feat: add per-user avatar seed regeneration with irreversible random avatar replacement

Implement a new `avatar_seed` column on the users table that overrides the username-based seed for Multiavatar generation. Introduce a null-safe `avatar_seed(user)` choke point in `avatar.py` that resolves `user.get("avatar_seed") or user.get("username")`, registered as a Jinja global so every render site (`_avatar_link.html`, `avatar_url(...)` calls, SEO `og_image`, issues ad-hoc dicts, devRant payload/PNG) propagates a regenerated seed. Add `POST /profile/{username}/regenerate-avatar` endpoint (owner-or-admin only) that writes a fresh `generate_uid()` to `avatar_seed`, invalidates the target's user cache, and audits `profile.avatar.regenerate`. The previous seed is overwritten and never stored, making regeneration irreversible. Document the feature in `AGENTS.md` and `README.md`, add the API endpoint to `docs_api.py`, and include the `regenerate_avatar` Devii tool in `CONFIRM_REQUIRED`.

tests/api/game/mutations.py

@@ -103,6 +103,48 @@ def test_steal_empty_plot_returns_400(app_server, seeded_db):
     assert r.status_code == 400
 
 
+def _set_stars(username, stars):
+    refresh_snapshot()
+    user = get_table("users").find_one(username=username)
+    farm = store.get_farm(user["uid"])
+    get_table("game_farms").update({"uid": farm["uid"], "stars": stars}, ["uid"])
+    refresh_snapshot()
+
+
+def test_legacy_requires_auth(app_server, seeded_db):
+    r = requests.post(f"{BASE_URL}/game/legacy", data={"key": "multiplier"}, headers=JSON)
+    assert r.status_code in (401, 303)
+
+
+def test_legacy_upgrade_spends_stars(app_server, seeded_db):
+    session, name = _signup()
+    _reset_farm(name)
+    _set_stars(name, 1000)
+    r = session.post(f"{BASE_URL}/game/legacy", data={"key": "multiplier"}, headers=JSON)
+    assert r.status_code == 200, r.text[:200]
+    refresh_snapshot()
+    user = get_table("users").find_one(username=name)
+    farm = store.get_farm(user["uid"])
+    assert int(farm.get("legacy_multiplier") or 0) == 1
+    assert int(farm.get("stars") or 0) < 1000
+
+
+def test_legacy_insufficient_stars_returns_400(app_server, seeded_db):
+    session, name = _signup()
+    _reset_farm(name)
+    _set_stars(name, 0)
+    r = session.post(f"{BASE_URL}/game/legacy", data={"key": "multiplier"}, headers=JSON)
+    assert r.status_code == 400
+
+
+def test_legacy_unknown_key_returns_400(app_server, seeded_db):
+    session, name = _signup()
+    _reset_farm(name)
+    _set_stars(name, 1000)
+    r = session.post(f"{BASE_URL}/game/legacy", data={"key": "telekinesis"}, headers=JSON)
+    assert r.status_code == 400
+
+
 def test_steal_ready_unprotected_crop_transfers_coins(app_server, seeded_db):
     owner_session, owner = _signup()
     _reset_farm(owner, coins=100000)
@@ -132,3 +174,41 @@ def test_steal_ready_unprotected_crop_transfers_coins(app_server, seeded_db):
     thief_farm = store.get_farm(thief_user["uid"])
     assert int(thief_farm.get("coins", 0)) > 0
     assert (get_table("game_plots").find_one(uid=plot["uid"]).get("crop_key") or "") == ""
+
+
+def _ripen_owner_plot(owner, slot=0):
+    refresh_snapshot()
+    owner_user = get_table("users").find_one(username=owner)
+    farm = store.get_farm(owner_user["uid"])
+    plot = get_table("game_plots").find_one(farm_uid=farm["uid"], slot_index=slot)
+    past = (datetime.now(timezone.utc) - timedelta(days=1)).isoformat()
+    get_table("game_plots").update(
+        {"uid": plot["uid"], "planted_at": past, "ready_at": past}, ["uid"]
+    )
+    refresh_snapshot()
+    return plot
+
+
+def test_steal_cooldown_blocks_second_raid(app_server, seeded_db):
+    owner_session, owner = _signup()
+    _reset_farm(owner, coins=100000)
+    thief_session, thief = _signup()
+    _reset_farm(thief, coins=0)
+
+    owner_session.post(
+        f"{BASE_URL}/game/plant", data={"slot": 0, "crop": "shell"}, headers=JSON
+    )
+    _ripen_owner_plot(owner)
+    first = thief_session.post(
+        f"{BASE_URL}/game/farm/{owner}/steal", data={"slot": 0}, headers=JSON
+    )
+    assert first.status_code == 200, first.text[:200]
+
+    owner_session.post(
+        f"{BASE_URL}/game/plant", data={"slot": 0, "crop": "shell"}, headers=JSON
+    )
+    _ripen_owner_plot(owner)
+    second = thief_session.post(
+        f"{BASE_URL}/game/farm/{owner}/steal", data={"slot": 0}, headers=JSON
+    )
+    assert second.status_code == 400

