@kromatv/sdk 0.1.40-canary.0

package/package.json

@@ -0,0 +1,78 @@
+{
+  "name": "@kromatv/sdk",
+  "version": "0.1.40-canary.0",
+  "description": "Build KROMA modules: the SDK, the design system types, the Rust crates and the kroma CLI in one package.",
+  "author": "Maxime Scharwath <maxscharwath@gmail.com>",
+  "license": "GPL-2.0-or-later",
+  "homepage": "https://kroma.tv",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/maxscharwath/kroma.git",
+    "directory": "packages/module-sdk"
+  },
+  "keywords": [
+    "kroma",
+    "module",
+    "kmod",
+    "sdk",
+    "cli",
+    "media-server"
+  ],
+  "type": "module",
+  "bin": {
+    "kroma": "./dist/cli.js"
+  },
+  "exports": {
+    ".": {
+      "types": "./types/module-sdk/src/index.d.ts"
+    },
+    "./shared": {
+      "types": "./types/module-sdk/src/shared.d.ts"
+    },
+    "./tsconfig": "./tsconfig.module.json"
+  },
+  "imports": {
+    "#ui/*": {
+      "types": [
+        "./types/ui/src/*.d.ts",
+        "./types/ui/src/*/index.d.ts"
+      ]
+    }
+  },
+  "files": [
+    "dist",
+    "types",
+    "rust",
+    "templates",
+    "tsconfig.module.json",
+    "README.md"
+  ],
+  "engines": {
+    "bun": ">=1.4.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@clack/prompts": "1.7.0",
+    "@tabler/icons-react": "^3.46.0",
+    "@tanstack/react-query": "^5.101.4",
+    "@tanstack/react-table": "^8.21.3",
+    "citty": "0.2.2",
+    "es-module-lexer": "^2.3.1",
+    "hono": "^4.13.2",
+    "magic-string": "^0.30.21",
+    "react-native-svg": "^15.15.5",
+    "vite": "8.2.1",
+    "zod": "^4.5.4"
+  },
+  "peerDependencies": {
+    "@tanstack/react-query": "^5",
+    "react": ">=18",
+    "react-dom": ">=18",
+    "react-native": "*"
+  },
+  "kroma": {
+    "reactNative": "npm:react-native-tvos@0.86.0-2"
+  }
+}

package/rust/Cargo.toml

@@ -0,0 +1,3 @@
+[workspace]
+resolver = "2"
+members = ["kroma-module-sdk", "kroma-module-runtime", "kroma-module-host", "kroma-module-manifest", "kroma-module-macros", "kroma-domain", "kroma-http", "kroma-db", "kroma-primitives", "kroma-testing"]

package/rust/kroma-db/Cargo.toml

@@ -0,0 +1,27 @@
+[package]
+name = "kroma-db"
+version = "0.1.40-canary.0"
+edition = "2021"
+rust-version = "1.88"
+description = "SQLite persistence layer: connection pool + all SQL, one table per domain noun"
+license = "MIT"
+
+[features]
+# Compiles `testing::temp_pool`, the shared throwaway database. Off by default
+# so nothing reaches a release build; crates whose tests need a real pool turn
+# it on in their dev-dependencies.
+testing = ["dep:kroma-testing"]
+
+[dependencies]
+kroma-domain = { path = "../kroma-domain" }
+kroma-primitives = { path = "../kroma-primitives" }
+kroma-testing = { path = "../kroma-testing", optional = true }
+anyhow = { version = "1" }
+serde = { version = "1", features = ["derive"] }
+serde_json = { version = "1" }
+time = { version = "0.3", features = ["formatting", "macros"] }
+# Embedded SQLite compiled from source (bundled) — no system libsqlite3 needed.
+rusqlite = { version = "0.40", features = ["bundled", "hooks"] }
+# Only for the denial line a module's storage grant emits: a bare SQLITE_AUTH
+# says "not authorized" and nothing about which table.
+tracing = { version = "0.1" }

