studio-engine 0.47.2 → 0.48.0

data/app/views/studio/profiles/_avatar_section.html.erb

@@ -0,0 +1,93 @@
+<%# Profile photo row — lifted from turf-monster's /account, which is the
+    interaction the operator wants standardized: click the avatar, hover reveals
+    an "Update" cap, pick a file, crop it square, and it saves immediately. No
+    Save button, no visible file field.
+
+    Locals: user (required).
+
+    HOW IT HANGS TOGETHER
+      imageUploadHost()      the engine's crop-then-immediate-save x-data factory
+                             (studio/modals/_image_upload). onFileSelected() reads
+                             the picked file and opens the crop modal; the modal
+                             dispatches the cropped Blob back on
+                             'crop-photo-confirmed'; applyCrop() drops it into the
+                             hidden form's file input and submits with a saving
+                             card.
+      profileModals          the PAGE-SCOPED Alpine store mounted by show.html.erb.
+                             Not the shared "modals" store — see below.
+      profile_avatar_path    its own endpoint, because an attachment param
+                             submitted empty PURGES the attachment.
+
+    WHY THE PAGE-SCOPED STORE AND NOT `modals`. turf's copy opens on
+    Alpine.store('modals') — the app's shared modal host — which works there
+    because turf's layout mounts one and registers crop-photo in it. Two of the
+    five consumers (mcritchie-industries, moms-app) render NO shared host at all,
+    and the two that do would each have to add a crop-photo registration to their
+    layout before this row worked. An engine page cannot ask that. show.html.erb
+    mounts studio/modals/_scoped_host instead, so the page brings its own modals
+    and this row behaves identically in every app. /admin/emails already does
+    exactly this.
+
+    WHY onCropConfirmed AND NOT applyCrop DIRECTLY. turf's call site binds
+    `applyCrop($event.detail.blob)`, which predates the owner guard. Every
+    imageUploadHost on a page hears the same window event, so a page that later
+    grows a second uploader (a host row with its own image) would have both
+    hosts save the same crop. onCropConfirmed() checks the owner token first and
+    is a strict improvement at the same call cost.
+
+    ON THE INLINE PIXEL SIZES. Same reason turf gives: the exact circle geometry
+    is expressed inline rather than through w-24/h-24, because a size utility
+    only exists if something already emitted it into the compiled bundle. The
+    classes used here (group-hover:opacity-100, rounded-full, object-cover,
+    absolute inset-0) already ship in other engine partials.
+%>
+<div x-data="imageUploadHost({
+       store: 'profileModals',
+       aspectRatio: 1,
+       filename: 'avatar.png',
+       saving: 'Saving photo…',
+       toast: false
+     })"
+     @crop-photo-confirmed.window="onCropConfirmed($event.detail)"
+     class="flex flex-col items-center">
+
+  <%# Auto-submitted once a crop is confirmed. Hidden because the person never
+      touches it — applyCrop() writes the cropped File onto fileInput and calls
+      submitFormWithProgress on form. %>
+  <%= form_with url: profile_avatar_path, method: :patch, scope: :profile,
+                html: { multipart: true, "x-ref": "form", class: "hidden" } do %>
+    <input type="file" name="profile[avatar]" x-ref="fileInput">
+  <% end %>
+
+  <%# The real picker. Opened by the avatar button; never shown. %>
+  <input type="file" x-ref="filePicker" @change="onFileSelected($event)"
+         accept="<%= Studio::ProfileImage::ALLOWED_CONTENT_TYPES.join(",") %>" class="hidden">
+
+  <%# The clickable avatar. A BUTTON rather than turf's <div @click>: a div is
+      unreachable by keyboard and invisible to a screen reader, so the only way
+      to change your photo would be a mouse. Same visual, and it focuses. %>
+  <button type="button"
+          @click="$refs.filePicker.click()"
+          aria-label="Change your profile photo"
+          style="width: 96px; height: 96px;"
+          class="relative rounded-full cursor-pointer group overflow-hidden mb-3 flex-shrink-0 p-0 border-0 bg-transparent">
+    <% if user.avatar.attached? %>
+      <%= image_tag user.avatar, class: "rounded-full object-cover",
+                    style: "width: 96px; height: 96px;", alt: user.display_name %>
+    <% else %>
+      <div class="rounded-full flex items-center justify-center font-bold text-white text-3xl"
+           style="width: 96px; height: 96px; background-color: <%= user.avatar_color %>">
+        <%= user.avatar_initials %>
+      </div>
+    <% end %>
+
+    <%# The hover cap. group-hover reveals it on pointer; focus-within is the
+        keyboard equivalent, so a tabbing user sees the same affordance. %>
+    <span class="absolute inset-0 rounded-full flex items-center justify-center opacity-0 group-hover:opacity-100 group-focus:opacity-100 transition-opacity duration-200"
+          style="background: rgba(0,0,0,0.5)">
+      <span class="text-white text-xs font-bold">Update</span>
+    </span>
+  </button>
+
+  <div class="text-xl font-bold text-heading"><%= user.display_name %></div>
+</div>

