271a2e1741
* feat(invitations): add emailed pre-provisioned invitations
Admins can invite a specific person by email: the invitation pre-binds
role, access group, and library access, and the invitee only chooses a
password. Their email address becomes their username, so login gains an
email fallback (username lookup first, email column only on miss for
inputs that parse as a bare address).
- invitations table: single-use token (SHA-256 at rest) bound to one
address; a partial unique index makes resend-supersedes atomic; no
users row exists until accept, so a typo'd address can't squat a
username. Status is derived from timestamps, not stored.
- internal/invitations: repository, service, and branded email through
the shared internal/mail sender. When SMTP is off the claim URL is
returned for manual delivery instead of failing.
- Admin endpoints /admin/invitations (list/create/resend/revoke) beside
the existing invite-codes routes; public claim endpoints
/invitations/{token} (+/accept) rate-limited with the other auth
endpoints. Unknown/expired/revoked/used tokens are indistinguishable.
- Accept returns the same login response shape as signup, so clients
reuse their session plumbing.
Spec: docs/superpowers/specs/2026-07-27-invitations-and-onboarding-design.md
Plan: docs/superpowers/plans/2026-07-27-invitations-and-onboarding.md
Part of #215
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat(web): add invitation admin tab, claim page, and household setup
- Admin → Users gains an Invitations tab: compose (email, role, access
group, libraries, note, first-profile and tour toggles), list with
derived status, resend, revoke. When the server has no SMTP the create
response's claim URL is surfaced for copy-paste instead of a fake
success.
- /invite/:token claim page: everything but the password was decided at
send time, so it asks for exactly one thing and lands the user signed
in. Expired/used links get an explanatory card, not a 404.
- /household-setup ("Who's watching?"): profile tiles plus the existing
ProfileEditorDialog, all through the existing /profiles endpoint —
no new backend. "Just me for now" is a first-class exit.
Part of #215
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat(onboarding): add server-driven onboarding manifest and state
GET /onboarding/flow returns the ordered first-run tour for this server
and profile: steps for disabled features (requests, watch together,
recommendations, notifications) are filtered out server-side, surface=tv
drops steps needing text entry, and child profiles never see stops they
can't act on. Copy lives in Go, so a wording fix is a deploy — clients
render step kinds they know and skip unknown ones by contract.
setting_choice steps name an explicit write target (profile_field /
setting / device_setting) because playback quality is a profile column,
not a settings key — the tour writes through the same APIs the settings
screens use.
Per-profile completion state lives in the user store (SQLite schema v14
+ a Postgres twin table), keyed by (profile_id, tour_id) with monotonic
completed/skipped timestamps: finishing on one device silences every
other; a later progress write can never un-complete.
Part of #215
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat(web): add the first-run feature tour
TourHost renders the server manifest as a modal overlay on Home: unknown
step kinds are skipped silently (the forward-compat contract), progress
posts per step, and setting_choice steps write real values through the
existing profile/settings mutations — by the last step the account is
genuinely configured. Skip is always one click and recorded server-side,
so no other device re-prompts. The tour ends by handing off to the
existing taste-seed picker, which now waits for the tour to finish
before its own redirect. Settings → Personalize gains a replay entry.
An invitation sent with show_tour=false plants a local hint that the
gate converts into a server-side skip for the first profile.
Part of #215
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(web): satisfy noUncheckedIndexedAccess in the tour's advance step
The Docker web build runs `tsc -b`, which applies the project's
noUncheckedIndexedAccess; the bounds check didn't narrow steps[next].
Look the step up once and branch on its presence instead.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(web): blur the whole app behind the tour, sidebar included
The tour overlay rendered inside the app layout, where an ancestor
creates a fixed-position containing block — inset-0 pinned to the
content pane, leaving the sidebar completely un-scrimmed. Portal the
dialog to <body> so the scrim truly covers the viewport, and raise the
backdrop blur from sm (4px) to xl (24px) so card titles and nav labels
aren't legible through it.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(onboarding): name features by their UI labels in the tour copy
"Same movie, different couches" never said what the feature is called.
Every feature card now leads with the name the sidebar actually uses —
Watch Party, Requests, Watchlist, Calendar, Notifications — and says
where to find it, so the tour teaches vocabulary, not just concepts.
Server-side copy, so all three clients pick this up with no release.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat(onboarding): add apps and Jellyfin-compat steps to the tour
Two new web-only feature cards near the end of the tour:
- "Take Silo with you" — native apps for iPhone/iPad/Apple TV and
Android/Android TV, with outbound TestFlight and Play Store links.
