Phase 18: settings that belong to the writer, not the browser
The mute toggle, the falling-petals toggle and the chosen companion lived in localStorage, which is a property of the machine. Now that two people can sign in to one Petal, sharing a laptop would have meant sharing a mascot and one person's silence muting the other. Each key is namespaced by user id. The awkward part is timing: sounds.ts and petals.ts read their value the moment they are imported, long before /api/me can have answered. Rather than block startup on the network for a mute flag, a read before the answer arrives sees the old un-namespaced key -- on a single-writer browser, exactly the right value -- and setPrefsScope then adopts it into that account's namespace and tells every reader to look again. Adoption moves rather than copies, so the first account inherits what was set before accounts existed and the second starts from Petal's defaults. The personal spelling dictionary moves further than that: onto the server. It is built from her own writing, so it should not be readable by whoever sits down at the same browser next -- but merely namespacing it would have split the list she already has between her laptop and her tablet, which is worse than where we started. A table keyed (user_id, lang, word) follows her instead. The lang is the dictionary's, not hers: an English exception must not silence a pt-PT flag once the second pair ships. Adding a word takes effect in the editor immediately and persists in the background, so the underline goes away the instant she asks. A browser still holding the old list hands it over on first load, and only lets go once the server has taken it. Claude-Session: https://claude.ai/code/session_016y6gyuHkQXPiEuW8RGQyua
This commit is contained in:
prosolis
+11
-4
@@ -180,7 +180,7 @@ Option B ratified. `go-oidc` + `x/oauth2`; config fields already existed. The `R
|
||||
|
||||
### Phase 17 — Migrate the `local` user ✅ (2026-07-27) — her writing now lives on her account
|
||||
Script, app stopped, backup first (OPEN #4). **The "she logs in once first" dependency turned out not to exist**: authentik's default `hashed_user_id` sub mode makes the subject `User.uid`, which is derived from her user id and the instance secret — stable, and readable before she has ever signed in (`ak shell -c "…User.objects.get(username='claire').uid"`). So the data can move *first*, and she signs in to find her writing already there rather than to an empty Petal that fills in later.
|
||||
- [ ] `scripts/migrate_local_user.*`: single transaction, `PRAGMA foreign_keys=OFF`, re-point `documents`/`tags`/`vocab_words` **and `images`** (versions/suggestions follow parents; `images` is new in Phase 16 and carries `user_id` directly — miss it and every pasted picture 404s), delete the empty provisioned row, verify row counts before commit; refuses to run if the app is up or the target has data
|
||||
- [x] `scripts/migrate_local_user.*`: single transaction, `PRAGMA foreign_keys=OFF`, re-point `documents`/`tags`/`vocab_words` **and `images`** (versions/suggestions follow parents; `images` is new in Phase 16 and carries `user_id` directly — miss it and every pasted picture 404s), delete the empty provisioned row, verify row counts before commit; refuses to run if the app is up or the target has data
|
||||
- [x] `scripts/migrate_local_user.py` — dry-run by default, `VACUUM INTO` backup before touching anything, one transaction with `PRAGMA foreign_keys=OFF`, re-points `documents`/`tags`/`vocab_words`/`images`, deletes the old user row, and **verifies every expected row actually moved (and that the source is left owning nothing) before it commits**, rolling back otherwise. Refuses to merge into an account that already owns writing. Runbook in the script header.
|
||||
- **The "is the app stopped?" guard needed a second attempt.** `BEGIN EXCLUSIVE` — the obvious check — passes straight through against a *running but idle* Petal, because in WAL mode it only conflicts with another writer. That is exactly the case the guard exists to catch, and it would have failed silently. `PRAGMA locking_mode = EXCLUSIVE` conflicts with any connection at all, since it locks the shared-memory index every WAL reader maps; verified against a live server.
|
||||
- [x] **Run for real.** Her 8 documents, 33 snapshots, 103 suggestions, 3 vocabulary words and 1 image moved from `local` onto `5f47d955…` (Claire, `clairew8@pm.me`). Sequence: `-backup` snapshot of millenia's live DB (taken while it kept running — `VACUUM INTO` needs no write lock), shipped to the VPS, installed over the throwaway staging database (kept as `petal.db.staging-*`), **started once so migration `0010` applied**, stopped, migrated, started. Verified over public HTTPS with a short-lived probe session, then removed: `/api/me` is her, 8 documents listed, her image 200s, vocabulary garden and version history intact, search returns hits — and 401 without the cookie.
|
||||
@@ -188,9 +188,15 @@ Script, app stopped, backup first (OPEN #4). **The "she logs in once first" depe
|
||||
- **A second bug in the guard, found by running it against production rather than a test file.** `PRAGMA locking_mode = EXCLUSIVE` keeps holding the lock after being set back to `NORMAL` — SQLite only releases it on that connection's next database access — so on a **WAL** database the script locked itself out of its own `VACUUM INTO` backup. It passed locally because the test database had come out of `VACUUM INTO` and so wasn't in WAL mode at all — the same shape of miss as the trailing-slash issuer: the fixture didn't look like production. The probe now runs on its own connection and closes it, and the fix was re-verified against a database that had genuinely been served in WAL mode.
|
||||
- **Startup crash averted while sequencing this**: the image backfill claims unowned files for `local`, which stops existing after the migration — a foreign-key error inside `images.New`, which `main.go` treats as fatal. Petal would have entered a crash loop the first time it started on a migrated database. The backfill now skips a missing owner (there is nothing to claim in that case anyway; the migration moves the image rows itself).
|
||||
|
||||
### Phase 18 — Per-user, per-language client state
|
||||
- [ ] Namespace `localStorage` keys by user id once known: `petal.spell.personal`, `petal.companion`, sound/petals prefs
|
||||
- [ ] Personal spell dictionary keyed by **user + language** (en and pt-PT word lists must not merge); consider promoting it to a server table so it follows her across devices (nice-to-have, decide during)
|
||||
### Phase 18 — Per-user, per-language client state ✅ (2026-07-27)
|
||||
- [x] **Preferences namespaced by account** (`web/src/lib/prefs.ts`) — `petal.sound`, `petal.petals` and `petal.companion` now read/write `<base>.u.<userId>`. The wrinkle is timing: `sounds.ts` and `petals.ts` read their value at *import* time, long before `/api/me` answers, so rather than block startup on the network for a mute flag, a read before the answer sees the **legacy un-namespaced key** (on a single-writer browser, exactly the right value) and `setPrefsScope` — called from `useSession` the moment `/api/me` resolves — adopts it and fires `onPrefsScopeChange` so each module re-reads. `PetalCompanion` re-reads too, unless she's already swapped mascots in the meantime.
|
||||
- [x] **Legacy adoption is a move, not a copy** (user's call): the first account to sign in on a browser inherits whatever was set back when Petal had no accounts, and the key is then deleted so the *second* account starts from Petal's defaults rather than from a stranger's choices. An existing scoped value is never overwritten by the legacy one.
|
||||
- [x] **Personal spell dictionary promoted to a server table** (the plan's nice-to-have; user chose it) — new `internal/spell` package + migration `0011_personal_dictionary`: `personal_words (user_id, lang, word, created_at)`, `PRIMARY KEY (user_id, lang, word)`, cascading with the account. `GET/POST/DELETE /api/spell/words`; adds are idempotent, a delete of a word that was never there is a success (the caller's intent already holds), and **every response carries the full resulting list** so the client never has to merge two views of one set. Namespacing it in `localStorage` instead would have *fragmented* the list she already has across her laptop and tablet — strictly worse than before; a table means it follows her.
|
||||
- [x] `lang` is the **dictionary's** language, not the writer's — an en-US personal word must not silence a pt-PT flag once the second pair ships. Normalised (`trim`/lowercase, default `en`) so `EN`/`en`/absent can't split one list into three.
|
||||
- [x] `useSpellChecker` is server-backed: nspell loads, then the word list arrives from her account and is replayed in. A browser still holding the Phase-7 `petal.spell.personal` key hands it over on first load — but **only lets go of it once the server has accepted it**, so a failed request costs nothing. `addWord` takes effect in the editor immediately and persists in the background: the underline goes away the instant she asks, whatever the network is doing. A word list that fails to load costs correct words being flagged, never writing.
