06 — Baby profiles and switching

Technical reference. For task-based help, see the corresponding user guide.

Documentation status: complete for the current implementation

Reviewed: 2026-07-21

Primary users: family members and authorized coaches

Surfaces: mobile web app and platform API

Purpose

A baby profile is the subject for activity logs, timers, analysis, allergy ladders and care content. Families can create and manage their babies and persist one selected baby. An assigned coach can work with an existing baby only within the permissions granted for that family.

Entry points

Context	Entry point
Family self-mode	Baby switcher and Add baby / Edit baby actions in the family side menu
Family Home	Selected baby avatar and name on `/family`
Coach phone view-as	Baby selector on `/coach/families/:familyId/view-as` and its child routes
Coach baby editor	Baby management inside the assigned-family dashboard, when write access is present

The family-selected baby follows the user across Home, tracking, Analysis, reminders and Allergy Ladders. Coach view-as uses an explicit route-local baby ID and does not overwrite the family's preference.

Profile fields

Field	Family behavior	Validation and storage
Name	Required text field	Leading/trailing whitespace is removed; an empty value is rejected.
Birthday	Required date field	Sent as an ISO timestamp at UTC midnight. The current client does not impose a maximum date, so the server contract—not an assumed UI rule—is authoritative.
Gender	Not set, Girl or Boy in the family editor	The shared contract also accepts `other`; the coach editor exposes Other. Omitted/blank values are stored as unset.
Profile image	Optional private image, replaceable or removable	Uploaded through a signed URL in the `baby-images` scope and read through a short-lived signed download URL.

Baby IDs are created by the platform and are always scoped to the owning family. A visible ID or query parameter is not proof of access.

Family workflow

Create the first or another baby

Open the side menu and choose Add baby.
Enter a name and birthday, optionally choose gender and an image, then save.
The platform creates the baby first. The app then uploads any chosen image and makes the new baby the selected baby.
Home and other baby-scoped screens refresh against the new selection.

If the baby is created but the image upload fails, the app does not pretend the entire save failed. It switches the form into edit mode and explains that the profile was saved while the image was not, allowing an immediate image retry without creating a duplicate baby.

Edit a baby

Family self-mode can update the profile fields, replace the image or remove it. The edit is scoped by both the authenticated family and baby ID. Signed image URLs are refreshed when they expire; if image loading still fails, the UI falls back to a baby icon.

Select a baby

Selecting a baby calls PATCH /families/me/selected-baby and refreshes the family summary. The selected ID is then used by:

Home shortcuts and recent activity;
the seven activity trackers and active timers;
Analysis date ranges and charts;
Allergy Ladders and other baby-specific care features.

The app validates the stored selection against the returned baby list. If it is absent or no longer valid, it falls back to the first available baby or to no selection when the family has none.

Delete a baby

Deletion is available only to the family. The confirmation warns that the baby profile, activities and allergy ladders will be removed and cannot be restored through the product. Active timers for that baby are also removed by the platform.

After deletion, the family summary keeps the current selected baby when it remains valid; otherwise it selects the first remaining baby, or null when no babies remain. Coaches cannot delete a baby.

Coach behavior

An assigned coach may list and view babies belonging to an authorized family.
With activity-write permission, the current coach editor can change an existing baby's name and birthday. The broader API update contract also supports gender/image metadata, but those fields are not all exposed by the present coach UI.
Coach updates create an audit event identifying the coach actor.
Coaches cannot create or delete family baby profiles.
Switching babies in view-as changes the route/query context for that coach session only. It does not change the family member's saved selection.
Losing or revoking the assignment immediately removes further read/write access even if a baby ID is still present in the URL.

Validation and user-visible states

State	Expected behavior
No babies	Show a safe empty state and direct family self-mode to add a baby; do not render another family's cached subject.
Missing name or birthday	Keep the editor open and identify the required field.
Duplicate save attempt	Disable/reject concurrent submission so one action does not create multiple babies.
Profile saved, image failed	Retain the created/updated profile, state the partial failure and allow image retry.
Expired signed image URL	Request a new authorized URL; fall back to the icon after a failed retry.
Selected baby deleted elsewhere	Reconcile to another valid baby or the empty state on refresh/realtime update.
Coach lacks write permission	Permit only the reads granted by the assignment and hide/disable editing; the API independently rejects writes.
Authorization expires	Stop showing protected baby data and route to the appropriate signed-out/forbidden state.

Platform API contract

Method and path	Role
`GET /babies`	List babies for the current family, or for an explicit authorized `familyUserId` actor/subject context.
`POST /babies`	Create a family-owned baby; family role only.
`PATCH /babies/:babyId`	Update an authorized baby; family owner or assigned coach with write permission.
`DELETE /babies/:babyId`	Delete a baby and dependent family data; family owner only.
`PATCH /families/me/selected-baby`	Persist the family member's selected baby.
`POST /files/signed-upload-url`	Obtain an authorized private `baby-images` upload target.
`POST /files/signed-download-url`	Resolve an authorized baby image for display.

The platform verifies that a requested baby belongs to the resolved subject before reading or mutating it. Coach access is checked against the live assignment and permission set, not merely against client-side route state.

Data and security rules

Baby images are private binary assets; clients do not receive a permanent public URL.
The selected-baby preference is family account state. Coach navigation is deliberately non-persistent for the family.
Baby deletion is a destructive family-only operation and cascades through related care records according to the platform service transaction.
A coach edit does not transfer ownership and is recorded for auditability.
Supabase Auth supplies identity; trusted baby ownership and coach authorization are enforced by the platform API.

Acceptance checklist

A family can create a baby with required fields and immediately use it across baby-scoped screens.
A failed image upload cannot create a duplicate baby and is recoverable from edit mode.
Selection persists for family self-mode and propagates to Home, tracking and Analysis.
Coach view-as switching never changes the family's selected-baby preference.
Assigned coaches can edit only when granted write access and cannot create/delete babies.
Deleting the selected baby chooses a valid fallback and removes its active timers and dependent data.
Private images remain inaccessible without a fresh subject-authorized signed URL.

Source evidence

mobile-web/src/components/FamilySideMenu.tsx
mobile-web/src/components/FamilyEditors.tsx
mobile-web/src/routes/FamilyDashboard.tsx
mobile-web/src/routes/CoachDashboard.tsx
mobile-web/src/utils/selected-baby.ts
platform/apps/api/src/routes/family-routes.ts
platform/apps/api/src/services/family-service.ts
platform/packages/shared/src/family.ts
platform/docs/multi-tenancy/05-development-plan.md

Littles Baby Tracker

Table of Contents