Steps gain an additive links field (label + url) that older clients
ignore; the web TourHost renders them as external-link buttons.
- "Already use a Jellyfin app? It works here" — Infuse/VidHub/Findroid/
Swiftfin connect via the Jellyfin API. Gated on
jellyfin_compat.enabled (default-on, so unset counts as enabled;
only an explicit "false" hides it).
Both steps are web-only: the apps card is pointless inside the apps it
advertises, and TV can't open store links. surface=phone/tv manifests
skip them, covered by tests.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(web): keep the tour card responsive on phone widths
Verified every step at 1600px, 390px, and 320px with an automated
overflow check. Fixes it found:
- Link buttons (apps step) now wrap and truncate instead of extending
past the card edge.
- The footer wraps at very narrow widths, so the handoff step's wide
primary button drops to its own line rather than overflowing.
- Progress pips hide on phones — decorative, and they crowded the
Back/Next buttons.
- The card scrolls within 85dvh so a tall step never pins its buttons
off-screen on landscape phones.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat(web): render store links as branded badges in the tour
The apps step's plain outline buttons now render as store badges: the
Apple or Google Play mark with a store eyebrow (TestFlight beta /
Google Play) over the platform label — the familiar app-store badge
idiom. The brand is inferred from the link's host on the client, so
the server contract stays icon-free and non-store links keep the plain
external-link button. Labels drop the parenthesized store name the
eyebrow now carries.
Verified at 1600px and 390px with the overflow sweep: none.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
145 lines
10 KiB
Go
145 lines
10 KiB
Go
package userstore
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"time"
|
|
)
|
|
|
|
var ErrCollectionGroupNotFound = errors.New("collection group not found")
|
|
|
|
// UserStore defines the interface for per-user data storage.
|
|
// Both SQLite and Postgres backends implement this interface.
|
|
type UserStore interface {
|
|
// Profiles
|
|
CreateProfile(ctx context.Context, p Profile) error
|
|
GetProfile(ctx context.Context, id string) (*Profile, error)
|
|
ListProfiles(ctx context.Context) ([]Profile, error)
|
|
UpdateProfile(ctx context.Context, id string, u UpdateProfileInput) error
|
|
DeleteProfile(ctx context.Context, id string) error
|
|
VerifyPIN(ctx context.Context, profileID, pin string) (bool, error)
|
|
|
|
// Progress
|
|
UpdateProgress(ctx context.Context, profileID, mediaItemID string, position, duration float64, thresholds ProgressThresholds) error
|
|
SetProgress(ctx context.Context, profileID, mediaItemID string, position, duration float64, thresholds ProgressThresholds) error
|
|
SetProgressAt(ctx context.Context, profileID, mediaItemID string, position, duration float64, completed bool, updatedAt time.Time) error
|
|
SetProgressIfNewer(ctx context.Context, profileID, mediaItemID string, position, duration float64, completed bool, updatedAt time.Time) (bool, error)
|
|
UpdateProgressHints(ctx context.Context, profileID, mediaItemID string, hints VersionHints) error
|
|
MarkWatched(ctx context.Context, profileID, mediaItemID string, duration float64) error
|
|
MarkProgressBatch(ctx context.Context, profileID string, mediaItemIDs []string, updatedAt time.Time) error
|
|
ClearProgressBatch(ctx context.Context, profileID string, mediaItemIDs []string, updatedAt time.Time) error
|
|
ClearProgress(ctx context.Context, profileID, mediaItemID string) error
|
|
GetProgress(ctx context.Context, profileID, mediaItemID string) (*WatchProgress, error)
|
|
ListProgress(ctx context.Context, profileID, status string, limit, offset int) ([]WatchProgress, error)
|
|
// ListProgressFiltered is ListProgress with an additional SQL pre-filter on
|
|
// the backing catalog item's type and/or library, so the watched-items path
|
|
// no longer scans the whole status set before discarding non-matching rows.
|
|
// types is matched case-insensitively against media_items.type ("episode"
|
|
// resolves through the separate episodes table); a nil libraryID drops the
|
|
// library predicate, and an empty types + nil libraryID degrades to the
|
|
// plain status listing. It is a coarse pre-filter: callers still apply
|
|
// access/parental exclusions over the returned rows.