data/app/views/studio/profiles/_first_name_section.html.erb

@@ -0,0 +1,26 @@
+<%# First-name row.
+
+    Locals: user (required).
+
+    This row only renders when the host's user model actually answers
+    `first_name` — Studio::ProfileSections drops it otherwise, so an app that has
+    not installed the standard profile columns gets a page without this row
+    rather than a NoMethodError on every visit. Nothing here needs to re-check.
+
+    The same column is written by the onboarding step
+    (Studio::OnboardingController#first_name); this is the surface for changing it
+    later.
+%>
+<%= form_with url: profile_path, method: :patch, scope: :profile,
+              data: { turbo: false }, class: "flex flex-wrap items-end gap-3" do |form| %>
+  <div class="flex-1 min-w-0" style="min-width: 12rem;">
+    <label class="block text-sm text-secondary mb-2 font-medium" for="profile_first_name">First name</label>
+    <%= form.text_field :first_name,
+                        value: user.first_name,
+                        maxlength: Studio::FIRST_NAME_MAX_LENGTH,
+                        autocomplete: "given-name",
+                        placeholder: "What should we call you?",
+                        class: "input-field" %>
+  </div>
+  <%= form.submit "Save", class: "btn btn-primary" %>
+<% end %>

data/app/views/studio/profiles/_google_section.html.erb

@@ -0,0 +1,56 @@
+<%# Google account row — lifted from turf-monster's /account Identities card.
+
+    Locals: user (required).
+
+    Two states. LINKED: a tick, "Connected via Google", and an Unlink button
+    behind a confirm. NOT LINKED: the branded Connect button, which POSTs to
+    OmniAuth's own /auth/google_oauth2 — the engine does not draw that path, the
+    middleware owns it, which is why this is a literal string and not a helper.
+
+    The row only renders when the host's user model answers provider AND uid
+    (Studio::ProfileSections drops it otherwise), so nothing here re-checks.
+
+    ON THE PREDICATE: turf's view asks `@user.google_connected?`, a method only
+    turf defines. The engine cannot call that — it reads provider/uid itself
+    through Studio::OauthIdentity, which also matches BOTH spellings that appear
+    in the wild (`google_oauth2` from the OmniAuth strategy, `google` from
+    Studio.auth_methods).
+%>
+<% linked = Studio::OauthIdentity.google_linked?(user) %>
+
+<% if linked %>
+  <div class="flex flex-wrap items-center justify-between gap-3">
+    <div class="flex items-center gap-3">
+      <svg class="w-5 h-5 text-primary" fill="none" stroke="currentColor" stroke-width="2" viewBox="0 0 24 24" aria-hidden="true">
+        <path stroke-linecap="round" stroke-linejoin="round" d="M5 13l4 4L19 7"/>
+      </svg>
+      <span class="text-body">Connected via Google</span>
+    </div>
+
+    <%# The button is rendered either way; when unlinking would orphan the
+        account it is DISABLED with the reason beside it, rather than hidden.
+        A control that vanishes teaches nothing — the person cannot tell whether
+        the feature is missing or their account is special. The server refuses
+        this case regardless (ProfilesController#unlink_google); this is the
+        explanation, not the enforcement. %>
+    <% orphans = Studio::OauthIdentity.unlink_orphans_account?(user) %>
+    <% if orphans %>
+      <div class="text-right">
+        <button type="button" disabled
+                class="btn btn-danger btn-sm opacity-50 cursor-not-allowed"
+                title="Google is currently the only way to sign in">Unlink</button>
+        <p class="text-muted text-xs mt-1">Add an email address first — Google is your only sign-in.</p>
+      </div>
+    <% else %>
+      <%= button_to "Unlink", profile_unlink_google_path, method: :delete,
+                    class: "btn btn-danger btn-sm",
+                    data: { turbo_confirm: "Unlink your Google account?" } %>
+    <% end %>
+  </div>
+<% else %>
+  <%= button_to "/auth/google_oauth2", method: :post, data: { turbo: false },
+                class: "btn btn-google gap-3 w-full" do %>
+    <%= render "components/google_logo" %>
+    Link Google Account
+  <% end %>
+<% end %>

