Add user feature permissions and unified account management

backend/tests/test_email_recaps.py

@@ -260,6 +260,20 @@ class RecapDeliveryTests(RecapFixture, unittest.IsolatedAsyncioTestCase):
             await self.run_claim()
         self.assertEqual(self.delivery(delivery_id)['state'], 'cancelled')
 
+    async def test_stats_permission_revoked_during_report_cancels_email(self):
+        from backend.app.feature_access import update_permissions
+        delivery_id = self.queue()
+        db.set_user_role('viewer', 'user')
+        async def report(*args):
+            update_permissions({'stats': False}, 'viewer')
+            return self.report
+        def transport(recipient, rendered, message_id, before_data):
+            before_data()
+            self.fail('Report must not be sent after stats permission is revoked')
+        with patch.object(recaps, 'get_monthly_report', side_effect=report), patch.object(mail, 'send_email', side_effect=transport):
+            await self.run_claim()
+        self.assertEqual(self.delivery(delivery_id)['state'], 'cancelled')
+
     async def test_blocked_expired_and_deleted_accounts_are_not_sent(self):
         for kind in ['blocked', 'expired', 'deleted']:
             with self.subTest(kind=kind):
@@ -331,7 +345,7 @@ class RecapApiTests(RecapFixture, unittest.TestCase):
         self.addCleanup(self.client.close)
 
     def login(self, role='admin'):
-        self.app.dependency_overrides[get_current_user] = lambda: {**self.user, 'role': role}
+        self.app.dependency_overrides[get_current_user] = lambda: {**self.user, 'role': role, 'features': {'stats': True}}
 
     def test_authentication_roles_and_recipient_override(self):
         self.assertEqual(self.client.get('/admin/email-recaps').status_code, 401)
@@ -550,7 +564,7 @@ class OnDemandReportTests(RecapFixture, unittest.IsolatedAsyncioTestCase):
     async def test_regular_user_can_only_send_to_self(self):
         self.subscribe()
         app = FastAPI(); app.include_router(router.router)
-        app.dependency_overrides[get_current_user] = lambda: {'username': 'viewer', 'role': 'user'}
+        app.dependency_overrides[get_current_user] = lambda: {'username': 'viewer', 'role': 'user', 'features': {'stats': True}}
         client = TestClient(app)
         body = {'month': self.report['month'], 'request_id': '11111111-1111-4111-8111-111111111111'}
         for extra in [{'email': 'other@example.test'}, {'user_id': 42}, {'kind': 'scheduled'}]:

backend/tests/test_feature_access.py

@@ -0,0 +1,110 @@
+import unittest
+from unittest.mock import patch
+from backend.app.config import settings
+from fastapi import FastAPI
+from fastapi.testclient import TestClient
+from backend.app import db
+from backend.app.feature_access import FEATURES, permissions, update_permissions
+from backend.app.routers import admin, auth, events, insights, portal, recaps, requests
+from backend.app.security import create_access_token
+from backend.tests.test_backend_quality import TempDatabaseMixin
+
+
+class FeatureAccessTests(TempDatabaseMixin, unittest.TestCase):
+    def setUp(self):
+        super().setUp()
+        secret = patch.object(settings, "jwt_secret", "feature-access-tests-only-secret-123456789")
+        secret.start()
+        self.addCleanup(secret.stop)
+        db.create_user('feature-viewer', 'Example-password123!', role='user')
+        db.create_user('feature-admin', 'Example-password123!', role='admin')
+        self.user = db.get_user_by_username('feature-viewer')
+        app = FastAPI()
+        for module in (admin, auth, events, insights, portal, recaps, requests):
+            app.include_router(module.router)
+        self.client = TestClient(app)
+        self.client.headers['Authorization'] = 'Bearer ' + create_access_token(self.user['username'], 'user')
+
+    def test_defaults_persist_and_invites_share_existing_setting(self):
+        self.assertEqual(permissions(self.user), dict(stats=True, requests=True, new_requests=True, issues=True, invites=False))
+        update_permissions({'stats': False, 'invites': True}, self.user['username'])
+        db.init_db()
+        fresh = db.get_user_by_username(self.user['username'])
+        self.assertTrue(fresh['invite_management_enabled'])
+        self.assertFalse(permissions(fresh)['stats'])
+        db.set_user_invite_management_enabled(self.user['username'], False)
+        self.assertFalse(permissions(db.get_user_by_username(self.user['username']))['invites'])
+
+    def test_all_feature_apis_reject_disabled_access_with_existing_token(self):
+        update_permissions(dict.fromkeys(FEATURES, False), self.user['username'])
+        endpoints = [
+            ('GET', '/insights', None), ('GET', '/insights/reports/monthly', None),
+            ('GET', '/insights/reports/monthly.csv', None), ('GET', '/insights/artwork/item?token=x', None),
+            ('GET', '/profile/email-recaps', None), ('POST', '/profile/email-recaps/send', {}),
+            ('GET', '/requests/recent', None), ('GET', '/requests/search?query=Movie', None),
+            ('GET', '/requests/request-options?mediaType=movie&tmdbId=1', None),
+            ('POST', '/requests/create', {'mediaType': 'movie', 'tmdbId': 1}),
+            ('GET', '/requests/1/snapshot', None), ('POST', '/requests/1/actions/search', {}),
+            ('GET', '/requests/1/issue-options', None), ('POST', '/requests/1/actions/replace', {}),
+            ('GET', '/portal/items?kind=issue', None), ('GET', '/portal/requests', None),
+            ('POST', '/portal/items', {'kind': 'issue'}), ('POST', '/portal/items', {'kind': 'request'}),
+            ('GET', '/portal/issues/media-status', None), ('POST', '/portal/requests/1/issues', {}),
+            ('GET', '/auth/profile/invites', None), ('POST', '/auth/profile/invites', {}),
+            ('PUT', '/auth/profile/invites/1', {}), ('DELETE', '/auth/profile/invites/1', None),
+            ('GET', '/events/stream', None), ('GET', '/events/requests/1/stream', None),
+        ]
+        for method, path, payload in endpoints:
+            with self.subTest(path=path, method=method):
+                self.assertEqual(self.client.request(method, path, json=payload).status_code, 403)
+        self.assertEqual(self.client.get('/auth/me').json()['features'], dict.fromkeys(FEATURES, False))
+        self.assertEqual(self.client.get('/auth/profile').status_code, 200)
+
+    def test_bulk_is_admin_only_strict_and_leaves_other_features_untouched(self):
+        self.assertEqual(self.client.put('/admin/users/features/bulk', json={'issues': False}).status_code, 403)
+        self.client.headers['Authorization'] = 'Bearer ' + create_access_token('feature-admin', 'admin')
+        for invalid in ({'issues': 'false'}, {'unknown': True}, {}):
+            self.assertEqual(self.client.put('/admin/users/features/bulk', json=invalid).status_code, 400)
+        response = self.client.put('/admin/users/features/bulk', json={'issues': False})
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(response.json()['updated'], 1)
+        self.assertFalse(permissions(self.user)['issues'])
+        self.assertTrue(permissions(self.user)['requests'])
+        self.assertTrue(all(permissions(db.get_user_by_username('feature-admin')).values()))
+        self.assertEqual(self.client.put('/admin/users/feature-admin/features', json={'stats': False}).status_code, 400)
+        self.assertEqual(self.client.put('/admin/users/missing/features', json={'stats': False}).status_code, 404)
+
+    def test_issue_and_request_item_routes_cannot_bypass_disabled_feature(self):
+        issue = db.create_portal_item(kind='issue', title='Problem', description='Problem', created_by_username=self.user['username'], created_by_id=self.user['id'])
+        update_permissions({'issues': False}, self.user['username'])
+        for path in (f'/portal/items/{issue["id"]}', f'/portal/items/{issue["id"]}/comments', '/portal/items', '/portal/overview'):
+            self.assertEqual(self.client.get(path).status_code, 403)
+        self.assertEqual(self.client.get('/portal/requests').status_code, 200)
+        self.assertEqual(self.client.get('/portal/items?kind=request').status_code, 200)
+        update_permissions({'issues': True, 'requests': False, 'new_requests': False}, self.user['username'])
+        self.assertEqual(self.client.get(f'/portal/items/{issue["id"]}').status_code, 200)
+        self.assertEqual(self.client.get('/portal/items?kind=issue').status_code, 200)
+        overview = self.client.get('/portal/overview?kind=issue')
+        self.assertEqual(overview.status_code, 200)
+        self.assertEqual(overview.json()['overview']['by_kind'], {'issue': 1})
+        self.assertEqual(self.client.post('/requests/create', json={'mediaType': 'movie', 'tmdbId': 1}).status_code, 403)
+
+    def test_deleted_account_does_not_leave_permissions_for_reused_id(self):
+        update_permissions({'stats': False}, self.user['username'])
+        db.delete_user_by_username(self.user['username'])
+        with db._connect() as conn:
+            self.assertEqual(conn.execute('SELECT COUNT(*) FROM user_feature_permissions').fetchone()[0], 0)
+
+
+    def test_open_request_stream_closes_after_permission_revocation(self):
+        import asyncio
+        from unittest.mock import AsyncMock
+        from types import SimpleNamespace
+        async def scenario():
+            request = SimpleNamespace(is_disconnected=AsyncMock(return_value=False))
+            response = await events.events_stream(request, user={**self.user, "features": permissions(self.user)})
+            iterator = response.body_iterator
+            self.assertIn('retry', await anext(iterator))
+            update_permissions({'requests': False}, self.user['username'])
+            with self.assertRaises(StopAsyncIteration):
+                await anext(iterator)
+        asyncio.run(scenario())