package/rust/kroma-db/src/accounts/access_tokens.rs

@@ -0,0 +1,197 @@
+//! The long-lived device credential a session is minted from.
+
+use anyhow::Result;
+use rusqlite::params;
+
+use kroma_domain::User;
+
+use crate::rows::row_to_user;
+use crate::{now_or_blank, Pool};
+
+/// `pin_verified` is true when the token was minted through a strong check
+/// (password login / correct PIN), so the exchange can skip the PIN on
+/// subsequent silent refreshes.
+pub fn create_access_token(
+    pool: &Pool,
+    token: &str,
+    user_id: &str,
+    expires_at: i64,
+    pin_verified: bool,
+    user_agent: Option<&str>,
+) -> Result<()> {
+    let conn = pool.get()?;
+    conn.execute(
+        "INSERT INTO access_tokens (token,user_id,created_at,expires_at,pin_verified,last_seen,user_agent) \
+         VALUES (?1,?2,?3,?4,?5,?3,?6)",
+        params![token, user_id, now_or_blank(), expires_at, pin_verified as i64, user_agent],
+    )?;
+    Ok(())
+}
+
+pub struct AccessTokenRow {
+    pub id: String,
+    pub user_agent: Option<String>,
+    pub created_at: String,
+    pub last_seen: Option<String>,
+}
+
+/// A user's live (non-expired) device credentials, newest first.
+pub fn list_access_tokens(pool: &Pool, user_id: &str) -> Result<Vec<AccessTokenRow>> {
+    let conn = pool.get()?;
+    let now = time::OffsetDateTime::now_utc().unix_timestamp();
+    let mut stmt = conn.prepare(
+        "SELECT token,created_at,last_seen,user_agent FROM access_tokens \
+         WHERE user_id = ?1 AND expires_at > ?2 ORDER BY created_at DESC",
+    )?;
+    let rows = stmt.query_map(params![user_id, now], |r| {
+        let token: String = r.get(0)?;
+        Ok(AccessTokenRow {
+            id: kroma_primitives::short_hash(&token),
+            created_at: r.get(1)?,
+            last_seen: r.get(2)?,
+            user_agent: r.get(3)?,
+        })
+    })?;
+    Ok(rows.collect::<rusqlite::Result<Vec<_>>>()?)
+}
+
+/// Revoke a device credential by its non-secret `short_hash(token)` id, also
+/// deleting any live sessions minted from it so the device is signed out at
+/// once. Scoped to `user_id`, so a caller can only revoke their own devices.
+pub fn delete_access_token_by_id(pool: &Pool, user_id: &str, id: &str) -> Result<bool> {
+    let conn = pool.get()?;
+    // Tokens are only reversible by hashing, hence the scan for a matching hash.
+    let mut stmt = conn.prepare("SELECT token FROM access_tokens WHERE user_id = ?1")?;
+    let tokens = stmt
+        .query_map(params![user_id], |r| r.get::<_, String>(0))?
+        .collect::<rusqlite::Result<Vec<_>>>()?;
+    let Some(token) = tokens
+        .into_iter()
+        .find(|t| kroma_primitives::short_hash(t) == id)
+    else {
+        return Ok(false);
+    };
+    conn.execute(
+        "DELETE FROM sessions WHERE access_token = ?1",
+        params![token],
+    )?;
+    conn.execute("DELETE FROM access_tokens WHERE token = ?1", params![token])?;
+    Ok(true)
+}
+
+/// The user behind a non-expired access token, plus its `pin_verified` flag.
+pub fn access_token_user(pool: &Pool, token: &str) -> Result<Option<(User, bool)>> {
+    let conn = pool.get()?;
+    let now = time::OffsetDateTime::now_utc().unix_timestamp();
+    let mut stmt = conn.prepare(
+        "SELECT u.id,u.email,u.username,u.avatar_url,u.created_at,u.permissions,u.language,(u.pin_hash IS NOT NULL),u.audio_language,u.subtitle_language,a.pin_verified \
+         FROM access_tokens a JOIN users u ON u.id = a.user_id \
+         WHERE a.token = ?1 AND a.expires_at > ?2",
+    )?;
+    let mut rows = stmt.query_map(params![token, now], |r| {
+        Ok((row_to_user(r)?, r.get::<_, i64>(10)? != 0))
+    })?;
+    match rows.next() {
+        Some(v) => Ok(Some(v?)),
+        None => Ok(None),
+    }
+}
+
+/// Stamp a device credential as seen now, re-labelling it with `user_agent`