|
||||
- [x] Tests: `internal/spell/handlers_test.go` — lifecycle (idempotent add, bulk add, repeat delete, `[]` not `null`), languages-don't-merge incl. the case-normalisation case, junk rejection, and the standing-rule **two-user isolation** (mount twice behind two resolvers over one DB: Bob sees none of Alice's words, his identical word is his own row, his delete doesn't reach hers, deleting the account takes the dictionary with it). `web/src/lib/prefs.test.ts` — legacy adoption, move-not-copy, two accounts on one browser, never-overwrite, listener fires once per real change, storage-throws safety.
|
||||
- Verified: go build/vet/test, tsc, vite build, vitest 82/82 all clean; live smoke on a throwaway DB (:8073) — add/bulk-add/list/delete, pt-PT list independent of en, CJK word accepted, 400 on empty.
|
||||
- ⚠️ **Not yet deployed, and the migration rehearsal against a copy of the live VPS database did not run** — the snapshot command was blocked by this session's permission classifier. `0011` is a plain `CREATE TABLE` with no table rebuild and no dependency on existing rows (unlike `0005`/`0010`), so the risk is low, but the convention is worth honouring before the container is rebuilt.
|
||||
|
||||
### Phase 19 — Langpack extraction (the copy chore)
|
||||
Pure refactor, zero visible change; prerequisite for every new pair (SUGGESTIONS §2, Q2 settled).
|
||||
@@ -238,6 +244,7 @@ Each item independent and small; order within is free (SUGGESTIONS §5–§6).
|
||||
- [x] **Phase 14 — companion warmth + bedtime nag + night mode**: more encouraging phrases, a gentle "go to bed" nudge after 11pm, and a calm dark theme + falling stars at night. ✅ (see Phase 14 above)
|
||||
|
||||
## Session log
|
||||
- 2026-07-27: **Phase 18 — the browser's settings become her settings** (user: "let's continue the build plan"). Two scope calls taken with the user: the personal spell dictionary goes **server-side** rather than being namespaced in place, and the pre-account `localStorage` keys are **adopted then rescoped** by the first writer to sign in. New `web/src/lib/prefs.ts` namespaces `petal.sound`/`petal.petals`/`petal.companion` by user id; the interesting part is timing — those modules read their value at *import* time, before `/api/me` can possibly have answered, so a pre-scope read deliberately sees the legacy key (the right value on a single-writer browser) and `setPrefsScope`, called from `useSession`, adopts it and notifies every reader. Adoption **moves** rather than copies, so account two starts from Petal's defaults instead of inheriting a stranger's mascot. New `internal/spell` package + migration `0011`: `personal_words` keyed `(user_id, lang, word)`, where `lang` is the **dictionary's** language, not the writer's — an English exception must not silence a pt-PT flag when the second pair ships. `useSpellChecker` now replays her list from her account, hands over any browser-held Phase-7 list on first load (releasing it only once the server has taken it), and persists an added word in the background so the underline vanishes the instant she asks. **The reason for the server table over cheaper namespacing**: keying the existing list by user in `localStorage` would have *fragmented* the words she already has across her laptop and tablet — the "cheap" fix was the one that made things worse. Tests: full lifecycle + languages-don't-merge + junk + the standing-rule two-user isolation suite in Go, and legacy-adoption/move-not-copy/two-accounts/storage-throws in vitest. go build/vet/test, tsc, vite, vitest 82/82 clean; live smoke on a throwaway DB. **Not deployed** — and the customary rehearsal of `0011` against a copy of the live VPS database was blocked by the session's permission classifier, so that check is outstanding (it is a plain `CREATE TABLE`, so lower-risk than `0005`/`0010`, but the convention exists for a reason).
|
||||
- 2026-07-27: **Phase 17 — Claire's writing moved onto her real account** (user: "claire is local user today in Petal. let's make sure to migrate existing data to her account"). `scripts/migrate_local_user.py`: dry-run by default, own `VACUUM INTO` backup, one transaction with foreign keys off, re-points `documents`/`tags`/`vocab_words`/`images`, verifies every expected row moved before committing. **The plan's stated prerequisite — "she logs in once so her sub exists" — turned out to be false**: authentik's `hashed_user_id` sub is `User.uid`, derived from her id and the instance secret, so it is readable in advance and the data could move *first*; she signs in to find her writing already there instead of to an empty Petal. Her 8 documents, 33 snapshots, 103 suggestions, 3 vocabulary words and 1 image now belong to `5f47d955…`, verified end to end over public HTTPS. Per the user's call the VPS is now canonical and millenia was left running and untouched as a frozen fallback (it diverges the moment either is written to — retire it rather than sync it). **Three bugs, each found by a different kind of contact with reality**: (1) the image backfill claims files for `local`, which stops existing after a migration — a foreign-key error inside `images.New`, which `main.go` treats as fatal, so Petal would have crash-looped on first start against a migrated database; (2) `BEGIN EXCLUSIVE` was the wrong liveness check, since in WAL mode it only conflicts with another *writer* and sails past a running-but-idle Petal — exactly the case the guard exists for; (3) the replacement, `PRAGMA locking_mode = EXCLUSIVE`, holds its lock past being reset to `NORMAL`, so on a real WAL database the script locked itself out of its own backup — invisible locally because the test file had come from `VACUUM INTO` and wasn't in WAL mode. Same shape as Phase 16's trailing-slash issuer: the fixture didn't look like production.
|
||||
- 2026-07-27: **Phase 16 built — Petal authenticates for itself** (user: "let's continue the build plan"; box access granted mid-session). New `internal/auth` surface on top of the Phase-0 `Resolver` seam: `session.go` (opaque cookie, **SHA-256-at-rest**, 30-day sliding expiry throttled to one write an hour, revoke/revoke-all/prune), `oidc.go` (login/callback/logout with state + nonce + PKCE, **lazy retried discovery** so an IdP outage can't stop Petal booting or invalidate live sessions), `users.go` (provisioning upsert keyed on `sub`, `/api/me`, allowlist). Migration `0010` lands `sessions`, `images` and `users.pair_lang` together. `main.go` picks the resolver from config, so a laptop build is unchanged. **Image ownership** closes the capability-URL hole flagged in the Phase-0 audit — one row per owner keeps dedup, a stranger gets 404 not 403, `Cache-Control` dropped to `private`, and pre-existing files are claimed at startup or they'd all 404. Frontend: a single 401 interceptor, a warm bilingual sign-in overlay over a still-visible editor, and a **draft rescue** to localStorage so an expired session can't cost writing — the auto-save stashes the body it couldn't send and reclaims it after re-login. **Three deliberate deviations from the plan**, all noted above: the allowlist matches emails as well as subject ids (a subject doesn't exist until first login, so a subject-only list is unusable in advance); `SESSION_SECRET` was dropped from config rather than left unused (nothing signs anything — sessions are opaque and server-side); and image rows are keyed `(name, user_id)` rather than owned singly, which is what preserves deduplication. **A real bug caught by writing the round-trip test rather than by reading the code**: the one-shot state/nonce/PKCE cookies were cleared in a `defer`, i.e. after the redirect had already written the header, so the clearing `Set-Cookie` was silently dropped. Verified: full go/tsc/vite/vitest suites, migration `0010` against a `VACUUM INTO` copy of the live millenia DB (counts intact, FTS still matching, image claimed), and a live smoke against the binary in both auth-off and auth-on modes including a hand-inserted session (valid → 200; absent/forged/expired → 401). **Then deployed** (user: "do it! register it!"): provider + application registered in Authentik via `ak shell`, `.env` filled in, image rebuilt, and the **Traefik basic-auth gate removed** — Petal holds its own door now. Deploying immediately found two things no test could: the issuer's **trailing slash is significant** (Authentik's has one, OIDC compares byte-for-byte, and my normalising it away broke discovery while the slashless stub kept passing — now a knob with a regression test), and a provider created through the shell rather than the admin UI comes up with **empty `grant_types`**, which authentik answers with `invalid_request` before the login page renders. Verified over public HTTPS: health 200, `/api/docs` 401 with no basic-auth challenge, `/auth/login` → Authentik with state+nonce+PKCE, following it lands on the real sign-in page. Also swapped the emoji favicon for a **drawn sakura** (`web/public/petal.svg`) that renders in Petal's own rose palette everywhere instead of at each platform's discretion, and doubles as the Authentik app tile (inlined as a data URI, since this authentik doesn't serve `/media`). **The allowlist is `prosolis@proton.me` only** — that IdP fronts ~40 accounts, so empty was not an option and guessing her account would either lock her out or let a stranger in; adding her is one `.env` line and a restart.
