

@@ -196,6 +196,58 @@ describe.skipIf(!url || !local)('dares + PostgreSQL', () => {
     expect((await repo.listDares(recipient, 'history'))[0]!.direction).toBe('incoming');
   });
 
+  async function insertProof(owner: string, coupleId: string | null, mime: string, kind = 'dare_proof') {
+    const id = randomUUID();
+    await pool.query(
+      'insert into media_objects(id,owner_id,couple_id,kind,storage_key,mime_type,byte_size) values($1,$2,$3,$4,$5,$6,100)',
+      [id, owner, coupleId, kind, `${kind}/test/${id}.bin`, mime],
+    );
+    return id;
+  }
+
+  it('stores the proof requirement and defaults to none', async () => {
+    const plain = await repo.send(sender, { dare_id: freeDare });
+    expect(plain).toMatchObject({ proof_type: 'none', proof_media_id: null });
+    const proofed = await repo.send(sender, { dare_id: freeDare, proof_type: 'photo' });
+    expect(proofed.proof_type).toBe('photo');
+    await expect(repo.send(sender, { dare_id: freeDare, proof_type: 'video' as never }))
+      .rejects.toMatchObject({ code: 'invalid_proof_type' });
+  });
+
+  it('requires matching proof media before a proofed dare can be submitted', async () => {
+    const dare = await repo.send(sender, { dare_id: freeDare, proof_type: 'photo' });
+    await repo.respond(recipient, dare.id, 'accept');
+
+    await expect(repo.submit(recipient, dare.id)).rejects.toMatchObject({ code: 'proof_required' });
+    const audio = await insertProof(recipient, couple, 'audio/mp4');
+    await expect(repo.submit(recipient, dare.id, audio)).rejects.toMatchObject({ code: 'proof_type_mismatch' });
+
+    const photo = await insertProof(recipient, couple, 'image/jpeg');
+    const submitted = await repo.submit(recipient, dare.id, photo);
+    expect(submitted).toMatchObject({ status: 'submitted', proof_media_id: photo });
+    expect((await repo.complete(sender, dare.id)).status).toBe('completed');
+  });
+
+  it('refuses proof media the recipient does not own or that is not dare proof', async () => {
+    const dare = await repo.send(sender, { dare_id: freeDare, proof_type: 'photo' });
+    await repo.respond(recipient, dare.id, 'accept');
+
+    const foreign = await insertProof(outsider, otherCouple, 'image/jpeg');
+    await expect(repo.submit(recipient, dare.id, foreign)).rejects.toMatchObject({ code: 'proof_not_found' });
+    const wrongKind = await insertProof(recipient, couple, 'image/jpeg', 'chat');
+    await expect(repo.submit(recipient, dare.id, wrongKind)).rejects.toMatchObject({ code: 'proof_not_found' });
+    const senderOwned = await insertProof(sender, couple, 'image/jpeg');
+    await expect(repo.submit(recipient, dare.id, senderOwned)).rejects.toMatchObject({ code: 'proof_not_found' });
+  });
+
+  it('accepts voluntary proof on dares that did not require any', async () => {
+    const dare = await repo.send(sender, { dare_id: freeDare });
+    await repo.respond(recipient, dare.id, 'accept');
+    const photo = await insertProof(recipient, couple, 'image/jpeg');
+    const submitted = await repo.submit(recipient, dare.id, photo);
+    expect(submitted).toMatchObject({ status: 'submitted', proof_type: 'none', proof_media_id: photo });
+  });
+
   it('rejects durations outside the offered presets', async () => {
     await expect(repo.send(sender, { dare_id: freeDare, duration_hours: 5 })).rejects.toMatchObject({ code: 'invalid_duration' });
   });

apps/api/test/dares.routes.test.ts

@@ -13,10 +13,12 @@ const catalogueDareId = '55555555-5555-4555-8555-555555555555';
 const dare: SentDare = {
   id: dareId, couple_id: '66666666-6666-4666-8666-666666666666', dare_id: catalogueDareId,
   text: 'A dare', intensity: 2, is_custom: false, sender_id: identity.id, recipient_id: partner,
-  direction: 'outgoing', status: 'pending', sender_notes: null,
+  direction: 'outgoing', status: 'pending', sender_notes: null, proof_type: 'none', proof_media_id: null,
   sent_at: new Date().toISOString(), accepted_at: null, submitted_at: null, completed_at: null, expires_at: null,
 };
 
+const proofMediaId = '77777777-7777-4777-8777-777777777777';
+
 function setup(overrides: Partial<DaresRepository> = {}) {
   const repository: DaresRepository = {
     getCatalog: vi.fn(async () => ({
@@ -91,7 +93,7 @@ describe('dare routes', () => {
     await post(app, `/v1/dares/${dareId}/respond`, { action: 'decline' });
     expect(repository.respond).toHaveBeenCalledWith(identity.id, dareId, 'decline');
     await post(app, `/v1/dares/${dareId}/submit`);
-    expect(repository.submit).toHaveBeenCalledWith(identity.id, dareId);
+    expect(repository.submit).toHaveBeenCalledWith(identity.id, dareId, null);
     await post(app, `/v1/dares/${dareId}/complete`);
     expect(repository.complete).toHaveBeenCalledWith(identity.id, dareId);
     await post(app, `/v1/dares/${dareId}/cancel`);
@@ -109,6 +111,22 @@ describe('dare routes', () => {
     expect((await post(app, `/v1/dares/${dareId}/submit`)).status).toBe(409);
   });
 
+  it('accepts a proof requirement on send and rejects unknown ones', async () => {
+    const { app, repository } = setup();
+    const response = await post(app, '/v1/dares', { dare_id: catalogueDareId, proof_type: 'photo' });
+    expect(response.status).toBe(201);
+    expect(repository.send).toHaveBeenCalledWith(identity.id, expect.objectContaining({ proof_type: 'photo' }));
+    expect((await post(app, '/v1/dares', { dare_id: catalogueDareId, proof_type: 'video' })).status).toBe(400);
+  });
+
+  it('passes proof media through on submit and validates its shape', async () => {
+    const { app, repository } = setup();
+    await post(app, `/v1/dares/${dareId}/submit`, { proof_media_id: proofMediaId });
+    expect(repository.submit).toHaveBeenCalledWith(identity.id, dareId, proofMediaId);
+    expect((await post(app, `/v1/dares/${dareId}/submit`, { proof_media_id: 'not-a-uuid' })).status).toBe(400);
+    expect((await post(app, `/v1/dares/${dareId}/submit`, { extra_field: true })).status).toBe(400);
+  });
+
   it('exposes the duration presets the send sheet offers', async () => {
     const { app } = setup();
     const response = await app.request('/v1/dares/durations');