studio-engine 0.47.1 → 0.48.0

data/app/services/studio/email_catalog.rb

@@ -142,7 +142,13 @@ module Studio
         # top. default_asset above stays the flat <img> for a mailer that has not
         # adopted the layered banner.
         background: "emails/magic-link-background.gif",
-        logo: "emails/logo-horizontal.png",
+        # NO logo: KEY — the same rule newsletter_subscribed above follows, and
+        # for the same reason. It seeded "emails/logo-horizontal.png" (the
+        # McRITCHIE STUDIO wordmark) into every host that registers this email
+        # without naming a mark, because register() merges on `logo.presence`
+        # and an omitted key INHERITS. On the SIGN-IN email, which is the most-
+        # sent email most of these apps have. Full reasoning under NO DEFAULT
+        # LOGO below; the guards are in test/integration/magic_link_logo_test.rb.
         # The DEFAULT wording, overridable per app on /admin/emails. {name} is
         # filled from whoever the mailer says the recipient is.
         header: "Welcome {name}!",
@@ -199,10 +205,14 @@ module Studio
     ASPECT_RATIO = 2.0
     MAX_WIDTH = 1200
 
-    # NO DEFAULT LOGO, deliberately — on any route.
+    # NO DEFAULT LOGO, deliberately — on any route, for any entry.
     #
-    # There is no DEFAULT_LOGO constant here, and newsletter_subscribed above
-    # seeds no logo either. Same rule, learned twice, on two different routes.
+    # There is no DEFAULT_LOGO constant here, and NO entry in STANDARD seeds a
+    # logo. That is now an invariant over the whole seed rather than a fact about
+    # two entries that happen to be clean — asserted in
+    # test/lib/studio/email_catalog_test.rb, which reads STANDARD and fails on any
+    # entry carrying a mark. The instance kept coming back; the rule is what
+    # stops it.
     #
     # The constant went first (DEFAULT_FOOTER_LOGO). It was
     # emails/logo-horizontal.png — the white "McRITCHIE STUDIO" wordmark —
@@ -235,26 +245,47 @@ module Studio
     # (`Studio::EmailCatalog.register("newsletter_subscribed", logo: "emails/our-mark.png")`,
     # a path THAT APP ships) or on /admin/emails.
     #
-    # STILL OUTSTANDING, stated so nobody reads this as swept: magic_link above
-    # DOES still seed the wordmark, so a host that registers no mark of its own
-    # inherits it on the sign-in email. turf-monster registers emails/turf-logo.png
-    # and the Studio hub owns the mark, so both are covered.
-    #
-    # It is an UPGRADE TRAP rather than a live leak, which is the sharper shape.
-    # The apps carrying no email initializer are pinned far enough back that this
-    # file does not exist in the gem they run, so they inherit nothing today — but
-    # the routine dependency bump that brings one forward would put another
-    # brand's mark in its most-sent email, with no code change of its own and
-    # nobody looking for it.
+    # THE THIRD INSTANCE closed the question the first two left open: should
+    # STANDARD seed a logo AT ALL? It should not, and now none does.
+    #
+    # magic_link was the last holdout, and the sharpest — it seeded the wordmark
+    # onto the SIGN-IN email, the most-sent email most Studio apps have. Two
+    # narrow fixes (turf's magic_link, then newsletter_subscribed) had already
+    # been made, and the mechanism produced a third anyway. So the rule moved
+    # from the instance to the seed: a shared default may not carry anybody's
+    # identity, and the guard reads STANDARD rather than a list of keys, because
+    # the failure mode is the NEXT entry, written by someone who never read this.
+    #
+    # WHY THE ASYMMETRY DECIDES IT. A host that wanted the mark and lost it sees
+    # a missing logo — visible, and one line to restore. A host that never asked
+    # inherits another brand's identity into its own inbox — invisible, and the
+    # ALT TEXT AGREES WITH IT, because Studio::Banner sets logo_alt from
+    # Studio.app_name. turf's read "Turf Monster" over the Studio wordmark for
+    # weeks and no one reviewing that email could have seen it. Given one error
+    # to make, make the loud one.
+    #
+    # WHO PAID FOR THIS, named rather than left to be discovered: McRitchie
+    # Studio, the hub, registers magic_link to attach a preview builder and names
+    # no logo — so it INHERITED the mark it owns, and ships no copy of the file
+    # itself. It opts in with `logo: "emails/logo-horizontal.png"` on the
+    # register() call it already makes. The asset stays in this gem so that line
+    # resolves today; the hub shipping its own copy is the tidier end-state, as
+    # the mark is its identity and not the engine's. turf-monster names
+    # emails/turf-logo.png and was never affected.
+    #
+    # It was an UPGRADE TRAP rather than a live leak, which is the sharper shape
+    # and the reason this was worth fixing before anyone was hurt. The apps
+    # carrying no email initializer (moms-app, mcritchie-industries,
+    # acquisition-studio) are pinned far enough back — 0.32.1 / 0.32.2 / 0.13.1 —
+    # that this file does not exist in the gem they run, so they inherited
+    # nothing. The routine dependency bump that brought one forward would have
+    # put another brand's mark in its most-sent email, with no code change of its
+    # own and nobody looking for it.
     #
     # CHECK REACHABILITY AT THE PIN, never from main: `git ls-tree` at the tag the
     # app resolves, or read the installed gem. "HEAD seeds it" plus "the app
     # registers nothing" are both true and together say nothing about what that
     # app RUNS — a wrong conclusion this very comment was first drafted with.
-    #
-    # Tracked, with the design question it raises — should STANDARD seed a logo at
-    # all, or should hosts opt in? — at /tasks/guard-wordmark-on-engine-bump.
-    # Fixing magic_link alone leaves the next entry free to repeat this.
 
