feat: add per-user avatar seed regeneration with irreversible random avatar replacement
Implement a new `avatar_seed` column on the users table that overrides the username-based seed for Multiavatar generation. Introduce a null-safe `avatar_seed(user)` choke point in `avatar.py` that resolves `user.get("avatar_seed") or user.get("username")`, registered as a Jinja global so every render site (`_avatar_link.html`, `avatar_url(...)` calls, SEO `og_image`, issues ad-hoc dicts, devRant payload/PNG) propagates a regenerated seed. Add `POST /profile/{username}/regenerate-avatar` endpoint (owner-or-admin only) that writes a fresh `generate_uid()` to `avatar_seed`, invalidates the target's user cache, and audits `profile.avatar.regenerate`. The previous seed is overwritten and never stored, making regeneration irreversible. Document the feature in `AGENTS.md` and `README.md`, add the API endpoint to `docs_api.py`, and include the `regenerate_avatar` Devii tool in `CONFIRM_REQUIRED`.
2026-06-28 00:31:34 +02:00
|
|
|
# retoor <retoor@molodetz.nl>
|
|
|
|
|
|
|
|
|
|
from playwright.sync_api import expect
|
|
|
|
|
from tests.conftest import BASE_URL
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def test_regenerate_avatar_updates_preview(alice):
|
|
|
|
|
page, user = alice
|
|
|
|
|
page.goto(
|
|
|
|
|
f"{BASE_URL}/profile/{user['username']}", wait_until="domcontentloaded"
|
|
|
|
|
)
|
|
|
|
|
preview = page.locator("#profile-avatar-preview")
|
|
|
|
|
expect(preview).to_be_visible()
|
|
|
|
|
before = preview.get_attribute("src")
|
|
|
|
|
|
|
|
|
|
page.locator("[data-regenerate-avatar]").click()
|
|
|
|
|
page.locator(".dialog-overlay.visible .dialog-confirm").click()
|
|
|
|
|
|
|
|
|
|
expect(preview).not_to_have_attribute("src", before)
|
|
|
|
|
after = preview.get_attribute("src")
|
|
|
|
|
assert after.startswith("/avatar/multiavatar/")
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def test_regenerate_button_hidden_for_other_user(alice, bob):
|
2026-07-04 22:24:59 +02:00
|
|
|
alice_page, alice_user = alice
|
|
|
|
|
bob_page, _ = bob
|
|
|
|
|
bob_page.goto(
|
|
|
|
|
f"{BASE_URL}/profile/{alice_user['username']}", wait_until="domcontentloaded"
|
feat: add per-user avatar seed regeneration with irreversible random avatar replacement
Implement a new `avatar_seed` column on the users table that overrides the username-based seed for Multiavatar generation. Introduce a null-safe `avatar_seed(user)` choke point in `avatar.py` that resolves `user.get("avatar_seed") or user.get("username")`, registered as a Jinja global so every render site (`_avatar_link.html`, `avatar_url(...)` calls, SEO `og_image`, issues ad-hoc dicts, devRant payload/PNG) propagates a regenerated seed. Add `POST /profile/{username}/regenerate-avatar` endpoint (owner-or-admin only) that writes a fresh `generate_uid()` to `avatar_seed`, invalidates the target's user cache, and audits `profile.avatar.regenerate`. The previous seed is overwritten and never stored, making regeneration irreversible. Document the feature in `AGENTS.md` and `README.md`, add the API endpoint to `docs_api.py`, and include the `regenerate_avatar` Devii tool in `CONFIRM_REQUIRED`.
2026-06-28 00:31:34 +02:00
|
|
|
)
|
2026-07-04 22:24:59 +02:00
|
|
|
expect(bob_page.locator("[data-regenerate-avatar]")).to_have_count(0)
|