+/// when the caller sent one; an absent header keeps the stored label rather
+/// than blanking it.
+pub fn touch_access_token(pool: &Pool, token: &str, user_agent: Option<&str>) -> Result<()> {
+    let conn = pool.get()?;
+    conn.execute(
+        "UPDATE access_tokens SET last_seen = ?2, user_agent = COALESCE(?3, user_agent) \
+         WHERE token = ?1",
+        params![token, now_or_blank(), user_agent],
+    )?;
+    Ok(())
+}
+
+pub fn set_access_pin_verified(pool: &Pool, token: &str, verified: bool) -> Result<()> {
+    let conn = pool.get()?;
+    conn.execute(
+        "UPDATE access_tokens SET pin_verified = ?2 WHERE token = ?1",
+        params![token, verified as i64],
+    )?;
+    Ok(())
+}
+
+/// Re-lock every device: called when the PIN is set, rotated or cleared, so all
+/// of them must re-confirm the new state.
+pub fn reset_access_pin_verified(pool: &Pool, user_id: &str) -> Result<()> {
+    let conn = pool.get()?;
+    conn.execute(
+        "UPDATE access_tokens SET pin_verified = 0 WHERE user_id = ?1",
+        params![user_id],
+    )?;
+    Ok(())
+}
+
+pub fn delete_access_token(pool: &Pool, token: &str) -> Result<()> {
+    let conn = pool.get()?;
+    conn.execute("DELETE FROM access_tokens WHERE token = ?1", params![token])?;
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::accounts::test_support::*;
+    use crate::accounts::{create_session, session_user};
+
+    #[test]
+    fn access_tokens_lifecycle_and_pin_verified() {
+        let p = pool();
+        let u = mk_user(&p, "a@b.c", "alice");
+        create_access_token(&p, "at1", &u.id, FUTURE, false, Some("Firefox")).unwrap();
+
+        let (user, pin_verified) = access_token_user(&p, "at1").unwrap().unwrap();
+        assert_eq!(user.id, u.id);
+        assert!(!pin_verified);
+
+        set_access_pin_verified(&p, "at1", true).unwrap();
+        assert!(access_token_user(&p, "at1").unwrap().unwrap().1);
+        reset_access_pin_verified(&p, &u.id).unwrap();
+        assert!(!access_token_user(&p, "at1").unwrap().unwrap().1);
+
+        let rows = list_access_tokens(&p, &u.id).unwrap();
+        assert_eq!(rows.len(), 1);
+        assert_eq!(rows[0].id, kroma_primitives::short_hash("at1"));
+        assert_eq!(rows[0].user_agent.as_deref(), Some("Firefox"));
+
+        touch_access_token(&p, "at1", Some("Kroma/1.0 (iPhone 17 Pro; iOS 26.0)")).unwrap();
+        touch_access_token(&p, "at1", None).unwrap();
+        let rows = list_access_tokens(&p, &u.id).unwrap();
+        assert_eq!(
+            rows[0].user_agent.as_deref(),
+            Some("Kroma/1.0 (iPhone 17 Pro; iOS 26.0)")
+        );
+        assert!(rows[0].last_seen.is_some());
+
+        create_access_token(&p, "old-at", &u.id, 1, false, None).unwrap();
+        assert!(access_token_user(&p, "old-at").unwrap().is_none());
+        assert_eq!(list_access_tokens(&p, &u.id).unwrap().len(), 1);
+
+        delete_access_token(&p, "at1").unwrap();
+        assert!(access_token_user(&p, "at1").unwrap().is_none());
+    }
+
+    #[test]
+    fn delete_access_token_by_id_scopes_to_owner_and_drops_sessions() {
+        let p = pool();
+        let alice = mk_user(&p, "a@b.c", "alice");
+        let bob = mk_user(&p, "b@b.c", "bob");
+        create_access_token(&p, "at-alice", &alice.id, FUTURE, true, None).unwrap();
+        create_session(&p, "sess-alice", &alice.id, FUTURE, Some("at-alice")).unwrap();
+
+        let id = kroma_primitives::short_hash("at-alice");
+        assert!(!delete_access_token_by_id(&p, &bob.id, &id).unwrap());
+        assert!(delete_access_token_by_id(&p, &alice.id, &id).unwrap());
+        assert!(access_token_user(&p, "at-alice").unwrap().is_none());
+        assert!(session_user(&p, "sess-alice").unwrap().is_none());
+        assert!(!delete_access_token_by_id(&p, &alice.id, "deadbeef").unwrap());
+    }
+}