tests/api/posts/index.py

@@ -28,3 +28,49 @@ def test_json_404_error_envelope(app_server):
     r = requests.get(f"{BASE_URL}/posts/does-not-exist-xyz", headers=JSON_content_negotiation)
     assert r.status_code == 404
     assert r.json()["error"]["status"] == 404
+
+
+def test_viewing_post_marks_notification_read(app_server):
+    from datetime import datetime, timezone
+    from devplacepy.database import (
+        get_table,
+        refresh_snapshot,
+        resolve_object_url,
+    )
+    from devplacepy.utils import generate_uid
+
+    session, name = _session_content_negotiation()
+    created = session.post(
+        f"{BASE_URL}/posts/create",
+        headers=JSON_content_negotiation,
+        data={
+            "title": f"mark read {int(time.time() * 1000)}",
+            "content": "post body for notification mark read",
+            "topic": "devlog",
+        },
+    ).json()["data"]
+    post_uid = created["uid"]
+    refresh_snapshot()
+    user = get_table("users").find_one(username=name)
+    target_url = resolve_object_url("post", post_uid)
+
+    notif_uid = generate_uid()
+    get_table("notifications").insert(
+        {
+            "uid": notif_uid,
+            "user_uid": user["uid"],
+            "type": "comment",
+            "message": "someone commented",
+            "related_uid": post_uid,
+            "target_url": f"{target_url}#comment-x",
+            "read": False,
+            "created_at": datetime.now(timezone.utc).isoformat(),
+        }
+    )
+    refresh_snapshot()
+
+    r = session.get(f"{BASE_URL}{target_url}", allow_redirects=True)
+    assert r.status_code == 200
+
+    refresh_snapshot()
+    assert bool(get_table("notifications").find_one(uid=notif_uid)["read"]) is True

tests/api/profile/index.py

@@ -168,3 +168,45 @@ def _seed_feed_posts(count):
 def test_missing_profile_returns_404(app_server):
     r = requests.get(f"{BASE_URL}/profile/no-such-user-xyz", allow_redirects=False)
     assert r.status_code == 404
+
+
+def test_viewing_profile_marks_notification_read(app_server):
+    import time
+    from datetime import datetime, timezone
+    from devplacepy.database import get_table, refresh_snapshot
+    from devplacepy.utils import generate_uid
+
+    name = f"nmark{int(time.time() * 1000)}"
+    session = requests.Session()
+    session.post(
+        f"{BASE_URL}/auth/signup",
+        data={
+            "username": name,
+            "email": f"{name}@t.dev",
+            "password": "secret123",
+            "confirm_password": "secret123",
+        },
+        allow_redirects=True,
+    )
+    refresh_snapshot()
+    user = get_table("users").find_one(username=name)
+    notif_uid = generate_uid()
+    get_table("notifications").insert(
+        {
+            "uid": notif_uid,
+            "user_uid": user["uid"],
+            "type": "follow",
+            "message": "someone followed you",
+            "related_uid": generate_uid(),
+            "target_url": f"/profile/{name}",
+            "read": False,
+            "created_at": datetime.now(timezone.utc).isoformat(),
+        }
+    )
+    refresh_snapshot()
+
+    r = session.get(f"{BASE_URL}/profile/{name}", allow_redirects=True)
+    assert r.status_code == 200
+
+    refresh_snapshot()
+    assert bool(get_table("notifications").find_one(uid=notif_uid)["read"]) is True