|
|
ListProgressFiltered(ctx context.Context, profileID, status string, types []string, libraryID *int, limit, offset int) ([]WatchProgress, error)
|
|
ListProgressByMediaItems(ctx context.Context, profileID string, mediaItemIDs []string) (map[string]WatchProgress, error)
|
|
// ListProgressSince returns rows whose server cursor exceeds the opaque
|
|
// cursor token (empty = full delta), in cursor order, with the next cursor.
|
|
// Cross-device delta delivery depends only on the server-assigned synced_seq.
|
|
ListProgressSince(ctx context.Context, profileID, cursor string) ([]WatchProgress, string, error)
|
|
AddHistory(ctx context.Context, entry WatchHistoryEntry) error
|
|
AddHistoryIfMissing(ctx context.Context, entry WatchHistoryEntry) (bool, error)
|
|
ListHistory(ctx context.Context, profileID string, limit, offset int) ([]WatchHistoryEntry, error)
|
|
ListCompletedHistory(ctx context.Context, query CompletedHistoryQuery) ([]WatchHistoryEntry, error)
|
|
ListCompletedHistoryItems(ctx context.Context, query CompletedHistoryItemQuery) ([]CompletedHistoryItem, error)
|
|
RemoveHistoryItems(ctx context.Context, profileID string, mediaItemIDs []string, removedAt time.Time) error
|
|
DeleteHistoryBySource(ctx context.Context, profileID string, mediaItemIDs []string, source WatchHistorySource) error
|
|
ListHomeDismissals(ctx context.Context, profileID, surface string) ([]HomeItemDismissal, error)
|
|
UpsertHomeDismissal(ctx context.Context, dismissal HomeItemDismissal) error
|
|
DeleteHomeDismissal(ctx context.Context, profileID, surface, mediaItemID string) error
|
|
|
|
// Favorites & Watchlist
|
|
AddFavorite(ctx context.Context, profileID, mediaItemID string) error
|
|
AddFavoriteAt(ctx context.Context, profileID, mediaItemID string, addedAt time.Time) (bool, error)
|
|
RemoveFavorite(ctx context.Context, profileID, mediaItemID string) error
|
|
ListFavorites(ctx context.Context, profileID string, limit, offset int) ([]Favorite, error)
|
|
ListFavoritesByMediaItems(ctx context.Context, profileID string, mediaItemIDs []string) (map[string]bool, error)
|
|
IsFavorite(ctx context.Context, profileID, mediaItemID string) (bool, error)
|
|
AddToWatchlist(ctx context.Context, profileID, mediaItemID string) error
|
|
AddToWatchlistAt(ctx context.Context, profileID, mediaItemID string, addedAt time.Time) (bool, error)
|
|
RemoveFromWatchlist(ctx context.Context, profileID, mediaItemID string) error
|
|
// ReplaceWatchlistOrder mirrors a provider's watchlist order: the given ids
|
|
// get sort_index 0..N-1 in order; all other rows reset to added_at ordering.
|
|
ReplaceWatchlistOrder(ctx context.Context, profileID string, orderedMediaItemIDs []string) error
|
|
ListWatchlist(ctx context.Context, profileID string, limit, offset int) ([]WatchlistEntry, error)
|
|
ListWatchlistByMediaItems(ctx context.Context, profileID string, mediaItemIDs []string) (map[string]bool, error)
|
|
InWatchlist(ctx context.Context, profileID, mediaItemID string) (bool, error)
|
|
// RemoveWatchedFromWatchlist reports the profile's preference for pruning
|
|
// fully-watched entries from the watchlist (defaults true): movies are
|
|
// removed outright on completion, while fully-watched series are only
|
|
// hidden from display so they reappear when new episodes are added.
|
|
RemoveWatchedFromWatchlist(ctx context.Context, profileID string) (bool, error)
|
|
|
|
// Collections
|
|
CreateCollection(ctx context.Context, input CreateCollectionInput) (*Collection, error)
|
|
GetCollection(ctx context.Context, id string) (*Collection, error)
|
|
ListCollections(ctx context.Context, profileID string) ([]Collection, error)
|
|
UpdateCollection(ctx context.Context, input UpdateCollectionInput) error
|
|
DeleteCollection(ctx context.Context, id string) error
|
|
AddCollectionItem(ctx context.Context, collectionID, mediaItemID string, position int) error
|
|
RemoveCollectionItem(ctx context.Context, collectionID, mediaItemID string) error
|
|
ListCollectionItems(ctx context.Context, collectionID string) ([]CollectionItem, error)
|
|
ReplaceCollectionItems(ctx context.Context, collectionID string, items []CollectionItemReplacement) error
|
|
ReorderCollectionItems(ctx context.Context, collectionID string, orderedMediaItemIDs []string) error
|
|
// ReorderCollections scopes to the supplied group_id. A nil groupID means
|
|
// the implicit Ungrouped bucket.