data/app/views/studio/profiles/show.html.erb

@@ -0,0 +1,73 @@
+<%# The shared /profile page.
+
+    A bare content wrapper, not a layout: it renders inside the host's
+    application layout and inherits that app's navbar, theme and flash. Same
+    shape as /admin/style and /admin/emails.
+
+    The page is nothing but its sections. @profile_sections is already resolved
+    and filtered by the controller (Studio.profile_sections_for) — rows the host
+    cannot serve, and admin rows for non-admins, are gone before we get here — so
+    this template makes no decisions of its own beyond an empty state.
+%>
+<% content_for(:title, "Profile") %>
+
+<%# Does any resolved row need the crop/saving modals? A row declares
+    `modals: true` and the page mounts them once, here.
+
+    The page owns its modal host DELIBERATELY. The obvious alternative — render
+    "studio/modals/host" and let the app supply it — fails in both directions:
+    mcritchie-industries and moms-app render no shared host at all, so there
+    would be nowhere to open a modal from; and mcritchie-studio and turf-monster
+    each ship their OWN app/views/studio/modals/_host.html.erb, which shadows the
+    engine's in this non-isolated engine, so the page would silently get their
+    fork and its registrations. studio/modals/_scoped_host is unforked in every
+    app. /admin/emails reached the same conclusion first.
+
+    Mounted once per page rather than once per row: two hosts sharing a store
+    name would register the same modal ids twice and render duplicate cards. %>
+<% profile_needs_modals = Array(@profile_sections).any? { |section| section[:modals] } %>
+
+<% if profile_needs_modals %>
+  <%# cropper.js + the imageUploadHost / cropPhotoModal / submitFormWithProgress
+      factories. Loaded only when a row can actually open the cropper, which is
+      the whole reason this is a partial and not a global include. %>
+  <%= render "studio/cropper_assets" %>
+<% end %>
+
+<div class="max-w-2xl mx-auto py-8">
+  <h1 class="text-2xl font-extrabold text-heading mb-8">Profile</h1>
+
+  <% if @profile_sections.blank? %>
+    <%# Reachable, and worth rendering honestly rather than as a blank page: an
+        app whose user model serves none of the declared rows (no avatar
+        attachment, no first_name column) lands here until it installs the
+        standard profile columns. %>
+    <%= render "components/empty_state",
+               message: "Nothing to edit yet",
+               detail: "This app has not enabled any profile fields." %>
+  <% else %>
+    <div class="space-y-6">
+      <% @profile_sections.each do |section| %>
+        <section class="card p-6" data-profile-section="<%= section[:key] %>">
+          <% if section[:title].present? %>
+            <h2 class="text-lg font-bold text-heading mb-4"><%= section[:title] %></h2>
+          <% end %>
+          <%= render section[:partial], **section.fetch(:locals, {}).merge(user: current_user) %>
+        </section>
+      <% end %>
+    </div>
+  <% end %>
+</div>
+
+<% if profile_needs_modals %>
+  <%# Optional chaining on current() is load-bearing: the outer template unmounts
+      one tick AFTER the stack empties, so a bare .id throws on every close. %>
+  <%= render "studio/modals/scoped_host", store: "profileModals" do %>
+    <template x-if="$store.profileModals.current()?.id === 'crop-photo'">
+      <div><%= render "studio/modals/crop_photo", store: "profileModals" %></div>
+    </template>
+    <template x-if="$store.profileModals.current()?.id === 'saving'">
+      <div><%= render "studio/modals/saving", store: "profileModals" %></div>
+    </template>
+  <% end %>
+<% end %>

