Seed household settings at boot and serve the settings API

On first boot create the single household_settings row with the zone from
MEALQUEST_DEFAULT_TZ and the seed times and days (dinner 17:30, reminder
16:30, rotation check 09:00, plan draft Fri 09:00, suggestions Sun 08:00,
chat autosend Sat 08:00). Boot fails if the row is missing and the zone is
unset; an existing row is never overwritten. Config validates the zone
whenever it is set.

Add household.SettingsService with Get, a validating Update (IANA zone,
zero-padded 24-hour HH:MM, day of week 0-6) that records updated_by, and
in-process Subscribe for the scheduler. Serve it as GET and PATCH
/api/v1/settings/household; invalid input is a 400 in the standard error
body. Migration 0002 adds household_settings.updated_by, and
internal/actor carries the member name in the request context.

Link time/tzdata from internal/household so zones load in the minimal
image, which has no system zone database.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -30,27 +30,18 @@ export MEALQUEST_PUBLIC_URL=http://localhost:5173
 export MEALQUEST_DATA_DIR="$HOME/.mealquest-dev"
 export MEALQUEST_SHUTDOWN_TIMEOUT=10s
 export MEALQUEST_SECRET_KEY_FILE="$HOME/.mealquest-dev/secret_key"
-# Authentik OAuth2/OpenID provider for MealQuest (redirect URI:
-# $MEALQUEST_PUBLIC_URL/auth/callback). Save its client secret to the file.
-export MEALQUEST_OIDC_ISSUER=https://auth.example.com/application/o/mealquest/
-export MEALQUEST_OIDC_CLIENT_ID=mealquest
-export MEALQUEST_OIDC_CLIENT_SECRET_FILE="$HOME/.mealquest-dev/oidc_client_secret"
-export MEALQUEST_OIDC_ALLOWED_GROUPS=mealquest-admin
-# Optional: sessions end after MEALQUEST_SESSION_IDLE unused (default 720h)
-# and always MEALQUEST_SESSION_MAX after sign-in (default 4320h).
-# export MEALQUEST_SESSION_IDLE=720h
-# export MEALQUEST_SESSION_MAX=4320h
+export MEALQUEST_DEFAULT_TZ=America/New_York
 make dev
 ```
 
 `make dev` runs the Go server on `:8080` and the Vite dev server on `:5173`
 (which proxies `/api`, `/auth` and `/media` to `:8080`). Open
 http://localhost:5173. Configuration is environment-only and fails fast:
-every variable above is required except the commented-out session
-lifetimes (when set they must be positive, with MAX at least IDLE), and
-secrets are read only from files named by `*_FILE` variables. `MEALQUEST_PUBLIC_URL`, `MEALQUEST_OIDC_ISSUER` and the
-endpoints the issuer advertises must be `https://`; plain `http://` is
-accepted only for `localhost`, `127.0.0.1` and `[::1]`.
+every variable above is required, and secrets are read only from files named
+by `*_FILE` variables. The exception is `MEALQUEST_DEFAULT_TZ`, the IANA zone
+the household settings are created with on first boot: boot fails without it
+until those settings exist, and later boots ignore it (change the zone in
+household settings instead). When set, it must be a valid IANA zone.
 
 ## Common commands
 

cmd/server/boot_test.go

@@ -3,15 +3,22 @@ package main
 import (
 	"bytes"
 	"context"
+	"crypto/rand"
+	"encoding/base64"
+	"errors"
 	"io/fs"
 	"log/slog"
-	"net/url"
+	"os"
+	"path/filepath"
 	"strings"
 	"testing"
 	"testing/fstest"
 	"time"
 
 	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/config"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/household"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/secretbox"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/store"
 	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/migrations"
 )
 
@@ -24,6 +31,42 @@ func useBootMigrations(t *testing.T, m fstest.MapFS) {
 	t.Cleanup(func() { bootMigrations = saved })
 }
 
+// loadConfig loads a configuration through config.Load whose secret key file
+// holds keyFile. Tests that call it must not run in parallel.
+func loadConfig(t *testing.T, keyFile string) config.Config {
+	t.Helper()
+	keyPath := filepath.Join(t.TempDir(), "secret_key")
+	if err := os.WriteFile(keyPath, []byte(keyFile), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv(config.EnvHTTPAddr, "127.0.0.1:0")
+	t.Setenv(config.EnvPublicURL, "http://localhost")
+	t.Setenv(config.EnvDataDir, t.TempDir())
+	t.Setenv(config.EnvShutdownTimeout, "1s")
+	t.Setenv(config.EnvSecretKeyFile, keyPath)
+	// MEALQUEST_DEFAULT_TZ is left unset; t.Setenv restores any outer value.
+	t.Setenv(config.EnvDefaultTZ, "")
+	if err := os.Unsetenv(config.EnvDefaultTZ); err != nil {
+		t.Fatal(err)
+	}
+	cfg, err := config.Load()
+	if err != nil {
+		t.Fatal(err)
+	}
+	return cfg
+}
+
+// validKeyFile returns secret key file contents as written by the README:
+// base64 of 32 random bytes followed by a newline.
+func validKeyFile(t *testing.T) string {
+	t.Helper()
+	key := make([]byte, secretbox.KeySize)
+	if _, err := rand.Read(key); err != nil {
+		t.Fatal(err)
+	}
+	return base64.StdEncoding.EncodeToString(key) + "\n"
+}
+
 var brokenMigrations = fstest.MapFS{
 	"0000_good.sql":   {Data: []byte("CREATE TABLE good (id INTEGER PRIMARY KEY);")},
 	"0001_broken.sql": {Data: []byte("CREATE TABLE broken (id INTEGER PRIMARY KEY;")},
@@ -73,12 +116,7 @@ func TestRunMigrationFailureReturnsBeforeListening(t *testing.T) {
 	useBootMigrations(t, brokenMigrations)
 
 	var logs bytes.Buffer
-	cfg := config.Config{
-		HTTPAddr:        "127.0.0.1:0",
-		PublicURL:       &url.URL{Scheme: "http", Host: "localhost"},
-		DataDir:         t.TempDir(),
-		ShutdownTimeout: time.Second,
-	}
+	cfg := loadConfig(t, validKeyFile(t))
 	errc := make(chan error, 1)
 	go func() { errc <- run(cfg, slog.New(slog.NewJSONHandler(&logs, nil))) }()
 
@@ -94,3 +132,128 @@ func TestRunMigrationFailureReturnsBeforeListening(t *testing.T) {
 		t.Errorf("run started listening despite the migration failure: %s", logs.String())
 	}
 }
+
+func TestOpenSecretBoxAcceptsReadmeKey(t *testing.T) {
+	cfg := loadConfig(t, validKeyFile(t))
+	box, err := openSecretBox(cfg.SecretKey)
+	if err != nil {
+		t.Fatal(err)
+	}
+	token, err := box.Encrypt([]byte("x"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := box.Decrypt(token); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestRunBadSecretKeyStopsBoot(t *testing.T) {
+	short := base64.StdEncoding.EncodeToString(make([]byte, 31))
+	tests := []struct {
+		name    string
+		keyFile string
+		want    error
+	}{
+		{"not base64", "this is not a base64 key!\n", secretbox.ErrKeyEncoding},
+		{"wrong length", short + "\n", secretbox.ErrKeyLength},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			cfg := loadConfig(t, tt.keyFile)
+			var logs bytes.Buffer
+			errc := make(chan error, 1)
+			go func() { errc <- run(cfg, slog.New(slog.NewJSONHandler(&logs, nil))) }()
+
+			var err error
+			select {
+			case err = <-errc:
+			case <-time.After(10 * time.Second):
+				t.Fatal("run kept going with a bad secret key")
+			}
+			if !errors.Is(err, tt.want) {
+				t.Fatalf("run error = %v, want %v", err, tt.want)
+			}
+			if !strings.Contains(err.Error(), config.EnvSecretKeyFile) {
+				t.Errorf("error does not name %s: %v", config.EnvSecretKeyFile, err)
+			}
+			if key := strings.TrimSpace(tt.keyFile); strings.Contains(err.Error(), key) {
+				t.Errorf("error leaks the key: %v", err)
+			}
+			if strings.Contains(logs.String(), `"listening"`) {
+				t.Errorf("run started listening despite the bad key: %s", logs.String())
+			}
+			if _, statErr := os.Stat(filepath.Join(cfg.DataDir, store.FileName)); !errors.Is(statErr, fs.ErrNotExist) {
+				t.Errorf("run opened the database before rejecting the key (stat: %v)", statErr)
+			}
+		})
+	}
+}
+
+func TestLoadMissingSecretKeyFileStopsBoot(t *testing.T) {
+	loadConfig(t, validKeyFile(t)) // sets every other variable
+	t.Setenv(config.EnvSecretKeyFile, filepath.Join(t.TempDir(), "missing"))
+	_, err := config.Load()
+	var cfgErr *config.Error
+	if !errors.As(err, &cfgErr) || !strings.Contains(err.Error(), config.EnvSecretKeyFile) {
+		t.Fatalf("Load error = %v, want a config error naming %s", err, config.EnvSecretKeyFile)
+	}
+}
+
+func TestRunWithoutDefaultZoneOnFirstBootStops(t *testing.T) {
+	cfg := loadConfig(t, validKeyFile(t))
+	var logs bytes.Buffer
+	errc := make(chan error, 1)
+	go func() { errc <- run(cfg, slog.New(slog.NewJSONHandler(&logs, nil))) }()
+
+	var err error
+	select {
+	case err = <-errc:
+	case <-time.After(10 * time.Second):
+		t.Fatal("run kept going with no household settings and no default zone")
+	}
+	if !errors.Is(err, household.ErrNoDefaultZone) || !strings.Contains(err.Error(), config.EnvDefaultTZ) {
+		t.Fatalf("run error = %v, want %v naming %s", err, household.ErrNoDefaultZone, config.EnvDefaultTZ)
+	}
+	if strings.Contains(logs.String(), `"listening"`) {
+		t.Errorf("run started listening without household settings: %s", logs.String())
+	}
+}
+
+func TestSeedSettingsAtBoot(t *testing.T) {
+	ctx := context.Background()
+	dir := t.TempDir()
+
+	// First boot seeds from the default zone.
+	db, err := openStore(ctx, dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := seedSettings(ctx, db, "America/Denver"); err != nil {
+		t.Fatal(err)
+	}
+	if err := db.Close(); err != nil {
+		t.Fatal(err)
+	}
+
+	// A later boot needs no default zone and keeps the stored one.
+	db, err = openStore(ctx, dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		if err := db.Close(); err != nil {
+			t.Error(err)
+		}
+	})
+	if err := seedSettings(ctx, db, ""); err != nil {
+		t.Fatalf("reboot without %s: %v", config.EnvDefaultTZ, err)
+	}
+	got, err := household.NewSettingsService(db).Get(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.Timezone != "America/Denver" {
+		t.Errorf("timezone after reboot = %q, want America/Denver", got.Timezone)
+	}
+}

cmd/server/main.go

@@ -13,9 +13,10 @@ import (
 	"syscall"
 	"time"
 
-	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/auth"
 	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/config"
 	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/frontend"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/household"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/secretbox"
 	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/server"
 	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/store"
 	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/migrations"
@@ -42,6 +43,10 @@ func run(cfg config.Config, logger *slog.Logger) error {
 	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
 	defer stop()
 
+	if _, err := openSecretBox(cfg.SecretKey); err != nil {
+		return err
+	}
+
 	db, err := openStore(ctx, cfg.DataDir)
 	if err != nil {
 		return err
@@ -52,22 +57,12 @@ func run(cfg config.Config, logger *slog.Logger) error {
 		}
 	}()
 
-	sessions, err := auth.NewSessionManager(db, cfg.SessionIdle, cfg.SessionMax)
-	if err != nil {
-		return err
-	}
-	authFlow, err := auth.New(ctx, auth.Config{
-		Issuer:       cfg.OIDCIssuer.String(),
-		ClientID:     cfg.OIDCClientID,
-		ClientSecret: cfg.OIDCClientSecret.Reveal(),
-		PublicURL:    cfg.PublicURL,
-		SecretKey:    []byte(cfg.SecretKey.Reveal()),
-	}, sessions, logger)
-	if err != nil {
+	if err := seedSettings(ctx, db, cfg.DefaultTZ); err != nil {
 		return err
 	}
+	settings := household.NewSettingsService(db)
 
-	router, err := server.NewRouter(logger, version, authFlow, frontend.Assets())
+	router, err := server.NewRouter(logger, version, frontend.Assets(), settings)
 	if err != nil {
 		return err
 	}
@@ -102,6 +97,16 @@ func run(cfg config.Config, logger *slog.Logger) error {
 	return nil
 }
 
+// openSecretBox builds the secret box from the configured key, naming the
+// variable whose file holds a bad key. The key itself is never reported.
+func openSecretBox(key config.Secret) (*secretbox.Box, error) {
+	box, err := secretbox.New(key.Reveal())
+	if err != nil {
+		return nil, fmt.Errorf("%s: %w", config.EnvSecretKeyFile, err)
+	}
+	return box, nil
+}
+
 // bootMigrations is the migration set applied at boot. Tests replace it to
 // prove a failing migration stops the boot.
 var bootMigrations fs.FS = migrations.FS
@@ -119,6 +124,16 @@ func openStore(ctx context.Context, dataDir string) (*store.Store, error) {
 	return db, nil
 }
 
+// seedSettings creates the household settings on first boot, naming the
+// variable that supplies the zone when it is missing.
+func seedSettings(ctx context.Context, db *store.Store, defaultTZ string) error {
+	err := household.SeedSettings(ctx, db, defaultTZ)
+	if errors.Is(err, household.ErrNoDefaultZone) {
+		return fmt.Errorf("%s: required on first boot to create the household settings: %w", config.EnvDefaultTZ, err)
+	}
+	return err
+}
+
 // logListening logs the startup line. Only the public URL's origin is logged
 // so no credential-bearing URL component can reach the log.
 func logListening(logger *slog.Logger, cfg config.Config) {

go.mod

@@ -3,16 +3,13 @@ module code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest
 go 1.25.0
 
 require (
-	github.com/coreos/go-oidc/v3 v3.21.0
 	github.com/go-chi/chi/v5 v5.3.1
 	github.com/oklog/ulid/v2 v2.1.2
-	golang.org/x/oauth2 v0.36.0
 	modernc.org/sqlite v1.59.0
 )
 
 require (
 	github.com/dustin/go-humanize v1.0.1 // indirect
-	github.com/go-jose/go-jose/v4 v4.1.4 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/ncruces/go-strftime v1.0.0 // indirect

go.sum

@@ -1,11 +1,7 @@
-github.com/coreos/go-oidc/v3 v3.21.0 h1:wZo4Q9Pum8dYEj0eMUPrqR+kvuGkeUplbLpNCkBqoWM=
-github.com/coreos/go-oidc/v3 v3.21.0/go.mod h1:DYCf24+ncYi+XkIH97GY1+dqoRlbaSI26KVTCI9SrY4=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
 github.com/go-chi/chi/v5 v5.3.1 h1:3j4HZLGZQ3JpMCrPJF/Jl3mYJfWLKBfNJ6quurUGCf8=
 github.com/go-chi/chi/v5 v5.3.1/go.mod h1:R+tYY2hNuVUUjxoPtqUdgBqevM9s9njzkTLutVsOCto=
-github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
-github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
 github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3 h1:LMLX+LgTNWpfvCBdFebv6EsYotImrt/Ppc5cXIriCSo=
 github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3/go.mod h1:jl5iWTm0/hd5PjEYEOuwAJ57L/CibdZfrqZ5XA5GrCk=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
@@ -23,8 +19,6 @@ github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk=
 golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40=
-golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
-golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
 golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
 golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=

internal/actor/actor.go

@@ -0,0 +1,18 @@
+// Package actor carries the signed-in member's name in a request context, so
+// changes can record who made them (the updated_by columns).
+package actor
+
+import "context"
+
+type key struct{}
+
+// With returns a copy of ctx naming the member making the request.
+func With(ctx context.Context, name string) context.Context {
+	return context.WithValue(ctx, key{}, name)
+}
+
+// From returns the member named in ctx, or "" when no member is known.
+func From(ctx context.Context) string {
+	name, _ := ctx.Value(key{}).(string)
+	return name
+}

internal/actor/actor_test.go

@@ -0,0 +1,16 @@
+package actor
+
+import (
+	"context"
+	"testing"
+)
+
+func TestFrom(t *testing.T) {
+	t.Parallel()
+	if got := From(context.Background()); got != "" {
+		t.Errorf("From(empty context) = %q, want empty", got)
+	}
+	if got := From(With(context.Background(), "sam")); got != "sam" {
+		t.Errorf("From(With(sam)) = %q, want sam", got)
+	}
+}

internal/auth/auth.go

@@ -1,325 +0,0 @@
-// Package auth signs the household in with Authentik over OpenID Connect.
-// The service is a confidential client: the authorization code, tokens and
-// client secret stay on the server and never reach JavaScript.
-package auth
-
-import (
-	"context"
-	"crypto/rand"
-	"crypto/subtle"
-	"errors"
-	"fmt"
-	"log/slog"
-	"net/http"
-	"net/url"
-	"time"
-
-	"github.com/coreos/go-oidc/v3/oidc"
-	"github.com/go-chi/chi/v5"
-	"golang.org/x/oauth2"
-
-	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/secureurl"
-)
-
-// Routes owned by this package.
-const (
-	LoginPath    = "/auth/login"
-	CallbackPath = "/auth/callback"
-	LogoutPath   = "/auth/logout"
-)
-
-// providerTimeout bounds every request to the identity provider.
-const providerTimeout = 10 * time.Second
-
-// scopes requested at login.
-var scopes = []string{oidc.ScopeOpenID, "profile", "email", "groups", oidc.ScopeOfflineAccess}
-
-// Claims are the verified ID token claims handed to the session layer.
-type Claims struct {
-	Subject           string   `json:"sub"`
-	Email             string   `json:"email"`
-	EmailVerified     bool     `json:"email_verified"`
-	Name              string   `json:"name"`
-	PreferredUsername string   `json:"preferred_username"`
-	Groups            []string `json:"groups"`
-}
-
-// Sessions is the session layer. StartSession is called once per successful
-// login with claims from a verified ID token; it must set the session cookie
-// on w. EndSession is called on logout; it must end the session r carries,
-// if any, and clear the cookie on w. A returned error fails the request with
-// 500.
-type Sessions interface {
-	StartSession(w http.ResponseWriter, r *http.Request, claims Claims) error
-	EndSession(w http.ResponseWriter, r *http.Request) error
-}
-
-// Config is what New needs to reach the identity provider.
-type Config struct {
-	// Issuer is the exact issuer URL; discovery runs against it.
-	Issuer       string
-	ClientID     string
-	ClientSecret string
-	// PublicURL is the service's public URL; its origin prefixes CallbackPath
-	// to form the redirect URI.
-	PublicURL *url.URL
-	// SecretKey is the server key the login cookie's signing key derives from.
