Add the account area and account-synced Appearance preferences

Stage 1 PR 6 (ADR 0062). /account shows who is signed in; /account/appearance chooses System, Light, or Dark and reduced motion (System, Reduce, Allow). - Core: ekklesia_core_user_preference, one typed, CHECK-constrained, nullable column per preference (null = never chosen), migration 0008_user_preferences (additive), @ekklesia/core/account store, and the authenticated-baseline permission core.account.self.manage. - API: GET /api/v1/account (name, email, preferences) and partial PATCH /api/v1/account/preferences, self-only by construction: no user id is accepted anywhere; trusted Origin and body limit on the mutation. - Shell: the account control shows name, email, and initials (never the unvetted image URL) and offers Account, Appearance, Sign out; native radio groups apply a choice at once through the ADR 0060 controller and save it; the server's answer wins and a failed save reverts. - First paint: a classic, same-origin, render-blocking appearance.js in <head> applies a two-word localStorage cache before paint (no inline script, CSP unchanged). The account replaces the cache on every load, sign-out clears it, and other tabs follow via the storage event. - Deploy smoke: real-Chromium checks for light/dark, OS emulation, overrides, reload persistence, pre-paint, Shadow DOM modules, reduced motion, the display staying light, and phone width; the browser container gets a 512 MiB /dev/shm so a long session no longer fails requests with ERR_INSUFFICIENT_RESOURCES. Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-14 23:56:50 -05:00
parent 8571e6854c
commit cd0287537e
88 changed files with 6404 additions and 158 deletions
@@ -260,6 +260,7 @@ async function applyCoreMigrations(url: string): Promise<void> {
      "core:0005_module_configuration",
      "core:0006_device_identity",
      "core:0007_verified_bootstrap_owners",
+      "core:0008_user_preferences",
    ]);
    expect(aggregate.migrations[0]?.checksum).toBe(
      "f8f2086ef06f7a6943e8ffc4350bb010b37aed04c0a72030d2b153c986b1325f",
@@ -1521,6 +1522,162 @@ describe.sequential("live API — exported browser auth shell against PostgreSQL
  });
 });

+describe.sequential("live API — a person's own account and preferences (ADR 0062)", () => {
+  let database: { name: string; url: string };
+  let running: RunningApi;
+  let origin: string;
+  let ada: { cookie: string; userId: string };
+  let grace: { cookie: string; userId: string };
+  const password = "correct horse battery staple";
+
+  async function account(cookie?: string): Promise<{ status: number; body: unknown }> {
+    const response = await fetch(`${origin}/api/v1/account`, {
+      headers: { origin: dashboardOrigin, ...(cookie ? { cookie } : {}) },
+    });
+    return { body: await response.json(), status: response.status };
+  }
+
+  async function changePreferences(
+    cookie: string | undefined,
+    body: unknown,
+    options: { readonly origin?: string; readonly query?: string } = {},
+  ): Promise<{ status: number; body: unknown }> {
+    const response = await fetch(`${origin}/api/v1/account/preferences${options.query ?? ""}`, {
+      body: JSON.stringify(body),
+      headers: {
+        "content-type": "application/json",
+        origin: options.origin ?? dashboardOrigin,
+        ...(cookie ? { cookie } : {}),
+      },
+      method: "PATCH",
+    });
+    return { body: await response.json(), status: response.status };
+  }
+
+  async function person(email: string): Promise<{ cookie: string; userId: string }> {
+    const created = await signUp(origin, email, password);
+    expect(created.response.status).toBe(200);
+    const session = await signIn(origin, email, password);
+    if (!session.cookiePair) {
+      throw harnessError("The account session cookie was not issued.");
+    }
+    return { cookie: session.cookiePair, userId: created.body.user.id };
+  }
+
+  it("starts a freshly migrated API with two ordinary accounts", async () => {
+    database = await createDisposableDatabase("account_prefs");
+    await applyCoreMigrations(database.url);
+    running = await startMigratedApi(database.url);
+    origin = apiOrigin(running);
+    ada = await person("[email protected]");
+    grace = await person("[email protected]");
+  });
+
+  it("shows each person their own name, email, and the defaults, with no grant", async () => {
+    expect(await account(ada.cookie)).toEqual({
+      body: {
+        email: "[email protected]",
+        name: "Integration Test User",
+        preferences: { appearance: "system", motion: "system" },
+      },
+      status: 200,
+    });
+    expect(((await account(grace.cookie)).body as { email: string }).email).toBe(
+      "[email protected]",
+    );
+  });
+
+  it("refuses an anonymous caller both routes", async () => {