     # The footer band. Dark on purpose: it closes the white card, and a light
     # sign-off floating under body copy reads as part of the message rather than

data/app/views/components/_user_nav.html.erb

@@ -40,6 +40,33 @@
      end
    end %>
 
+<%# Where the username and the avatar point — resolved ONCE, used by both.
+
+    A HOST'S OWN account_path WINS: an app that already has an account page keeps
+    it rather than being repointed at a thinner /profile by a routine dependency
+    bump. An app adopting /profile flips over by DELETING its account route, so
+    the last step of the migration is the deliberate one.
+
+    NO CONSUMER EXERCISES THAT BRANCH TODAY, and the comment here said otherwise
+    until 2026-08-14. turf-monster is the only app with an account_path, and it
+    ships its own app/views/components/_user_nav.html.erb — a host view SHADOWS
+    the engine's in this non-isolated engine, so turf never renders THIS file.
+    The rule is for apps that adopt /profile later.
+
+    nil when NEITHER exists, and then the name and avatar render as plain text.
+    They used to render `href="#"`, which was not a graceful degradation but a
+    dead link. Who that actually reached: mcritchie-industries and
+    acquisition-studio — the consumers rendering this partial rather than a fork
+    of it. A link that goes nowhere looks identical to one that works until it is
+    clicked, which is why nobody reported it.
+%>
+<% studio_nav_destination =
+     if defined?(account_path)
+       account_path
+     elsif defined?(profile_path)
+       profile_path
+     end %>
+
 <div class="flex gap-2">
   <% if logged_in? %>
     <%# Left column: Div 1 + Div 2 stacked %>
@@ -61,9 +88,11 @@
           <%= render "components/admin_dropdown" unless respond_to?(:studio_sidebar_replaces_admin_menu?) && studio_sidebar_replaces_admin_menu? %>
           <%= render "components/theme_toggle_morph" %>
         </div>
-        <% account_link = defined?(account_path) ? account_path : "#" %>
-        <%= link_to account_link, class: "text-heading font-semibold hover:text-primary transition text-base leading-none truncate text-right" do %>
-          <%= current_user.display_name %>
+        <% nav_name_classes = "text-heading font-semibold hover:text-primary transition text-base leading-none truncate text-right" %>
+        <% if studio_nav_destination %>
+          <%= link_to current_user.display_name, studio_nav_destination, class: nav_name_classes %>
+        <% else %>
+          <span class="<%= nav_name_classes %>"><%= current_user.display_name %></span>
         <% end %>
       </div>
       <% div2_content = studio_nav_slot.call(div2_slot, div2_html) %>
@@ -168,9 +197,14 @@
       <% end %>
     </div>
     <%# Div 3 (Avatar): spans both rows %>
-    <% account_link = defined?(account_path) ? account_path : "#" %>
-    <%= link_to account_link, class: "hover:opacity-80 transition flex-shrink-0 flex items-center", "x-bind:style": "$store.devMode && 'background: lightgreen'" do %>
-      <%= render "components/avatar", user: current_user, size: "nav" %>
+    <% if studio_nav_destination %>
+      <%= link_to studio_nav_destination, class: "hover:opacity-80 transition flex-shrink-0 flex items-center", "x-bind:style": "$store.devMode && 'background: lightgreen'" do %>
+        <%= render "components/avatar", user: current_user, size: "nav" %>
+      <% end %>
+    <% else %>
+      <span class="flex-shrink-0 flex items-center" x-bind:style="$store.devMode && 'background: lightgreen'">
+        <%= render "components/avatar", user: current_user, size: "nav" %>
+      </span>
     <% end %>
   <% else %>
     <%= render "components/admin_dropdown" unless respond_to?(:studio_sidebar_replaces_admin_menu?) && studio_sidebar_replaces_admin_menu? %>