-	SecretKey []byte
-}
-
-// Auth serves the login and callback routes.
-type Auth struct {
-	oauth    oauth2.Config
-	verifier *oidc.IDTokenVerifier
-	client   *http.Client
-	cookie   loginCookie
-	sessions Sessions
-	// endSessionURL is the provider's end_session_endpoint; logout ends
-	// there so the provider's own session ends too.
-	endSessionURL string
-	logger        *slog.Logger
-}
-
-// New discovers the provider at cfg.Issuer and returns the login flow. It
-// fails if discovery fails or the issuer the provider reports differs.
-func New(ctx context.Context, cfg Config, sessions Sessions, logger *slog.Logger) (*Auth, error) {
-	switch {
-	case cfg.Issuer == "", cfg.ClientID == "", cfg.ClientSecret == "":
-		return nil, errors.New("auth: issuer, client ID and client secret are required")
-	case cfg.PublicURL == nil:
-		return nil, errors.New("auth: public URL is required")
-	case len(cfg.SecretKey) == 0:
-		return nil, errors.New("auth: secret key is required")
-	case sessions == nil:
-		return nil, errors.New("auth: session layer is required")
-	}
-
-	if err := checkEndpoint("issuer", cfg.Issuer); err != nil {
-		return nil, err
-	}
-
-	client := &http.Client{Timeout: providerTimeout, CheckRedirect: checkRedirect}
-	provider, err := oidc.NewProvider(oidc.ClientContext(ctx, client), cfg.Issuer)
-	if err != nil {
-		return nil, fmt.Errorf("auth: OIDC discovery: %w", err)
-	}
-	endpoint := provider.Endpoint()
-	var discovered struct {
-		JWKSURI       string `json:"jwks_uri"`
-		EndSessionURI string `json:"end_session_endpoint"`
-	}
-	if err := provider.Claims(&discovered); err != nil {
-		return nil, fmt.Errorf("auth: OIDC discovery: %w", err)
-	}
-	// The token endpoint receives the client secret and the key set decides
-	// which tokens verify, so every endpoint used must pass the same rule.
-	for _, e := range []struct{ name, raw string }{
-		{"authorization endpoint", endpoint.AuthURL},
-		{"token endpoint", endpoint.TokenURL},
-		{"JWKS endpoint", discovered.JWKSURI},
-		{"end session endpoint", discovered.EndSessionURI},
-	} {
-		if err := checkEndpoint(e.name, e.raw); err != nil {
-			return nil, err
-		}
-	}
-	// client_secret_basic, the OIDC default; no auto-detection retries.
-	endpoint.AuthStyle = oauth2.AuthStyleInHeader
-
-	return &Auth{
-		oauth: oauth2.Config{
-			ClientID:     cfg.ClientID,
-			ClientSecret: cfg.ClientSecret,
-			Endpoint:     endpoint,
-			RedirectURL:  cfg.PublicURL.Scheme + "://" + cfg.PublicURL.Host + CallbackPath,
-			Scopes:       scopes,
-		},
-		verifier: provider.Verifier(&oidc.Config{
-			ClientID:             cfg.ClientID,
-			SupportedSigningAlgs: []string{oidc.RS256},
-		}),
-		client:        client,
-		cookie:        newLoginCookie(cfg.SecretKey),
-		sessions:      sessions,
-		endSessionURL: discovered.EndSessionURI,
-		logger:        logger,
-	}, nil
-}
-
-// checkEndpoint applies secureurl.Check to the provider URL raw, naming the
-// endpoint in the error.
-func checkEndpoint(name, raw string) error {
-	u, err := url.Parse(raw)
-	if err != nil {
-		return fmt.Errorf("auth: OIDC %s %q is not a valid URL", name, raw)
-	}
-	if err := secureurl.Check(u); err != nil {
-		return fmt.Errorf("auth: OIDC %s %q: %w", name, raw, err)
-	}
-	return nil
-}
-
-// maxRedirects matches net/http's default redirect limit.
-const maxRedirects = 10
-
-// checkRedirect is the provider client's redirect policy. On a 307 or 308 to
-// the same host Go resends the body and Authorization header, which carry the
-// code and client secret, so every target must pass secureurl.Check and an
-// https:// request never follows a redirect to plain http://, even loopback.
-func checkRedirect(req *http.Request, via []*http.Request) error {
-	if len(via) >= maxRedirects {
-		return fmt.Errorf("stopped after %d redirects", maxRedirects)
-	}
-	if err := secureurl.Check(req.URL); err != nil {
-		return fmt.Errorf("redirect refused: %w", err)
-	}
-	if via[len(via)-1].URL.Scheme == "https" && req.URL.Scheme != "https" {
-		return errors.New("redirect refused: https:// to plain http:// downgrade")
-	}
-	return nil
-}
-
-// Mount registers GET LoginPath, GET CallbackPath and POST LogoutPath on r.
-func (a *Auth) Mount(r chi.Router) {
-	r.Get(LoginPath, a.login)
-	r.Get(CallbackPath, a.callback)
-	r.Post(LogoutPath, a.logout)
-}
-
-// EndSessionURL is the provider's end_session_endpoint.
-func (a *Auth) EndSessionURL() string { return a.endSessionURL }
-
-// login starts the authorization code flow with PKCE (S256). The optional
-// "return" query parameter must be a same-origin path; anything else fails
-// the login with 400.
-func (a *Auth) login(w http.ResponseWriter, r *http.Request) {
-	w.Header().Set("Cache-Control", "no-store")
-
-	returnTo, err := returnPath(r.URL.Query().Get("return"))
-	if err != nil {
-		http.Error(w, "invalid return path", http.StatusBadRequest)
-		return
-	}
-	state := loginState{
-		State:    rand.Text(),
-		Nonce:    rand.Text(),
-		Verifier: oauth2.GenerateVerifier(),
-		Return:   returnTo,
-	}
-	if err := a.cookie.set(w, state, time.Now()); err != nil {
-		a.logger.ErrorContext(r.Context(), "set login cookie", "error", err)
-		http.Error(w, "internal error", http.StatusInternalServerError)
-		return
-	}
-	http.Redirect(w, r, a.oauth.AuthCodeURL(state.State,
-		oidc.Nonce(state.Nonce),
-		oauth2.S256ChallengeOption(state.Verifier),
-	), http.StatusFound)
-}
-
-// callback completes the flow: it checks state against the login cookie,
-// exchanges the code, verifies the ID token and nonce, then starts a session.
-func (a *Auth) callback(w http.ResponseWriter, r *http.Request) {
-	w.Header().Set("Cache-Control", "no-store")
-	ctx := r.Context()
-	// The login cookie is single-use.
-	a.cookie.clear(w)
-
-	state, err := a.cookie.read(r, time.Now())
-	if err != nil {
-		a.logger.WarnContext(ctx, "login callback without a valid login cookie", "error", err)
-		http.Error(w, "sign-in expired; start again", http.StatusBadRequest)
-		return
-	}
-	q := r.URL.Query()
-	if subtle.ConstantTimeCompare([]byte(q.Get("state")), []byte(state.State)) != 1 {
-		a.logger.WarnContext(ctx, "login callback state mismatch")
-		http.Error(w, "sign-in state mismatch; start again", http.StatusBadRequest)
-		return
-	}
-	if q.Get("error") != "" {
-		// error and error_description are provider-supplied text; only the
-		// fixed category is logged.
-		a.logger.WarnContext(ctx, "identity provider returned an authorization error")
-		http.Error(w, "sign-in was refused", http.StatusUnauthorized)
-		return
-	}
-	code := q.Get("code")
-	if code == "" {
-		http.Error(w, "missing authorization code", http.StatusBadRequest)
-		return
-	}
-
-	claims, err := a.verify(ctx, code, state)
-	if err != nil {
-		a.logger.WarnContext(ctx, "sign-in failed", "error", err)
-		http.Error(w, "sign-in failed", http.StatusUnauthorized)
-		return
-	}
-	if err := a.sessions.StartSession(w, r, claims); err != nil {
-		a.logger.ErrorContext(ctx, "start session", "error", err)
-		http.Error(w, "internal error", http.StatusInternalServerError)
-		return
-	}
-	http.Redirect(w, r, state.Return, http.StatusSeeOther)
-}
-
-// logout ends the session, clears the cookie and sends the browser to the
-// provider's end_session_endpoint to end the provider session as well.
-func (a *Auth) logout(w http.ResponseWriter, r *http.Request) {
-	w.Header().Set("Cache-Control", "no-store")
-	if err := a.sessions.EndSession(w, r); err != nil {
-		a.logger.ErrorContext(r.Context(), "end session", "error", err)
-		http.Error(w, "internal error", http.StatusInternalServerError)
-		return
-	}
-	http.Redirect(w, r, a.endSessionURL, http.StatusSeeOther)
-}
-
-// verify exchanges code for tokens and returns the verified ID token claims.
-// The verifier enforces RS256, issuer, audience and expiry; nonce is checked
-// here.
-func (a *Auth) verify(ctx context.Context, code string, state loginState) (Claims, error) {
-	token, err := a.oauth.Exchange(context.WithValue(ctx, oauth2.HTTPClient, a.client), code,
-		oauth2.VerifierOption(state.Verifier))
-	if err != nil {
-		return Claims{}, exchangeError(err)
-	}
-	raw, ok := token.Extra("id_token").(string)
-	if !ok || raw == "" {
-		return Claims{}, errors.New("token response has no id_token")
-	}
-	idToken, err := a.verifier.Verify(ctx, raw)
-	if err != nil {
-		return Claims{}, fmt.Errorf("verify ID token: %w", err)
-	}
-	if subtle.ConstantTimeCompare([]byte(idToken.Nonce), []byte(state.Nonce)) != 1 {
-		return Claims{}, errors.New("ID token nonce mismatch")
-	}
-	var claims Claims
-	if err := idToken.Claims(&claims); err != nil {
-		return Claims{}, fmt.Errorf("decode ID token claims: %w", err)
-	}
-	if claims.Subject == "" {
-		return Claims{}, errors.New("ID token has no subject")
-	}
-	return claims, nil
-}
-
-// exchangeError reduces a failed code exchange to a fixed category and safe
-// metadata. The oauth2 error text can carry the token endpoint's response
-// body or error_description, which may echo credentials, so it is dropped.
-func exchangeError(err error) error {
-	var retrieve *oauth2.RetrieveError
-	var transport *url.Error
-	switch {
-	case errors.As(err, &retrieve):
-		return fmt.Errorf("exchange code: token endpoint rejected the request (HTTP %d)", retrieve.Response.StatusCode)
-	case errors.As(err, &transport):
-		// Request failures never carry the response. The URL is dropped: after
-		// a refused redirect it is the provider-supplied Location.
-		return fmt.Errorf("exchange code: token request failed: %s: %w", transport.Op, transport.Err)
-	default:
-		return errors.New("exchange code: token endpoint returned an unusable response")
-	}
-}

internal/auth/auth_test.go

@@ -1,914 +0,0 @@
-package auth
-
-import (
-	"bytes"
-	"context"
-	"crypto"
-	"crypto/hmac"
-	"crypto/rand"
-	"crypto/rsa"
-	"crypto/sha256"
-	"encoding/base64"
-	"encoding/json"
-	"errors"
-	"io"
-	"log/slog"
-	"maps"
-	"math/big"
-	"net/http"
-	"net/http/httptest"
-	"net/url"
-	"slices"
-	"strings"
-	"sync"
-	"sync/atomic"
-	"testing"
-	"time"
-
-	"github.com/go-chi/chi/v5"
-)
-
-const (
-	testClientID     = "mealquest"
-	testClientSecret = "client-s3cret"
-	testKID          = "test-key"
-)
-
-var testPublicURL = &url.URL{Scheme: "https", Host: "meals.example.com"}
-
-// fakeProvider is an OIDC provider serving discovery, JWKS and a token
-// endpoint. Each issued code maps to the ID token the token endpoint returns.
-type fakeProvider struct {
-	t   *testing.T
-	srv *httptest.Server
-	key *rsa.PrivateKey
-
-	mu    sync.Mutex
-	codes map[string]issuedCode
-	// discoveryOverrides replace fields of the discovery document.
-	discoveryOverrides map[string]any
-	// tokenReply, when set, is returned by the token endpoint instead of a
-	// token.
-	tokenReply *tokenReply
-}
-
-type tokenReply struct {
-	status int
-	body   string
-}
-
-type issuedCode struct {
-	challenge string
-	idToken   string
-}
-
-func newFakeProvider(t *testing.T) *fakeProvider {
-	t.Helper()
-	key, err := rsa.GenerateKey(rand.Reader, 2048)
-	if err != nil {
-		t.Fatal(err)
-	}
-	p := &fakeProvider{t: t, key: key, codes: map[string]issuedCode{}}
-	mux := http.NewServeMux()
-	mux.HandleFunc("GET /.well-known/openid-configuration", p.discovery)
-	mux.HandleFunc("GET /jwks", p.jwks)
-	mux.HandleFunc("POST /token", p.token)
-	p.srv = httptest.NewServer(mux)
-	t.Cleanup(p.srv.Close)
-	return p
-}
-
-func (p *fakeProvider) issuer() string { return p.srv.URL }
-
-func (p *fakeProvider) discovery(w http.ResponseWriter, _ *http.Request) {
-	doc := map[string]any{
-		"issuer":                                p.issuer(),
-		"authorization_endpoint":                p.issuer() + "/authorize",
-		"token_endpoint":                        p.issuer() + "/token",
-		"jwks_uri":                              p.issuer() + "/jwks",
-		"end_session_endpoint":                  p.issuer() + "/end-session/",
-		"response_types_supported":              []string{"code"},
-		"subject_types_supported":               []string{"public"},
-		"id_token_signing_alg_values_supported": []string{"RS256", "HS256"},
-	}
-	p.mu.Lock()
-	maps.Copy(doc, p.discoveryOverrides)
-	p.mu.Unlock()
-	writeJSON(w, doc)
-}
-
-func (p *fakeProvider) jwks(w http.ResponseWriter, _ *http.Request) {
-	writeJSON(w, map[string]any{"keys": []map[string]string{{
-		"kty": "RSA",
-		"kid": testKID,
-		"use": "sig",
-		"alg": "RS256",
-		"n":   b64(p.key.N.Bytes()),
-		"e":   b64(big.NewInt(int64(p.key.E)).Bytes()),
-	}}})
-}
-
-// token checks client authentication, the code and the PKCE verifier before
-// returning the code's ID token.
-func (p *fakeProvider) token(w http.ResponseWriter, r *http.Request) {
-	p.mu.Lock()
-	reply := p.tokenReply
-	p.mu.Unlock()
-	if reply != nil {
-		w.Header().Set("Content-Type", "application/json")
-		w.WriteHeader(reply.status)
-		io.WriteString(w, reply.body)
-		return
-	}
-	id, secret, ok := r.BasicAuth()
-	if !ok || id != testClientID || secret != testClientSecret {
-		http.Error(w, `{"error":"invalid_client"}`, http.StatusUnauthorized)
-		return
-	}
-	if err := r.ParseForm(); err != nil {
-		http.Error(w, `{"error":"invalid_request"}`, http.StatusBadRequest)
-		return
-	}
-	p.mu.Lock()
-	issued, ok := p.codes[r.PostForm.Get("code")]
-	delete(p.codes, r.PostForm.Get("code"))
-	p.mu.Unlock()
-	if r.PostForm.Get("grant_type") != "authorization_code" || !ok ||
-		challengeS256(r.PostForm.Get("code_verifier")) != issued.challenge {
-		w.Header().Set("Content-Type", "application/json")
-		w.WriteHeader(http.StatusBadRequest)
-		io.WriteString(w, `{"error":"invalid_grant"}`)
-		return
-	}
-	writeJSON(w, map[string]any{
-		"access_token": "access-token",
-		"token_type":   "Bearer",
-		"expires_in":   3600,
-		"id_token":     issued.idToken,
-	})
-}
-
-// authorize stands in for the user signing in at the provider: it records a
-// code bound to the PKCE challenge and returns it.
-func (p *fakeProvider) authorize(challenge, idToken string) string {
-	code := rand.Text()
-	p.mu.Lock()
-	p.codes[code] = issuedCode{challenge: challenge, idToken: idToken}
-	p.mu.Unlock()
-	return code
-}
-
-// claims returns valid ID token claims for nonce.
-func (p *fakeProvider) claims(nonce string) map[string]any {
-	now := time.Now()
-	return map[string]any{
-		"iss":                p.issuer(),
-		"sub":                "user-123",
-		"aud":                testClientID,
-		"iat":                now.Unix(),
-		"exp":                now.Add(5 * time.Minute).Unix(),
-		"nonce":              nonce,
-		"email":              "cook@example.com",
-		"email_verified":     true,
-		"name":               "Home Cook",
-		"preferred_username": "cook",
-		"groups":             []string{"mealquest-admin"},
-	}
-}
-
-func (p *fakeProvider) signRS256(claims map[string]any) string {
-	return signRS256(p.t, p.key, claims)
-}
-
-func signRS256(t *testing.T, key *rsa.PrivateKey, claims map[string]any) string {
-	t.Helper()
-	signing := jwtSigningInput(t, "RS256", claims)
-	digest := sha256.Sum256([]byte(signing))
-	sig, err := rsa.SignPKCS1v15(rand.Reader, key, crypto.SHA256, digest[:])
-	if err != nil {
-		t.Fatal(err)
-	}
-	return signing + "." + b64(sig)
-}
-
-// signHS256 signs with the client secret, as in an algorithm-confusion attack.
-func (p *fakeProvider) signHS256(claims map[string]any) string {
-	signing := jwtSigningInput(p.t, "HS256", claims)
-	mac := hmac.New(sha256.New, []byte(testClientSecret))
-	mac.Write([]byte(signing))
-	return signing + "." + b64(mac.Sum(nil))
-}
-
-func jwtSigningInput(t *testing.T, alg string, claims map[string]any) string {
-	t.Helper()
-	header, err := json.Marshal(map[string]string{"alg": alg, "typ": "JWT", "kid": testKID})
-	if err != nil {
-		t.Fatal(err)
-	}
-	body, err := json.Marshal(claims)
-	if err != nil {
-		t.Fatal(err)
-	}
-	return b64(header) + "." + b64(body)
-}
-
-func challengeS256(verifier string) string {
-	sum := sha256.Sum256([]byte(verifier))
-	return b64(sum[:])
-}
-
-func b64(b []byte) string { return base64.RawURLEncoding.EncodeToString(b) }
-
-func writeJSON(w http.ResponseWriter, v any) {
-	w.Header().Set("Content-Type", "application/json")
-	json.NewEncoder(w).Encode(v)
-}
-
-// memorySessions is an in-memory Sessions that records the claims it was
-// handed and how many sessions were ended.