|
||||
- 2026-07-27: **Phase 15 finished off on the two boxes** (user granted millenia access mid-session: `ssh reala@192.168.1.212`, and parodia is `ssh reala@100.64.0.1` over headscale). **LLM link**: rather than rebinding vLLM as planned, `deploy/vllm-headscale-proxy.service` (socat) adds a listener on `100.64.0.2` only — `vllm-chat.service` is shared with **Gogobee** and **Open WebUI** (whose endpoint lives in its own DB, not env), so a rebind meant three consumer edits and a 35B reload; the forwarder cost nothing and no downtime. Grammar checkpoint from the VPS now returns real suggestions in ~3s. **Backups**: the user pointed out the VPS already has daily provider VM backups *and* an age-encrypted offsite `parodia-backup` job, so Petal was folded into the latter instead of running a parallel cron — and doing so **exposed a real bug in that job's `sqlite_dump` helper**: Python's `iterdump` does not reproduce an FTS5 virtual table, so any restore would have come back with cross-document search silently missing (fixed with a `VACUUM INTO`-based helper, round-trip verified). The **bigger** find: millenia, which holds her actual writing, had **no scheduled backup at all** — now `petal-backup.timer`, age-encrypted with the parodia public recipient and pushed off-box, neither machine able to decrypt it. **Encryption at rest** (user raised it; correctly): VPS data dir is now LUKS2 covering the DB, images *and* the TTS cache; key on-box as a deliberate availability tradeoff, documented for what it does and doesn't stop. Rehearsing a reboot caught two bugs a clean run would have hidden — the plaintext originals were still on the unencrypted root fs *under* the mount, and `systemd-cryptsetup` wasn't installed so crypttab was being ignored entirely and the volume would never have unlocked at boot. Added a `.volume-ok` guard so an unmounted volume fails loudly instead of serving a blank DB. **Millenia hygiene**: Piper had been dead since the Jul 26 reboot — **26,800+ failed restarts**, read-aloud silently degrading to browser Web Speech — because an OS upgrade moved `/usr/bin/python3` 3.13→3.14 and the venv's `site-packages` went invisible; venv recreated (lands Piper 1.6.0, which is what `TTS_PATH` exists for), both voices verified through Petal. Petal itself was running unsupervised at PPID 1 and is now `petal.service` (verified by `kill -9`); the Piper units got `StartLimitIntervalSec`/`Burst` so a broken service enters `failed` instead of looping forever unnoticed. Remaining: an external uptime-kuma probe (needs the UI), a true VPS reboot test (shared public host, user's call), and millenia is still unencrypted at rest.
|
||||
|
||||
@@ -21,6 +21,7 @@ import (
|
||||
"gitea.parodia.dev/drwily/petal/internal/images"
|
||||
"gitea.parodia.dev/drwily/petal/internal/lexicon"
|
||||
"gitea.parodia.dev/drwily/petal/internal/llm"
|
||||
"gitea.parodia.dev/drwily/petal/internal/spell"
|
||||
"gitea.parodia.dev/drwily/petal/internal/suggestions"
|
||||
"gitea.parodia.dev/drwily/petal/internal/tts"
|
||||
"gitea.parodia.dev/drwily/petal/internal/vocab"
|
||||
@@ -160,6 +161,11 @@ func main() {
|
||||
// surfaced for gentle spaced-repetition review.
|
||||
pr.Mount("/vocab", vocab.New(database).Routes())
|
||||
|
||||
// The personal spelling dictionary — the words she's told Petal to stop
|
||||
// flagging. Kept server-side (rather than in the browser) so it belongs
|
||||
// to her account and follows her between devices.
|
||||
pr.Mount("/spell", spell.New(database).Routes())
|
||||
|
||||
// Editor image uploads, stored on disk and served back by content hash
|
||||
// to whoever owns them. Files already on disk from before ownership
|
||||
// existed are claimed for the local user at startup.
|
||||
|
||||
@@ -436,6 +436,29 @@ CREATE TABLE images (
|
||||
CREATE INDEX idx_images_user_id ON images(user_id);
|
||||
|
||||
ALTER TABLE users ADD COLUMN pair_lang TEXT NOT NULL DEFAULT 'zh';
|
||||
`,
|
||||
},
|
||||
{
|
||||
// The personal spelling dictionary moves off the browser. It used to be a
|
||||
// single `petal.spell.personal` key in localStorage, which meant two
|
||||
// people sharing a device shared a word list built from one person's
|
||||
// private writing — and one person writing on two devices had two
|
||||
// unrelated lists.
|
||||
//
|
||||
// `lang` is the *dictionary's* language, not the writer's: a word is only
|
||||
// ever added while a particular Hunspell dictionary flagged it, and an
|
||||
// en-US personal word must not silence a pt-PT flag (or vice versa) once
|
||||
// the second pair ships. `word` is stored as typed; matching is exact,
|
||||
// because case carries meaning to a speller ("polish" vs "Polish").
|
||||
name: "0011_personal_dictionary",
|
||||
stmt: `
|
||||
CREATE TABLE personal_words (
|
||||
user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
|
||||
lang TEXT NOT NULL,
|
||||
word TEXT NOT NULL,
|
||||
created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
|
||||
PRIMARY KEY (user_id, lang, word)
|
||||
);
|
||||
`,
|
||||
},
|
||||
}
|
||||
|
||||
@@ -0,0 +1,198 @@
|
||||
// Package spell owns the personal spelling dictionary — the words a writer has
|
||||
// told Petal to stop flagging.
|
||||
//
|
||||
// It lived in the browser's localStorage until Phase 18, which was wrong twice
|
||||
// over: two people sharing a device shared one list (built from one person's
|
||||
// private writing), and one person writing on a laptop and a tablet had two
|
||||
// lists that never met. It is a small amount of state, but it is *her* state,
|
||||
// so it belongs to her account rather than to a browser profile.
|
||||
//
|
||||
// Everything here is scoped by `lang` as well as by user. That is the language
|
||||
// of the *dictionary* that flagged the word, not the writer's own language: an
|
||||
// en-US personal word must not silence a pt-PT flag once the second pair ships.
|
||||
package spell
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"net/http"
|
||||
"strings"
|
||||
|
||||
"github.com/go-chi/chi/v5"
|
||||
|
||||
"gitea.parodia.dev/drwily/petal/internal/auth"
|
||||
"gitea.parodia.dev/drwily/petal/internal/db"
|
||||
"gitea.parodia.dev/drwily/petal/internal/httputil"
|
||||
)
|
||||
|
||||
// DefaultLang is the dictionary assumed when a caller doesn't name one. Only
|
||||
// en-US ships today; pt-PT arrives with the first Latin pair.
|
||||
const DefaultLang = "en"
|
||||
|
||||
// MaxWordLen bounds a single entry. A personal dictionary holds words, and a
|
||||
// pasted paragraph is a bug (or an attempt to use the table as storage).
|
||||
const MaxWordLen = 80
|
||||
|
||||
// MaxBatch bounds one request. The only bulk caller is the one-time adoption of
|
||||
// a browser's pre-Phase-18 list, which is realistically tens of words.
|
||||
const MaxBatch = 500
|
||||
|
||||
// Handler owns the /api/spell routes.
|
||||
type Handler struct {
|
||||
DB *db.DB
|
||||
}
|
||||
|
||||
func New(database *db.DB) *Handler { return &Handler{DB: database} }
|
||||
|
||||
// Routes mounts the personal-dictionary endpoints under /api/spell.
|
||||
func (h *Handler) Routes() chi.Router {
|
||||
r := chi.NewRouter()
|
||||
r.Get("/words", h.list)
|
||||
r.Post("/words", h.add)
|
||||
r.Delete("/words", h.remove)
|
||||
return r
|
||||
}
|
||||
|
||||
type wordsResponse struct {
|
||||
Lang string `json:"lang"`
|
||||
Words []string `json:"words"`
|
||||
}
|
||||
|
||||
type addRequest struct {
|
||||
Lang string `json:"lang"`
|
||||
// Word and Words are both accepted so the everyday "add this one word" call
|
||||
// stays obvious while the one-shot migration of a browser's old list is a
|
||||
// single request rather than one per word.
|
||||
Word string `json:"word"`
|
||||
Words []string `json:"words"`
|
||||
}
|
||||
|
||||
// normLang keeps the dictionary tag in one canonical shape so "EN", "en" and a
|
||||
// missing value can never split one list into three.