data/lib/studio/oauth_identity.rb

@@ -0,0 +1,95 @@
+# frozen_string_literal: true
+
+# The OAuth identity bound to an account — is Google linked, and is it safe to
+# unlink it?
+#
+# Pure Ruby and duck-typed, like Studio::ProfileImage: it takes anything that
+# answers `provider` / `uid` / `email`, so the rules are unit-testable without a
+# users table, and a host whose model has none of those columns is simply
+# reported as "not linked" rather than raising.
+#
+# THE ORPHAN GUARD IS THE REASON THIS FILE EXISTS. turf-monster's
+# AccountsController#unlink_google is one line — `update!(provider: nil, uid: nil)`
+# — with no check at all. For an account whose ONLY sign-in is Google (blank
+# email, so no magic link; no wallet; no password) that button silently locks
+# someone out of their own account, and the label just says "Unlink". It is safe
+# in turf today only because turf's users happen to carry an email; that is a
+# property of turf's data, not of the code, and the engine ships to apps whose
+# data it has never seen.
+#
+# So the engine asks first: after this unlink, is there still a way back in?
+module Studio
+  module OauthIdentity
+    # Both spellings appear across the ecosystem: `google_oauth2` is the OmniAuth
+    # strategy name that lands in users.provider, and `google` is what
+    # Studio.auth_methods calls the same thing. Matching both means a host that
+    # stored either is read correctly rather than reported as unlinked.
+    GOOGLE_PROVIDERS = %w[google google_oauth2].freeze
+
+    module_function
+
+    def google_linked?(user)
+      return false unless user.respond_to?(:provider) && user.respond_to?(:uid)
+
+      GOOGLE_PROVIDERS.include?(user.provider.to_s) && user.uid.present?
+    end
+
+    # Every way this account could sign in if Google were gone. Returns symbols
+    # so a caller can name what is left in a message rather than just refusing.
+    #
+    # Gated on Studio.auth_methods, not just on the column: an app that has an
+    # email column but does not offer magic-link sign-in cannot use it to get
+    # back in, and counting it would be exactly the wrong answer.
+    def remaining_sign_ins(user, auth_methods: Studio.auth_methods)
+      methods = Array(auth_methods).map(&:to_sym)
+      remaining = []
+
+      remaining << :magic_link if methods.include?(:magic_link) && present?(user, :email)
+      remaining << :wallet     if methods.include?(:wallet) && wallet_present?(user)
+      # `Studio.password_login_available?` — NOT a bare password_digest check.
+      # A digest can be a FOSSIL: turf-monster removed `has_secure_password` and
+      # kept the column, so rows still carry digests no code can authenticate
+      # against. Counting one as a way back in is a false positive in the
+      # dangerous direction — it would permit an unlink that orphans the account.
+      # The engine already ships the correct composite predicate
+      # (auth_method?(:password) && the User answering `authenticate`).
+      remaining << :password if methods.include?(:password) &&
+                                Studio.password_login_available? &&
+                                present?(user, :password_digest)
+
+      remaining
+    end
+
+    # The question the controller actually asks before unlinking.
+    def unlink_orphans_account?(user, auth_methods: Studio.auth_methods)
+      remaining_sign_ins(user, auth_methods: auth_methods).empty?
+    end
+
+    def present?(user, attribute)
+      user.respond_to?(attribute) && user.public_send(attribute).present?
+    end
+
+    # ONLY the explicitly configured wallet column — no fallback to a
+    # conventional name, deliberately.
+    #
+    # A convention-guessed reader is a false positive waiting to happen, and
+    # turf-monster is the live example: its `User#solana_address` returns
+    # `web3_solana_address || web2_solana_address`, and only the WEB3 address can
+    # actually sign in (SolanaSessionsController verifies a wallet signature; the
+    # web2 address is a custodial account with no signer). Guessing that reader
+    # would count a custodial address as a way back in and permit an unlink that
+    # orphans the account.
+    #
+    # So an app that has not named its signing-wallet column is treated as having
+    # no wallet sign-in. That errs toward REFUSING an unlink, which is the safe
+    # direction: the cost is an occasional refusal the operator can resolve by
+    # configuring `Studio.wallet_address_method`; the cost of the other direction
+    # is someone locked out of their account.
+    def wallet_present?(user)
+      configured = Studio.wallet_address_method
+      return false if configured.blank?
+
+      present?(user, configured)
+    end
+  end
+end