-type memorySessions struct {
-	mu     sync.Mutex
-	claims []Claims
-	ended  int
-	err    error
-}
-
-func (m *memorySessions) StartSession(w http.ResponseWriter, _ *http.Request, claims Claims) error {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	if m.err != nil {
-		return m.err
-	}
-	m.claims = append(m.claims, claims)
-	http.SetCookie(w, &http.Cookie{Name: "test_session", Value: claims.Subject})
-	return nil
-}
-
-func (m *memorySessions) EndSession(http.ResponseWriter, *http.Request) error {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	if m.err != nil {
-		return m.err
-	}
-	m.ended++
-	return nil
-}
-
-func (m *memorySessions) started() []Claims {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	return slices.Clone(m.claims)
-}
-
-type harness struct {
-	provider *fakeProvider
-	sessions *memorySessions
-	router   http.Handler
-	logs     *syncBuffer
-}
-
-// syncBuffer is a bytes.Buffer safe for concurrent log writes.
-type syncBuffer struct {
-	mu  sync.Mutex
-	buf bytes.Buffer
-}
-
-func (b *syncBuffer) Write(p []byte) (int, error) {
-	b.mu.Lock()
-	defer b.mu.Unlock()
-	return b.buf.Write(p)
-}
-
-func (b *syncBuffer) String() string {
-	b.mu.Lock()
-	defer b.mu.Unlock()
-	return b.buf.String()
-}
-
-func newHarness(t *testing.T) *harness {
-	t.Helper()
-	p := newFakeProvider(t)
-	sessions := &memorySessions{}
-	logs := &syncBuffer{}
-	a, err := New(context.Background(), Config{
-		Issuer:       p.issuer(),
-		ClientID:     testClientID,
-		ClientSecret: testClientSecret,
-		PublicURL:    testPublicURL,
-		SecretKey:    []byte("server-secret-key"),
-	}, sessions, slog.New(slog.NewTextHandler(logs, nil)))
-	if err != nil {
-		t.Fatal(err)
-	}
-	r := chi.NewRouter()
-	a.Mount(r)
-	return &harness{provider: p, sessions: sessions, router: r, logs: logs}
-}
-
-func (h *harness) get(target string, cookies ...*http.Cookie) *http.Response {
-	req := httptest.NewRequest(http.MethodGet, target, nil)
-	for _, c := range cookies {
-		req.AddCookie(c)
-	}
-	rec := httptest.NewRecorder()
-	h.router.ServeHTTP(rec, req)
-	return rec.Result()
-}
-
-// login is a started login: the authorize URL's query and the login cookie.
-type login struct {
-	query  url.Values
-	cookie *http.Cookie
-}
-
-func (h *harness) login(t *testing.T, target string) login {
-	t.Helper()
-	resp := h.get(target)
-	if resp.StatusCode != http.StatusFound {
-		t.Fatalf("GET %s status = %d, want 302", target, resp.StatusCode)
-	}
-	loc, err := url.Parse(resp.Header.Get("Location"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got, want := loc.Scheme+"://"+loc.Host+loc.Path, h.provider.issuer()+"/authorize"; got != want {
-		t.Fatalf("redirect to %s, want %s", got, want)
-	}
-	var cookie *http.Cookie
-	for _, c := range resp.Cookies() {
-		if c.Name == loginCookieName {
-			cookie = c
-		}
-	}
-	if cookie == nil {
-		t.Fatalf("login set no %s cookie", loginCookieName)
-	}
-	return login{query: loc.Query(), cookie: cookie}
-}
-
-// callback completes l at the provider with idToken and calls the callback.
-func (h *harness) callback(l login, state, idToken string) *http.Response {
-	code := h.provider.authorize(l.query.Get("code_challenge"), idToken)
-	q := url.Values{"code": {code}, "state": {state}}
-	return h.get(CallbackPath+"?"+q.Encode(), l.cookie)
-}
-
-func TestLoginRedirect(t *testing.T) {
-	t.Parallel()
-	h := newHarness(t)
-	l := h.login(t, LoginPath+"?return=/plan")
-
-	want := map[string]string{
-		"client_id":             testClientID,
-		"response_type":         "code",
-		"scope":                 "openid profile email groups offline_access",
-		"redirect_uri":          "https://meals.example.com/auth/callback",
-		"code_challenge_method": "S256",
-	}
-	for k, v := range want {
-		if got := l.query.Get(k); got != v {
-			t.Errorf("authorize %s = %q, want %q", k, got, v)
-		}
-	}
-	for _, k := range []string{"state", "nonce", "code_challenge"} {
-		if l.query.Get(k) == "" {
-			t.Errorf("authorize URL has no %s", k)
-		}
-	}
-
-	c := l.cookie
-	if !c.HttpOnly || !c.Secure || c.SameSite != http.SameSiteLaxMode || c.Path != "/" {
-		t.Errorf("login cookie HttpOnly=%v Secure=%v SameSite=%v Path=%q, want HttpOnly, Secure, Lax, /",
-			c.HttpOnly, c.Secure, c.SameSite, c.Path)
-	}
-	if c.MaxAge <= 0 || c.MaxAge > 600 {
-		t.Errorf("login cookie MaxAge = %d, want 1-600 seconds", c.MaxAge)
-	}
-}
-
-func TestLoginStateIsFreshEachTime(t *testing.T) {
-	t.Parallel()
-	h := newHarness(t)
-	a, b := h.login(t, LoginPath), h.login(t, LoginPath)
-	for _, k := range []string{"state", "nonce", "code_challenge"} {
-		if a.query.Get(k) == b.query.Get(k) {
-			t.Errorf("%s repeated across logins", k)
-		}
-	}
-}
-
-func TestCallbackSuccess(t *testing.T) {
-	t.Parallel()
-	h := newHarness(t)
-	l := h.login(t, LoginPath+"?return="+url.QueryEscape("/plan?week=2026-W40"))
-
-	resp := h.callback(l, l.query.Get("state"), h.provider.signRS256(h.provider.claims(l.query.Get("nonce"))))
-
-	if resp.StatusCode != http.StatusSeeOther {
-		t.Fatalf("callback status = %d, want 303", resp.StatusCode)
-	}
-	if got := resp.Header.Get("Location"); got != "/plan?week=2026-W40" {
-		t.Errorf("callback redirect = %q, want the return path", got)
-	}
-	started := h.sessions.started()
-	want := Claims{
-		Subject:           "user-123",
-		Email:             "cook@example.com",
-		EmailVerified:     true,
-		Name:              "Home Cook",
-		PreferredUsername: "cook",
-		Groups:            []string{"mealquest-admin"},
-	}
-	if len(started) != 1 || started[0].Subject != want.Subject || started[0].Email != want.Email ||
-		started[0].Name != want.Name || started[0].PreferredUsername != want.PreferredUsername ||
-		!started[0].EmailVerified || !slices.Equal(started[0].Groups, want.Groups) {
-		t.Errorf("session started with %+v, want [%+v]", started, want)
-	}
-	assertLoginCookieCleared(t, resp)
-}
-
-func TestCallbackDefaultReturnPath(t *testing.T) {
-	t.Parallel()
-	h := newHarness(t)
-	l := h.login(t, LoginPath)
-	resp := h.callback(l, l.query.Get("state"), h.provider.signRS256(h.provider.claims(l.query.Get("nonce"))))
-	if resp.StatusCode != http.StatusSeeOther || resp.Header.Get("Location") != "/" {
-		t.Errorf("callback = %d to %q, want 303 to /", resp.StatusCode, resp.Header.Get("Location"))
-	}
-}
-
-func TestCallbackRejected(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name string
-		// state returns the state sent to the callback.
-		state func(l login) string
-		// token returns the ID token the provider issues.
-		token      func(p *fakeProvider, l login) string
-		wantStatus int
-	}{
-		{
-			name:       "mismatched state",
-			state:      func(login) string { return "attacker-state" },
-			wantStatus: http.StatusBadRequest,
-		},
-		{
-			name: "wrong nonce",
-			token: func(p *fakeProvider, _ login) string {
-				return p.signRS256(p.claims("other-nonce"))
-			},
-			wantStatus: http.StatusUnauthorized,
-		},
-		{
-			name: "missing nonce",
-			token: func(p *fakeProvider, _ login) string {
-				c := p.claims("")
-				delete(c, "nonce")
-				return p.signRS256(c)
-			},
-			wantStatus: http.StatusUnauthorized,
-		},
-		{
-			name: "HS256-signed token",
-			token: func(p *fakeProvider, l login) string {
-				return p.signHS256(p.claims(l.query.Get("nonce")))
-			},
-			wantStatus: http.StatusUnauthorized,
-		},
-		{
-			name: "expired token",
-			token: func(p *fakeProvider, l login) string {
-				c := p.claims(l.query.Get("nonce"))
-				c["iat"] = time.Now().Add(-2 * time.Hour).Unix()
-				c["exp"] = time.Now().Add(-time.Hour).Unix()
-				return p.signRS256(c)
-			},
-			wantStatus: http.StatusUnauthorized,
-		},
-		{
-			name: "wrong issuer",
-			token: func(p *fakeProvider, l login) string {
-				c := p.claims(l.query.Get("nonce"))
-				c["iss"] = "https://evil.example.com"
-				return p.signRS256(c)
-			},
-			wantStatus: http.StatusUnauthorized,
-		},
-		{
-			name: "wrong audience",
-			token: func(p *fakeProvider, l login) string {
-				c := p.claims(l.query.Get("nonce"))
-				c["aud"] = "another-client"
-				return p.signRS256(c)
-			},
-			wantStatus: http.StatusUnauthorized,
-		},
-		{
-			name: "signed by an unknown key",
-			token: func(p *fakeProvider, l login) string {
-				key, err := rsa.GenerateKey(rand.Reader, 2048)
-				if err != nil {
-					p.t.Fatal(err)
-				}
-				return signRS256(p.t, key, p.claims(l.query.Get("nonce")))
-			},
-			wantStatus: http.StatusUnauthorized,
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-			h := newHarness(t)
-			l := h.login(t, LoginPath)
-			state := l.query.Get("state")
-			if tc.state != nil {
-				state = tc.state(l)
-			}
-			token := h.provider.signRS256(h.provider.claims(l.query.Get("nonce")))
-			if tc.token != nil {
-				token = tc.token(h.provider, l)
-			}
-
-			resp := h.callback(l, state, token)
-
-			if resp.StatusCode != tc.wantStatus {
-				t.Errorf("callback status = %d, want %d", resp.StatusCode, tc.wantStatus)
-			}
-			if n := len(h.sessions.started()); n != 0 {
-				t.Errorf("%d sessions started, want none", n)
-			}
-			assertLoginCookieCleared(t, resp)
-		})
-	}
-}
-
-func TestCallbackWithoutLoginCookie(t *testing.T) {
-	t.Parallel()
-	h := newHarness(t)
-	l := h.login(t, LoginPath)
-	l.cookie = &http.Cookie{Name: "unrelated", Value: "x"}
-	resp := h.callback(l, l.query.Get("state"), h.provider.signRS256(h.provider.claims(l.query.Get("nonce"))))
-	if resp.StatusCode != http.StatusBadRequest {
-		t.Errorf("callback status = %d, want 400", resp.StatusCode)
-	}
-	if n := len(h.sessions.started()); n != 0 {
-		t.Errorf("%d sessions started, want none", n)
-	}
-}
-
-func TestCallbackTamperedLoginCookie(t *testing.T) {
-	t.Parallel()
-	h := newHarness(t)
-	l := h.login(t, LoginPath)
-	payload, sig, _ := strings.Cut(l.cookie.Value, ".")
-	data, err := base64.RawURLEncoding.DecodeString(payload)
-	if err != nil {
-		t.Fatal(err)
-	}
-	var s loginState
-	if err := json.Unmarshal(data, &s); err != nil {
-		t.Fatal(err)
-	}
-	s.Return = "/somewhere-else"
-	data, err = json.Marshal(s)
-	if err != nil {
-		t.Fatal(err)
-	}
-	l.cookie = &http.Cookie{Name: loginCookieName, Value: b64(data) + "." + sig}
-
-	resp := h.callback(l, l.query.Get("state"), h.provider.signRS256(h.provider.claims(l.query.Get("nonce"))))
-	if resp.StatusCode != http.StatusBadRequest {
-		t.Errorf("callback status = %d, want 400", resp.StatusCode)
-	}
-}
-
-// The provider's error and error_description are untrusted text and never
-// reach the logs; only the fixed category does.
-func TestCallbackProviderError(t *testing.T) {
-	t.Parallel()
-	const (
-		errorMarker       = "provider-error-marker"
-		descriptionMarker = "description-marker-" + testClientSecret
-	)
-	h := newHarness(t)
-	l := h.login(t, LoginPath)
-	q := url.Values{
-		"error":             {errorMarker},
-		"error_description": {descriptionMarker},
-		"state":             {l.query.Get("state")},
-	}
-	resp := h.get(CallbackPath+"?"+q.Encode(), l.cookie)
-	if resp.StatusCode != http.StatusUnauthorized {
-		t.Errorf("callback status = %d, want 401", resp.StatusCode)
-	}
-	assertLoginCookieCleared(t, resp)
-	if n := len(h.sessions.started()); n != 0 {
-		t.Errorf("started %d sessions, want 0", n)
-	}
-	logs := h.logs.String()
-	for _, marker := range []string{errorMarker, descriptionMarker} {
-		if strings.Contains(logs, marker) {
-			t.Errorf("logs contain provider text %q: %s", marker, logs)
-		}
-	}
-	if !strings.Contains(logs, "identity provider returned an authorization error") {
-		t.Errorf("logs = %q, want the authorization error category", logs)
-	}
-}
-
-func TestCallbackSessionError(t *testing.T) {
-	t.Parallel()
-	h := newHarness(t)
-	h.sessions.err = errors.New("database down")
-	l := h.login(t, LoginPath)
-	resp := h.callback(l, l.query.Get("state"), h.provider.signRS256(h.provider.claims(l.query.Get("nonce"))))
-	if resp.StatusCode != http.StatusInternalServerError {
-		t.Errorf("callback status = %d, want 500", resp.StatusCode)
-	}
-}
-
-// A failed code exchange is logged by category and status only: the token
-// endpoint's body and error_description may echo credentials.
-func TestCallbackExchangeFailureDoesNotLogProviderResponse(t *testing.T) {
-	t.Parallel()
-	const leaked = "leaked-" + testClientSecret
-	tests := []struct {
-		name     string
-		reply    tokenReply
-		wantLogs string
-	}{
-		{
-			name:     "error response",
-			reply:    tokenReply{http.StatusBadRequest, `{"error":"invalid_grant","error_description":"` + leaked + `"}`},
-			wantLogs: "HTTP 400",
-		},
-		{
-			name:     "unparseable error response",
-			reply:    tokenReply{http.StatusInternalServerError, leaked},
-			wantLogs: "HTTP 500",
-		},
-		{
-			name:     "success without access token",
-			reply:    tokenReply{http.StatusOK, `{"id_token":"` + leaked + `"}`},
-			wantLogs: "unusable response",
-		},
-	}
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-			h := newHarness(t)
-			h.provider.mu.Lock()
-			h.provider.tokenReply = &tc.reply
-			h.provider.mu.Unlock()
-			l := h.login(t, LoginPath)
-
-			resp := h.callback(l, l.query.Get("state"), "unused")
-
-			if resp.StatusCode != http.StatusUnauthorized {
-				t.Errorf("callback status = %d, want 401", resp.StatusCode)
-			}
-			logs := h.logs.String()
-			if strings.Contains(logs, leaked) {
-				t.Errorf("logs contain the provider response: %s", logs)
-			}
-			if !strings.Contains(logs, tc.wantLogs) {
-				t.Errorf("logs = %q, want %q", logs, tc.wantLogs)
-			}
-		})
-	}
-}
-
-func TestLoginCookieExpires(t *testing.T) {
-	t.Parallel()
-	c := newLoginCookie([]byte("server-secret-key"))
-	now := time.Now()
-	rec := httptest.NewRecorder()
-	if err := c.set(rec, loginState{State: "s", Nonce: "n", Verifier: "v", Return: "/"}, now); err != nil {
-		t.Fatal(err)
-	}
-	req := httptest.NewRequest(http.MethodGet, CallbackPath, nil)
-	req.AddCookie(rec.Result().Cookies()[0])
-
-	if _, err := c.read(req, now.Add(loginCookieTTL-time.Second)); err != nil {
-		t.Errorf("read before expiry: %v", err)
-	}
-	if _, err := c.read(req, now.Add(loginCookieTTL)); err == nil {
-		t.Error("read at expiry succeeded")
-	}
-}
-
-func TestLoginRejectsOffOriginReturn(t *testing.T) {
-	t.Parallel()
-	h := newHarness(t)
-	for _, ret := range []string{
-		"https://evil.example.com/",
-		"http://meals.example.com/plan",
-		"//evil.example.com/",
-		"/\\evil.example.com",
-		"\\\\evil.example.com",
-		"javascript:alert(1)",
-		"plan",
-		"/plan\r\nSet-Cookie: x=y",
-	} {
-		resp := h.get(LoginPath + "?return=" + url.QueryEscape(ret))
-		if resp.StatusCode != http.StatusBadRequest {
-			t.Errorf("return=%q: status = %d, want 400", ret, resp.StatusCode)
-		}
-		if loc := resp.Header.Get("Location"); loc != "" {
-			t.Errorf("return=%q: redirected to %q", ret, loc)
-		}
-		if len(resp.Cookies()) != 0 {
-			t.Errorf("return=%q: set cookies %v", ret, resp.Cookies())
-		}
-	}
-}
-
-func TestNewFailsWhenDiscoveryFails(t *testing.T) {
-	t.Parallel()
-	srv := httptest.NewServer(http.NotFoundHandler())
-	t.Cleanup(srv.Close)
-	_, err := New(context.Background(), Config{
-		Issuer:       srv.URL,
-		ClientID:     testClientID,
-		ClientSecret: testClientSecret,
-		PublicURL:    testPublicURL,
-		SecretKey:    []byte("k"),
-	}, &memorySessions{}, slog.New(slog.DiscardHandler))
-	if err == nil {
-		t.Fatal("New succeeded without a discovery document")
-	}
-}
-
-func TestNewFailsOnIssuerMismatch(t *testing.T) {
-	t.Parallel()
-	p := newFakeProvider(t)
-	// Discovery trims the trailing slash, so this fetches the provider's
-	// document, which reports the issuer without it.