data/app/views/studio/emails/show.html.erb

@@ -312,8 +312,15 @@
         </div>
 
         <%# THE LOGO — three states, because a URL box can only express two.
-            Standard inherits the shared mark, Custom is what this app uploaded,
-            Hidden is the deliberate "no logo" that blank cannot say. %>
+            Standard is the mark THIS APP registered, Custom is what it uploaded,
+            Hidden is the deliberate "no logo" that blank cannot say.
+
+            "Standard" is no longer a shared mark. No STANDARD entry seeds a logo
+            (the engine's wordmark riding the seed into a host's sign-in email
+            was the bug), so on an app that registered none, Standard and None
+            are the same picture — nothing. The note below says so, because a
+            control offering a choice that changes nothing is the failure this
+            page keeps producing. %>
         <div>
           <span class="text-sm text-muted block mb-1">Logo</span>
           <div class="flex flex-wrap items-center gap-2">
@@ -336,6 +343,13 @@
             <%= button_to "Back to the standard logo", admin_email_logo_path(@entry.key),
                   method: :patch, params: { remove: "1" },
                   class: "text-2xs text-muted underline underline-offset-2 mt-2" %>
+          <% elsif Studio::EmailCatalog.logo_url(@entry.key).blank? %>
+            <p class="text-2xs text-muted mt-2" data-logo-none-registered>
+              This app registers no mark for this email, so Standard shows none.
+              Upload one here, or name a file your app ships with
+              <code class="font-mono">logo:</code> in
+              <code class="font-mono">config/initializers/studio_emails.rb</code>.
+            </p>
           <% end %>
         </div>
 

