Let the onboarding screen complete a profile (PMS-752) #507

Merged

longjacksonle merged 1 commit from feat/PMS-752-complete-onboarding into main

2026-08-09 21:10:00 +02:00

longjacksonle commented

2026-08-09 21:04:26 +02:00

Owner

PMS-752. Small server half: one endpoint so the SPA's onboarding screen can finish. The SPA half is mokosh-apps #502 and needs this.

Since PMS-512, profile_completed_at has had exactly one writer: upsert_user_from_oidc, stamping it on a login whose bunyip claims carry both names. A user whose claims did not carry them lands on mokosh's fallback onboarding screen and cannot leave it. That screen submits names to PUT /auth/me, which ignores them (bunyip owns the names, mokosh keeps a read-only cache), so nothing completes the profile and the AuthGuard sends the user straight back. It only looks healthy because bunyip normally supplies names and the screen is normally skipped.

POST /api/v1/auth/me/complete-onboarding stamps it for the caller and returns the refreshed user. Idempotent via COALESCE, so a double submit or a replayed request records when onboarding was actually finished rather than moving the timestamp forward.

Nothing about the request is trusted beyond the session: there is no body, the only assertion is "this user has been through onboarding", and the caller is the user.

Testing

cargo fmt --all --check, cargo clippy --all-targets, and a new test in tests/bunyip_login.rs that places a user with no name claims (so the profile is genuinely incomplete, asserted first), completes onboarding, and calls it twice to pin the idempotence. It sits with the two existing tests for the stamping rules it changes, rather than in a file of its own.

PMS-752. Small server half: one endpoint so the SPA's onboarding screen can finish. The SPA half is mokosh-apps #502 and needs this. Since PMS-512, `profile_completed_at` has had exactly one writer: `upsert_user_from_oidc`, stamping it on a login whose bunyip claims carry both names. A user whose claims did not carry them lands on mokosh's fallback onboarding screen and cannot leave it. That screen submits names to `PUT /auth/me`, which ignores them (bunyip owns the names, mokosh keeps a read-only cache), so nothing completes the profile and the AuthGuard sends the user straight back. It only looks healthy because bunyip normally supplies names and the screen is normally skipped. `POST /api/v1/auth/me/complete-onboarding` stamps it for the caller and returns the refreshed user. Idempotent via `COALESCE`, so a double submit or a replayed request records when onboarding was actually finished rather than moving the timestamp forward. Nothing about the request is trusted beyond the session: there is no body, the only assertion is "this user has been through onboarding", and the caller is the user. ## Testing `cargo fmt --all --check`, `cargo clippy --all-targets`, and a new test in `tests/bunyip_login.rs` that places a user with no name claims (so the profile is genuinely incomplete, asserted first), completes onboarding, and calls it twice to pin the idempotence. It sits with the two existing tests for the stamping rules it changes, rather than in a file of its own.

longjacksonle added 1 commit

2026-08-09 21:04:27 +02:00

feat(auth): let the onboarding screen complete a profile

E2E / Playwright against staging (pull_request) Successful in 2m13s

Details

Check / fmt + clippy + build + tests (pull_request) Successful in 5m31s

Details

Create release / Gate (release-branch merges only) (pull_request) Successful in 2s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

Integration / integration tests (pull_request) Failing after 7m20s

Details

d3d3a0cabd

PMS-752. Since PMS-512, `profile_completed_at` has had exactly one writer: `upsert_user_from_oidc`, stamping it on a login whose bunyip claims carry both names. A user whose claims did not carry them lands on the SPA's onboarding screen, and could not leave it. That screen posts names to `PUT /auth/me`, which ignores them because bunyip owns the names, so nothing completed the profile and the AuthGuard sent the user straight back.

`POST /api/v1/auth/me/complete-onboarding` stamps it for the caller. Idempotent via COALESCE, so a double submit records when onboarding was finished rather than when it was last re-submitted.

Nothing about the request is trusted beyond the session. The only assertion is "this user has been through onboarding", and the caller is the user.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E48b8YHWYwmaKjFBy5esXp

longjacksonle scheduled this pull request to auto merge when all checks succeed

2026-08-09 21:05:20 +02:00