|
||||
func normLang(lang string) string {
|
||||
lang = strings.ToLower(strings.TrimSpace(lang))
|
||||
if lang == "" {
|
||||
return DefaultLang
|
||||
}
|
||||
return lang
|
||||
}
|
||||
|
||||
// list returns the caller's words for one dictionary, alphabetically so the
|
||||
// order is stable between requests.
|
||||
func (h *Handler) list(w http.ResponseWriter, r *http.Request) {
|
||||
lang := normLang(r.URL.Query().Get("lang"))
|
||||
words, err := h.fetch(auth.UserID(r.Context()), lang)
|
||||
if err != nil {
|
||||
httputil.ServerError(w, err)
|
||||
return
|
||||
}
|
||||
httputil.WriteJSON(w, http.StatusOK, wordsResponse{Lang: lang, Words: words})
|
||||
}
|
||||
|
||||
// add inserts one or more words, idempotently, and answers with the resulting
|
||||
// full list — so the client never has to merge two views of the same set.
|
||||
func (h *Handler) add(w http.ResponseWriter, r *http.Request) {
|
||||
var req addRequest
|
||||
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
|
||||
httputil.BadRequest(w, "invalid JSON body")
|
||||
return
|
||||
}
|
||||
lang := normLang(req.Lang)
|
||||
|
||||
incoming := req.Words
|
||||
if req.Word != "" {
|
||||
incoming = append(incoming, req.Word)
|
||||
}
|
||||
clean := make([]string, 0, len(incoming))
|
||||
for _, word := range incoming {
|
||||
word = strings.TrimSpace(word)
|
||||
if word == "" || len([]rune(word)) > MaxWordLen {
|
||||
continue
|
||||
}
|
||||
clean = append(clean, word)
|
||||
}
|
||||
if len(clean) == 0 {
|
||||
httputil.BadRequest(w, "no word given")
|
||||
return
|
||||
}
|
||||
if len(clean) > MaxBatch {
|
||||
httputil.BadRequest(w, "too many words in one request")
|
||||
return
|
||||
}
|
||||
|
||||
userID := auth.UserID(r.Context())
|
||||
tx, err := h.DB.Begin()
|
||||
if err != nil {
|
||||
httputil.ServerError(w, err)
|
||||
return
|
||||
}
|
||||
defer func() { _ = tx.Rollback() }()
|
||||
for _, word := range clean {
|
||||
if _, err := tx.Exec(
|
||||
`INSERT INTO personal_words (user_id, lang, word) VALUES (?, ?, ?)
|
||||
ON CONFLICT(user_id, lang, word) DO NOTHING`,
|
||||
userID, lang, word,
|
||||
); err != nil {
|
||||
httputil.ServerError(w, err)
|
||||
return
|
||||
}
|
||||
}
|
||||
if err := tx.Commit(); err != nil {
|
||||
httputil.ServerError(w, err)
|
||||
return
|
||||
}
|
||||
|
||||
words, err := h.fetch(userID, lang)
|
||||
if err != nil {
|
||||
httputil.ServerError(w, err)
|
||||
return
|
||||
}
|
||||
httputil.WriteJSON(w, http.StatusOK, wordsResponse{Lang: lang, Words: words})
|
||||
}
|
||||
|
||||
// remove forgets one word. Deleting something that was never there is a success:
|
||||
// the caller's intent — "this word is not in my dictionary" — already holds.
|
||||
func (h *Handler) remove(w http.ResponseWriter, r *http.Request) {
|
||||
word := strings.TrimSpace(r.URL.Query().Get("word"))
|
||||
if word == "" {
|
||||
httputil.BadRequest(w, "no word given")
|
||||
return
|
||||
}
|
||||
lang := normLang(r.URL.Query().Get("lang"))
|
||||
userID := auth.UserID(r.Context())
|
||||
if _, err := h.DB.Exec(
|
||||
`DELETE FROM personal_words WHERE user_id = ? AND lang = ? AND word = ?`,
|
||||
userID, lang, word,
|
||||
); err != nil {
|
||||
httputil.ServerError(w, err)
|
||||
return
|
||||
}
|
||||
words, err := h.fetch(userID, lang)
|
||||
if err != nil {
|
||||
httputil.ServerError(w, err)
|
||||
return
|
||||
}
|
||||
httputil.WriteJSON(w, http.StatusOK, wordsResponse{Lang: lang, Words: words})
|
||||
}
|
||||
|
||||
// fetch reads one (user, dictionary) list. Both keys are always bound — an
|
||||
// unscoped read here would hand one writer another's private vocabulary.
|
||||
func (h *Handler) fetch(userID, lang string) ([]string, error) {
|
||||
rows, err := h.DB.Query(
|
||||
`SELECT word FROM personal_words WHERE user_id = ? AND lang = ? ORDER BY word`,
|
||||
userID, lang,
|
||||
)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
defer rows.Close()
|
||||
|
||||
words := []string{} // never nil: the client expects a list, not null
|
||||
for rows.Next() {
|
||||
var word string
|
||||
if err := rows.Scan(&word); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
words = append(words, word)
|
||||
}
|
||||
return words, rows.Err()
|
||||
}
|
||||
@@ -0,0 +1,213 @@
|
||||
package spell
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"encoding/json"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"path/filepath"
|
||||
"testing"
|
||||
|
||||
"github.com/go-chi/chi/v5"
|
||||
|
||||
"gitea.parodia.dev/drwily/petal/internal/auth"
|
||||
"gitea.parodia.dev/drwily/petal/internal/db"
|
||||
)
|
||||
|
||||
// newTestServer mounts the routes behind the same auth middleware main.go
|
||||
// installs — a bare router resolves no caller, so every scoped query would
|
||||
// silently match nothing.
|
||||
func newTestServer(t *testing.T) (http.Handler, *db.DB) {
|
||||
t.Helper()
|
||||
database, err := db.Open(filepath.Join(t.TempDir(), "test.db"))
|
||||
if err != nil {
|
||||
t.Fatalf("open db: %v", err)
|
||||
}
|
||||
t.Cleanup(func() { database.Close() })
|
||||
r := chi.NewRouter()
|
||||
r.Mount("/spell", New(database).Routes())
|
||||
return auth.Middleware(auth.StaticResolver(db.LocalUserID))(r), database
|
||||
}
|
||||
|
||||
func do(t *testing.T, srv http.Handler, method, path, body string) *httptest.ResponseRecorder {
|
||||
t.Helper()
|
||||
var r *http.Request
|
||||
if body != "" {
|
||||
r = httptest.NewRequest(method, path, bytes.NewBufferString(body))
|
||||
} else {
|
||||
r = httptest.NewRequest(method, path, nil)
|
||||
}
|
||||
rec := httptest.NewRecorder()
|
||||
srv.ServeHTTP(rec, r)
|
||||
return rec
|
||||
}
|
||||
|
||||
func decodeWords(t *testing.T, rec *httptest.ResponseRecorder) wordsResponse {
|
||||
t.Helper()
|
||||
if rec.Code != http.StatusOK {
|
||||
t.Fatalf("code=%d body=%s", rec.Code, rec.Body)
|
||||
}
|
||||
var got wordsResponse
|
||||
if err := json.Unmarshal(rec.Body.Bytes(), &got); err != nil {
|
||||
t.Fatalf("decode: %v (body %s)", err, rec.Body)
|
||||
}
|
||||
return got
|
||||
}
|
||||
|
||||
func equal(a, b []string) bool {
|
||||
if len(a) != len(b) {
|
||||
return false
|
||||
}
|
||||
for i := range a {
|
||||
if a[i] != b[i] {
|
||||
return false
|
||||
}
|
||||
}
|
||||
return true
|
||||
}
|
||||
|
||||
// TestLifecycle walks add → list → re-add → delete, and asserts the two
|
||||
// properties the client relies on: adds are idempotent, and every response
|
||||
// carries the full resulting list so the browser never has to merge.
|
||||
func TestLifecycle(t *testing.T) {
|
||||
srv, _ := newTestServer(t)
|
||||
|
||||
// Empty to start, and a list, never null.