data/app/views/studio/profiles/_avatar_section.html.erb

@@ -0,0 +1,93 @@
+<%# Profile photo row — lifted from turf-monster's /account, which is the
+    interaction the operator wants standardized: click the avatar, hover reveals
+    an "Update" cap, pick a file, crop it square, and it saves immediately. No
+    Save button, no visible file field.
+
+    Locals: user (required).
+
+    HOW IT HANGS TOGETHER
+      imageUploadHost()      the engine's crop-then-immediate-save x-data factory
+                             (studio/modals/_image_upload). onFileSelected() reads
+                             the picked file and opens the crop modal; the modal
+                             dispatches the cropped Blob back on
+                             'crop-photo-confirmed'; applyCrop() drops it into the
+                             hidden form's file input and submits with a saving
+                             card.
+      profileModals          the PAGE-SCOPED Alpine store mounted by show.html.erb.
+                             Not the shared "modals" store — see below.
+      profile_avatar_path    its own endpoint, because an attachment param
+                             submitted empty PURGES the attachment.
+
+    WHY THE PAGE-SCOPED STORE AND NOT `modals`. turf's copy opens on
+    Alpine.store('modals') — the app's shared modal host — which works there
+    because turf's layout mounts one and registers crop-photo in it. Two of the
+    five consumers (mcritchie-industries, moms-app) render NO shared host at all,
+    and the two that do would each have to add a crop-photo registration to their
+    layout before this row worked. An engine page cannot ask that. show.html.erb
+    mounts studio/modals/_scoped_host instead, so the page brings its own modals
+    and this row behaves identically in every app. /admin/emails already does
+    exactly this.
+
+    WHY onCropConfirmed AND NOT applyCrop DIRECTLY. turf's call site binds
+    `applyCrop($event.detail.blob)`, which predates the owner guard. Every
+    imageUploadHost on a page hears the same window event, so a page that later
+    grows a second uploader (a host row with its own image) would have both
+    hosts save the same crop. onCropConfirmed() checks the owner token first and
+    is a strict improvement at the same call cost.
+
+    ON THE INLINE PIXEL SIZES. Same reason turf gives: the exact circle geometry
+    is expressed inline rather than through w-24/h-24, because a size utility
+    only exists if something already emitted it into the compiled bundle. The
+    classes used here (group-hover:opacity-100, rounded-full, object-cover,
+    absolute inset-0) already ship in other engine partials.
+%>
+<div x-data="imageUploadHost({
+       store: 'profileModals',
+       aspectRatio: 1,
+       filename: 'avatar.png',
+       saving: 'Saving photo…',
+       toast: false
+     })"
+     @crop-photo-confirmed.window="onCropConfirmed($event.detail)"
+     class="flex flex-col items-center">
+
+  <%# Auto-submitted once a crop is confirmed. Hidden because the person never
+      touches it — applyCrop() writes the cropped File onto fileInput and calls
+      submitFormWithProgress on form. %>
+  <%= form_with url: profile_avatar_path, method: :patch, scope: :profile,
+                html: { multipart: true, "x-ref": "form", class: "hidden" } do %>
+    <input type="file" name="profile[avatar]" x-ref="fileInput">
+  <% end %>
+
+  <%# The real picker. Opened by the avatar button; never shown. %>
+  <input type="file" x-ref="filePicker" @change="onFileSelected($event)"
+         accept="<%= Studio::ProfileImage::ALLOWED_CONTENT_TYPES.join(",") %>" class="hidden">
+
+  <%# The clickable avatar. A BUTTON rather than turf's <div @click>: a div is
+      unreachable by keyboard and invisible to a screen reader, so the only way
+      to change your photo would be a mouse. Same visual, and it focuses. %>
+  <button type="button"
+          @click="$refs.filePicker.click()"
+          aria-label="Change your profile photo"
+          style="width: 96px; height: 96px;"
+          class="relative rounded-full cursor-pointer group overflow-hidden mb-3 flex-shrink-0 p-0 border-0 bg-transparent">
+    <% if user.avatar.attached? %>
+      <%= image_tag user.avatar, class: "rounded-full object-cover",
+                    style: "width: 96px; height: 96px;", alt: user.display_name %>
+    <% else %>
+      <div class="rounded-full flex items-center justify-center font-bold text-white text-3xl"
+           style="width: 96px; height: 96px; background-color: <%= user.avatar_color %>">
+        <%= user.avatar_initials %>
+      </div>
+    <% end %>
+
+    <%# The hover cap. group-hover reveals it on pointer; focus-within is the
+        keyboard equivalent, so a tabbing user sees the same affordance. %>
+    <span class="absolute inset-0 rounded-full flex items-center justify-center opacity-0 group-hover:opacity-100 group-focus:opacity-100 transition-opacity duration-200"
+          style="background: rgba(0,0,0,0.5)">
+      <span class="text-white text-xs font-bold">Update</span>
+    </span>
+  </button>
+
+  <div class="text-xl font-bold text-heading"><%= user.display_name %></div>
+</div>

data/app/views/studio/profiles/_first_name_section.html.erb

@@ -0,0 +1,26 @@
+<%# First-name row.
+
+    Locals: user (required).
+
+    This row only renders when the host's user model actually answers
+    `first_name` — Studio::ProfileSections drops it otherwise, so an app that has
+    not installed the standard profile columns gets a page without this row
+    rather than a NoMethodError on every visit. Nothing here needs to re-check.
+
+    The same column is written by the onboarding step
+    (Studio::OnboardingController#first_name); this is the surface for changing it
+    later.
+%>
+<%= form_with url: profile_path, method: :patch, scope: :profile,
+              data: { turbo: false }, class: "flex flex-wrap items-end gap-3" do |form| %>
+  <div class="flex-1 min-w-0" style="min-width: 12rem;">
+    <label class="block text-sm text-secondary mb-2 font-medium" for="profile_first_name">First name</label>
+    <%= form.text_field :first_name,
+                        value: user.first_name,
+                        maxlength: Studio::FIRST_NAME_MAX_LENGTH,
+                        autocomplete: "given-name",
+                        placeholder: "What should we call you?",
+                        class: "input-field" %>
+  </div>
+  <%= form.submit "Save", class: "btn btn-primary" %>
+<% end %>