-	_, err := New(context.Background(), Config{
-		Issuer:       p.issuer() + "/",
-		ClientID:     testClientID,
-		ClientSecret: testClientSecret,
-		PublicURL:    testPublicURL,
-		SecretKey:    []byte("k"),
-	}, &memorySessions{}, slog.New(slog.DiscardHandler))
-	if err == nil {
-		t.Fatal("New accepted a provider reporting a different issuer")
-	}
-}
-
-func assertLoginCookieCleared(t *testing.T, resp *http.Response) {
-	t.Helper()
-	for _, c := range resp.Cookies() {
-		if c.Name == loginCookieName && c.MaxAge < 0 {
-			return
-		}
-	}
-	t.Errorf("callback did not clear the %s cookie", loginCookieName)
-}
-
-func TestNewRejectsRemoteHTTPIssuer(t *testing.T) {
-	t.Parallel()
-	for _, issuer := range []string{"http://auth.example.com/application/o/mealquest/", "http://192.0.2.10"} {
-		_, err := New(context.Background(), Config{
-			Issuer:       issuer,
-			ClientID:     testClientID,
-			ClientSecret: testClientSecret,
-			PublicURL:    testPublicURL,
-			SecretKey:    []byte("k"),
-		}, &memorySessions{}, slog.New(slog.DiscardHandler))
-		if err == nil || !strings.Contains(err.Error(), "issuer") {
-			t.Errorf("New(issuer %q) error = %v, want issuer rejected", issuer, err)
-		}
-	}
-}
-
-func TestNewRejectsRemoteHTTPEndpoint(t *testing.T) {
-	t.Parallel()
-	tests := []struct {
-		field, name string
-	}{
-		{"authorization_endpoint", "authorization endpoint"},
-		{"token_endpoint", "token endpoint"},
-		{"jwks_uri", "JWKS endpoint"},
-		{"end_session_endpoint", "end session endpoint"},
-	}
-	for _, tc := range tests {
-		t.Run(tc.field, func(t *testing.T) {
-			t.Parallel()
-			p := newFakeProvider(t)
-			p.discoveryOverrides = map[string]any{tc.field: "http://auth.example.com/" + tc.field}
-			_, err := New(context.Background(), Config{
-				Issuer:       p.issuer(),
-				ClientID:     testClientID,
-				ClientSecret: testClientSecret,
-				PublicURL:    testPublicURL,
-				SecretKey:    []byte("k"),
-			}, &memorySessions{}, slog.New(slog.DiscardHandler))
-			if err == nil || !strings.Contains(err.Error(), tc.name) {
-				t.Errorf("New error = %v, want %s rejected", err, tc.name)
-			}
-		})
-	}
-}
-
-// A token endpoint on https:// that redirects the code exchange to plain
-// http:// must not receive a follow-up request: Go would resend the client
-// secret in the Authorization header. The plaintext target is loopback, so
-// only the downgrade rule stops it.
-func TestCallbackRefusesTokenRedirectToHTTP(t *testing.T) {
-	t.Parallel()
-	for _, status := range []int{http.StatusTemporaryRedirect, http.StatusPermanentRedirect} {
-		t.Run(http.StatusText(status), func(t *testing.T) {
-			t.Parallel()
-			var plaintextHits atomic.Int32
-			plaintext := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-				plaintextHits.Add(1)
-				http.Error(w, "unreachable", http.StatusTeapot)
-			}))
-			t.Cleanup(plaintext.Close)
-			var tlsHits atomic.Int32
-			tlsToken := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-				tlsHits.Add(1)
-				http.Redirect(w, r, plaintext.URL+"/token", status)
-			}))
-			t.Cleanup(tlsToken.Close)
-
-			p := newFakeProvider(t)
-			p.discoveryOverrides = map[string]any{"token_endpoint": tlsToken.URL + "/token"}
-			sessions := &memorySessions{}
-			logs := &syncBuffer{}
-			a, err := New(context.Background(), Config{
-				Issuer:       p.issuer(),
-				ClientID:     testClientID,
-				ClientSecret: testClientSecret,
-				PublicURL:    testPublicURL,
-				SecretKey:    []byte("server-secret-key"),
-			}, sessions, slog.New(slog.NewTextHandler(logs, nil)))
-			if err != nil {
-				t.Fatal(err)
-			}
-			// Trust the test server's certificate; the redirect policy stays.
-			a.client.Transport = tlsToken.Client().Transport
-			r := chi.NewRouter()
-			a.Mount(r)
-			h := &harness{provider: p, sessions: sessions, router: r, logs: logs}
-			l := h.login(t, LoginPath)
-
-			resp := h.callback(l, l.query.Get("state"), "unused")
-
-			if resp.StatusCode != http.StatusUnauthorized {
-				t.Errorf("callback status = %d, want 401", resp.StatusCode)
-			}
-			if n := tlsHits.Load(); n != 1 {
-				t.Errorf("https token endpoint hit %d times, want 1", n)
-			}
-			if n := plaintextHits.Load(); n != 0 {
-				t.Errorf("plaintext endpoint hit %d times, want 0", n)
-			}
-			if n := len(sessions.started()); n != 0 {
-				t.Errorf("started %d sessions, want 0", n)
-			}
-			if got := logs.String(); !strings.Contains(got, "downgrade") {
-				t.Errorf("logs = %q, want the downgrade refusal", got)
-			}
-		})
-	}
-}
-
-func TestCheckRedirect(t *testing.T) {
-	t.Parallel()
-	request := func(raw string) *http.Request {
-		req, err := http.NewRequest(http.MethodPost, raw, nil)
-		if err != nil {
-			t.Fatal(err)
-		}
-		return req
-	}
-	tests := []struct {
-		from, to string
-		ok       bool
-	}{
-		{"https://auth.example.com/token", "https://auth2.example.com/token", true},
-		{"http://127.0.0.1:9000/token", "http://localhost:9001/token", true},
-		{"http://127.0.0.1:9000/token", "https://auth.example.com/token", true},
-		{"https://auth.example.com/token", "http://auth.example.com/token", false},
-		{"https://127.0.0.1:9000/token", "http://127.0.0.1:9001/token", false},
-		{"http://127.0.0.1:9000/token", "http://auth.example.com/token", false},
-		{"https://auth.example.com/token", "ftp://auth.example.com/token", false},
-	}
-	for _, tc := range tests {
-		err := checkRedirect(request(tc.to), []*http.Request{request(tc.from)})
-		if (err == nil) != tc.ok {
-			t.Errorf("redirect %s -> %s: error = %v, want ok=%v", tc.from, tc.to, err, tc.ok)
-		}
-	}
-	via := make([]*http.Request, maxRedirects)
-	for i := range via {
-		via[i] = request("https://auth.example.com/token")
-	}
-	if err := checkRedirect(request("https://auth.example.com/token"), via); err == nil {
-		t.Errorf("redirect after %d hops: error = nil, want limit", maxRedirects)
-	}
-}

internal/auth/cookie.go

@@ -1,124 +0,0 @@
-package auth
-
-import (
-	"crypto/hmac"
-	"crypto/sha256"
-	"encoding/base64"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"net/http"
-	"net/url"
-	"strings"
-	"time"
-)
-
-const (
-	loginCookieName = "__Host-mealquest_login"
-	loginCookieTTL  = 10 * time.Minute
-	// loginCookieKeyLabel separates the login cookie's signing key from other
-	// keys derived from the same server secret.
-	loginCookieKeyLabel = "mealquest auth login cookie v1"
-)
-
-// loginState travels from login to callback in the signed login cookie.
-type loginState struct {
-	State    string `json:"s"`
-	Nonce    string `json:"n"`
-	Verifier string `json:"v"`
-	Return   string `json:"r"`
-	Expires  int64  `json:"e"` // Unix seconds
-}
-
-// loginCookie signs and verifies the login cookie with HMAC-SHA256.
-type loginCookie struct {
-	key []byte
-}
-
-func newLoginCookie(secretKey []byte) loginCookie {
-	mac := hmac.New(sha256.New, secretKey)
-	mac.Write([]byte(loginCookieKeyLabel))
-	return loginCookie{key: mac.Sum(nil)}
-}
-
-func (c loginCookie) sign(payload string) string {
-	mac := hmac.New(sha256.New, c.key)
-	mac.Write([]byte(payload))
-	return base64.RawURLEncoding.EncodeToString(mac.Sum(nil))
-}
-
-func (c loginCookie) set(w http.ResponseWriter, s loginState, now time.Time) error {
-	s.Expires = now.Add(loginCookieTTL).Unix()
-	data, err := json.Marshal(s)
-	if err != nil {
-		return err
-	}
-	payload := base64.RawURLEncoding.EncodeToString(data)
-	http.SetCookie(w, &http.Cookie{
-		Name:     loginCookieName,
-		Value:    payload + "." + c.sign(payload),
-		Path:     "/",
-		MaxAge:   int(loginCookieTTL / time.Second),
-		Secure:   true,
-		HttpOnly: true,
-		// Lax so the cookie rides the provider's top-level redirect back.
-		SameSite: http.SameSiteLaxMode,
-	})
-	return nil
-}
-
-func (c loginCookie) clear(w http.ResponseWriter) {
-	http.SetCookie(w, &http.Cookie{
-		Name:     loginCookieName,
-		Path:     "/",
-		MaxAge:   -1,
-		Secure:   true,
-		HttpOnly: true,
-		SameSite: http.SameSiteLaxMode,
-	})
-}
-
-func (c loginCookie) read(r *http.Request, now time.Time) (loginState, error) {
-	cookie, err := r.Cookie(loginCookieName)
-	if err != nil {
-		return loginState{}, errors.New("login cookie missing")
-	}
-	payload, sig, ok := strings.Cut(cookie.Value, ".")
-	if !ok || !hmac.Equal([]byte(sig), []byte(c.sign(payload))) {
-		return loginState{}, errors.New("login cookie signature invalid")
-	}
-	data, err := base64.RawURLEncoding.DecodeString(payload)
-	if err != nil {
-		return loginState{}, fmt.Errorf("login cookie encoding: %w", err)
-	}
-	var s loginState
-	if err := json.Unmarshal(data, &s); err != nil {
-		return loginState{}, fmt.Errorf("login cookie payload: %w", err)
-	}
-	if now.Unix() >= s.Expires {
-		return loginState{}, errors.New("login cookie expired")
-	}
-	return s, nil
-}
-
-// returnPath validates the optional post-login return path. Empty means "/".
-// Only same-origin absolute paths are allowed: no scheme, host, protocol-
-// relative "//" prefix, backslashes or control characters.
-func returnPath(raw string) (string, error) {
-	if raw == "" {
-		return "/", nil
-	}
-	if !strings.HasPrefix(raw, "/") || strings.HasPrefix(raw, "//") || strings.ContainsRune(raw, '\\') {
-		return "", errors.New("return path must be a same-origin path")
-	}
-	for _, c := range raw {
-		if c < 0x20 || c == 0x7f {
-			return "", errors.New("return path contains a control character")
-		}
-	}
-	u, err := url.Parse(raw)
-	if err != nil || u.Scheme != "" || u.Host != "" || u.User != nil {
-		return "", errors.New("return path must be a same-origin path")
-	}
-	return raw, nil
-}

internal/auth/session.go

@@ -1,238 +0,0 @@
-package auth
-
-import (
-	"crypto/rand"
-	"crypto/sha256"
-	"database/sql"
-	"encoding/base64"
-	"encoding/hex"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"net/http"
-	"time"
-
-	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/store"
-)
-
-// SessionCookieName is the session cookie. The __Host- prefix makes the
-// browser insist on Secure, Path=/ and no Domain.
-const SessionCookieName = "__Host-mealquest_session"
-
-// sessionIDBytes is the size of the random session ID: 256 bits.
-const sessionIDBytes = 32
-
-// ErrNoSession means the request carries no live session: the cookie is
-// missing or malformed, or its session is unknown, ended or expired.
-var ErrNoSession = errors.New("auth: no valid session")
-
-// Session is a signed-in household member's server-side session.
-type Session struct {
-	Subject   string
-	Email     string
-	Name      string
-	Groups    []string
-	CSRFToken string
-	CreatedAt time.Time
-	// LastSeenAt is the last time the session was used.
-	LastSeenAt time.Time
-	// ExpiresAt is when the session ends unless used again first.
-	ExpiresAt time.Time
-}
-
-// SessionManager keeps sessions in the sessions table. The cookie holds only
-// the random session ID; the table holds only its SHA-256 hash. A session
-// ends after idle without use and always max after it was created.
-type SessionManager struct {
-	db   *store.Store
-	idle time.Duration
-	max  time.Duration
-	// now is the clock; tests replace it.
-	now func() time.Time
-}
-
-// NewSessionManager returns a SessionManager over db. idle and max must be
-// positive with max >= idle.
-func NewSessionManager(db *store.Store, idle, max time.Duration) (*SessionManager, error) {
-	switch {
-	case db == nil:
-		return nil, errors.New("auth: session store is required")
-	case idle <= 0 || max <= 0:
-		return nil, errors.New("auth: session idle and max lifetimes must be positive")
-	case max < idle:
-		return nil, errors.New("auth: session max lifetime must be at least the idle lifetime")
-	}
-	return &SessionManager{db: db, idle: idle, max: max, now: time.Now}, nil
-}
-
-// StartSession creates a session for claims and sets the session cookie.
-func (m *SessionManager) StartSession(w http.ResponseWriter, r *http.Request, claims Claims) error {
-	if claims.Subject == "" {
-		return errors.New("auth: session needs a subject")
-	}
-	id, csrf := randomToken(), randomToken()
-	groups := claims.Groups
-	if groups == nil {
-		groups = []string{}
-	}
-	groupsJSON, err := json.Marshal(groups)
-	if err != nil {
-		return fmt.Errorf("auth: encode session groups: %w", err)
-	}
-
-	now := m.timestamp()
-	if _, err := m.db.Writer.ExecContext(r.Context(), `
-		INSERT INTO sessions (id_hash, subject, email, name, groups, csrf_token, created_at, last_seen_at, expires_at)
-		VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
-		hashSessionID(id), claims.Subject, claims.Email, claims.Name, string(groupsJSON), csrf,
-		now, now, m.expiry(now.Time, now.Time),
-	); err != nil {
-		return fmt.Errorf("auth: create session: %w", err)
-	}
-
-	// The cookie outlives idle gaps so a returning device presents its ID;
-	// the server decides whether the session is still live. Max-Age is whole
-	// seconds, rounded up so the cookie never ends before the absolute limit.
-	http.SetCookie(w, sessionCookie(id, cookieMaxAge(m.max)))
-	return nil
-}
-
-// cookieMaxAge is lifetime in whole seconds, rounded up. It rounds the
-// quotient rather than adding to lifetime, which would overflow near the
-// largest time.Duration.
-func cookieMaxAge(lifetime time.Duration) int {
-	seconds := lifetime / time.Second
-	if lifetime%time.Second != 0 {
-		seconds++
-	}
-	return int(seconds)
-}
-
-// SessionFor returns the live session r carries and slides its last use to
-// now. It returns ErrNoSession when there is none; an expired session is
-// deleted.
-func (m *SessionManager) SessionFor(r *http.Request) (Session, error) {
-	idHash, err := sessionIDHash(r)
-	if err != nil {
-		return Session{}, err
-	}
-	now := m.timestamp()
-
-	var s Session
-	live := false
-	err = m.db.WithTx(r.Context(), func(tx *sql.Tx) error {
-		var groupsJSON string
-		var created, lastSeen, expires store.Timestamp
-		err := tx.QueryRowContext(r.Context(), `
-			SELECT subject, email, name, groups, csrf_token, created_at, last_seen_at, expires_at
-			FROM sessions WHERE id_hash = ?`, idHash,
-		).Scan(&s.Subject, &s.Email, &s.Name, &groupsJSON, &s.CSRFToken, &created, &lastSeen, &expires)
-		if errors.Is(err, sql.ErrNoRows) {
-			return nil
-		}
-		if err != nil {
-			return fmt.Errorf("auth: read session: %w", err)
-		}
-
-		if !now.Before(expires.Time) || now.Sub(lastSeen.Time) >= m.idle || now.Sub(created.Time) >= m.max {
-			if _, err := tx.ExecContext(r.Context(), `DELETE FROM sessions WHERE id_hash = ?`, idHash); err != nil {
-				return fmt.Errorf("auth: delete expired session: %w", err)
-			}
-			return nil
-		}
-
-		if err := json.Unmarshal([]byte(groupsJSON), &s.Groups); err != nil {
-			return fmt.Errorf("auth: decode session groups: %w", err)
-		}
-		expiresAt := m.expiry(created.Time, now.Time)
-		if _, err := tx.ExecContext(r.Context(), `
-			UPDATE sessions SET last_seen_at = ?, expires_at = ? WHERE id_hash = ?`,
-			now, expiresAt, idHash,
-		); err != nil {
-			return fmt.Errorf("auth: slide session: %w", err)
-		}
-		s.CreatedAt, s.LastSeenAt, s.ExpiresAt = created.Time, now.Time, expiresAt.Time
-		live = true
-		return nil
-	})
-	if err != nil {
-		return Session{}, err
-	}
-	if !live {
-		return Session{}, ErrNoSession
-	}
-	return s, nil
-}
-
-// EndSession deletes the session r carries, if any, and clears the cookie.
-func (m *SessionManager) EndSession(w http.ResponseWriter, r *http.Request) error {
-	http.SetCookie(w, sessionCookie("", -1))
-	idHash, err := sessionIDHash(r)
-	if errors.Is(err, ErrNoSession) {
-		return nil
-	}
-	if err != nil {
-		return err
-	}
-	if _, err := m.db.Writer.ExecContext(r.Context(), `DELETE FROM sessions WHERE id_hash = ?`, idHash); err != nil {
-		return fmt.Errorf("auth: delete session: %w", err)
-	}
-	return nil
-}
-
-// timestamp is the clock's current instant at stored precision.
-func (m *SessionManager) timestamp() store.Timestamp {
-	return store.Timestamp{Time: m.now().UTC().Truncate(time.Millisecond)}
-}
-
-// expiry is when a session created at created and last used at lastSeen
-// ends: idle after lastSeen, but never later than max after created.
-func (m *SessionManager) expiry(created, lastSeen time.Time) store.Timestamp {
-	idle, absolute := lastSeen.Add(m.idle), created.Add(m.max)
-	if absolute.Before(idle) {
-		return store.Timestamp{Time: absolute}
-	}
-	return store.Timestamp{Time: idle}
-}
-
-// sessionCookie is the session cookie carrying value, with maxAge seconds;
-// a negative maxAge clears it.
-func sessionCookie(value string, maxAge int) *http.Cookie {
-	return &http.Cookie{
-		Name:     SessionCookieName,
-		Value:    value,
-		Path:     "/",
-		MaxAge:   maxAge,
-		Secure:   true,
-		HttpOnly: true,
-		SameSite: http.SameSiteLaxMode,
-	}
-}
-
-// sessionIDHash returns the stored hash of r's session ID, or ErrNoSession
-// when the cookie is missing or is not a well-formed ID.
-func sessionIDHash(r *http.Request) (string, error) {
-	c, err := r.Cookie(SessionCookieName)
-	if err != nil {
-		return "", ErrNoSession
-	}
-	raw, err := base64.RawURLEncoding.DecodeString(c.Value)
-	if err != nil || len(raw) != sessionIDBytes {
-		return "", ErrNoSession
-	}
-	return hashSessionID(c.Value), nil
-}
-
-// hashSessionID is the SHA-256 hex digest of the cookie value.
-func hashSessionID(id string) string {
-	sum := sha256.Sum256([]byte(id))
-	return hex.EncodeToString(sum[:])
-}
-
-// randomToken returns 256 random bits, base64url-encoded without padding.