+    expect((await account()).status).toBe(403);
+    expect((await changePreferences(undefined, { appearance: "dark" })).status).toBe(403);
+  });
+
+  it("saves each person's change to their own account only", async () => {
+    expect(await changePreferences(ada.cookie, { appearance: "dark" })).toEqual({
+      body: { appearance: "dark", motion: "system" },
+      status: 200,
+    });
+    expect(await changePreferences(ada.cookie, { motion: "reduce" })).toEqual({
+      body: { appearance: "dark", motion: "reduce" },
+      status: 200,
+    });
+    expect((await account(grace.cookie)).body).toMatchObject({
+      preferences: { appearance: "system", motion: "system" },
+    });
+  });
+
+  it("cannot be pointed at another person's account by the query or the body", async () => {
+    const viaQuery = await changePreferences(
+      ada.cookie,
+      { appearance: "light" },
+      { query: `?userId=${grace.userId}` },
+    );
+    expect(viaQuery).toEqual({ body: { appearance: "light", motion: "reduce" }, status: 200 });
+
+    const viaBody = await changePreferences(ada.cookie, {
+      appearance: "dark",
+      userId: grace.userId,
+    });
+    expect(viaBody).toEqual({ body: { code: "INVALID_REQUEST" }, status: 400 });
+
+    expect((await account(grace.cookie)).body).toMatchObject({
+      preferences: { appearance: "system", motion: "system" },
+    });
+    expect((await account(ada.cookie)).body).toMatchObject({
+      preferences: { appearance: "light", motion: "reduce" },
+    });
+  });
+
+  it("refuses an untrusted Origin and an invalid value, changing nothing", async () => {
+    expect(
+      await changePreferences(ada.cookie, { appearance: "dark" }, { origin: untrustedOrigin }),
+    ).toEqual({ body: { code: "UNTRUSTED_ORIGIN" }, status: 403 });
+    expect(await changePreferences(ada.cookie, { appearance: "sepia" })).toEqual({
+      body: { code: "INVALID_REQUEST" },
+      status: 400,
+    });
+    expect((await account(ada.cookie)).body).toMatchObject({
+      preferences: { appearance: "light", motion: "reduce" },
+    });
+  });
+
+  it("follows the person to a new session, as another device would see it", async () => {
+    const elsewhere = await signIn(origin, "[email protected]", password);
+    expect((await account(elsewhere.cookiePair as string)).body).toMatchObject({
+      preferences: { appearance: "light", motion: "reduce" },
+    });
+  });
+
+  it("stores exactly one typed row, for the one person who chose something", async () => {
+    const admin = await openAdministrativeClient(database.url);
+    try {
+      const rows = await safeQuery<{ user_id: string; appearance: string; motion: string }>(
+        admin,
+        "select user_id, appearance, motion from ekklesia_core_user_preference",
+      );
+      expect(rows).toEqual([{ appearance: "light", motion: "reduce", user_id: ada.userId }]);
+    } finally {
+      await safeEnd(admin);
+    }
+  });
+
+  it("refuses a signed-out session", async () => {
+    const signedOut = await fetch(`${origin}/api/auth/sign-out`, {
+      body: "{}",
+      headers: { "content-type": "application/json", cookie: ada.cookie, origin: dashboardOrigin },
+      method: "POST",
+    });
+    expect(signedOut.status).toBe(200);
+    expect((await account(ada.cookie)).status).toBe(403);
+    expect((await changePreferences(ada.cookie, { appearance: "dark" })).status).toBe(403);
+  });
+
+  it("shuts down cleanly", async () => {
+    await running.shutdown();
+    await dropDatabase(database.name);
+  });
+});
+
 describe.sequential("live API — startup and migration guarantees", () => {
  it("refuses to start against an unmigrated database, and creates no tables or migration history", async () => {
    const database = await createDisposableDatabase("unmigrated");
@@ -2630,10 +2787,11 @@ describe.sequential("live API — installed module permission end-to-end", () =>
    expect(moduleCheck).toMatchObject({ status: "pass" });
    expect(moduleCheck?.details).toEqual(["calendar 0.1.0"]);
    expect(permissionsCheck).toMatchObject({
-      // Core's own six (`core.authorization.grants.manage`, `core.modules.ui.read`,
+      // Core's own seven (`core.authorization.grants.manage`, `core.modules.ui.read`,
      // `core.dashboard.navigation.manage`, `core.modules.lifecycle.manage`,
-      // `core.modules.configuration.manage`, `core.devices.manage`) plus the fixture module's one.
-      details: ["7 permissions registered"],
+      // `core.modules.configuration.manage`, `core.devices.manage`, `core.account.self.manage`)
+      // plus the fixture module's one.
+      details: ["8 permissions registered"],
      status: "pass",
    });
    // Doctor and permission composition read only the manifest — the fixture's register/start