data/app/views/studio/profiles/_google_section.html.erb

@@ -0,0 +1,56 @@
+<%# Google account row — lifted from turf-monster's /account Identities card.
+
+    Locals: user (required).
+
+    Two states. LINKED: a tick, "Connected via Google", and an Unlink button
+    behind a confirm. NOT LINKED: the branded Connect button, which POSTs to
+    OmniAuth's own /auth/google_oauth2 — the engine does not draw that path, the
+    middleware owns it, which is why this is a literal string and not a helper.
+
+    The row only renders when the host's user model answers provider AND uid
+    (Studio::ProfileSections drops it otherwise), so nothing here re-checks.
+
+    ON THE PREDICATE: turf's view asks `@user.google_connected?`, a method only
+    turf defines. The engine cannot call that — it reads provider/uid itself
+    through Studio::OauthIdentity, which also matches BOTH spellings that appear
+    in the wild (`google_oauth2` from the OmniAuth strategy, `google` from
+    Studio.auth_methods).
+%>
+<% linked = Studio::OauthIdentity.google_linked?(user) %>
+
+<% if linked %>
+  <div class="flex flex-wrap items-center justify-between gap-3">
+    <div class="flex items-center gap-3">
+      <svg class="w-5 h-5 text-primary" fill="none" stroke="currentColor" stroke-width="2" viewBox="0 0 24 24" aria-hidden="true">
+        <path stroke-linecap="round" stroke-linejoin="round" d="M5 13l4 4L19 7"/>
+      </svg>
+      <span class="text-body">Connected via Google</span>
+    </div>
+
+    <%# The button is rendered either way; when unlinking would orphan the
+        account it is DISABLED with the reason beside it, rather than hidden.
+        A control that vanishes teaches nothing — the person cannot tell whether
+        the feature is missing or their account is special. The server refuses
+        this case regardless (ProfilesController#unlink_google); this is the
+        explanation, not the enforcement. %>
+    <% orphans = Studio::OauthIdentity.unlink_orphans_account?(user) %>
+    <% if orphans %>
+      <div class="text-right">
+        <button type="button" disabled
+                class="btn btn-danger btn-sm opacity-50 cursor-not-allowed"
+                title="Google is currently the only way to sign in">Unlink</button>
+        <p class="text-muted text-xs mt-1">Add an email address first — Google is your only sign-in.</p>
+      </div>
+    <% else %>
+      <%= button_to "Unlink", profile_unlink_google_path, method: :delete,
+                    class: "btn btn-danger btn-sm",
+                    data: { turbo_confirm: "Unlink your Google account?" } %>
+    <% end %>
+  </div>
+<% else %>
+  <%= button_to "/auth/google_oauth2", method: :post, data: { turbo: false },
+                class: "btn btn-google gap-3 w-full" do %>
+    <%= render "components/google_logo" %>
+    Link Google Account
+  <% end %>
+<% end %>