-// crypto/rand.Read never returns an error; it crashes the program instead.
-func randomToken() string {
-	b := make([]byte, sessionIDBytes)
-	rand.Read(b)
-	return base64.RawURLEncoding.EncodeToString(b)
-}

internal/auth/session_test.go

@@ -1,521 +0,0 @@
-package auth
-
-import (
-	"context"
-	"crypto/sha256"
-	"encoding/hex"
-	"errors"
-	"log/slog"
-	"net/http"
-	"net/http/httptest"
-	"slices"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/go-chi/chi/v5"
-
-	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/store"
-	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/migrations"
-)
-
-const (
-	testIdle = 30 * 24 * time.Hour
-	testMax  = 180 * 24 * time.Hour
-)
-
-// testEpoch is the fake clock's starting instant.
-var testEpoch = time.Date(2026, 10, 3, 18, 30, 0, 0, time.UTC)
-
-// sessionHarness runs the real login flow against a fake provider with a
-// SessionManager over a migrated database and a fake clock.
-type sessionHarness struct {
-	*harness
-	db       *store.Store
-	sessions *SessionManager
-	auth     *Auth
-	clock    time.Time
-}
-
-func newSessionHarness(t *testing.T) *sessionHarness {
-	t.Helper()
-	ctx := context.Background()
-	db, err := store.Open(ctx, t.TempDir())
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() {
-		if err := db.Close(); err != nil {
-			t.Error(err)
-		}
-	})
-	if err := store.Migrate(ctx, db.Writer, migrations.FS); err != nil {
-		t.Fatal(err)
-	}
-	sessions, err := NewSessionManager(db, testIdle, testMax)
-	if err != nil {
-		t.Fatal(err)
-	}
-	h := &sessionHarness{db: db, sessions: sessions, clock: testEpoch}
-	sessions.now = func() time.Time { return h.clock }
-
-	p := newFakeProvider(t)
-	logs := &syncBuffer{}
-	a, err := New(ctx, Config{
-		Issuer:       p.issuer(),
-		ClientID:     testClientID,
-		ClientSecret: testClientSecret,
-		PublicURL:    testPublicURL,
-		SecretKey:    []byte("server-secret-key"),
-	}, sessions, slog.New(slog.NewTextHandler(logs, nil)))
-	if err != nil {
-		t.Fatal(err)
-	}
-	r := chi.NewRouter()
-	a.Mount(r)
-	h.harness = &harness{provider: p, router: r, logs: logs}
-	h.auth = a
-	return h
-}
-
-func (h *sessionHarness) advance(d time.Duration) { h.clock = h.clock.Add(d) }
-
-// signIn completes a login and returns the callback response and the
-// session cookie it set.
-func (h *sessionHarness) signIn(t *testing.T) (*http.Response, *http.Cookie) {
-	t.Helper()
-	l := h.login(t, LoginPath)
-	resp := h.callback(l, l.query.Get("state"), h.provider.signRS256(h.provider.claims(l.query.Get("nonce"))))
-	if resp.StatusCode != http.StatusSeeOther {
-		t.Fatalf("callback status = %d, want 303", resp.StatusCode)
-	}
-	for _, c := range resp.Cookies() {
-		if c.Name == SessionCookieName {
-			return resp, c
-		}
-	}
-	t.Fatalf("callback set no %s cookie", SessionCookieName)
-	return nil, nil
-}
-
-// use looks up the session cookie c names.
-func (h *sessionHarness) use(c *http.Cookie) (Session, error) {
-	req := httptest.NewRequest(http.MethodGet, "/api/anything", nil)
-	if c != nil {
-		req.AddCookie(c)
-	}
-	return h.sessions.SessionFor(req)
-}
-
-type sessionRow struct {
-	idHash, subject, email, name, groups, csrf string
-	created, lastSeen, expires                 store.Timestamp
-}
-
-func (h *sessionHarness) rows(t *testing.T) []sessionRow {
-	t.Helper()
-	rs, err := h.db.Reader.Query(`SELECT id_hash, subject, email, name, groups, csrf_token,
-		created_at, last_seen_at, expires_at FROM sessions`)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer rs.Close()
-	var out []sessionRow
-	for rs.Next() {
-		var r sessionRow
-		if err := rs.Scan(&r.idHash, &r.subject, &r.email, &r.name, &r.groups, &r.csrf,
-			&r.created, &r.lastSeen, &r.expires); err != nil {
-			t.Fatal(err)
-		}
-		out = append(out, r)
-	}
-	if err := rs.Err(); err != nil {
-		t.Fatal(err)
-	}
-	return out
-}
-
-// sessionSetCookie returns the raw Set-Cookie header for the session cookie.
-func sessionSetCookie(t *testing.T, resp *http.Response) string {
-	t.Helper()
-	for _, v := range resp.Header.Values("Set-Cookie") {
-		if strings.HasPrefix(v, SessionCookieName+"=") {
-			return v
-		}
-	}
-	t.Fatalf("no Set-Cookie for %s in %q", SessionCookieName, resp.Header.Values("Set-Cookie"))
-	return ""
-}
-
-// assertSessionCookieAttributes checks the attributes the __Host- prefix
-// and D-004 require, on the raw header so nothing is lost in parsing.
-func assertSessionCookieAttributes(t *testing.T, raw string) {
-	t.Helper()
-	attrs := map[string]bool{}
-	for _, a := range strings.Split(raw, ";")[1:] {
-		name, _, _ := strings.Cut(strings.TrimSpace(a), "=")
-		attrs[strings.ToLower(name)] = true
-	}
-	for _, want := range []string{"Path=/", "HttpOnly", "Secure", "SameSite=Lax"} {
-		if !slices.Contains(strings.Split(raw, "; "), want) {
-			t.Errorf("session Set-Cookie %q lacks %s", raw, want)
-		}
-	}
-	if attrs["domain"] {
-		t.Errorf("session Set-Cookie %q has a Domain", raw)
-	}
-}
-
-func sha256Hex(s string) string {
-	sum := sha256.Sum256([]byte(s))
-	return hex.EncodeToString(sum[:])
-}
-
-func TestCallbackStartsSession(t *testing.T) {
-	t.Parallel()
-	h := newSessionHarness(t)
-	resp, cookie := h.signIn(t)
-
-	assertSessionCookieAttributes(t, sessionSetCookie(t, resp))
-	if cookie.MaxAge != int(testMax/time.Second) {
-		t.Errorf("session cookie MaxAge = %d, want %d", cookie.MaxAge, int(testMax/time.Second))
-	}
-
-	rows := h.rows(t)
-	if len(rows) != 1 {
-		t.Fatalf("sessions has %d rows, want 1", len(rows))
-	}
-	r := rows[0]
-	if len(cookie.Value) != 43 {
-		t.Errorf("session ID %q is %d chars, want 43 (256 bits, base64url)", cookie.Value, len(cookie.Value))
-	}
-	if r.idHash != sha256Hex(cookie.Value) {
-		t.Errorf("id_hash = %q, want the SHA-256 of the cookie value", r.idHash)
-	}
-	if r.subject != "user-123" || r.email != "cook@example.com" || r.name != "Home Cook" ||
-		r.groups != `["mealquest-admin"]` {
-		t.Errorf("session row = %+v, want the ID token claims", r)
-	}
-	if len(r.csrf) != 43 || r.csrf == cookie.Value {
-		t.Errorf("csrf_token = %q, want a separate 256-bit token", r.csrf)
-	}
-	if !r.created.Equal(testEpoch) || !r.lastSeen.Equal(testEpoch) || !r.expires.Equal(testEpoch.Add(testIdle)) {
-		t.Errorf("created, last_seen, expires = %v, %v, %v, want %v, %v, %v",
-			r.created, r.lastSeen, r.expires, testEpoch, testEpoch, testEpoch.Add(testIdle))
-	}
-
-	s, err := h.use(cookie)
-	if err != nil {
-		t.Fatalf("SessionFor = %v, want the new session", err)
-	}
-	if s.Subject != "user-123" || s.CSRFToken != r.csrf || !slices.Equal(s.Groups, []string{"mealquest-admin"}) {
-		t.Errorf("SessionFor = %+v", s)
-	}
-}
-
-func TestStartSessionStoresOnlyTheHash(t *testing.T) {
-	t.Parallel()
-	h := newSessionHarness(t)
-	_, cookie := h.signIn(t)
-	var n int
-	err := h.db.Reader.QueryRow(`SELECT count(*) FROM sessions WHERE
-		id_hash = ?1 OR subject = ?1 OR email = ?1 OR name = ?1 OR groups = ?1 OR csrf_token = ?1`,
-		cookie.Value).Scan(&n)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if n != 0 {
-		t.Error("the raw session ID is stored in the sessions table")
-	}
-}
-
-func TestSessionLastSeenSlides(t *testing.T) {
-	t.Parallel()
-	h := newSessionHarness(t)
-	_, cookie := h.signIn(t)
-
-	// Used every 20 days, the session outlives several idle periods.
-	for range 4 {
-		h.advance(20 * 24 * time.Hour)
-		s, err := h.use(cookie)
-		if err != nil {
-			t.Fatalf("at %v SessionFor = %v, want the session", h.clock, err)
-		}
-		if !s.LastSeenAt.Equal(h.clock) || !s.ExpiresAt.Equal(h.clock.Add(testIdle)) {
-			t.Errorf("at %v session last seen %v, expires %v, want %v, %v",
-				h.clock, s.LastSeenAt, s.ExpiresAt, h.clock, h.clock.Add(testIdle))
-		}
-		r := h.rows(t)[0]
-		if !r.lastSeen.Equal(h.clock) || !r.expires.Equal(h.clock.Add(testIdle)) || !r.created.Equal(testEpoch) {
-			t.Errorf("at %v row created %v, last seen %v, expires %v", h.clock, r.created, r.lastSeen, r.expires)
-		}
-	}
-}
-
-func TestSessionIdleExpiry(t *testing.T) {
-	t.Parallel()
-	h := newSessionHarness(t)
-	_, cookie := h.signIn(t)
-
-	h.advance(testIdle - time.Millisecond)
-	if _, err := h.use(cookie); err != nil {
-		t.Fatalf("just inside the idle limit SessionFor = %v, want the session", err)
-	}
-	h.advance(testIdle)
-	if _, err := h.use(cookie); !errors.Is(err, ErrNoSession) {
-		t.Fatalf("after idle SessionFor = %v, want ErrNoSession", err)
-	}
-	if n := len(h.rows(t)); n != 0 {
-		t.Errorf("expired session left %d rows, want 0", n)
-	}
-	// Turning the clock back cannot revive it.
-	h.clock = testEpoch
-	if _, err := h.use(cookie); !errors.Is(err, ErrNoSession) {
-		t.Errorf("after deletion SessionFor = %v, want ErrNoSession", err)
-	}
-}
-
-func TestSessionAbsoluteExpiry(t *testing.T) {
-	t.Parallel()
-	h := newSessionHarness(t)
-	_, cookie := h.signIn(t)
-
-	for h.clock.Before(testEpoch.Add(testMax - 20*24*time.Hour)) {
-		h.advance(20 * 24 * time.Hour)
-		if _, err := h.use(cookie); err != nil {
-			t.Fatalf("at %v SessionFor = %v, want the session", h.clock, err)
-		}
-	}
-	// Last used 20 days before the absolute limit: the idle window would run
-	// past it, so expiry is capped there.
-	if r := h.rows(t)[0]; !r.expires.Equal(testEpoch.Add(testMax)) {
-		t.Errorf("expires_at = %v, want the absolute limit %v", r.expires, testEpoch.Add(testMax))
-	}
-
-	h.clock = testEpoch.Add(testMax - time.Millisecond)
-	if _, err := h.use(cookie); err != nil {
-		t.Fatalf("just inside the absolute limit SessionFor = %v, want the session", err)
-	}
-	h.clock = testEpoch.Add(testMax)
-	if _, err := h.use(cookie); !errors.Is(err, ErrNoSession) {
-		t.Fatalf("at the absolute limit, used 1ms ago, SessionFor = %v, want ErrNoSession", err)
-	}
-	if n := len(h.rows(t)); n != 0 {
-		t.Errorf("expired session left %d rows, want 0", n)
-	}
-}
-
-// A max with fractional seconds rounds the cookie Max-Age up, so the browser
-// keeps the cookie until the server-side absolute limit.
-func TestSessionCookieOutlivesFractionalMax(t *testing.T) {
-	t.Parallel()
-	h := newSessionHarness(t)
-	h.sessions.idle, h.sessions.max = 1500*time.Millisecond, 2500*time.Millisecond
-	_, cookie := h.signIn(t)
-	if cookie.MaxAge != 3 {
-		t.Errorf("session cookie MaxAge = %d, want 3", cookie.MaxAge)
-	}
-	if r := h.rows(t)[0]; !r.expires.Equal(testEpoch.Add(1500 * time.Millisecond)) {
-		t.Errorf("expires_at = %v, want %v", r.expires, testEpoch.Add(1500*time.Millisecond))
-	}
-
-	h.advance(time.Second)
-	if _, err := h.use(cookie); err != nil {
-		t.Fatalf("at 1s SessionFor = %v, want the session", err)
-	}
-	h.clock = testEpoch.Add(2500*time.Millisecond - time.Millisecond)
-	if _, err := h.use(cookie); err != nil {
-		t.Fatalf("just inside the absolute limit SessionFor = %v, want the session", err)
-	}
-	h.clock = testEpoch.Add(2500 * time.Millisecond)
-	if _, err := h.use(cookie); !errors.Is(err, ErrNoSession) {
-		t.Errorf("at the absolute limit SessionFor = %v, want ErrNoSession", err)
-	}
-}
-
-// A lifetime near the largest accepted duration still yields a positive,
-// rounded-up cookie Max-Age rather than overflowing.
-func TestSessionCookieMaxAgeNearLargestMax(t *testing.T) {
-	t.Parallel()
-	largest, err := time.ParseDuration("2562047h47m16.854s")
-	if err != nil {
-		t.Fatal(err)
-	}
-	h := newSessionHarness(t)
-	h.sessions.max = largest
-	_, cookie := h.signIn(t)
-	if want := 9223372037; cookie.MaxAge != want {
-		t.Errorf("session cookie MaxAge = %d, want %d", cookie.MaxAge, want)
-	}
-}
-
-// A lifetime shortened by configuration applies to existing sessions even
-// though their stored expires_at is later.
-func TestSessionLifetimeChecksUseCurrentConfig(t *testing.T) {
-	t.Parallel()
-	h := newSessionHarness(t)
-	_, cookie := h.signIn(t)
-	h.sessions.idle = 24 * time.Hour
-	h.advance(24 * time.Hour)
-	if _, err := h.use(cookie); !errors.Is(err, ErrNoSession) {
-		t.Errorf("past the shortened idle SessionFor = %v, want ErrNoSession", err)
-	}
-
-	_, cookie = h.signIn(t)
-	h.sessions.idle, h.sessions.max = 24*time.Hour, 48*time.Hour
-	for range 3 {
-		h.advance(12 * time.Hour)
-		if _, err := h.use(cookie); err != nil {
-			t.Fatalf("SessionFor = %v, want the session", err)
-		}
-	}
-	h.advance(12 * time.Hour)
-	if _, err := h.use(cookie); !errors.Is(err, ErrNoSession) {
-		t.Errorf("past the shortened max SessionFor = %v, want ErrNoSession", err)
-	}
-
-	// Used recently and with expires_at still ahead, but older than a max
-	// shortened after that use: only the absolute check ends it.
-	h.sessions.idle, h.sessions.max = testIdle, testMax
-	_, cookie = h.signIn(t)
-	h.advance(10 * 24 * time.Hour)
-	if _, err := h.use(cookie); err != nil {
-		t.Fatalf("SessionFor = %v, want the session", err)
-	}
-	h.sessions.max = 10 * 24 * time.Hour
-	h.advance(time.Hour)
-	if _, err := h.use(cookie); !errors.Is(err, ErrNoSession) {
-		t.Errorf("past a max shortened after the last use SessionFor = %v, want ErrNoSession", err)
-	}
-}
-
-func TestSessionForRejectsBadCookies(t *testing.T) {
-	t.Parallel()
-	h := newSessionHarness(t)
-	h.signIn(t)
-	for name, c := range map[string]*http.Cookie{
-		"missing":      nil,
-		"empty":        {Name: SessionCookieName, Value: ""},
-		"not base64":   {Name: SessionCookieName, Value: strings.Repeat("!", 43)},
-		"short":        {Name: SessionCookieName, Value: "AAAA"},
-		"unknown ID":   {Name: SessionCookieName, Value: randomToken()},
-		"other cookie": {Name: "mealquest_session", Value: randomToken()},
-	} {
-		if _, err := h.use(c); !errors.Is(err, ErrNoSession) {
-			t.Errorf("%s: SessionFor = %v, want ErrNoSession", name, err)
-		}
-	}
-	if n := len(h.rows(t)); n != 1 {
-		t.Errorf("sessions has %d rows, want the signed-in session only", n)
-	}
-}
-
-func (h *sessionHarness) logout(cookies ...*http.Cookie) *http.Response {
-	req := httptest.NewRequest(http.MethodPost, LogoutPath, nil)
-	for _, c := range cookies {
-		req.AddCookie(c)
-	}
-	rec := httptest.NewRecorder()
-	h.router.ServeHTTP(rec, req)
-	return rec.Result()
-}
-
-func TestLogout(t *testing.T) {
-	t.Parallel()
-	h := newSessionHarness(t)
-	_, cookie := h.signIn(t)
-	_, other := h.signIn(t)
-
-	resp := h.logout(cookie)
-	if resp.StatusCode != http.StatusSeeOther {
-		t.Fatalf("logout status = %d, want 303", resp.StatusCode)
-	}
-	want := h.provider.issuer() + "/end-session/"
-	if got := resp.Header.Get("Location"); got != want || h.auth.EndSessionURL() != want {
-		t.Errorf("logout redirect = %q, EndSessionURL = %q, want %q", got, h.auth.EndSessionURL(), want)
-	}
-	raw := sessionSetCookie(t, resp)
-	assertSessionCookieAttributes(t, raw)
-	if !strings.HasPrefix(raw, SessionCookieName+"=;") || !strings.Contains(raw, "Max-Age=0") {
-		t.Errorf("logout Set-Cookie = %q, want the cookie cleared", raw)
-	}
-
-	rows := h.rows(t)
-	if len(rows) != 1 || rows[0].idHash != sha256Hex(other.Value) {
-		t.Errorf("after logout sessions = %+v, want only the other session", rows)
-	}
-	if _, err := h.use(cookie); !errors.Is(err, ErrNoSession) {
-		t.Errorf("logged-out cookie: SessionFor = %v, want ErrNoSession", err)
-	}
-	if _, err := h.use(other); err != nil {
-		t.Errorf("other session: SessionFor = %v, want it untouched", err)
-	}
-}
-
-func TestLogoutWithoutSession(t *testing.T) {
-	t.Parallel()
-	h := newSessionHarness(t)
-	resp := h.logout()
-	if resp.StatusCode != http.StatusSeeOther || resp.Header.Get("Location") != h.provider.issuer()+"/end-session/" {
-		t.Errorf("logout = %d to %q, want 303 to the end session endpoint", resp.StatusCode, resp.Header.Get("Location"))
-	}
-	assertSessionCookieAttributes(t, sessionSetCookie(t, resp))
-}
-
-func TestLogoutIsPostOnly(t *testing.T) {
-	t.Parallel()
-	h := newSessionHarness(t)
-	_, cookie := h.signIn(t)
-	if resp := h.get(LogoutPath, cookie); resp.StatusCode != http.StatusMethodNotAllowed {
-		t.Errorf("GET %s status = %d, want 405", LogoutPath, resp.StatusCode)
-	}
-	if _, err := h.use(cookie); err != nil {
-		t.Errorf("after GET %s SessionFor = %v, want the session", LogoutPath, err)
-	}
-}
-
-func TestLogoutSessionError(t *testing.T) {
-	t.Parallel()
-	h := newHarness(t)
-	h.sessions.err = errors.New("database down")
-	rec := httptest.NewRecorder()
-	h.router.ServeHTTP(rec, httptest.NewRequest(http.MethodPost, LogoutPath, nil))
-	if rec.Code != http.StatusInternalServerError {
-		t.Errorf("logout status = %d, want 500", rec.Code)
-	}
-}
-
-func TestNewRequiresEndSessionEndpoint(t *testing.T) {
-	t.Parallel()
-	p := newFakeProvider(t)
-	p.discoveryOverrides = map[string]any{"end_session_endpoint": nil}
-	_, err := New(context.Background(), Config{
-		Issuer:       p.issuer(),
-		ClientID:     testClientID,
-		ClientSecret: testClientSecret,
-		PublicURL:    testPublicURL,
-		SecretKey:    []byte("k"),
-	}, &memorySessions{}, slog.New(slog.DiscardHandler))
-	if err == nil || !strings.Contains(err.Error(), "end session endpoint") {
-		t.Errorf("New error = %v, want the missing end session endpoint named", err)
-	}
-}
-
-func TestNewSessionManagerValidates(t *testing.T) {
-	t.Parallel()
-	db := &store.Store{}
-	for _, tc := range []struct {
-		name      string
-		db        *store.Store
-		idle, max time.Duration
-	}{
-		{"nil store", nil, time.Hour, time.Hour},
-		{"zero idle", db, 0, time.Hour},
-		{"negative max", db, time.Hour, -time.Hour},
-		{"max below idle", db, 2 * time.Hour, time.Hour},
-	} {
-		if _, err := NewSessionManager(tc.db, tc.idle, tc.max); err == nil {
-			t.Errorf("%s: NewSessionManager succeeded", tc.name)
-		}
-	}
-}

internal/config/config.go

@@ -12,7 +12,7 @@ import (
 	"strings"
 	"time"
 
-	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/secureurl"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/household"
 )
 
 // Environment variable names.