|
||||
got := decodeWords(t, do(t, srv, http.MethodGet, "/spell/words", ""))
|
||||
if got.Lang != "en" || len(got.Words) != 0 {
|
||||
t.Fatalf("fresh list = %+v, want empty en", got)
|
||||
}
|
||||
if !bytes.Contains(
|
||||
do(t, srv, http.MethodGet, "/spell/words", "").Body.Bytes(), []byte(`"words":[]`),
|
||||
) {
|
||||
t.Fatal("empty list encoded as null, not []")
|
||||
}
|
||||
|
||||
// One word, then a bulk add (the shape the browser's one-time adoption uses).
|
||||
got = decodeWords(t, do(t, srv, http.MethodPost, "/spell/words", `{"word":"Petal"}`))
|
||||
if !equal(got.Words, []string{"Petal"}) {
|
||||
t.Fatalf("after add = %v", got.Words)
|
||||
}
|
||||
got = decodeWords(t, do(t, srv, http.MethodPost, "/spell/words",
|
||||
`{"words":["hanfu","qipao","Petal"]}`))
|
||||
if !equal(got.Words, []string{"Petal", "hanfu", "qipao"}) {
|
||||
t.Fatalf("after bulk add = %v, want sorted and de-duplicated", got.Words)
|
||||
}
|
||||
|
||||
// Re-adding an existing word must not error or duplicate it.
|
||||
got = decodeWords(t, do(t, srv, http.MethodPost, "/spell/words", `{"word":"hanfu"}`))
|
||||
if !equal(got.Words, []string{"Petal", "hanfu", "qipao"}) {
|
||||
t.Fatalf("re-add changed the list: %v", got.Words)
|
||||
}
|
||||
|
||||
// Delete, then delete again — forgetting a word Petal never knew is a
|
||||
// success, since the caller's intent already holds.
|
||||
got = decodeWords(t, do(t, srv, http.MethodDelete, "/spell/words?word=qipao", ""))
|
||||
if !equal(got.Words, []string{"Petal", "hanfu"}) {
|
||||
t.Fatalf("after delete = %v", got.Words)
|
||||
}
|
||||
got = decodeWords(t, do(t, srv, http.MethodDelete, "/spell/words?word=qipao", ""))
|
||||
if !equal(got.Words, []string{"Petal", "hanfu"}) {
|
||||
t.Fatalf("repeat delete = %v", got.Words)
|
||||
}
|
||||
}
|
||||
|
||||
// TestLanguagesDoNotMerge is the reason `lang` is in the primary key: a word the
|
||||
// writer excused in English must not silence the pt-PT dictionary too.
|
||||
func TestLanguagesDoNotMerge(t *testing.T) {
|
||||
srv, _ := newTestServer(t)
|
||||
|
||||
do(t, srv, http.MethodPost, "/spell/words", `{"word":"tarde"}`)
|
||||
got := decodeWords(t, do(t, srv, http.MethodPost, "/spell/words",
|
||||
`{"lang":"pt-PT","word":"tarde"}`))
|
||||
if !equal(got.Words, []string{"tarde"}) || got.Lang != "pt-pt" {
|
||||
t.Fatalf("pt list = %+v", got)
|
||||
}
|
||||
|
||||
// Removing it from one dictionary leaves the other alone.
|
||||
do(t, srv, http.MethodDelete, "/spell/words?lang=pt-PT&word=tarde", "")
|
||||
if got = decodeWords(t, do(t, srv, http.MethodGet, "/spell/words?lang=pt-PT", "")); len(got.Words) != 0 {
|
||||
t.Fatalf("pt list after delete = %v", got.Words)
|
||||
}
|
||||
if got = decodeWords(t, do(t, srv, http.MethodGet, "/spell/words", "")); !equal(got.Words, []string{"tarde"}) {
|
||||
t.Fatalf("en list collaterally damaged: %v", got.Words)
|
||||
}
|
||||
|
||||
// Case and whitespace in the tag must not split one list into three.
|
||||
got = decodeWords(t, do(t, srv, http.MethodGet, "/spell/words?lang=EN", ""))
|
||||
if !equal(got.Words, []string{"tarde"}) {
|
||||
t.Fatalf("uppercase lang tag saw a different list: %v", got.Words)
|
||||
}
|
||||
}
|
||||
|
||||
func TestRejectsJunk(t *testing.T) {
|
||||
srv, _ := newTestServer(t)
|
||||
|
||||
cases := []struct{ name, method, path, body string }{
|
||||
{"empty word", http.MethodPost, "/spell/words", `{"word":" "}`},
|
||||
{"no word at all", http.MethodPost, "/spell/words", `{"lang":"en"}`},
|
||||
{"not json", http.MethodPost, "/spell/words", `nonsense`},
|
||||
{"delete without a word", http.MethodDelete, "/spell/words", ""},
|
||||
}
|
||||
for _, c := range cases {
|
||||
if rec := do(t, srv, c.method, c.path, c.body); rec.Code != http.StatusBadRequest {
|
||||
t.Errorf("%s: code=%d, want 400", c.name, rec.Code)
|
||||
}
|
||||
}
|
||||
|
||||
// An over-long entry is dropped rather than stored — a pasted paragraph is
|
||||
// not a word. Dropping the only entry leaves nothing to add, hence 400.
|
||||
long := `{"word":"` + string(bytes.Repeat([]byte("a"), MaxWordLen+1)) + `"}`
|
||||
if rec := do(t, srv, http.MethodPost, "/spell/words", long); rec.Code != http.StatusBadRequest {
|
||||
t.Errorf("over-long word: code=%d, want 400", rec.Code)
|
||||
}
|
||||
}
|
||||
|
||||
// TestTwoUsersDoNotShare is the standing rule for every user-scoped endpoint:
|
||||
// mount the same routes twice behind two resolvers over one database.
|
||||
func TestTwoUsersDoNotShare(t *testing.T) {
|
||||
database, err := db.Open(filepath.Join(t.TempDir(), "test.db"))
|
||||
if err != nil {
|
||||
t.Fatalf("open db: %v", err)
|
||||
}
|
||||
t.Cleanup(func() { database.Close() })
|
||||
if _, err := database.Exec(
|
||||
`INSERT INTO users (id, email, display_name) VALUES (?, ?, ?)`,
|
||||
"bob", "bob@petal.local", "Bob",
|
||||
); err != nil {
|
||||
t.Fatalf("seed second user: %v", err)
|
||||
}
|
||||
mount := func(userID string) http.Handler {
|
||||
r := chi.NewRouter()
|
||||
r.Mount("/spell", New(database).Routes())
|
||||
return auth.Middleware(auth.StaticResolver(userID))(r)
|
||||
}
|
||||
alice, bob := mount(db.LocalUserID), mount("bob")
|
||||
|
||||
do(t, alice, http.MethodPost, "/spell/words", `{"words":["Xiaolan","hanfu"]}`)
|
||||
|
||||
// Bob sees none of it — a personal dictionary is built from private writing.
|
||||
if got := decodeWords(t, do(t, bob, http.MethodGet, "/spell/words", "")); len(got.Words) != 0 {
|
||||
t.Fatalf("bob sees alice's words: %v", got.Words)
|
||||
}
|
||||
|
||||
// Bob's own identical word is his own row, and deleting it leaves hers.
|
||||
do(t, bob, http.MethodPost, "/spell/words", `{"word":"hanfu"}`)
|
||||
do(t, bob, http.MethodDelete, "/spell/words?word=hanfu", "")
|
||||
if got := decodeWords(t, do(t, alice, http.MethodGet, "/spell/words", "")); !equal(got.Words, []string{"Xiaolan", "hanfu"}) {
|
||||
t.Fatalf("bob's delete reached alice's list: %v", got.Words)
|
||||
}
|
||||
|
||||
// Deleting the account takes the dictionary with it.
|
||||
if _, err := database.Exec(`DELETE FROM users WHERE id = 'bob'`); err != nil {
|
||||
t.Fatalf("delete user: %v", err)
|
||||
}
|
||||
var n int
|
||||
if err := database.QueryRow(
|
||||
`SELECT COUNT(*) FROM personal_words WHERE user_id = 'bob'`).Scan(&n); err != nil {
|
||||
t.Fatalf("count: %v", err)
|
||||
}
|
||||
if n != 0 {
|
||||
t.Fatalf("%d orphaned rows after the user was deleted", n)
|
||||
}
|
||||
}
|
||||
@@ -150,6 +150,13 @@ export interface MechanicsFinding {
|
||||
explanation: string
|
||||
}
|
||||
|
||||
// One dictionary's worth of personal words — the ones she's excused from
|
||||
// spell-check. Keyed by the dictionary's language, not the writer's.