package/rust/kroma-db/src/accounts/credentials.rs

@@ -0,0 +1,97 @@
+//! The secrets on a user row: the password hash and the PIN hash.
+
+use anyhow::Result;
+use rusqlite::{params, OptionalExtension};
+
+use crate::Pool;
+
+pub fn user_password_hash(pool: &Pool, user_id: &str) -> Result<Option<String>> {
+    let conn = pool.get()?;
+    let hash = conn
+        .query_row(
+            "SELECT password_hash FROM users WHERE id = ?1",
+            params![user_id],
+            |r| r.get::<_, String>(0),
+        )
+        .optional()?;
+    Ok(hash)
+}
+
+pub fn set_user_password(pool: &Pool, user_id: &str, password_hash: &str) -> Result<()> {
+    let conn = pool.get()?;
+    conn.execute(
+        "UPDATE users SET password_hash = ?2 WHERE id = ?1",
+        params![user_id, password_hash],
+    )?;
+    Ok(())
+}
+
+/// The stored PBKDF2 PIN hash, or `None` when no PIN is set.
+pub fn user_pin_hash(pool: &Pool, user_id: &str) -> Result<Option<String>> {
+    let conn = pool.get()?;
+    let hash = conn
+        .query_row(
+            "SELECT pin_hash FROM users WHERE id = ?1",
+            params![user_id],
+            |r| r.get::<_, Option<String>>(0),
+        )
+        .optional()?
+        .flatten();
+    Ok(hash)
+}
+
+pub fn set_user_pin(pool: &Pool, user_id: &str, pin_hash: Option<&str>) -> Result<()> {
+    let conn = pool.get()?;
+    conn.execute(
+        "UPDATE users SET pin_hash = ?2 WHERE id = ?1",
+        params![user_id, pin_hash],
+    )?;
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::accounts::test_support::*;
+    use crate::accounts::{find_user_by_email, list_users, set_user_email, user_by_id};
+
+    #[test]
+    fn password_and_email_updates() {
+        let p = pool();
+        let u = mk_user(&p, "a@b.c", "alice");
+        assert_eq!(
+            user_password_hash(&p, &u.id).unwrap().as_deref(),
+            Some("hash")
+        );
+        assert!(user_password_hash(&p, "missing").unwrap().is_none());
+        set_user_password(&p, &u.id, "new-hash").unwrap();
+        assert_eq!(
+            user_password_hash(&p, &u.id).unwrap().as_deref(),
+            Some("new-hash")
+        );
+
+        set_user_email(&p, &u.id, "new@b.c").unwrap();
+        assert!(find_user_by_email(&p, "new@b.c").unwrap().is_some());
+        assert!(find_user_by_email(&p, "a@b.c").unwrap().is_none());
+    }
+
+    #[test]
+    fn pin_hash_set_clear_and_has_pin_flag() {
+        let p = pool();
+        let u = mk_user(&p, "a@b.c", "alice");
+        assert!(user_pin_hash(&p, &u.id).unwrap().is_none());
+        assert!(!user_by_id(&p, &u.id).unwrap().unwrap().has_pin);
+
+        set_user_pin(&p, &u.id, Some("pin-hash")).unwrap();
+        assert_eq!(
+            user_pin_hash(&p, &u.id).unwrap().as_deref(),
+            Some("pin-hash")
+        );
+        assert!(user_by_id(&p, &u.id).unwrap().unwrap().has_pin);
+        assert!(list_users(&p).unwrap()[0].has_pin);
+
+        set_user_pin(&p, &u.id, None).unwrap();
+        assert!(user_pin_hash(&p, &u.id).unwrap().is_none());
+        assert!(!user_by_id(&p, &u.id).unwrap().unwrap().has_pin);
+    }
+}