backend/tests/test_insights.py

@@ -177,7 +177,7 @@ class InsightsRouteTests(unittest.TestCase):
         app = FastAPI()
         app.include_router(router.router)
         if authenticated:
-            app.dependency_overrides[router.get_current_user] = lambda: USER
+            app.dependency_overrides[router.get_current_user] = lambda: {**USER, "features": {"stats": True}}
         return TestClient(app)
 
     def test_requires_authentication(self):
@@ -190,7 +190,7 @@ class InsightsRouteTests(unittest.TestCase):
                 response = client.get(f"/insights?days={days}")
                 self.assertEqual(response.status_code, 200, response.text)
                 self.assertEqual(response.headers["cache-control"], "no-store")
-            report.assert_awaited_with(USER, 365)
+            report.assert_awaited_with({**USER, "features": {"stats": True}}, 365)
             for query in ["days=-1", "days=999999", "days=invalid", "userid=other", "user_id=other", "scope=server"]:
                 self.assertEqual(client.get(f"/insights?{query}").status_code, 422, query)
 

backend/tests/test_insights_media.py

@@ -154,7 +154,7 @@ class ArtworkRouteTests(unittest.TestCase):
         app.include_router(router.router)
         client = TestClient(app)
         self.assertEqual(client.get(f"/insights/artwork/{ITEM}?token=invalid").status_code, 401)
-        app.dependency_overrides[router.get_current_user] = lambda: USER
+        app.dependency_overrides[router.get_current_user] = lambda: {**USER, "features": {"stats": True}}
         with patch.object(router, "get_runtime_settings", return_value=None), \
              patch.object(router, "get_artwork", new_callable=AsyncMock, return_value=(PNG, "image/png")):
             result = client.get(f"/insights/artwork/{ITEM}?token=fixture")

backend/tests/test_monthly_reports.py

@@ -175,7 +175,7 @@ class MonthlyReportRouteTests(unittest.TestCase):
         app = FastAPI()
         app.include_router(router.router)
         if authenticated:
-            app.dependency_overrides[router.get_current_user] = lambda: USER
+            app.dependency_overrides[router.get_current_user] = lambda: {**USER, "features": {"stats": True}}
         return TestClient(app)
 
     def test_both_formats_require_auth_and_reject_scope_overrides(self):
@@ -189,7 +189,7 @@ class MonthlyReportRouteTests(unittest.TestCase):
              patch.object(router, 'report_csv', return_value='\ufeffMetric,Value\r\nMinutes,60\r\n'):
             response = self.client().get('/insights/reports/monthly?month=2026-08')
             self.assertEqual(response.headers['cache-control'], 'no-store')
-            report.assert_awaited_with(USER, '2026-08')
+            report.assert_awaited_with({**USER, "features": {"stats": True}}, '2026-08')
             response = self.client().get('/insights/reports/monthly.csv?month=2026-08')
             self.assertEqual(response.status_code, 200)
             self.assertEqual(response.headers['content-type'], 'text/csv; charset=utf-8')

backend/tests/test_portal_privacy.py

@@ -15,7 +15,7 @@ class PortalPrivacyTests(unittest.TestCase):
                    'message': 'Sent to secret@example.com for private-reporter', 'is_internal': False}
         app = FastAPI()
         app.include_router(portal.router)
-        app.dependency_overrides[portal.get_current_user] = lambda: {'username': 'viewer', 'role': 'user'}
+        app.dependency_overrides[portal.get_current_user] = lambda: {'username': 'viewer', 'role': 'user', 'features': {'issues': True, 'requests': True, 'new_requests': True}}
         with patch.object(portal, 'get_portal_item', return_value=item), \
              patch.object(portal, '_list_portal_comments', return_value=[comment]), \
              patch.object(portal, 'list_portal_item_activity', return_value=[]), \