data/app/views/studio/profiles/show.html.erb

@@ -0,0 +1,73 @@
+<%# The shared /profile page.
+
+    A bare content wrapper, not a layout: it renders inside the host's
+    application layout and inherits that app's navbar, theme and flash. Same
+    shape as /admin/style and /admin/emails.
+
+    The page is nothing but its sections. @profile_sections is already resolved
+    and filtered by the controller (Studio.profile_sections_for) — rows the host
+    cannot serve, and admin rows for non-admins, are gone before we get here — so
+    this template makes no decisions of its own beyond an empty state.
+%>
+<% content_for(:title, "Profile") %>
+
+<%# Does any resolved row need the crop/saving modals? A row declares
+    `modals: true` and the page mounts them once, here.
+
+    The page owns its modal host DELIBERATELY. The obvious alternative — render
+    "studio/modals/host" and let the app supply it — fails in both directions:
+    mcritchie-industries and moms-app render no shared host at all, so there
+    would be nowhere to open a modal from; and mcritchie-studio and turf-monster
+    each ship their OWN app/views/studio/modals/_host.html.erb, which shadows the
+    engine's in this non-isolated engine, so the page would silently get their
+    fork and its registrations. studio/modals/_scoped_host is unforked in every
+    app. /admin/emails reached the same conclusion first.
+
+    Mounted once per page rather than once per row: two hosts sharing a store
+    name would register the same modal ids twice and render duplicate cards. %>
+<% profile_needs_modals = Array(@profile_sections).any? { |section| section[:modals] } %>
+
+<% if profile_needs_modals %>
+  <%# cropper.js + the imageUploadHost / cropPhotoModal / submitFormWithProgress
+      factories. Loaded only when a row can actually open the cropper, which is
+      the whole reason this is a partial and not a global include. %>
+  <%= render "studio/cropper_assets" %>
+<% end %>
+
+<div class="max-w-2xl mx-auto py-8">
+  <h1 class="text-2xl font-extrabold text-heading mb-8">Profile</h1>
+
+  <% if @profile_sections.blank? %>
+    <%# Reachable, and worth rendering honestly rather than as a blank page: an
+        app whose user model serves none of the declared rows (no avatar
+        attachment, no first_name column) lands here until it installs the
+        standard profile columns. %>
+    <%= render "components/empty_state",
+               message: "Nothing to edit yet",
+               detail: "This app has not enabled any profile fields." %>
+  <% else %>
+    <div class="space-y-6">
+      <% @profile_sections.each do |section| %>
+        <section class="card p-6" data-profile-section="<%= section[:key] %>">
+          <% if section[:title].present? %>
+            <h2 class="text-lg font-bold text-heading mb-4"><%= section[:title] %></h2>
+          <% end %>
+          <%= render section[:partial], **section.fetch(:locals, {}).merge(user: current_user) %>
+        </section>
+      <% end %>
+    </div>
+  <% end %>
+</div>
+
+<% if profile_needs_modals %>
+  <%# Optional chaining on current() is load-bearing: the outer template unmounts
+      one tick AFTER the stack empties, so a bare .id throws on every close. %>
+  <%= render "studio/modals/scoped_host", store: "profileModals" do %>
+    <template x-if="$store.profileModals.current()?.id === 'crop-photo'">
+      <div><%= render "studio/modals/crop_photo", store: "profileModals" %></div>
+    </template>
+    <template x-if="$store.profileModals.current()?.id === 'saving'">
+      <div><%= render "studio/modals/saving", store: "profileModals" %></div>
+    </template>
+  <% end %>
+<% end %>