data/lib/studio/profile_image.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+# The house rule for "is this upload an acceptable profile picture?" — one
+# allowlist, one size cap, in one place.
+#
+# Pure Ruby and duck-typed on purpose: it takes anything answering
+# `content_type` and `size`, which is what an ActionDispatch::Http::UploadedFile
+# answers, so the rule is unit-testable without Rails, a request, or a users
+# table.
+#
+# LIFTED FROM turf-monster, where this lived as ApplicationController#valid_image?
+# with an IMAGE_UPLOAD_TYPES constant beside it. Same allowlist, same 8 MB cap —
+# the values are turf's, deliberately, because they are the ones that have been
+# in front of real uploads. What changes is that the second and third app no
+# longer have to re-derive them.
+#
+# ON THE ALLOWLIST BEING AN ALLOWLIST: an avatar is attacker-supplied bytes that
+# the app then serves back to other people. Naming the three formats we accept is
+# what keeps an SVG — which is a script host, not a picture — from becoming a
+# profile photo. Do not widen this to a `start_with?("image/")` check.
+module Studio
+  module ProfileImage
+    ALLOWED_CONTENT_TYPES = %w[image/png image/jpeg image/webp].freeze
+
+    # 8 MB. Phone cameras clear this comfortably; it is a bound on abuse, not on
+    # the user's actual photo.
+    MAX_BYTES = 8 * 1024 * 1024
+
+    # A human sentence for the rejection path. Kept next to the rule so the two
+    # cannot drift — a message naming the wrong limit is worse than none.
+    MESSAGE = "Use a PNG, JPG, or WebP under 8 MB."
+
+    module_function
+
+    def acceptable?(file)
+      return false unless file.respond_to?(:content_type) && file.respond_to?(:size)
+      return false unless ALLOWED_CONTENT_TYPES.include?(file.content_type)
+
+      size = file.size
+      size.is_a?(Numeric) && size.positive? && size <= MAX_BYTES
+    end
+  end
+end

