"""User settings + per-sender image allowlist (SPEC §9.1 Settings, §9.4).""" from __future__ import annotations from typing import Annotated from fastapi import APIRouter, Depends from pydantic import BaseModel from sqlalchemy import func, select from sqlalchemy.ext.asyncio import AsyncSession from app.db import get_session from app.identity.deps import CurrentUser, require_csrf from app.models import Message, User router = APIRouter(prefix="/settings", tags=["settings"]) DbSession = Annotated[AsyncSession, Depends(get_session)] _ALLOWED_ORDER = {"asc", "desc"} _ALLOWED_TIME_FORMAT = {"12", "24"} class SettingsOut(BaseModel): thread_order: str = "asc" tz: str = "UTC" time_format: str = "24" # 12 = AM/PM, 24 = 24-hour (default); applies app-wide jitsi_server: str = "" # blank => https://meet.jit.si/ default_calendar: str = "" # calendar id new events default to (blank => first) default_reminders_timed: list[int] = [] # minutes-before defaults for timed events default_reminders_allday: list[int] = [] # minutes-before defaults for all-day events allowed_image_senders: list[str] = [] class SettingsPatch(BaseModel): thread_order: str | None = None tz: str | None = None time_format: str | None = None jitsi_server: str | None = None default_calendar: str | None = None default_reminders_timed: list[int] | None = None default_reminders_allday: list[int] | None = None class QuotaOut(BaseModel): used_bytes: int quota_bytes: int def allowed_image_senders(user: User) -> set[str]: value = user.settings.get("allowed_image_senders", []) if isinstance(value, list): return {str(e).lower() for e in value} return set() def add_allowed_image_sender(user: User, email: str) -> None: current = sorted(allowed_image_senders(user)) if email.lower() not in current: current.append(email.lower()) # Reassign the whole dict so SQLAlchemy detects the JSONB change. user.settings = {**user.settings, "allowed_image_senders": current} def _int_list(value: object) -> list[int]: return [int(x) for x in value] if isinstance(value, list) else [] def _settings_out(user: User) -> SettingsOut: s = user.settings return SettingsOut( thread_order=str(s.get("thread_order", "asc")), tz=str(s.get("tz", "UTC")), time_format=str(s.get("time_format", "24")), jitsi_server=str(s.get("jitsi_server", "")), default_calendar=str(s.get("default_calendar", "")), default_reminders_timed=_int_list(s.get("default_reminders_timed")), default_reminders_allday=_int_list(s.get("default_reminders_allday")), allowed_image_senders=sorted(allowed_image_senders(user)), ) @router.get("", response_model=SettingsOut) async def get_settings_endpoint(user: CurrentUser) -> SettingsOut: return _settings_out(user) @router.get("/quota", response_model=QuotaOut) async def get_quota(user: CurrentUser, db: DbSession) -> QuotaOut: """Storage quota and current usage (sum of stored message sizes).""" used = await db.scalar( select(func.coalesce(func.sum(Message.size_bytes), 0)).where(Message.user_id == user.id) ) return QuotaOut(used_bytes=int(used or 0), quota_bytes=user.quota_bytes) @router.patch("", response_model=SettingsOut, dependencies=[Depends(require_csrf)]) async def patch_settings(body: SettingsPatch, user: CurrentUser, db: DbSession) -> SettingsOut: updates = dict(user.settings) if body.thread_order is not None and body.thread_order in _ALLOWED_ORDER: updates["thread_order"] = body.thread_order if body.tz is not None: updates["tz"] = body.tz if body.time_format is not None and body.time_format in _ALLOWED_TIME_FORMAT: updates["time_format"] = body.time_format if body.jitsi_server is not None: updates["jitsi_server"] = body.jitsi_server.strip() if body.default_calendar is not None: updates["default_calendar"] = body.default_calendar if body.default_reminders_timed is not None: updates["default_reminders_timed"] = [int(x) for x in body.default_reminders_timed] if body.default_reminders_allday is not None: updates["default_reminders_allday"] = [int(x) for x in body.default_reminders_allday] user.settings = updates await db.commit() return _settings_out(user)