|
|
ReorderCollections(ctx context.Context, profileID string, groupID *string, orderedIDs []string) error
|
|
UpdateCollectionSyncState(ctx context.Context, input UpdateCollectionSyncStateInput) error
|
|
ListCollectionGroups(ctx context.Context) ([]CollectionGroup, error)
|
|
EnsureCollectionGroup(ctx context.Context, id string) error
|
|
CreateCollectionGroup(ctx context.Context, name, slug string, defaultSortMode GroupSortMode) (*CollectionGroup, error)
|
|
UpdateCollectionGroup(ctx context.Context, id string, name *string, slug *string, defaultSortMode *GroupSortMode) (*CollectionGroup, error)
|
|
DeleteCollectionGroup(ctx context.Context, id string) error
|
|
ReorderCollectionGroups(ctx context.Context, orderedIDs []string) error
|
|
|
|
// Section Overrides
|
|
ListSectionOverrides(ctx context.Context, profileID, scope, libraryID string) ([]SectionOverride, error)
|
|
SaveSectionOverrides(ctx context.Context, profileID, scope, libraryID string, overrides []SectionOverride) error
|
|
ResetSectionOverrides(ctx context.Context, profileID, scope, libraryID string) error
|
|
|
|
// Settings & Preferences
|
|
GetSetting(ctx context.Context, key string) (string, error)
|
|
SetSetting(ctx context.Context, key, value string) error
|
|
DeleteSetting(ctx context.Context, key string) error
|
|
ListSettings(ctx context.Context) ([]SettingEntry, error)
|
|
GetDeviceSetting(ctx context.Context, profileID, deviceID, key string) (*DeviceSettingEntry, error)
|
|
SetDeviceSetting(ctx context.Context, entry DeviceSettingEntry) error
|
|
DeleteDeviceSetting(ctx context.Context, profileID, deviceID, key string) error
|
|
DeleteAllDeviceSettings(ctx context.Context, profileID, deviceID string) error
|
|
DeleteDeviceSettingsByKey(ctx context.Context, key string) error
|
|
ListDeviceSettings(ctx context.Context, key string) ([]DeviceSettingEntry, error)
|
|
ListAllDeviceSettings(ctx context.Context) ([]DeviceSettingEntry, error)
|
|
SetSubtitlePreference(ctx context.Context, pref SubtitlePreference) error
|
|
GetSubtitlePreference(ctx context.Context, profileID, seriesID string) (*SubtitlePreference, error)
|
|
DeleteSubtitlePreference(ctx context.Context, profileID, seriesID string) error
|
|
SetAudioPreference(ctx context.Context, pref AudioPreference) error
|
|
GetAudioPreference(ctx context.Context, profileID, seriesID string) (*AudioPreference, error)
|
|
DeleteAudioPreference(ctx context.Context, profileID, seriesID string) error
|
|
SetSeriesPlaybackPreference(ctx context.Context, pref SeriesPlaybackPreference) error
|
|
GetSeriesPlaybackPreference(ctx context.Context, profileID, seriesID string) (*SeriesPlaybackPreference, error)
|
|
DeleteSeriesPlaybackPreference(ctx context.Context, profileID, seriesID string) error
|
|
GetLibraryPlaybackPreference(ctx context.Context, profileID string, libraryID int) (*LibraryPlaybackPreference, error)
|
|
ListLibraryPlaybackPreferences(ctx context.Context, profileID string) ([]LibraryPlaybackPreference, error)
|
|
UpsertLibraryPlaybackPreference(ctx context.Context, pref LibraryPlaybackPreference) error
|
|
DeleteLibraryPlaybackPreference(ctx context.Context, profileID string, libraryID int) error
|
|
|
|
// Onboarding
|
|
GetOnboardingState(ctx context.Context, profileID, tourID string) (*OnboardingState, error)
|
|
UpsertOnboardingState(ctx context.Context, state OnboardingState) error
|
|
}
|
|
|
|
// DeviceRegistry is implemented by stores that track observed devices even
|
|
// when they do not currently have any device-scoped overrides.
|
|
type DeviceRegistry interface {
|
|
RegisterDevice(ctx context.Context, entry DeviceEntry) error
|
|
ListDevices(ctx context.Context) ([]DeviceEntry, error)
|
|
}
|