data/lib/studio/oauth_identity.rb

@@ -0,0 +1,95 @@
+# frozen_string_literal: true
+
+# The OAuth identity bound to an account — is Google linked, and is it safe to
+# unlink it?
+#
+# Pure Ruby and duck-typed, like Studio::ProfileImage: it takes anything that
+# answers `provider` / `uid` / `email`, so the rules are unit-testable without a
+# users table, and a host whose model has none of those columns is simply
+# reported as "not linked" rather than raising.
+#
+# THE ORPHAN GUARD IS THE REASON THIS FILE EXISTS. turf-monster's
+# AccountsController#unlink_google is one line — `update!(provider: nil, uid: nil)`
+# — with no check at all. For an account whose ONLY sign-in is Google (blank
+# email, so no magic link; no wallet; no password) that button silently locks
+# someone out of their own account, and the label just says "Unlink". It is safe
+# in turf today only because turf's users happen to carry an email; that is a
+# property of turf's data, not of the code, and the engine ships to apps whose
+# data it has never seen.
+#
+# So the engine asks first: after this unlink, is there still a way back in?
+module Studio
+  module OauthIdentity
+    # Both spellings appear across the ecosystem: `google_oauth2` is the OmniAuth
+    # strategy name that lands in users.provider, and `google` is what
+    # Studio.auth_methods calls the same thing. Matching both means a host that
+    # stored either is read correctly rather than reported as unlinked.
+    GOOGLE_PROVIDERS = %w[google google_oauth2].freeze
+
+    module_function
+
+    def google_linked?(user)
+      return false unless user.respond_to?(:provider) && user.respond_to?(:uid)
+
+      GOOGLE_PROVIDERS.include?(user.provider.to_s) && user.uid.present?
+    end
+
+    # Every way this account could sign in if Google were gone. Returns symbols
+    # so a caller can name what is left in a message rather than just refusing.
+    #
+    # Gated on Studio.auth_methods, not just on the column: an app that has an
+    # email column but does not offer magic-link sign-in cannot use it to get
+    # back in, and counting it would be exactly the wrong answer.
+    def remaining_sign_ins(user, auth_methods: Studio.auth_methods)
+      methods = Array(auth_methods).map(&:to_sym)
+      remaining = []
+
+      remaining << :magic_link if methods.include?(:magic_link) && present?(user, :email)
+      remaining << :wallet     if methods.include?(:wallet) && wallet_present?(user)
+      # `Studio.password_login_available?` — NOT a bare password_digest check.
+      # A digest can be a FOSSIL: turf-monster removed `has_secure_password` and
+      # kept the column, so rows still carry digests no code can authenticate
+      # against. Counting one as a way back in is a false positive in the
+      # dangerous direction — it would permit an unlink that orphans the account.
+      # The engine already ships the correct composite predicate
+      # (auth_method?(:password) && the User answering `authenticate`).
+      remaining << :password if methods.include?(:password) &&
+                                Studio.password_login_available? &&
+                                present?(user, :password_digest)
+
+      remaining
+    end
+
+    # The question the controller actually asks before unlinking.
+    def unlink_orphans_account?(user, auth_methods: Studio.auth_methods)
+      remaining_sign_ins(user, auth_methods: auth_methods).empty?
+    end
+
+    def present?(user, attribute)
+      user.respond_to?(attribute) && user.public_send(attribute).present?
+    end
+
+    # ONLY the explicitly configured wallet column — no fallback to a
+    # conventional name, deliberately.
+    #
+    # A convention-guessed reader is a false positive waiting to happen, and
+    # turf-monster is the live example: its `User#solana_address` returns
+    # `web3_solana_address || web2_solana_address`, and only the WEB3 address can
+    # actually sign in (SolanaSessionsController verifies a wallet signature; the
+    # web2 address is a custodial account with no signer). Guessing that reader
+    # would count a custodial address as a way back in and permit an unlink that
+    # orphans the account.
+    #
+    # So an app that has not named its signing-wallet column is treated as having
+    # no wallet sign-in. That errs toward REFUSING an unlink, which is the safe
+    # direction: the cost is an occasional refusal the operator can resolve by
+    # configuring `Studio.wallet_address_method`; the cost of the other direction
+    # is someone locked out of their account.
+    def wallet_present?(user)
+      configured = Studio.wallet_address_method
+      return false if configured.blank?
+
+      present?(user, configured)
+    end
+  end
+end

data/lib/studio/profile_image.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+# The house rule for "is this upload an acceptable profile picture?" — one
+# allowlist, one size cap, in one place.
+#
+# Pure Ruby and duck-typed on purpose: it takes anything answering
+# `content_type` and `size`, which is what an ActionDispatch::Http::UploadedFile
+# answers, so the rule is unit-testable without Rails, a request, or a users
+# table.
+#
+# LIFTED FROM turf-monster, where this lived as ApplicationController#valid_image?
+# with an IMAGE_UPLOAD_TYPES constant beside it. Same allowlist, same 8 MB cap —
+# the values are turf's, deliberately, because they are the ones that have been
+# in front of real uploads. What changes is that the second and third app no
+# longer have to re-derive them.
+#
+# ON THE ALLOWLIST BEING AN ALLOWLIST: an avatar is attacker-supplied bytes that
+# the app then serves back to other people. Naming the three formats we accept is
+# what keeps an SVG — which is a script host, not a picture — from becoming a
+# profile photo. Do not widen this to a `start_with?("image/")` check.
+module Studio
+  module ProfileImage
+    ALLOWED_CONTENT_TYPES = %w[image/png image/jpeg image/webp].freeze
+
+    # 8 MB. Phone cameras clear this comfortably; it is a bound on abuse, not on
+    # the user's actual photo.
+    MAX_BYTES = 8 * 1024 * 1024
+
+    # A human sentence for the rejection path. Kept next to the rule so the two
+    # cannot drift — a message naming the wrong limit is worse than none.
+    MESSAGE = "Use a PNG, JPG, or WebP under 8 MB."
+
+    module_function
+
+    def acceptable?(file)
+      return false unless file.respond_to?(:content_type) && file.respond_to?(:size)
+      return false unless ALLOWED_CONTENT_TYPES.include?(file.content_type)
+
+      size = file.size
+      size.is_a?(Numeric) && size.positive? && size <= MAX_BYTES
+    end
+  end
+end