data/lib/studio/profile_sections.rb

@@ -0,0 +1,153 @@
+# frozen_string_literal: true
+
+# Resolves Studio.profile_sections — the rows that make up the shared /profile
+# page — for a given view context. Pure Ruby (no Rails dependency) so the unit
+# suite exercises the resolution rules without booting the dummy app.
+#
+# THE SHAPE IS DELIBERATELY THE SIDEBAR'S. Studio.sidebar_sections already taught
+# this codebase one way to let a host declare page furniture: a static Array or a
+# callable that receives the view, symbolized on the way out, with sections the
+# viewer may not see dropped before render. Reusing that shape means a host that
+# has declared a sidebar already knows how to declare a profile.
+#
+# What a section looks like:
+#
+#   { key: :avatar, title: "Profile photo", partial: "studio/profiles/avatar_section",
+#     locals: { ... }, requires: :avatar, admin: false }
+#
+#   key      — stable identifier. A host removes or replaces a default by key,
+#              so reordering the defaults never breaks a host's override.
+#   title    — the row's heading.
+#   partial  — the partial to render. Host partials are ordinary app views.
+#   locals   — optional Hash passed to the partial.
+#   requires — optional attribute (or Array of them) the CURRENT USER must
+#              respond to for the row to render. See below.
+#   admin    — admin-only row, same rule as the sidebar's.
+#   if       — optional callable. The row renders only when it returns truthy.
+#              Called with the view when it takes an argument, without when it
+#              does not. This is the APP-CAPABILITY gate, distinct from
+#              `requires:` which is the MODEL gate — and the two really are
+#              different questions. Every consumer's users table carries
+#              `provider` and `uid`, so `requires:` alone selected the whole
+#              fleet for the Google row; mcritchie-industries has those columns
+#              AND `auth_methods = %i[magic_link]` with no omniauth gem at all,
+#              so it would have rendered a "Link Google Account" button leading
+#              nowhere. Having a column is not the same as offering the feature.
+#   modals   — the row opens the shared crop/saving modals. The PAGE mounts them
+#              once (studio/modals/_scoped_host on a "profileModals" store) when
+#              any resolved row asks for them, so a row never has to know whether
+#              the host app renders a modal host of its own. Two of the five
+#              consumers render none at all, and the two that do ship a FORK of
+#              the engine's shared host that would shadow it.
+#
+# ON `requires` — this is the whole reason the registry exists rather than a
+# hardcoded page. The consuming apps do NOT agree on their users table:
+# mcritchie-industries has eight columns and no `first_name`; turf-monster has
+# forty. A shared page that assumed a column would raise NoMethodError on every
+# signed-in request in the app that lacked it — the same failure mode
+# Studio.first_name_outstanding? already guards against with respond_to?.
+#
+# So a row DECLARES what it needs and is dropped when the host cannot serve it.
+# mcritchie-industries gets a working profile page with an avatar row and no name
+# row until it installs the standard-profile-columns migration, at which point
+# the row appears with no code change. Silence, not a 500.
+module Studio
+  module ProfileSections
+    # The page every consumer gets for free. Iteration one is deliberately two
+    # rows: the picture and the name. Everything else the account-standardization
+    # program lifts (email change, identities, preferences) arrives as further
+    # defaults, and a host that has declared its own list keeps working because
+    # it composes against `Studio.default_profile_sections` rather than a literal.
+    DEFAULTS = [
+      { key: :avatar, title: "Profile photo",
+        partial: "studio/profiles/avatar_section", requires: :avatar, modals: true },
+      { key: :first_name, title: "Your name",
+        partial: "studio/profiles/first_name_section", requires: :first_name },
+      # Gated on the app OFFERING Google, not merely on having the columns —
+      # the same question app/views/sessions/new.html.erb:79 already asks before
+      # drawing this identical button on the login page.
+      { key: :google, title: "Google account",
+        partial: "studio/profiles/google_section", requires: %i[provider uid],
+        if: -> { Studio.auth_method?(:google) } }
+    ].freeze
+
+    module_function
+
+    # A fresh, mutable copy every call. Hosts compose with `+` and sometimes
+    # `reject`, and handing out the frozen literal would let one host's edit
+    # leak into the next request's page.
+    def defaults
+      DEFAULTS.map { |section| section.dup }
+    end
+
+    # Declared may be nil (the host has said nothing — it gets the defaults), an
+    # Array, or a callable receiving the view context.
+    #
+    # `nil` meaning "the defaults" rather than "no sections" is the load-bearing
+    # choice here: it is what makes a brand-new app's profile page work with an
+    # empty initializer, which is the entire point of standardizing this.
+    def resolve(declared, view)
+      sections = declared.respond_to?(:call) ? declared.call(view) : declared
+      sections = defaults if sections.nil?
+
+      admin = view.respond_to?(:admin?) && view.admin?
+      user  = view.respond_to?(:current_user) ? view.current_user : nil
+
+      Array(sections)
+        .map { |section| symbolize(section) }
+        .reject { |section| section[:admin] && !admin }
+        .select { |section| enabled?(section[:if], view) }
+        .select { |section| served_by?(user, section[:requires]) }
+    end
+
+    # The app-capability gate. No `if:` means always enabled. The callable takes
+    # the view when it wants one and nothing when it does not, so a host can
+    # write either `-> { Studio.feature?(:x) }` or `->(view) { view.admin? }`.
+    def enabled?(condition, view)
+      return true if condition.nil?
+
+      # A Symbol/String names a method on the VIEW — Rails' own
+      # `before_action ..., if: :method_name` convention, and therefore the most
+      # natural thing a host will write here.
+      #
+      # It is handled explicitly because the alternative FAILS OPEN: a Symbol
+      # does not answer `call`, so the earlier `return !!condition` coerced
+      # `:some_predicate` to true and rendered the row unconditionally — a gate
+      # that silently does nothing, in the same permissive direction as the bug
+      # this whole `if:` key was added to fix. A host would have had no signal.
+      if condition.is_a?(Symbol) || condition.is_a?(String)
+        return false unless view.respond_to?(condition)
+
+        return !!view.public_send(condition)
+      end
+
+      return !!condition unless condition.respond_to?(:call)
+
+      !!(condition.arity.zero? ? condition.call : condition.call(view))
+    end
+
+    # Can this host's user model serve the row? No requirement means yes — a row
+    # that reads nothing off the user (a static explainer, a link out) is always
+    # served. A nil user means we are rendering for nobody, and nothing is served.
+    def served_by?(user, requires)
+      needed = Array(requires).compact
+      return true if needed.empty?
+      return false if user.nil?
+
+      needed.all? { |attribute| user.respond_to?(attribute) }
+    end
+
+    def symbolize(hash)
+      out = hash.to_h.each_with_object({}) { |(key, value), acc| acc[key.to_sym] = value }
+
+      # `key` is an IDENTIFIER, so its VALUE symbolizes too — unlike every other
+      # field, whose value is data. A host composing by key writes
+      # `reject { |s| s[:key] == :avatar }`, and that silently matches nothing if
+      # a section declared with string keys kept `"avatar"` as a String. Removing
+      # a standard row is the documented seam; it must not depend on which
+      # spelling the host happened to use.
+      out[:key] = out[:key].to_sym if out[:key].respond_to?(:to_sym)
+      out
+    end
+  end
+end

data/lib/studio/version.rb

@@ -1,3 +1,3 @@
 module Studio
-  VERSION = "0.47.2"
+  VERSION = "0.48.0"
 end