package/rust/kroma-db/src/accounts/invites.rs

@@ -0,0 +1,136 @@
+//! Invites: the token a new account is created against.
+
+use anyhow::Result;
+use rusqlite::{params, OptionalExtension, Row};
+
+use kroma_domain::{Invite, Permission};
+
+use crate::rows::parse_permissions;
+use crate::{now_or_blank, Pool};
+
+fn row_to_invite(r: &Row) -> rusqlite::Result<Invite> {
+    let used_at: Option<String> = r.get(5)?;
+    Ok(Invite {
+        token: r.get(0)?,
+        permissions: parse_permissions(&r.get::<_, String>(1)?),
+        created_by: r.get(2)?,
+        created_at: r.get(3)?,
+        expires_at: r.get(4)?,
+        used: used_at.is_some(),
+    })
+}
+
+pub fn create_invite(
+    pool: &Pool,
+    token: &str,
+    permissions: &[Permission],
+    created_by: &str,
+    expires_at: i64,
+) -> Result<()> {
+    let conn = pool.get()?;
+    let perms_json = serde_json::to_string(permissions).unwrap_or_else(|_| "[\"playback\"]".into());
+    conn.execute(
+        "INSERT INTO invites (token,permissions,created_by,created_at,expires_at,used_at) \
+         VALUES (?1,?2,?3,?4,?5,NULL)",
+        params![token, perms_json, created_by, now_or_blank(), expires_at],
+    )?;
+    Ok(())
+}
+
+/// Fetch one invite by token, whatever its state.
+pub fn get_invite(pool: &Pool, token: &str) -> Result<Option<Invite>> {
+    let conn = pool.get()?;
+    let inv = conn
+        .query_row(
+            "SELECT token,permissions,created_by,created_at,expires_at,used_at FROM invites WHERE token = ?1",
+            params![token],
+            row_to_invite,
+        )
+        .optional()?;
+    Ok(inv)
+}
+
+/// Atomically consume a valid (unused, unexpired) invite → its granted
+/// permissions. `None` if the token is unknown / used / expired.
+pub fn consume_invite(pool: &Pool, token: &str) -> Result<Option<Vec<Permission>>> {
+    let conn = pool.get()?;
+    let now = time::OffsetDateTime::now_utc().unix_timestamp();
+    // `used_at IS NULL` is checked in the same statement that stamps it, and
+    // `RETURNING` only yields to the caller that flipped the row, so two
+    // concurrent registrations can't both win a single-use invite.
+    let perms: Option<String> = conn
+        .query_row(
+            "UPDATE invites SET used_at = ?2 \
+             WHERE token = ?1 AND used_at IS NULL AND expires_at > ?3 \
+             RETURNING permissions",
+            params![token, now_or_blank(), now],
+            |r| r.get(0),
+        )
+        .optional()?;
+    Ok(perms.map(|json| parse_permissions(&json)))
+}
+
+/// Pending invites (unused, unexpired), newest first.
+pub fn list_invites(pool: &Pool) -> Result<Vec<Invite>> {
+    let conn = pool.get()?;
+    let now = time::OffsetDateTime::now_utc().unix_timestamp();
+    let mut stmt = conn.prepare(
+        "SELECT token,permissions,created_by,created_at,expires_at,used_at FROM invites \
+         WHERE used_at IS NULL AND expires_at > ?1 ORDER BY created_at DESC",
+    )?;
+    let rows = stmt.query_map(params![now], row_to_invite)?;
+    Ok(rows.collect::<rusqlite::Result<Vec<_>>>()?)
+}
+
+pub fn delete_invite(pool: &Pool, token: &str) -> Result<()> {
+    let conn = pool.get()?;
+    conn.execute("DELETE FROM invites WHERE token = ?1", params![token])?;
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::accounts::test_support::*;
+
+    #[test]
+    fn invites_create_list_consume_and_delete() {
+        let p = pool();
+        let owner = mk_user(&p, "o@b.c", "owner");
+        create_invite(
+            &p,
+            "inv1",
+            &[Permission::Playback, Permission::RequestsCreate],
+            &owner.id,
+            FUTURE,
+        )
+        .unwrap();
+
+        let got = get_invite(&p, "inv1").unwrap().unwrap();
+        assert_eq!(got.token, "inv1");
+        assert_eq!(
+            got.permissions,
+            vec![Permission::Playback, Permission::RequestsCreate]
+        );
+        assert!(!got.used);
+        assert_eq!(list_invites(&p).unwrap().len(), 1);
+
+        let perms = consume_invite(&p, "inv1").unwrap().unwrap();
+        assert_eq!(
+            perms,
+            vec![Permission::Playback, Permission::RequestsCreate]
+        );
+        assert!(get_invite(&p, "inv1").unwrap().unwrap().used);
+        assert!(consume_invite(&p, "inv1").unwrap().is_none());
+        assert!(list_invites(&p).unwrap().is_empty());
+
+        create_invite(&p, "old", &[Permission::Playback], &owner.id, 1).unwrap();
+        assert!(consume_invite(&p, "old").unwrap().is_none());
+        assert!(list_invites(&p).unwrap().is_empty());
+        assert!(consume_invite(&p, "unknown").unwrap().is_none());
+
+        create_invite(&p, "inv2", &[Permission::Playback], &owner.id, FUTURE).unwrap();
+        delete_invite(&p, "inv2").unwrap();
+        assert!(get_invite(&p, "inv2").unwrap().is_none());
+    }
+}