|
||||
export interface PersonalWords {
|
||||
lang: string
|
||||
words: string[]
|
||||
}
|
||||
|
||||
// Who's writing. Mirrors the backend db.User.
|
||||
export interface Me {
|
||||
id: string
|
||||
@@ -333,6 +340,24 @@ export const api = {
|
||||
req<VocabWord>(`/vocab/${id}/review`, { method: 'POST', body: JSON.stringify({ grade }) }),
|
||||
deleteVocab: (id: string) => req<void>(`/vocab/${id}`, { method: 'DELETE' }),
|
||||
|
||||
// The personal spelling dictionary — words she's told Petal to stop flagging.
|
||||
// Server-side, so it belongs to her account and follows her between devices.
|
||||
// `lang` is the *dictionary's* language: an English exception must not silence
|
||||
// a pt-PT flag. Every call answers with the full resulting list, so the client
|
||||
// never has to merge two views of the same set.
|
||||
listPersonalWords: (lang: string) =>
|
||||
req<PersonalWords>(`/spell/words?lang=${encodeURIComponent(lang)}`),
|
||||
addPersonalWords: (lang: string, words: string[]) =>
|
||||
req<PersonalWords>('/spell/words', {
|
||||
method: 'POST',
|
||||
body: JSON.stringify({ lang, words }),
|
||||
}),
|
||||
removePersonalWord: (lang: string, word: string) =>
|
||||
req<PersonalWords>(
|
||||
`/spell/words?lang=${encodeURIComponent(lang)}&word=${encodeURIComponent(word)}`,
|
||||
{ method: 'DELETE' },
|
||||
),
|
||||
|
||||
// Current deployed build id — changes whenever a new frontend ships. The
|
||||
// app polls this to offer a refresh. Bypasses any cache so the answer is live.
|
||||
version: () => req<{ version: string }>('/version', { cache: 'no-store' }),
|
||||
|
||||
+16
-10
@@ -13,7 +13,10 @@ import blockUrl from '../assets/sounds/block.mp3'
|
||||
import baodingUrl from '../assets/sounds/baoding.mp3'
|
||||
import milestoneUrl from '../assets/sounds/milestone.mp3'
|
||||
import errorUrl from '../assets/sounds/error.mp3'
|
||||
import { onPrefsScopeChange, readPref, writePref } from '../lib/prefs'
|
||||
|
||||
// The mute choice belongs to the account, not the browser — one person's
|
||||
// silence must not mute the next writer to sign in here.
|
||||
const STORAGE_KEY = 'petal.sound'
|
||||
|
||||
// Master volume — deliberately gentle. These are background delights, not alerts.
|
||||
@@ -53,24 +56,27 @@ let enabled = readEnabled()
|
||||
const listeners = new Set<(on: boolean) => void>()
|
||||
|
||||
function readEnabled(): boolean {
|
||||
try {
|
||||
return localStorage.getItem(STORAGE_KEY) !== 'off'
|
||||
} catch {
|
||||
return true
|
||||
}
|
||||
return readPref(STORAGE_KEY) !== 'off'
|
||||
}
|
||||
|
||||
// This module reads its value at import time, before /api/me has answered.
|
||||
// Re-read once the account is known, in case this writer's choice differs from
|
||||
// whatever the browser was holding.
|
||||
onPrefsScopeChange(() => {
|
||||
const next = readEnabled()
|
||||
if (next === enabled) return
|
||||
enabled = next
|
||||
listeners.forEach((fn) => fn(next))
|
||||
if (next) void ensureContext()
|
||||
})
|
||||
|
||||
export function isSoundEnabled(): boolean {
|
||||
return enabled
|
||||
}
|
||||
|
||||
export function setSoundEnabled(on: boolean): void {
|
||||
enabled = on
|
||||
try {
|
||||
localStorage.setItem(STORAGE_KEY, on ? 'on' : 'off')
|
||||
} catch {
|
||||
/* private mode — choice just won't persist */
|
||||
}
|
||||
writePref(STORAGE_KEY, on ? 'on' : 'off')
|
||||
listeners.forEach((fn) => fn(on))
|
||||
// Touching the context on enable doubles as a user-gesture unlock + warm-up.
|
||||
if (on) void ensureContext()
|
||||
|
||||
@@ -3,6 +3,7 @@ import type { SaveStatus } from '../../hooks/useAutoSave'
|
||||
import { useCompanion, type Mood } from './useCompanion'
|
||||
import { LottiePlayer } from './LottiePlayer'
|
||||
import { COMPANIONS, DEFAULT_COMPANION } from './companions'
|
||||
import { onPrefsScopeChange, readPref, writePref } from '../../lib/prefs'
|
||||
|
||||
interface Props {
|
||||
wordCount: number
|
||||
@@ -38,13 +39,22 @@ export function PetalCompanion({ wordCount, saveStatus, llmDown, editTick, accep
|
||||
text,
|
||||
})
|
||||
|
||||
const [companionId, setCompanionId] = useState<string>(() => {
|
||||
try {
|
||||
return localStorage.getItem(STORAGE_KEY) || DEFAULT_COMPANION
|
||||
} catch {
|
||||
return DEFAULT_COMPANION
|
||||
}
|
||||
})
|
||||
const [companionId, setCompanionId] = useState<string>(
|
||||
() => readPref(STORAGE_KEY) || DEFAULT_COMPANION,
|
||||
)
|
||||
|
||||
// The mascot belongs to the writer, not the browser. That first read happens
|
||||
// before /api/me answers, so pick the choice up again once the account is
|
||||
// known — unless she's already swapped companions in the meantime.
|
||||
const touched = useRef(false)
|
||||
useEffect(
|
||||
() =>
|
||||
onPrefsScopeChange(() => {
|
||||
if (touched.current) return
|
||||
setCompanionId(readPref(STORAGE_KEY) || DEFAULT_COMPANION)
|
||||
}),
|
||||
[],
|
||||
)
|
||||
const companion = COMPANIONS.find((c) => c.id === companionId) ?? COMPANIONS[0]
|
||||
const [pickerOpen, setPickerOpen] = useState(false)
|
||||
const rootRef = useRef<HTMLDivElement>(null)
|
||||
@@ -69,11 +79,8 @@ export function PetalCompanion({ wordCount, saveStatus, llmDown, editTick, accep
|
||||
|
||||
function choose(id: string) {
|
||||
setCompanionId(id)
|
||||
try {
|
||||
localStorage.setItem(STORAGE_KEY, id)
|
||||
} catch {
|
||||
/* private mode / storage disabled — selection just won't persist */
|
||||
}
|
||||
touched.current = true
|
||||
writePref(STORAGE_KEY, id)
|
||||
setPickerOpen(false)
|
||||
}
|
||||
|
||||
|
||||
+16
-10
@@ -2,6 +2,10 @@
|
||||
// people find drifting petals distracting rather than cozy, so the whole effect
|
||||
// is opt-out-able and the choice persists in localStorage so it survives reloads.
|
||||
// Mirrors the tiny pub/sub used for the sound mute toggle (../audio/sounds).
|
||||
// The choice belongs to the account, not the browser, so it reads and writes
|
||||
// through the per-user preference scope (../lib/prefs).
|
||||
|
||||
import { onPrefsScopeChange, readPref, writePref } from '../lib/prefs'
|
||||
|
||||
const STORAGE_KEY = 'petal.petals'
|
||||
|
||||
@@ -9,24 +13,26 @@ let enabled = readEnabled()
|
||||
const listeners = new Set<(on: boolean) => void>()
|
||||
|
||||
function readEnabled(): boolean {
|
||||
try {
|
||||
return localStorage.getItem(STORAGE_KEY) !== 'off'
|
||||
} catch {
|
||||
return true
|
||||
}
|
||||
return readPref(STORAGE_KEY) !== 'off'
|
||||
}
|
||||
|
||||
// The first read happens at import time, before /api/me has said who is
|
||||
// writing. Re-read once it has, in case this writer's choice differs from
|
||||
// whatever the browser held.