@@ -22,21 +22,7 @@ const (
 	EnvDataDir         = "MEALQUEST_DATA_DIR"
 	EnvShutdownTimeout = "MEALQUEST_SHUTDOWN_TIMEOUT"
 	EnvSecretKeyFile   = "MEALQUEST_SECRET_KEY_FILE"
-
-	EnvOIDCIssuer           = "MEALQUEST_OIDC_ISSUER"
-	EnvOIDCClientID         = "MEALQUEST_OIDC_CLIENT_ID"
-	EnvOIDCClientSecretFile = "MEALQUEST_OIDC_CLIENT_SECRET_FILE"
-	EnvOIDCAllowedGroups    = "MEALQUEST_OIDC_ALLOWED_GROUPS"
-
-	EnvSessionIdle = "MEALQUEST_SESSION_IDLE"
-	EnvSessionMax  = "MEALQUEST_SESSION_MAX"
-)
-
-// Session lifetime defaults (D-004): long enough that the kitchen tablet
-// stays signed in.
-const (
-	DefaultSessionIdle = 720 * time.Hour  // 30 days
-	DefaultSessionMax  = 4320 * time.Hour // 180 days
+	EnvDefaultTZ       = "MEALQUEST_DEFAULT_TZ"
 )
 
 // Config is the validated service configuration.
@@ -46,18 +32,10 @@ type Config struct {
 	DataDir         string
 	ShutdownTimeout time.Duration
 	SecretKey       Secret
-
-	// OIDCIssuer is the Authentik issuer URL used for discovery.
-	OIDCIssuer       *url.URL
-	OIDCClientID     string
-	OIDCClientSecret Secret
-	// OIDCAllowedGroups lists the groups whose members may sign in.
-	OIDCAllowedGroups []string
-
-	// SessionIdle ends a session left unused this long.
-	SessionIdle time.Duration
-	// SessionMax ends every session this long after sign-in, used or not.
-	SessionMax time.Duration
+	// DefaultTZ is the IANA zone the household settings are created with on
+	// first boot. It is optional here: boot requires it only while the
+	// settings do not exist yet. Empty when unset.
+	DefaultTZ string
 }
 
 // PublicOrigin returns the scheme and host of PublicURL, the only parts of it
@@ -76,21 +54,11 @@ func load(lookup func(string) (string, bool)) (Config, error) {
 	r := reader{lookup: lookup}
 	cfg := Config{
 		HTTPAddr:        r.listenAddr(EnvHTTPAddr),
-		PublicURL:       r.secureURL(EnvPublicURL),
+		PublicURL:       r.httpURL(EnvPublicURL),
 		DataDir:         r.dir(EnvDataDir),
 		ShutdownTimeout: r.duration(EnvShutdownTimeout),
 		SecretKey:       r.secretFile(EnvSecretKeyFile),
-
-		OIDCIssuer:        r.secureURL(EnvOIDCIssuer),
-		OIDCClientID:      r.str(EnvOIDCClientID),
-		OIDCClientSecret:  r.secretFile(EnvOIDCClientSecretFile),
-		OIDCAllowedGroups: r.list(EnvOIDCAllowedGroups),
-
-		SessionIdle: r.sessionDuration(EnvSessionIdle, DefaultSessionIdle),
-		SessionMax:  r.sessionDuration(EnvSessionMax, DefaultSessionMax),
-	}
-	if cfg.SessionIdle > 0 && cfg.SessionMax > 0 && cfg.SessionMax < cfg.SessionIdle {
-		r.fail(EnvSessionMax, "must be at least %s (%s)", EnvSessionIdle, cfg.SessionIdle)
+		DefaultTZ:       r.optionalZone(EnvDefaultTZ),
 	}
 	if len(r.problems) > 0 {
 		return Config{}, &Error{Problems: r.problems}
@@ -154,29 +122,6 @@ func (r *reader) required(name string) (string, bool) {
 	return v, true
 }
 
-func (r *reader) str(name string) string {
-	v, _ := r.required(name)
-	return v
-}
-
-// list parses a comma-separated list. Every entry must be non-empty after
-// trimming spaces.
-func (r *reader) list(name string) []string {
-	v, ok := r.required(name)
-	if !ok {
-		return nil
-	}
-	items := strings.Split(v, ",")
-	for i, item := range items {
-		items[i] = strings.TrimSpace(item)
-		if items[i] == "" {
-			r.fail(name, "empty entry in comma-separated list %q", v)
-			return nil
-		}
-	}
-	return items
-}
-
 func (r *reader) listenAddr(name string) string {
 	v, ok := r.required(name)
 	if !ok {
@@ -218,21 +163,15 @@ func validHostname(h string) bool {
 	return true
 }
 
-// secureURL reads an absolute URL that must pass secureurl.Check: https://,
-// or http:// to a loopback host only.
-func (r *reader) secureURL(name string) *url.URL {
+func (r *reader) httpURL(name string) *url.URL {
 	v, ok := r.required(name)
 	if !ok {
 		return nil
 	}
 	// The value is never echoed: it may carry credentials.
 	u, err := url.Parse(v)
-	if err != nil {
-		r.fail(name, "invalid URL (want absolute https:// URL)")
-		return nil
-	}
-	if err := secureurl.Check(u); err != nil {
-		r.fail(name, "invalid URL: %v", err)
+	if err != nil || (u.Scheme != "http" && u.Scheme != "https") || u.Hostname() == "" {
+		r.fail(name, "invalid URL (want absolute http:// or https:// URL)")
 		return nil
 	}
 	if u.User != nil {
@@ -264,32 +203,6 @@ func (r *reader) duration(name string) time.Duration {
 	if !ok {
 		return 0
 	}
-	return r.parseDuration(name, v)
-}
-
-// optionalDuration returns def when name is unset. A set value, even an empty
-// one, must be a valid positive duration.
-func (r *reader) optionalDuration(name string, def time.Duration) time.Duration {
-	v, ok := r.lookup(name)
-	if !ok {
-		return def
-	}
-	return r.parseDuration(name, v)
-}
-
-// sessionDuration is optionalDuration restricted to whole milliseconds:
-// session expiry is stored as a store.Timestamp, which keeps millisecond
-// precision, so a finer duration could not be honoured.
-func (r *reader) sessionDuration(name string, def time.Duration) time.Duration {
-	d := r.optionalDuration(name, def)
-	if d%time.Millisecond != 0 {
-		r.fail(name, "duration must be a whole number of milliseconds, got %s", d)
-		return 0
-	}
-	return d
-}
-
-func (r *reader) parseDuration(name, v string) time.Duration {
 	d, err := time.ParseDuration(v)
 	if err != nil {
 		r.fail(name, "invalid duration %q (want e.g. 10s, 1m)", v)
@@ -302,6 +215,20 @@ func (r *reader) parseDuration(name, v string) time.Duration {
 	return d
 }
 
+// optionalZone returns the IANA zone name in the variable, or "" when it is
+// unset. A set value must be a loadable zone.
+func (r *reader) optionalZone(name string) string {
+	v, ok := r.lookup(name)
+	if !ok {
+		return ""
+	}
+	if _, err := household.LoadZone(v); err != nil {
+		r.fail(name, "%v", err)
+		return ""
+	}
+	return v
+}
+
 // secretFile reads a secret from the file named by name, which must end in
 // _FILE. Setting the secret inline (name without _FILE) is rejected.
 func (r *reader) secretFile(name string) Secret {

internal/config/config_test.go

@@ -6,7 +6,6 @@ import (
 	"net/url"
 	"os"
 	"path/filepath"
-	"reflect"
 	"slices"
 	"strings"
 	"testing"
@@ -22,10 +21,6 @@ func TestLoad(t *testing.T) {
 		t.Fatal(err)
 	}
 	unreadablePath := filepath.Join(dir, "missing_secret")
-	clientSecretPath := filepath.Join(dir, "oidc_client_secret")
-	if err := os.WriteFile(clientSecretPath, []byte("client-s3cret\n"), 0o600); err != nil {
-		t.Fatal(err)
-	}
 	emptyPath := filepath.Join(dir, "empty_secret")
 	if err := os.WriteFile(emptyPath, []byte("\n"), 0o600); err != nil {
 		t.Fatal(err)
@@ -38,11 +33,6 @@ func TestLoad(t *testing.T) {
 			EnvDataDir:         dir,
 			EnvShutdownTimeout: "15s",
 			EnvSecretKeyFile:   secretPath,
-
-			EnvOIDCIssuer:           "https://auth.example.com/application/o/mealquest/",
-			EnvOIDCClientID:         "mealquest",
-			EnvOIDCClientSecretFile: clientSecretPath,
-			EnvOIDCAllowedGroups:    "mealquest-admin",
 		}
 	}
 	with := func(changes map[string]string, unset ...string) map[string]string {
@@ -65,6 +55,25 @@ func TestLoad(t *testing.T) {
 			name: "all required vars present",
 			env:  valid(),
 		},
+		{
+			name: "default time zone set",
+			env:  with(map[string]string{EnvDefaultTZ: "America/New_York"}),
+		},
+		{
+			name:    "default time zone not an IANA zone",
+			env:     with(map[string]string{EnvDefaultTZ: "Mars/Olympus_Mons"}),
+			badVars: []string{EnvDefaultTZ},
+		},
+		{
+			name:    "default time zone set but empty",
+			env:     with(map[string]string{EnvDefaultTZ: ""}),
+			badVars: []string{EnvDefaultTZ},
+		},
+		{
+			name:    "default time zone Local refused",
+			env:     with(map[string]string{EnvDefaultTZ: "Local"}),
+			badVars: []string{EnvDefaultTZ},
+		},
 		{
 			name:    "one missing",
 			env:     with(nil, EnvHTTPAddr),
@@ -80,7 +89,6 @@ func TestLoad(t *testing.T) {
 			env:  map[string]string{},
 			badVars: []string{
 				EnvHTTPAddr, EnvPublicURL, EnvDataDir, EnvShutdownTimeout, EnvSecretKeyFile,
-				EnvOIDCIssuer, EnvOIDCClientID, EnvOIDCClientSecretFile, EnvOIDCAllowedGroups,
 			},
 		},
 		{
@@ -150,24 +158,6 @@ func TestLoad(t *testing.T) {
 			env:     with(map[string]string{EnvPublicURL: "http://:8080"}),
 			badVars: []string{EnvPublicURL},
 		},
-		{
-			name:    "plain HTTP public URL on a remote host",
-			env:     with(map[string]string{EnvPublicURL: "http://meals.example.com"}),
-			badVars: []string{EnvPublicURL},
-		},
-		{
-			name:    "plain HTTP public URL on a non-loopback IP",
-			env:     with(map[string]string{EnvPublicURL: "http://192.168.1.20:8080"}),
-			badVars: []string{EnvPublicURL},
-		},
-		{
-			name: "plain HTTP public URL on 127.0.0.1",
-			env:  with(map[string]string{EnvPublicURL: "http://127.0.0.1:8080"}),
-		},
-		{
-			name: "plain HTTP public URL on [::1]",
-			env:  with(map[string]string{EnvPublicURL: "http://[::1]:8080"}),
-		},
 		{
 			name:    "relative public URL",
 			env:     with(map[string]string{EnvPublicURL: "meals.example.com"}),
@@ -198,101 +188,6 @@ func TestLoad(t *testing.T) {
 			env:     with(map[string]string{"MEALQUEST_SECRET_KEY": "inline"}),
 			badVars: []string{"MEALQUEST_SECRET_KEY"},
 		},
-		{
-			name:    "inline OIDC client secret rejected",
-			env:     with(map[string]string{"MEALQUEST_OIDC_CLIENT_SECRET": "inline"}),
-			badVars: []string{"MEALQUEST_OIDC_CLIENT_SECRET"},
-		},
-		{
-			name:    "unreadable OIDC client secret file",
-			env:     with(map[string]string{EnvOIDCClientSecretFile: unreadablePath}),
-			badVars: []string{EnvOIDCClientSecretFile},
-		},
-		{
-			name:    "relative OIDC issuer",
-			env:     with(map[string]string{EnvOIDCIssuer: "auth.example.com"}),
-			badVars: []string{EnvOIDCIssuer},
-		},
-		{
-			name:    "non-http OIDC issuer",
-			env:     with(map[string]string{EnvOIDCIssuer: "ftp://auth.example.com"}),
-			badVars: []string{EnvOIDCIssuer},
-		},
-		{
-			name:    "plain HTTP OIDC issuer on a remote host",
-			env:     with(map[string]string{EnvOIDCIssuer: "http://auth.example.com/application/o/mealquest/"}),
-			badVars: []string{EnvOIDCIssuer},
-		},
-		{
-			name: "plain HTTP OIDC issuer on localhost",
-			env:  with(map[string]string{EnvOIDCIssuer: "http://localhost:9000/application/o/mealquest/"}),
-		},
-		{
-			name: "several allowed groups",
-			env:  with(map[string]string{EnvOIDCAllowedGroups: "mealquest-admin, family"}),
-		},
-		{
-			name:    "empty allowed group entry",
-			env:     with(map[string]string{EnvOIDCAllowedGroups: "mealquest-admin,,family"}),
-			badVars: []string{EnvOIDCAllowedGroups},
-		},
-		{
-			name:    "trailing comma in allowed groups",
-			env:     with(map[string]string{EnvOIDCAllowedGroups: "mealquest-admin,"}),
-			badVars: []string{EnvOIDCAllowedGroups},
-		},
-		{
-			name:    "blank OIDC client ID",
-			env:     with(map[string]string{EnvOIDCClientID: "  "}),
-			badVars: []string{EnvOIDCClientID},
-		},
-		{
-			name: "session lifetimes set",
-			env:  with(map[string]string{EnvSessionIdle: "24h", EnvSessionMax: "48h"}),
-		},
-		{
-			name: "session max equal to idle",
-			env:  with(map[string]string{EnvSessionIdle: "24h", EnvSessionMax: "24h"}),
-		},
-		{
-			name:    "invalid session idle",
-			env:     with(map[string]string{EnvSessionIdle: "a month"}),
-			badVars: []string{EnvSessionIdle},
-		},
-		{
-			name:    "empty session idle",
-			env:     with(map[string]string{EnvSessionIdle: ""}),
-			badVars: []string{EnvSessionIdle},
-		},
-		{
-			name:    "non-positive session max",
-			env:     with(map[string]string{EnvSessionMax: "-1h"}),
-			badVars: []string{EnvSessionMax},
-		},
-		{
-			name: "whole-millisecond session lifetimes",
-			env:  with(map[string]string{EnvSessionIdle: "1ms", EnvSessionMax: "2ms"}),
-		},
-		{
-			name:    "sub-millisecond session idle",
-			env:     with(map[string]string{EnvSessionIdle: "1500us", EnvSessionMax: "2ms"}),
-			badVars: []string{EnvSessionIdle},
-		},
-		{
-			name:    "sub-millisecond session max",
-			env:     with(map[string]string{EnvSessionIdle: "1ms", EnvSessionMax: "1ms500us"}),
-			badVars: []string{EnvSessionMax},
-		},
-		{
-			name:    "session max below idle",
-			env:     with(map[string]string{EnvSessionIdle: "48h", EnvSessionMax: "24h"}),
-			badVars: []string{EnvSessionMax},
-		},
-		{
-			name:    "session max below default idle",
-			env:     with(map[string]string{EnvSessionMax: "719h"}),
-			badVars: []string{EnvSessionMax},
-		},
 		{
 			name: "several invalid values are all named",
 			env: with(map[string]string{
@@ -335,7 +230,7 @@ func TestLoad(t *testing.T) {
 					t.Errorf("error message %q does not name %s", err.Error(), v)
 				}
 			}
-			if !reflect.ValueOf(cfg).IsZero() {
+			if cfg != (Config{}) {
 				t.Errorf("load() returned non-zero Config alongside error: %+v", cfg)
 			}
 		})
@@ -350,21 +245,13 @@ func TestLoadValues(t *testing.T) {
 	if err := os.WriteFile(secretPath, []byte("s3cret-value\r\n"), 0o600); err != nil {
 		t.Fatal(err)
 	}
-	clientSecretPath := filepath.Join(dir, "oidc_client_secret")
-	if err := os.WriteFile(clientSecretPath, []byte("client-s3cret\n"), 0o600); err != nil {
-		t.Fatal(err)
-	}
 	env := map[string]string{
 		EnvHTTPAddr:        "127.0.0.1:9000",
 		EnvPublicURL:       "http://localhost:9000",
 		EnvDataDir:         dir,
 		EnvShutdownTimeout: "1m30s",
 		EnvSecretKeyFile:   secretPath,
-
-		EnvOIDCIssuer:           "https://auth.example.com/application/o/mealquest/",
-		EnvOIDCClientID:         "mealquest",
-		EnvOIDCClientSecretFile: clientSecretPath,
-		EnvOIDCAllowedGroups:    " mealquest-admin ,family",
+		EnvDefaultTZ:       "Europe/London",
 	}
 	cfg, err := load(func(k string) (string, bool) { v, ok := env[k]; return v, ok })
 	if err != nil {
@@ -386,30 +273,8 @@ func TestLoadValues(t *testing.T) {
 	if cfg.SecretKey.Reveal() != "s3cret-value" {
 		t.Errorf("SecretKey.Reveal() = %q, want trailing newline trimmed", cfg.SecretKey.Reveal())
 	}
-	if got, want := cfg.OIDCIssuer.String(), "https://auth.example.com/application/o/mealquest/"; got != want {
-		t.Errorf("OIDCIssuer = %q, want %q", got, want)
-	}
-	if cfg.OIDCClientID != "mealquest" {
-		t.Errorf("OIDCClientID = %q", cfg.OIDCClientID)
-	}
-	if cfg.OIDCClientSecret.Reveal() != "client-s3cret" {
-		t.Errorf("OIDCClientSecret.Reveal() = %q", cfg.OIDCClientSecret.Reveal())
-	}
-	if want := []string{"mealquest-admin", "family"}; !slices.Equal(cfg.OIDCAllowedGroups, want) {
-		t.Errorf("OIDCAllowedGroups = %q, want %q", cfg.OIDCAllowedGroups, want)
-	}
-	if cfg.SessionIdle != 720*time.Hour || cfg.SessionMax != 4320*time.Hour {
-		t.Errorf("SessionIdle, SessionMax = %v, %v, want defaults 720h, 4320h", cfg.SessionIdle, cfg.SessionMax)
-	}
-
-	env[EnvSessionIdle] = "12h"
-	env[EnvSessionMax] = "36h"
-	cfg, err = load(func(k string) (string, bool) { v, ok := env[k]; return v, ok })
-	if err != nil {
-		t.Fatalf("load() error = %v", err)
-	}
-	if cfg.SessionIdle != 12*time.Hour || cfg.SessionMax != 36*time.Hour {
-		t.Errorf("SessionIdle, SessionMax = %v, %v, want 12h, 36h", cfg.SessionIdle, cfg.SessionMax)
+	if cfg.DefaultTZ != "Europe/London" {
+		t.Errorf("DefaultTZ = %q, want Europe/London", cfg.DefaultTZ)
 	}
 }
 
@@ -418,7 +283,7 @@ func TestSecretRedacted(t *testing.T) {
 
 	s := Secret{value: "s3cret-value"}
 	for _, format := range []string{"%v", "%s", "%+v", "%#v"} {
-		cfg := Config{SecretKey: s, OIDCClientSecret: s}
+		cfg := Config{SecretKey: s}
 		for _, out := range []string{fmt.Sprintf(format, s), fmt.Sprintf(format, cfg)} {
 			if strings.Contains(out, "s3cret-value") {
 				t.Errorf("format %s leaked secret: %s", format, out)

internal/db/models.go

@@ -85,6 +85,7 @@ type HouseholdSetting struct {
 	UpdatesSeenAt         sql.NullString
 	CreatedAt             string
 	UpdatedAt             string
+	UpdatedBy             sql.NullString
 }
 
 type IntegrationsGoogle struct {

internal/db/settings.sql.go

@@ -57,7 +57,7 @@ func (q *Queries) GetChatSettings(ctx context.Context) (ChatSetting, error) {
 }
 
 const getHouseholdSettings = `-- name: GetHouseholdSettings :one
-SELECT id, timezone, dinner_time, reminder_time, review_time, plan_draft_dow, plan_draft_time, suggestions_dow, suggestions_time, chat_autosend_dow, chat_autosend_time, onboarding_completed_at, updates_seen_at, created_at, updated_at FROM household_settings
+SELECT id, timezone, dinner_time, reminder_time, review_time, plan_draft_dow, plan_draft_time, suggestions_dow, suggestions_time, chat_autosend_dow, chat_autosend_time, onboarding_completed_at, updates_seen_at, created_at, updated_at, updated_by FROM household_settings
 WHERE id = 1
 `
 
@@ -81,6 +81,7 @@ func (q *Queries) GetHouseholdSettings(ctx context.Context) (HouseholdSetting, e
 		&i.UpdatesSeenAt,
 		&i.CreatedAt,
 		&i.UpdatedAt,
+		&i.UpdatedBy,
 	)
 	return i, err
 }
@@ -248,12 +249,12 @@ INSERT INTO household_settings (
 	id, timezone, dinner_time, reminder_time, review_time, plan_draft_dow,
 	plan_draft_time, suggestions_dow, suggestions_time, chat_autosend_dow,
 	chat_autosend_time, onboarding_completed_at, updates_seen_at,
-	created_at, updated_at
+	updated_by, created_at, updated_at
 ) VALUES (
 	1, ?, ?, ?, ?, ?,
 	?, ?, ?, ?,
 	?, ?, ?,
-	?, ?
