Fix profile privacy and simplify code

src/hooks/useProfile.tsx

@@ -10,25 +10,47 @@ export function useProfile(userId: string | undefined) {
     queryFn: async () => {
       if (!userId) return null;
       
-      console.log('[useProfile] Fetching profile for userId:', userId);
+      console.log('[useProfile] Fetching filtered profile for userId:', userId);
       
-      const { data, error } = await supabase
-        .from('profiles')
-        .select('*, location:locations(*)')
-        .eq('user_id', userId)
-        .maybeSingle();
+      // Get current viewer ID
+      const { data: { user } } = await supabase.auth.getUser();
+      const viewerId = user?.id || null;
+      
+      // Use get_filtered_profile RPC for privacy-aware field filtering
+      const { data, error } = await supabase.rpc('get_filtered_profile', {
+        _profile_user_id: userId,
+        _viewer_id: viewerId
+      });
       
       if (error) {
         console.error('[useProfile] Error:', error);
         throw error;
       }
       
-      console.log('[useProfile] Profile loaded:', {
-        username: data?.username,
-        avatar_url: data?.avatar_url
+      if (!data) return null;
+      
+      // Type assertion since we know the structure from the RPC function
+      const profileData = data as unknown as Profile;
+      
+      // Fetch location separately if location_id is present and visible
+      if (profileData.location_id) {
+        const { data: location } = await supabase
+          .from('locations')
+          .select('*')
+          .eq('id', profileData.location_id)
+          .single();
+        
+        if (location) {
+          profileData.location = location;
+        }
+      }
+      
+      console.log('[useProfile] Filtered profile loaded:', {
+        username: profileData.username,
+        has_avatar: !!profileData.avatar_url
       });
       
-      return data as Profile;
+      return profileData;
     },
     enabled: !!userId,
     staleTime: 5 * 60 * 1000, // 5 minutes