|
||||
onPrefsScopeChange(() => {
|
||||
const next = readEnabled()
|
||||
if (next === enabled) return
|
||||
enabled = next
|
||||
listeners.forEach((fn) => fn(next))
|
||||
})
|
||||
|
||||
export function isPetalsEnabled(): boolean {
|
||||
return enabled
|
||||
}
|
||||
|
||||
export function setPetalsEnabled(on: boolean): void {
|
||||
enabled = on
|
||||
try {
|
||||
localStorage.setItem(STORAGE_KEY, on ? 'on' : 'off')
|
||||
} catch {
|
||||
/* private mode — choice just won't persist */
|
||||
}
|
||||
writePref(STORAGE_KEY, on ? 'on' : 'off')
|
||||
listeners.forEach((fn) => fn(on))
|
||||
}
|
||||
|
||||
|
||||
@@ -1,5 +1,6 @@
|
||||
import { useEffect, useState } from 'react'
|
||||
import { api, onUnauthorized, type Me } from '../api/client'
|
||||
import { setPrefsScope } from '../lib/prefs'
|
||||
|
||||
// useSession tracks who is writing, and notices the moment the server stops
|
||||
// recognising them.
|
||||
@@ -18,7 +19,13 @@ export function useSession() {
|
||||
api
|
||||
.me()
|
||||
.then((user) => {
|
||||
if (!cancelled) setMe(user)
|
||||
if (cancelled) return
|
||||
// Browser preferences (mute, petals, companion) belong to the writer,
|
||||
// not the machine. This is the moment their storage keys can stop being
|
||||
// shared — and the first account on this browser inherits whatever was
|
||||
// set back when Petal had no accounts at all.
|
||||
setPrefsScope(user.id)
|
||||
setMe(user)
|
||||
})
|
||||
.catch(() => {
|
||||
// A 401 has already flipped signedOut through the interceptor; anything
|
||||
|
||||
@@ -1,13 +1,20 @@
|
||||
import { useCallback, useEffect, useMemo, useRef, useState } from 'react'
|
||||
import nspell, { type NSpell } from 'nspell'
|
||||
import { api } from '../api/client'
|
||||
|
||||
// useSpellChecker loads the vendored en-US Hunspell dictionary (served from
|
||||
// /dictionaries/en, embedded in the Go binary via web/dist) and builds an
|
||||
// in-browser nspell instance — zero backend round-trips, per spec. The
|
||||
// dictionary is ~550KB, so it's fetched as a static asset (kept out of the JS
|
||||
// bundle) once per app session, not per document. A personal word list lives in
|
||||
// localStorage and is replayed into nspell on load; adding a word bumps a
|
||||
// `version` so consumers re-run their decorations and the word stops flagging.
|
||||
// bundle) once per app session, not per document.
|
||||
//
|
||||
// The personal word list — the words she's told Petal to stop flagging — lives
|
||||
// on the server, keyed by her account and by the dictionary's language. It used
|
||||
// to be one localStorage key, which meant two people sharing a device shared a
|
||||
// word list built from one person's private writing, and one person on a laptop
|
||||
// and a tablet had two lists that never met. It is replayed into nspell on load;
|
||||
// adding a word bumps a `version` so consumers re-run their decorations and the
|
||||
// word stops flagging.
|
||||
|
||||
// SpellChecker is the minimal surface the editor decoration layer consumes.
|
||||
export interface SpellChecker {
|
||||
@@ -15,11 +22,21 @@ export interface SpellChecker {
|
||||
suggest(word: string): string[]
|
||||
}
|
||||
|
||||
const PERSONAL_KEY = 'petal.spell.personal'
|
||||
// The dictionary this hook loads. Only en-US ships today; pt-PT arrives with the
|
||||
// first Latin pair, and its personal words are a separate list by design — an
|
||||
// English exception must not silence a Portuguese flag.
|
||||
const DICT_LANG = 'en'
|
||||
|
||||
function loadPersonal(): string[] {
|
||||
// Where the list lived before it had an owner (Phase 7). Read once, handed to
|
||||
// the account, and then removed — see takeLegacyWords.
|
||||
const LEGACY_KEY = 'petal.spell.personal'
|
||||
|
||||
// takeLegacyWords reads the pre-account list without deleting it: the words are
|
||||
// only dropped from the browser once the server has actually accepted them, so
|
||||
// a failed request costs nothing.
|
||||
function readLegacyWords(): string[] {
|
||||
try {
|
||||
const raw = localStorage.getItem(PERSONAL_KEY)
|
||||
const raw = localStorage.getItem(LEGACY_KEY)
|
||||
const parsed = raw ? JSON.parse(raw) : []
|
||||
return Array.isArray(parsed) ? parsed.filter((w): w is string => typeof w === 'string') : []
|
||||
} catch {
|
||||
@@ -27,11 +44,11 @@ function loadPersonal(): string[] {
|
||||
}
|
||||
}
|
||||
|
||||
function savePersonal(words: string[]) {
|
||||
function clearLegacyWords() {
|
||||
try {
|
||||
localStorage.setItem(PERSONAL_KEY, JSON.stringify(words))
|
||||
localStorage.removeItem(LEGACY_KEY)
|
||||
} catch {
|
||||
/* storage unavailable — personal words just won't persist this session */
|
||||
/* storage unavailable — nothing was read from it either */
|
||||
}
|
||||
}
|
||||
|
||||
@@ -52,10 +69,25 @@ export function useSpellChecker() {
|
||||
])
|
||||
if (cancelled) return
|
||||
const sp = nspell(aff, dic)
|
||||
for (const w of loadPersonal()) sp.add(w)
|
||||
spellRef.current = sp
|
||||
setReady(true)
|
||||
|
||||
// Her own words come from her account. A browser holding a list from
|
||||
// before accounts existed hands it over on the way — but only lets go of
|
||||
// it once the server has taken it.
|
||||
const legacy = readLegacyWords()
|
||||
const stored = legacy.length
|
||||
? await api.addPersonalWords(DICT_LANG, legacy).then((res) => {
|
||||
clearLegacyWords()
|
||||
return res
|
||||
})
|
||||
: await api.listPersonalWords(DICT_LANG)
|
||||
if (cancelled) return
|
||||
for (const w of stored.words) sp.add(w)
|
||||
setVersion((v) => v + 1)
|
||||
} catch (err) {
|
||||
// A failure here costs correct words being flagged, not writing. The
|
||||
// checker itself stays usable if only the word list failed to arrive.
|
||||
console.error('spell checker failed to load', err)
|
||||
}
|
||||
})()
|
||||
@@ -75,13 +107,17 @@ export function useSpellChecker() {
|
||||
// eslint-disable-next-line react-hooks/exhaustive-deps
|
||||
}, [ready, version])
|
||||
|
||||
// Adding a word takes effect in the editor immediately and is persisted in the
|
||||
// background: the word stops being underlined the instant she asks, whatever
|
||||
// the network is doing.
|
||||
const addWord = useCallback((word: string) => {
|
||||
const sp = spellRef.current
|
||||
if (!sp) return
|
||||
sp.add(word)
|
||||
const next = Array.from(new Set([...loadPersonal(), word]))
|
||||
savePersonal(next)
|
||||
setVersion((v) => v + 1)
|
||||
api.addPersonalWords(DICT_LANG, [word]).catch((err) => {
|
||||
console.error('could not save personal word', err)
|
||||
})
|
||||
}, [])
|
||||
|
||||
return { checker, ready, addWord }
|
||||
|
||||
@@ -0,0 +1,118 @@
|
||||
import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest'
|
||||
|
||||
// These preferences are small — a mute toggle, a mascot — but they are the
|
||||
// difference between "my Petal" and "this browser's Petal". The properties that
|
||||
// matter: two accounts on one machine never see each other's choices, and the
|
||||
// person who was here before accounts existed doesn't lose hers.
|
||||
|
||||
function fakeStorage(): Storage {
|
||||
const map = new Map<string, string>()
|
||||
return {
|
||||
get length() {
|
||||
return map.size
|
||||
},
|
||||
key: (i: number) => [...map.keys()][i] ?? null,
|
||||
getItem: (k: string) => map.get(k) ?? null,
|
||||
setItem: (k: string, v: string) => void map.set(k, v),
|
||||
removeItem: (k: string) => void map.delete(k),
|
||||
clear: () => map.clear(),
|
||||
} as Storage
|
||||
}
|
||||
|
||||
// Each test gets a fresh module, since the scope is module-level state that the
|
||||
// real app sets exactly once.