tests/api/profile/regenerateavatar.py

@@ -0,0 +1,125 @@
+# retoor <retoor@molodetz.nl>
+
+import time
+import pytest
+import requests
+from tests.conftest import BASE_URL
+from devplacepy.database import get_table, refresh_snapshot, set_setting
+
+JSON = {"Accept": "application/json"}
+_counter_rav = [0]
+
+
+@pytest.fixture(scope="module", autouse=True)
+def _settings(app_server):
+    set_setting("rate_limit_per_minute", "1000000")
+    set_setting("registration_open", "1")
+    yield
+
+
+def _member():
+    _counter_rav[0] += 1
+    name = f"rav{int(time.time() * 1000)}{_counter_rav[0]}"
+    requests.post(
+        f"{BASE_URL}/auth/signup",
+        data={
+            "username": name,
+            "email": f"{name}@t.dev",
+            "password": "secret123",
+            "confirm_password": "secret123",
+        },
+        allow_redirects=True,
+    )
+    refresh_snapshot()
+    user = get_table("users").find_one(username=name)
+    return name, user["uid"], user["api_key"]
+
+
+def _admin_key(seeded_db):
+    refresh_snapshot()
+    return get_table("users").find_one(username="alice_test")["api_key"]
+
+
+def test_owner_regenerates_avatar(app_server):
+    name, uid, key = _member()
+    r = requests.post(
+        f"{BASE_URL}/profile/{name}/regenerate-avatar",
+        headers={"X-API-KEY": key, **JSON},
+    )
+    assert r.status_code == 200, r.text[:200]
+    body = r.json()["data"]
+    seed = body["avatar_seed"]
+    assert seed
+    assert body["url"] == f"/profile/{name}"
+    assert body["avatar_url"] == f"/avatar/multiavatar/{seed}?size=80"
+    refresh_snapshot()
+    assert get_table("users").find_one(uid=uid)["avatar_seed"] == seed
+
+
+def test_regenerate_changes_seed(app_server):
+    name, uid, key = _member()
+    first = requests.post(
+        f"{BASE_URL}/profile/{name}/regenerate-avatar",
+        headers={"X-API-KEY": key, **JSON},
+    ).json()["data"]["avatar_seed"]
+    second = requests.post(
+        f"{BASE_URL}/profile/{name}/regenerate-avatar",
+        headers={"X-API-KEY": key, **JSON},
+    ).json()["data"]["avatar_seed"]
+    assert first != second
+
+
+def test_admin_regenerates_for_other_user(seeded_db):
+    name, uid, key = _member()
+    r = requests.post(
+        f"{BASE_URL}/profile/{name}/regenerate-avatar",
+        headers={"X-API-KEY": _admin_key(seeded_db), **JSON},
+    )
+    assert r.status_code == 200, r.text[:200]
+    refresh_snapshot()
+    assert get_table("users").find_one(uid=uid)["avatar_seed"]
+
+
+def test_non_owner_forbidden(app_server):
+    name, uid, key = _member()
+    _, _, other_key = _member()
+    r = requests.post(
+        f"{BASE_URL}/profile/{name}/regenerate-avatar",
+        headers={"X-API-KEY": other_key, **JSON},
+    )
+    assert r.status_code == 403
+
+
+def test_unknown_user_404(app_server):
+    name, uid, key = _member()
+    r = requests.post(
+        f"{BASE_URL}/profile/nobody_xyz_zzz/regenerate-avatar",
+        headers={"X-API-KEY": key, **JSON},
+    )
+    assert r.status_code == 404
+
+
+def test_guest_rejected(app_server):
+    name, uid, key = _member()
+    r = requests.post(
+        f"{BASE_URL}/profile/{name}/regenerate-avatar",
+        headers=JSON,
+        allow_redirects=False,
+    )
+    assert r.status_code in (401, 303)
+
+
+def test_audit_event_recorded(seeded_db):
+    name, uid, key = _member()
+    requests.post(
+        f"{BASE_URL}/profile/{name}/regenerate-avatar",
+        headers={"X-API-KEY": key, **JSON},
+    )
+    admin = requests.Session()
+    admin.headers.update({"X-API-KEY": _admin_key(seeded_db)})
+    data = admin.get(
+        f"{BASE_URL}/admin/audit-log",
+        headers=JSON,
+        params={"event_key": "profile.avatar.regenerate"},
+    ).json()
+    assert any(e.get("target_uid") == uid for e in data["entries"])

tests/api/projects/index.py

@@ -444,3 +444,33 @@ def test_public_detail_is_indexable(app_server):
     r = requests.get(f"{BASE_URL}/projects/{slug}", headers={"X-API-KEY": key})
     assert r.status_code == 200, r.text[:300]
     assert '<meta name="robots" content="index,follow">' in r.text
+
+
+def test_viewing_project_marks_notification_read(app_server):
+    from devplacepy.database import resolve_object_url
+
+    name, uid, key = _signup_project_visibility()
+    project = _create_project_project_visibility(key, "Notif Mark Read")
+    refresh_snapshot()
+    target_url = resolve_object_url("project", project["uid"])
+
+    notif_uid = generate_uid()
+    get_table("notifications").insert(
+        {
+            "uid": notif_uid,
+            "user_uid": uid,
+            "type": "comment",
+            "message": "someone commented on your project",
+            "related_uid": project["uid"],
+            "target_url": target_url,
+            "read": False,
+            "created_at": datetime.now(timezone.utc).isoformat(),
+        }
+    )
+    refresh_snapshot()
+
+    r = requests.get(f"{BASE_URL}{target_url}", headers={"X-API-KEY": key})
+    assert r.status_code == 200, r.text[:200]
+
+    refresh_snapshot()
+    assert bool(get_table("notifications").find_one(uid=notif_uid)["read"]) is True