package/rust/kroma-db/src/accounts/preferences.rs

@@ -0,0 +1,100 @@
+//! What a user chose: their avatar and their languages.
+
+use anyhow::Result;
+use rusqlite::params;
+
+use crate::Pool;
+
+/// Uploaded avatars live in the same `images` dir as the regenerable art cache,
+/// so the cleanup job uses this to spare them — they can't be re-downloaded.
+pub fn avatar_urls(pool: &Pool) -> Result<Vec<String>> {
+    let conn = pool.get()?;
+    let mut stmt = conn.prepare("SELECT avatar_url FROM users WHERE avatar_url IS NOT NULL")?;
+    let rows = stmt.query_map([], |r| r.get::<_, String>(0))?;
+    Ok(rows.collect::<rusqlite::Result<Vec<_>>>()?)
+}
+
+pub fn set_user_avatar(pool: &Pool, user_id: &str, avatar_url: Option<&str>) -> Result<()> {
+    let conn = pool.get()?;
+    conn.execute(
+        "UPDATE users SET avatar_url = ?2 WHERE id = ?1",
+        params![user_id, avatar_url],
+    )?;
+    Ok(())
+}
+
+pub fn set_user_language(pool: &Pool, user_id: &str, language: Option<&str>) -> Result<()> {
+    let conn = pool.get()?;
+    conn.execute(
+        "UPDATE users SET language = ?2 WHERE id = ?1",
+        params![user_id, language],
+    )?;
+    Ok(())
+}
+
+pub fn set_user_audio_language(pool: &Pool, user_id: &str, language: Option<&str>) -> Result<()> {
+    let conn = pool.get()?;
+    conn.execute(
+        "UPDATE users SET audio_language = ?2 WHERE id = ?1",
+        params![user_id, language],
+    )?;
+    Ok(())
+}
+
+/// The sentinel `"off"` is a stored value meaning "force subtitles off".
+pub fn set_user_subtitle_language(
+    pool: &Pool,
+    user_id: &str,
+    language: Option<&str>,
+) -> Result<()> {
+    let conn = pool.get()?;
+    conn.execute(
+        "UPDATE users SET subtitle_language = ?2 WHERE id = ?1",
+        params![user_id, language],
+    )?;
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::accounts::test_support::*;
+    use crate::accounts::user_by_id;
+
+    #[test]
+    fn avatar_get_set_and_urls() {
+        let p = pool();
+        let u = mk_user(&p, "a@b.c", "alice");
+        assert!(avatar_urls(&p).unwrap().is_empty());
+        set_user_avatar(&p, &u.id, Some("/api/images/av.webp")).unwrap();
+        assert_eq!(
+            avatar_urls(&p).unwrap(),
+            vec!["/api/images/av.webp".to_string()]
+        );
+        assert_eq!(
+            user_by_id(&p, &u.id)
+                .unwrap()
+                .unwrap()
+                .avatar_url
+                .as_deref(),
+            Some("/api/images/av.webp")
+        );
+        set_user_avatar(&p, &u.id, None).unwrap();
+        assert!(avatar_urls(&p).unwrap().is_empty());
+    }
+
+    #[test]
+    fn language_preferences_round_trip() {
+        let p = pool();
+        let u = mk_user(&p, "a@b.c", "alice");
+        set_user_language(&p, &u.id, Some("fr")).unwrap();
+        set_user_audio_language(&p, &u.id, Some("ja")).unwrap();
+        set_user_subtitle_language(&p, &u.id, Some("off")).unwrap();
+        let got = user_by_id(&p, &u.id).unwrap().unwrap();
+        assert_eq!(got.language.as_deref(), Some("fr"));
+        assert_eq!(got.audio_language.as_deref(), Some("ja"));
+        assert_eq!(got.subtitle_language.as_deref(), Some("off"));
+        set_user_language(&p, &u.id, None).unwrap();
+        assert!(user_by_id(&p, &u.id).unwrap().unwrap().language.is_none());
+    }
+}