|
||||
async function freshPrefs() {
|
||||
vi.resetModules()
|
||||
return import('./prefs')
|
||||
}
|
||||
|
||||
beforeEach(() => {
|
||||
vi.stubGlobal('localStorage', fakeStorage())
|
||||
})
|
||||
|
||||
afterEach(() => {
|
||||
vi.unstubAllGlobals()
|
||||
})
|
||||
|
||||
describe('per-account preferences', () => {
|
||||
it('reads and writes the legacy key until the account is known', async () => {
|
||||
const prefs = await freshPrefs()
|
||||
prefs.writePref('petal.sound', 'off')
|
||||
expect(localStorage.getItem('petal.sound')).toBe('off')
|
||||
expect(prefs.readPref('petal.sound')).toBe('off')
|
||||
})
|
||||
|
||||
it('adopts the pre-account choices for the first writer to sign in', async () => {
|
||||
const prefs = await freshPrefs()
|
||||
localStorage.setItem('petal.sound', 'off')
|
||||
localStorage.setItem('petal.companion', 'happy-dog')
|
||||
|
||||
prefs.setPrefsScope('claire')
|
||||
|
||||
expect(prefs.readPref('petal.sound')).toBe('off')
|
||||
expect(prefs.readPref('petal.companion')).toBe('happy-dog')
|
||||
// Moved, not copied — the next account must not inherit them.
|
||||
expect(localStorage.getItem('petal.sound')).toBeNull()
|
||||
expect(localStorage.getItem('petal.companion')).toBeNull()
|
||||
expect(localStorage.getItem('petal.sound.u.claire')).toBe('off')
|
||||
})
|
||||
|
||||
it('keeps two accounts on one browser apart', async () => {
|
||||
const prefs = await freshPrefs()
|
||||
prefs.setPrefsScope('claire')
|
||||
prefs.writePref('petal.companion', 'happy-dog')
|
||||
|
||||
prefs.resetPrefsScopeForTests()
|
||||
prefs.setPrefsScope('sam')
|
||||
// Sam starts from Petal's defaults, not from Claire's mascot.
|
||||
expect(prefs.readPref('petal.companion')).toBeNull()
|
||||
|
||||
prefs.writePref('petal.companion', 'sleeping-cat')
|
||||
prefs.resetPrefsScopeForTests()
|
||||
prefs.setPrefsScope('claire')
|
||||
expect(prefs.readPref('petal.companion')).toBe('happy-dog')
|
||||
})
|
||||
|
||||
it('never lets an existing choice be overwritten by the legacy one', async () => {
|
||||
const prefs = await freshPrefs()
|
||||
localStorage.setItem('petal.sound', 'off')
|
||||
localStorage.setItem('petal.sound.u.claire', 'on')
|
||||
|
||||
prefs.setPrefsScope('claire')
|
||||
|
||||
expect(prefs.readPref('petal.sound')).toBe('on')
|
||||
expect(localStorage.getItem('petal.sound')).toBeNull()
|
||||
})
|
||||
|
||||
it('notifies listeners once the account is known', async () => {
|
||||
const prefs = await freshPrefs()
|
||||
const seen: (string | null)[] = []
|
||||
prefs.onPrefsScopeChange(() => seen.push(prefs.readPref('petal.petals')))
|
||||
|
||||
localStorage.setItem('petal.petals', 'off')
|
||||
prefs.setPrefsScope('claire')
|
||||
// A second call for the same writer is not a change and must not re-fire.
|
||||
prefs.setPrefsScope('claire')
|
||||
|
||||
expect(seen).toEqual(['off'])
|
||||
})
|
||||
|
||||
it('survives storage being unavailable', async () => {
|
||||
const prefs = await freshPrefs()
|
||||
vi.stubGlobal('localStorage', {
|
||||
getItem: () => {
|
||||
throw new Error('denied')
|
||||
},
|
||||
setItem: () => {
|
||||
throw new Error('denied')
|
||||
},
|
||||
removeItem: () => {
|
||||
throw new Error('denied')
|
||||
},
|
||||
})
|
||||
|
||||
expect(() => prefs.setPrefsScope('claire')).not.toThrow()
|
||||
expect(() => prefs.writePref('petal.sound', 'off')).not.toThrow()
|
||||
expect(prefs.readPref('petal.sound')).toBeNull()
|
||||
})
|
||||
})
|
||||
@@ -0,0 +1,94 @@
|
||||
// Per-account browser preferences.
|
||||
//
|
||||
// Petal's small "how I like it" settings — the mute toggle, the falling-petals
|
||||
// toggle, the chosen companion — live in localStorage, which is a property of
|
||||
// the *browser*, not of the writer. Once two people can sign in to one Petal
|
||||
// that is a bleed: sharing a laptop would mean sharing a mascot, and one
|
||||
// person's silence would mute the other.
|
||||
//
|
||||
// So every key is namespaced by user id. The wrinkle is timing: these modules
|
||||
// read their value the moment they're imported, long before /api/me answers.
|
||||
// Rather than block startup on the network for a mute flag, a read before the
|
||||
// answer arrives sees the *legacy* un-namespaced key — which on a single-writer
|
||||
// browser is exactly the right value — and `setPrefsScope` then adopts it into
|
||||
// that writer's namespace and tells everyone to re-read.
|
||||
//
|
||||
// Adoption is a move, not a copy: the first account to sign in on a browser
|
||||
// inherits whatever was set before accounts existed, and the second starts from
|
||||
// Petal's defaults rather than from a stranger's choices.
|
||||
|
||||
type Listener = () => void
|
||||
|
||||
let userID: string | null = null
|
||||
const listeners = new Set<Listener>()
|
||||
|
||||
// Every base key that should follow the account rather than the browser. Listed
|
||||
// here (not just at each call site) because adoption has to walk them all the
|
||||
// moment the scope becomes known.
|
||||
const SCOPED_KEYS = ['petal.sound', 'petal.petals', 'petal.companion'] as const
|
||||
|
||||
// scopedKey is the storage key actually used for `base` right now. Before the
|
||||
// caller is known it is the legacy key, so a reload keeps working offline and
|
||||
// pre-login reads see the browser's existing preference.
|
||||
export function scopedKey(base: string): string {
|
||||
return userID ? `${base}.u.${userID}` : base
|
||||
}
|
||||
|
||||
export function readPref(base: string): string | null {
|
||||
try {
|
||||
return localStorage.getItem(scopedKey(base))
|
||||
} catch {
|
||||
return null
|
||||
}
|
||||
}
|
||||
|
||||
export function writePref(base: string, value: string): void {
|
||||
try {
|
||||
localStorage.setItem(scopedKey(base), value)
|
||||
} catch {
|
||||
/* private mode or a full quota — the choice just won't survive a reload */
|
||||
}
|
||||
}
|
||||
|
||||
// onPrefsScopeChange fires once the account is known and the keys have moved,
|
||||
// so a module that already read a value can read it again. Returns an
|
||||
// unsubscribe.
|
||||
export function onPrefsScopeChange(fn: Listener): () => void {
|
||||
listeners.add(fn)
|
||||
return () => listeners.delete(fn)
|
||||
}
|
||||
|
||||
// setPrefsScope names the writer these preferences belong to. Called once, from
|
||||
// App, as soon as /api/me answers.
|
||||
export function setPrefsScope(id: string): void {
|
||||
if (!id || id === userID) return
|
||||
userID = id
|
||||
adoptLegacy()
|
||||
listeners.forEach((fn) => fn())
|
||||
}
|
||||
|
||||
// adoptLegacy hands the pre-account values to the first account that signs in
|
||||
// on this browser, then removes them so nobody else can inherit them.
|
||||
function adoptLegacy(): void {
|
||||
try {
|
||||
for (const base of SCOPED_KEYS) {
|
||||
const legacy = localStorage.getItem(base)
|
||||
if (legacy === null) continue
|
||||
// Never overwrite a choice this account has already made here.
|
||||
if (localStorage.getItem(scopedKey(base)) === null) {
|
||||
localStorage.setItem(scopedKey(base), legacy)
|
||||
}
|
||||
localStorage.removeItem(base)
|
||||
}
|
||||
} catch {
|
||||
/* storage unavailable — nothing to adopt, and nothing breaks */
|
||||
}
|
||||
}
|
||||
|
||||
// resetPrefsScopeForTests unbinds the account again. Exported for tests only;
|
||||
// the app sets the scope once and never clears it (signing out leaves the
|
||||
// editor mounted, and the same person usually signs back in).
|
||||
export function resetPrefsScopeForTests(): void {
|
||||
userID = null
|
||||
listeners.clear()
|
||||
}
|
||||
Reference in New Issue
Block a user