+	?, ?, ?
 )
 ON CONFLICT (id) DO UPDATE SET
 	timezone = excluded.timezone,
@@ -268,8 +269,9 @@ ON CONFLICT (id) DO UPDATE SET
 	chat_autosend_time = excluded.chat_autosend_time,
 	onboarding_completed_at = excluded.onboarding_completed_at,
 	updates_seen_at = excluded.updates_seen_at,
+	updated_by = excluded.updated_by,
 	updated_at = excluded.updated_at
-RETURNING id, timezone, dinner_time, reminder_time, review_time, plan_draft_dow, plan_draft_time, suggestions_dow, suggestions_time, chat_autosend_dow, chat_autosend_time, onboarding_completed_at, updates_seen_at, created_at, updated_at
+RETURNING id, timezone, dinner_time, reminder_time, review_time, plan_draft_dow, plan_draft_time, suggestions_dow, suggestions_time, chat_autosend_dow, chat_autosend_time, onboarding_completed_at, updates_seen_at, created_at, updated_at, updated_by
 `
 
 type UpsertHouseholdSettingsParams struct {
@@ -285,6 +287,7 @@ type UpsertHouseholdSettingsParams struct {
 	ChatAutosendTime      string
 	OnboardingCompletedAt sql.NullString
 	UpdatesSeenAt         sql.NullString
+	UpdatedBy             sql.NullString
 	CreatedAt             string
 	UpdatedAt             string
 }
@@ -305,6 +308,7 @@ func (q *Queries) UpsertHouseholdSettings(ctx context.Context, arg UpsertHouseho
 		arg.ChatAutosendTime,
 		arg.OnboardingCompletedAt,
 		arg.UpdatesSeenAt,
+		arg.UpdatedBy,
 		arg.CreatedAt,
 		arg.UpdatedAt,
 	)
@@ -325,6 +329,7 @@ func (q *Queries) UpsertHouseholdSettings(ctx context.Context, arg UpsertHouseho
 		&i.UpdatesSeenAt,
 		&i.CreatedAt,
 		&i.UpdatedAt,
+		&i.UpdatedBy,
 	)
 	return i, err
 }

internal/household/settings.go

@@ -0,0 +1,332 @@
+package household
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+	"regexp"
+	"strings"
+	"sync"
+
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/db"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/store"
+)
+
+// Seed values for a new household (CTXD CONTEXT.MD). Days count from
+// Sunday = 0, as time.Weekday does.
+const (
+	SeedDinnerTime       = "17:30"
+	SeedReminderTime     = "16:30"
+	SeedReviewTime       = "09:00" // rotation check
+	SeedPlanDraftDow     = 5       // Friday
+	SeedPlanDraftTime    = "09:00"
+	SeedSuggestionsDow   = 0 // Sunday
+	SeedSuggestionsTime  = "08:00"
+	SeedChatAutosendDow  = 6 // Saturday
+	SeedChatAutosendTime = "08:00"
+)
+
+// ErrNoDefaultZone is returned by SeedSettings when the household settings
+// do not exist yet and no default zone was configured to create them with.
+var ErrNoDefaultZone = errors.New("household settings do not exist yet and no default time zone is configured")
+
+// Settings are the shared household settings. Times are household-local
+// 24-hour HH:MM in Timezone; days of the week count from Sunday = 0.
+type Settings struct {
+	Timezone              string  `json:"timezone"`
+	DinnerTime            string  `json:"dinner_time"`
+	ReminderTime          string  `json:"reminder_time"`
+	ReviewTime            string  `json:"review_time"`
+	PlanDraftDow          int     `json:"plan_draft_dow"`
+	PlanDraftTime         string  `json:"plan_draft_time"`
+	SuggestionsDow        int     `json:"suggestions_dow"`
+	SuggestionsTime       string  `json:"suggestions_time"`
+	ChatAutosendDow       int     `json:"chat_autosend_dow"`
+	ChatAutosendTime      string  `json:"chat_autosend_time"`
+	OnboardingCompletedAt *string `json:"onboarding_completed_at"`
+	UpdatesSeenAt         *string `json:"updates_seen_at"`
+	UpdatedBy             *string `json:"updated_by"`
+	CreatedAt             string  `json:"created_at"`
+	UpdatedAt             string  `json:"updated_at"`
+}
+
+// SettingsPatch changes the household settings. Nil fields are left as they
+// are.
+type SettingsPatch struct {
+	Timezone         *string
+	DinnerTime       *string
+	ReminderTime     *string
+	ReviewTime       *string
+	PlanDraftDow     *int
+	PlanDraftTime    *string
+	SuggestionsDow   *int
+	SuggestionsTime  *string
+	ChatAutosendDow  *int
+	ChatAutosendTime *string
+}
+
+// Problem is one invalid field of a SettingsPatch, named by its JSON key.
+type Problem struct {
+	Field  string
+	Reason string
+}
+
+// ValidationError lists every invalid field of a SettingsPatch.
+type ValidationError struct {
+	Problems []Problem
+}
+
+func (e *ValidationError) Error() string {
+	parts := make([]string, len(e.Problems))
+	for i, p := range e.Problems {
+		parts[i] = p.Field + ": " + p.Reason
+	}
+	return "invalid household settings: " + strings.Join(parts, "; ")
+}
+
+// SeedSettings creates the household settings row with zone defaultTZ and the
+// seed times and days if it does not exist. An existing row is never changed,
+// and defaultTZ is then ignored. With no row, an empty defaultTZ is
+// ErrNoDefaultZone and an unloadable one is an error.
+func SeedSettings(ctx context.Context, st *store.Store, defaultTZ string) error {
+	return st.WithTx(ctx, func(tx *sql.Tx) error {
+		q := db.New(tx)
+		_, err := q.GetHouseholdSettings(ctx)
+		if err == nil {
+			return nil
+		}
+		if !errors.Is(err, sql.ErrNoRows) {
+			return fmt.Errorf("household: read settings: %w", err)
+		}
+		if defaultTZ == "" {
+			return ErrNoDefaultZone
+		}
+		if _, err := LoadZone(defaultTZ); err != nil {
+			return fmt.Errorf("household: seed settings: %w", err)
+		}
+		now := store.Now().String()
+		_, err = q.UpsertHouseholdSettings(ctx, db.UpsertHouseholdSettingsParams{
+			Timezone:         defaultTZ,
+			DinnerTime:       SeedDinnerTime,
+			ReminderTime:     SeedReminderTime,
+			ReviewTime:       SeedReviewTime,
+			PlanDraftDow:     SeedPlanDraftDow,
+			PlanDraftTime:    SeedPlanDraftTime,
+			SuggestionsDow:   SeedSuggestionsDow,
+			SuggestionsTime:  SeedSuggestionsTime,
+			ChatAutosendDow:  SeedChatAutosendDow,
+			ChatAutosendTime: SeedChatAutosendTime,
+			CreatedAt:        now,
+			UpdatedAt:        now,
+		})
+		if err != nil {
+			return fmt.Errorf("household: seed settings: %w", err)
+		}
+		return nil
+	})
+}
+
+// SettingsService reads and changes the household settings, and tells
+// in-process subscribers (the scheduler) about every change.
+type SettingsService struct {
+	st *store.Store
+
+	// updateMu serialises Update with its publish, so subscribers see
+	// changes in commit order.
+	updateMu sync.Mutex
+
+	subsMu sync.Mutex
+	subs   map[int]func(Settings)
+	nextID int
+}
+
+// NewSettingsService returns a service over st. Call SeedSettings first.
+func NewSettingsService(st *store.Store) *SettingsService {
+	return &SettingsService{st: st, subs: make(map[int]func(Settings))}
+}
+
+// Get returns the household settings.
+func (s *SettingsService) Get(ctx context.Context) (Settings, error) {
+	row, err := db.New(s.st.Reader).GetHouseholdSettings(ctx)
+	if err != nil {
+		return Settings{}, fmt.Errorf("household: read settings: %w", err)
+	}
+	return fromRow(row), nil
+}
+
+// Update validates patch, applies it, records updatedBy ("" when no member
+// is known) and publishes the new settings to every subscriber. An invalid
+// patch is a *ValidationError and changes nothing.
+func (s *SettingsService) Update(ctx context.Context, patch SettingsPatch, updatedBy string) (Settings, error) {
+	if err := patch.validate(); err != nil {
+		return Settings{}, err
+	}
+
+	s.updateMu.Lock()
+	defer s.updateMu.Unlock()
+
+	var row db.HouseholdSetting
+	err := s.st.WithTx(ctx, func(tx *sql.Tx) error {
+		q := db.New(tx)
+		cur, err := q.GetHouseholdSettings(ctx)
+		if err != nil {
+			return fmt.Errorf("household: read settings: %w", err)
+		}
+		p := db.UpsertHouseholdSettingsParams{
+			Timezone:              cur.Timezone,
+			DinnerTime:            cur.DinnerTime,
+			ReminderTime:          cur.ReminderTime,
+			ReviewTime:            cur.ReviewTime,
+			PlanDraftDow:          cur.PlanDraftDow,
+			PlanDraftTime:         cur.PlanDraftTime,
+			SuggestionsDow:        cur.SuggestionsDow,
+			SuggestionsTime:       cur.SuggestionsTime,
+			ChatAutosendDow:       cur.ChatAutosendDow,
+			ChatAutosendTime:      cur.ChatAutosendTime,
+			OnboardingCompletedAt: cur.OnboardingCompletedAt,
+			UpdatesSeenAt:         cur.UpdatesSeenAt,
+			UpdatedBy:             sql.NullString{String: updatedBy, Valid: updatedBy != ""},
+			CreatedAt:             cur.CreatedAt,
+			UpdatedAt:             store.Now().String(),
+		}
+		setString(&p.Timezone, patch.Timezone)
+		setString(&p.DinnerTime, patch.DinnerTime)
+		setString(&p.ReminderTime, patch.ReminderTime)
+		setString(&p.ReviewTime, patch.ReviewTime)
+		setDow(&p.PlanDraftDow, patch.PlanDraftDow)
+		setString(&p.PlanDraftTime, patch.PlanDraftTime)
+		setDow(&p.SuggestionsDow, patch.SuggestionsDow)
+		setString(&p.SuggestionsTime, patch.SuggestionsTime)
+		setDow(&p.ChatAutosendDow, patch.ChatAutosendDow)
+		setString(&p.ChatAutosendTime, patch.ChatAutosendTime)
+		row, err = q.UpsertHouseholdSettings(ctx, p)
+		if err != nil {
+			return fmt.Errorf("household: update settings: %w", err)
+		}
+		return nil
+	})
+	if err != nil {
+		return Settings{}, err
+	}
+
+	settings := fromRow(row)
+	s.publish(settings)
+	return settings, nil
+}
+
+// Subscribe registers fn to receive the new settings after every successful
+// Update. fn runs synchronously on the updating goroutine, so it must return
+// promptly and must not call Update. The returned function unsubscribes fn.
+func (s *SettingsService) Subscribe(fn func(Settings)) (unsubscribe func()) {
+	s.subsMu.Lock()
+	defer s.subsMu.Unlock()
+	id := s.nextID
+	s.nextID++
+	s.subs[id] = fn
+	return func() {
+		s.subsMu.Lock()
+		defer s.subsMu.Unlock()
+		delete(s.subs, id)
+	}
+}
+
+func (s *SettingsService) publish(settings Settings) {
+	s.subsMu.Lock()
+	fns := make([]func(Settings), 0, len(s.subs))
+	for _, fn := range s.subs {
+		fns = append(fns, fn)
+	}
+	s.subsMu.Unlock()
+	for _, fn := range fns {
+		fn(settings)
+	}
+}
+
+func (p SettingsPatch) validate() error {
+	var problems []Problem
+	fail := func(field, reason string) {
+		problems = append(problems, Problem{Field: field, Reason: reason})
+	}
+	if p == (SettingsPatch{}) {
+		fail("settings", "no settings to change")
+	}
+	if p.Timezone != nil {
+		if _, err := LoadZone(*p.Timezone); err != nil {
+			fail("timezone", err.Error())
+		}
+	}
+	for _, t := range []struct {
+		field string
+		value *string
+	}{
+		{"dinner_time", p.DinnerTime},
+		{"reminder_time", p.ReminderTime},
+		{"review_time", p.ReviewTime},
+		{"plan_draft_time", p.PlanDraftTime},
+		{"suggestions_time", p.SuggestionsTime},
+		{"chat_autosend_time", p.ChatAutosendTime},
+	} {
+		if t.value != nil && !clockTime.MatchString(*t.value) {
+			fail(t.field, fmt.Sprintf("invalid time %q (want 24-hour HH:MM, 00:00-23:59)", *t.value))
+		}
+	}
+	for _, d := range []struct {
+		field string
+		value *int
+	}{
+		{"plan_draft_dow", p.PlanDraftDow},
+		{"suggestions_dow", p.SuggestionsDow},
+		{"chat_autosend_dow", p.ChatAutosendDow},
+	} {
+		if d.value != nil && (*d.value < 0 || *d.value > 6) {
+			fail(d.field, fmt.Sprintf("invalid day of the week %d (want 0-6, Sunday = 0)", *d.value))
+		}
+	}
+	if len(problems) > 0 {
+		return &ValidationError{Problems: problems}
+	}
+	return nil
+}
+
+// clockTime matches a zero-padded 24-hour HH:MM time.
+var clockTime = regexp.MustCompile(`^([01][0-9]|2[0-3]):[0-5][0-9]$`)
+
+func setString(dst *string, v *string) {
+	if v != nil {
+		*dst = *v
+	}
+}
+
+func setDow(dst *int64, v *int) {
+	if v != nil {
+		*dst = int64(*v)
+	}
+}
+
+func fromRow(r db.HouseholdSetting) Settings {
+	return Settings{
+		Timezone:              r.Timezone,
+		DinnerTime:            r.DinnerTime,
+		ReminderTime:          r.ReminderTime,
+		ReviewTime:            r.ReviewTime,
+		PlanDraftDow:          int(r.PlanDraftDow),
+		PlanDraftTime:         r.PlanDraftTime,
+		SuggestionsDow:        int(r.SuggestionsDow),
+		SuggestionsTime:       r.SuggestionsTime,
+		ChatAutosendDow:       int(r.ChatAutosendDow),
+		ChatAutosendTime:      r.ChatAutosendTime,
+		OnboardingCompletedAt: nullable(r.OnboardingCompletedAt),
+		UpdatesSeenAt:         nullable(r.UpdatesSeenAt),
+		UpdatedBy:             nullable(r.UpdatedBy),
+		CreatedAt:             r.CreatedAt,
+		UpdatedAt:             r.UpdatedAt,
+	}
+}
+
+func nullable(s sql.NullString) *string {
+	if !s.Valid {
+		return nil
+	}
+	return &s.String
+}

internal/household/settings_test.go

@@ -0,0 +1,356 @@
+package household
+
+import (
+	"context"
+	"errors"
+	"slices"
+	"sync"
+	"testing"
+
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/store"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/migrations"
+)
+
+// migratedStore opens a temp store in dir migrated with the embedded
+// migrations, closed when the test ends.
+func migratedStore(t *testing.T, dir string) *store.Store {
+	t.Helper()
+	ctx := context.Background()
+	st, err := store.Open(ctx, dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		if err := st.Close(); err != nil {
+			t.Error(err)
+		}
+	})
+	if err := store.Migrate(ctx, st.Writer, migrations.FS); err != nil {
+		t.Fatal(err)
+	}
+	return st
+}
+
+// seededService returns a settings service over a migrated temp database
+// seeded with zone America/New_York.
+func seededService(t *testing.T) *SettingsService {
+	t.Helper()
+	st := migratedStore(t, t.TempDir())
+	if err := SeedSettings(context.Background(), st, "America/New_York"); err != nil {
+		t.Fatal(err)
+	}
+	return NewSettingsService(st)
+}
+
+func ptr[T any](v T) *T { return &v }
+
+func TestSeedSettingsCreatesRow(t *testing.T) {
+	t.Parallel()
+	ctx := context.Background()
+	st := migratedStore(t, t.TempDir())
+
+	if err := SeedSettings(ctx, st, "America/Chicago"); err != nil {
+		t.Fatal(err)
+	}
+	got, err := NewSettingsService(st).Get(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := Settings{
+		Timezone:         "America/Chicago",
+		DinnerTime:       "17:30",
+		ReminderTime:     "16:30",
+		ReviewTime:       "09:00",
+		PlanDraftDow:     5,
+		PlanDraftTime:    "09:00",
+		SuggestionsDow:   0,
+		SuggestionsTime:  "08:00",
+		ChatAutosendDow:  6,
+		ChatAutosendTime: "08:00",
+		CreatedAt:        got.CreatedAt,
+		UpdatedAt:        got.UpdatedAt,
+	}
+	if !equalSettings(got, want) {
+		t.Errorf("seeded settings = %+v\nwant %+v", got, want)
+	}
+	var created store.Timestamp
+	if err := created.Scan(got.CreatedAt); err != nil {
+		t.Errorf("created_at: %v", err)
+	}
+	if got.UpdatedAt != got.CreatedAt {
+		t.Errorf("updated_at = %q, want created_at %q", got.UpdatedAt, got.CreatedAt)
+	}
+}
+
+func TestSeedSettingsNeverOverwrites(t *testing.T) {
+	t.Parallel()
+	ctx := context.Background()
+	dir := t.TempDir()
+
+	// First boot seeds; the household then changes a setting.
+	first := migratedStore(t, dir)
+	if err := SeedSettings(ctx, first, "America/Chicago"); err != nil {
+		t.Fatal(err)
+	}
+	changed, err := NewSettingsService(first).Update(ctx, SettingsPatch{DinnerTime: ptr("18:15")}, "sam")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := first.Close(); err != nil {
+		t.Fatal(err)
+	}
+
+	// Later boots reopen the same database with a different default zone,
+	// and with none at all.
+	for _, defaultTZ := range []string{"Europe/London", ""} {
+		st := migratedStore(t, dir)
+		if err := SeedSettings(ctx, st, defaultTZ); err != nil {
+			t.Fatalf("reboot with default zone %q: %v", defaultTZ, err)
+		}
+		got, err := NewSettingsService(st).Get(ctx)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if !equalSettings(got, changed) {
+			t.Errorf("reboot with default zone %q changed settings:\n got %+v\nwant %+v", defaultTZ, got, changed)
+		}
+		if err := st.Close(); err != nil {
+			t.Fatal(err)
+		}
+	}
+}
+
+func TestSeedSettingsRequiresDefaultZone(t *testing.T) {
+	t.Parallel()
+	ctx := context.Background()
+
+	tests := []struct {
+		name      string
+		defaultTZ string
+		is        error
+	}{
+		{"unset", "", ErrNoDefaultZone},
+		{"not an IANA zone", "Mars/Olympus_Mons", nil},
+		{"Local", "Local", nil},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			st := migratedStore(t, t.TempDir())
+			err := SeedSettings(ctx, st, tt.defaultTZ)
+			if err == nil {
+				t.Fatal("SeedSettings succeeded")
+			}
+			if tt.is != nil && !errors.Is(err, tt.is) {
+				t.Errorf("error = %v, want %v", err, tt.is)
+			}
+			if _, err := NewSettingsService(st).Get(ctx); err == nil {
+				t.Error("a settings row was created despite the error")
+			}
+		})
+	}
+}
+
+func TestUpdateAppliesPatchAndRecordsUpdatedBy(t *testing.T) {
+	t.Parallel()
+	ctx := context.Background()
+	svc := seededService(t)
+	before, err := svc.Get(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	got, err := svc.Update(ctx, SettingsPatch{
+		Timezone:         ptr("Europe/Paris"),
+		DinnerTime:       ptr("19:00"),
+		ReminderTime:     ptr("00:00"),
+		ReviewTime:       ptr("23:59"),
+		PlanDraftDow:     ptr(4),
+		PlanDraftTime:    ptr("10:30"),
+		SuggestionsDow:   ptr(1),
+		SuggestionsTime:  ptr("07:45"),
+		ChatAutosendDow:  ptr(0),
+		ChatAutosendTime: ptr("12:00"),
+	}, "sam")
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := Settings{
+		Timezone:         "Europe/Paris",
+		DinnerTime:       "19:00",
+		ReminderTime:     "00:00",
+		ReviewTime:       "23:59",
+		PlanDraftDow:     4,
+		PlanDraftTime:    "10:30",
+		SuggestionsDow:   1,
+		SuggestionsTime:  "07:45",
+		ChatAutosendDow:  0,
+		ChatAutosendTime: "12:00",
+		UpdatedBy:        ptr("sam"),
+		CreatedAt:        before.CreatedAt,
+		UpdatedAt:        got.UpdatedAt,
+	}
+	if !equalSettings(got, want) {
+		t.Errorf("Update = %+v\nwant %+v", got, want)
+	}
+	if got.UpdatedAt < before.UpdatedAt {
+		t.Errorf("updated_at went back: %s < %s", got.UpdatedAt, before.UpdatedAt)
+	}
+	stored, err := svc.Get(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !equalSettings(stored, got) {
+		t.Errorf("stored = %+v\nwant %+v", stored, got)
+	}
+
+	// A partial patch changes only its fields; no known member clears
+	// updated_by rather than keeping the previous member's name.
+	got, err = svc.Update(ctx, SettingsPatch{DinnerTime: ptr("18:00")}, "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	want.DinnerTime = "18:00"
+	want.UpdatedBy = nil
+	want.UpdatedAt = got.UpdatedAt
+	if !equalSettings(got, want) {
+		t.Errorf("partial Update = %+v\nwant %+v", got, want)
+	}
+}
+
+func TestUpdateValidation(t *testing.T) {
+	t.Parallel()
+	ctx := context.Background()
+
+	tests := []struct {
+		name   string
+		patch  SettingsPatch
+		fields []string
+	}{
+		{"empty patch", SettingsPatch{}, []string{"settings"}},
+		{"unknown zone", SettingsPatch{Timezone: ptr("Mars/Olympus_Mons")}, []string{"timezone"}},
+		{"empty zone", SettingsPatch{Timezone: ptr("")}, []string{"timezone"}},
+		{"Local zone", SettingsPatch{Timezone: ptr("Local")}, []string{"timezone"}},
+		{"zone path traversal", SettingsPatch{Timezone: ptr("../../etc/passwd")}, []string{"timezone"}},
+		{"hour 24", SettingsPatch{DinnerTime: ptr("24:00")}, []string{"dinner_time"}},
+		{"minute 60", SettingsPatch{ReminderTime: ptr("16:60")}, []string{"reminder_time"}},
+		{"unpadded hour", SettingsPatch{ReviewTime: ptr("9:00")}, []string{"review_time"}},
+		{"seconds", SettingsPatch{PlanDraftTime: ptr("09:00:00")}, []string{"plan_draft_time"}},
+		{"12-hour", SettingsPatch{SuggestionsTime: ptr("08:00 AM")}, []string{"suggestions_time"}},
+		{"empty time", SettingsPatch{ChatAutosendTime: ptr("")}, []string{"chat_autosend_time"}},
+		{"dow 7", SettingsPatch{PlanDraftDow: ptr(7)}, []string{"plan_draft_dow"}},
+		{"dow -1", SettingsPatch{SuggestionsDow: ptr(-1)}, []string{"suggestions_dow"}},
+		{"dow 100", SettingsPatch{ChatAutosendDow: ptr(100)}, []string{"chat_autosend_dow"}},
+		{
+			"every problem is reported",
+			SettingsPatch{Timezone: ptr("Nowhere"), DinnerTime: ptr("5pm"), PlanDraftDow: ptr(9)},
+			[]string{"timezone", "dinner_time", "plan_draft_dow"},
+		},
+		{
+			"valid fields do not mask an invalid one",
+			SettingsPatch{DinnerTime: ptr("18:00"), ChatAutosendDow: ptr(8)},
+			[]string{"chat_autosend_dow"},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			svc := seededService(t)
+			before, err := svc.Get(ctx)
+			if err != nil {
+				t.Fatal(err)
+			}
+			published := 0
+			svc.Subscribe(func(Settings) { published++ })
+
+			_, err = svc.Update(ctx, tt.patch, "sam")
+			var verr *ValidationError
+			if !errors.As(err, &verr) {
+				t.Fatalf("Update error = %v, want *ValidationError", err)
+			}
+			var fields []string
+			for _, p := range verr.Problems {
+				fields = append(fields, p.Field)
+			}
+			if !slices.Equal(fields, tt.fields) {
+				t.Errorf("problem fields = %v, want %v", fields, tt.fields)
+			}
+
+			after, err := svc.Get(ctx)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if !equalSettings(after, before) {
+				t.Errorf("invalid patch changed settings:\n got %+v\nwant %+v", after, before)
+			}
+			if published != 0 {
+				t.Errorf("invalid patch published %d times", published)
+			}
+		})
+	}
+}
+
+func TestUpdatePublishesToSubscribers(t *testing.T) {
+	t.Parallel()
+	ctx := context.Background()
+	svc := seededService(t)
+
+	var mu sync.Mutex
+	var first, second []Settings
+	unsubscribe := svc.Subscribe(func(s Settings) {
+		mu.Lock()
+		defer mu.Unlock()
+		first = append(first, s)
+	})
+	svc.Subscribe(func(s Settings) {
+		mu.Lock()
+		defer mu.Unlock()
+		second = append(second, s)
+	})
+
+	updated, err := svc.Update(ctx, SettingsPatch{Timezone: ptr("Asia/Tokyo")}, "sam")
+	if err != nil {
+		t.Fatal(err)
+	}
+	mu.Lock()
+	if len(first) != 1 || !equalSettings(first[0], updated) {
+		t.Errorf("first subscriber got %+v, want [%+v]", first, updated)
+	}
+	if len(second) != 1 || !equalSettings(second[0], updated) {
+		t.Errorf("second subscriber got %+v, want [%+v]", second, updated)
+	}
+	mu.Unlock()
+
+	unsubscribe()
+	updated, err = svc.Update(ctx, SettingsPatch{DinnerTime: ptr("18:45")}, "sam")
+	if err != nil {
+		t.Fatal(err)
+	}
+	mu.Lock()
+	defer mu.Unlock()
+	if len(first) != 1 {
+		t.Errorf("unsubscribed subscriber got %d notifications, want 1", len(first))
+	}
+	if len(second) != 2 || !equalSettings(second[1], updated) {
+		t.Errorf("second subscriber got %+v, want a second notification %+v", second, updated)
+	}
+}
+
+func TestUpdateWithoutSeedFails(t *testing.T) {
+	t.Parallel()
+	svc := NewSettingsService(migratedStore(t, t.TempDir()))
+	if _, err := svc.Update(context.Background(), SettingsPatch{DinnerTime: ptr("18:00")}, ""); err == nil {
+		t.Fatal("Update succeeded with no settings row")
+	}
+}
+
+// equalSettings compares settings by value, following the nullable pointers.
+func equalSettings(a, b Settings) bool {
+	eq := func(x, y *string) bool { return (x == nil) == (y == nil) && (x == nil || *x == *y) }
+	if !eq(a.OnboardingCompletedAt, b.OnboardingCompletedAt) || !eq(a.UpdatesSeenAt, b.UpdatesSeenAt) || !eq(a.UpdatedBy, b.UpdatedBy) {
+		return false
+	}
+	a.OnboardingCompletedAt, a.UpdatesSeenAt, a.UpdatedBy = nil, nil, nil
+	b.OnboardingCompletedAt, b.UpdatesSeenAt, b.UpdatedBy = nil, nil, nil
+	return a == b
+}

internal/household/week.go

@@ -0,0 +1,130 @@
+// Package household owns household-local calendar and clock logic. Every
+// function works in the household's IANA zone, passed explicitly, and never
+// in the process zone (time.Local).
+//
+// Weeks are ISO weeks: Monday to Sunday, numbered by ISO 8601, so the period
+// key of 2026-12-28 is "2026-W53" and of 2027-01-04 is "2027-W01".
+//
+// Calendar arithmetic is done on UTC midnights, which have no DST, so a date
+// plus seven days is always the same weekday a week later.
+package household
+
+import (
+	"errors"
+	"fmt"
+	"time"
+
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/store"
+)
+
+// Today returns the household-local date at instant now in zone loc.
+func Today(now time.Time, loc *time.Location) store.LocalDate {
+	return store.LocalDateOf(now.In(loc))
+}
+
+// WeekStart returns the ISO Monday of the week containing d. It panics if d is
+// the zero LocalDate.
+func WeekStart(d store.LocalDate) store.LocalDate {
+	t := midnightUTC(d)
+	// Weekday counts from Sunday = 0; shift so Monday = 0 and Sunday = 6.
+	sinceMonday := (int(t.Weekday()) + 6) % 7
+	return store.LocalDateOf(t.AddDate(0, 0, -sinceMonday))
+}
+
+// WeekDays returns the seven dates Monday to Sunday of the week starting on
+// weekStart. It is an error if weekStart is not a Monday.
+func WeekDays(weekStart store.LocalDate) ([7]store.LocalDate, error) {
+	t, err := monday(weekStart)
+	if err != nil {
+		return [7]store.LocalDate{}, err
+	}
+	var days [7]store.LocalDate
+	for i := range days {
+		days[i] = store.LocalDateOf(t.AddDate(0, 0, i))
+	}
+	return days, nil
+}
+
+// WeekLabel returns the display label of the week starting on weekStart, such
+// as "Week 41 · Oct 5 – 11", or "Week 40 · Sep 28 – Oct 4" when the week
+// spans two months. It is an error if weekStart is not a Monday.
+func WeekLabel(weekStart store.LocalDate) (string, error) {
+	start, err := monday(weekStart)
+	if err != nil {
+		return "", err
+	}
+	_, week := start.ISOWeek()
+	end := start.AddDate(0, 0, 6)
+	if end.Month() == start.Month() {
+		return fmt.Sprintf("Week %d · %s – %d", week, start.Format("Jan 2"), end.Day()), nil
+	}
+	return fmt.Sprintf("Week %d · %s – %s", week, start.Format("Jan 2"), end.Format("Jan 2")), nil
+}
+
+// PeriodKey returns the ISO week key of the week containing d, such as
+// "2026-W41". The year is the ISO week-numbering year, which differs from the
+// calendar year around New Year. It panics if d is the zero LocalDate.
+func PeriodKey(d store.LocalDate) string {
+	year, week := midnightUTC(d).ISOWeek()
+	return fmt.Sprintf("%04d-W%02d", year, week)
+}
+
+// LocalTime returns the instant at which household clocks in zone loc read
+// hhmm (24-hour "HH:MM") on date d.
+//
+// DST rule: a wall time that does not exist (spring forward) or occurs twice
+// (fall back) is read with the UTC offset in effect before the transition. A
+// skipped time therefore moves forward by the length of the gap (02:30 on a
+// day clocks jump 02:00→03:00 is 03:30), and a repeated time is its first
+// occurrence. The rule assumes at most one offset change in the 48 hours
+// around the wall time, which holds for every real zone.
+func LocalTime(loc *time.Location, d store.LocalDate, hhmm string) (time.Time, error) {
+	if d.IsZero() {
+		return time.Time{}, errors.New("household: zero date")
+	}
+	clock, err := time.Parse("15:04", hhmm)
+	if err != nil || clock.Format("15:04") != hhmm {
+		return time.Time{}, fmt.Errorf("household: invalid time %q: want HH:MM", hhmm)
+	}
+	y, m, day := d.Date()
+	// wall is the wall-clock reading expressed as if it were UTC; the real
+	// instant is wall minus the zone's UTC offset at that instant.
+	wall := time.Date(y, m, day, clock.Hour(), clock.Minute(), 0, 0, time.UTC)
+	before := offset(wall.Add(-24*time.Hour), loc)
+	after := offset(wall.Add(24*time.Hour), loc)
+	early := wall.Add(-before)
+	late := wall.Add(-after)
+	// Use the post-transition offset only when the pre-transition reading is
+	// not a real wall time and the post-transition one is.
+	if offset(early, loc) != before && offset(late, loc) == after {
+		return late.In(loc), nil
+	}
+	return early.In(loc), nil
+}
+
+// offset returns the UTC offset of zone loc at instant t.
+func offset(t time.Time, loc *time.Location) time.Duration {
+	_, secs := t.In(loc).Zone()
+	return time.Duration(secs) * time.Second
+}
+
+// midnightUTC returns d as midnight UTC. It panics if d is the zero LocalDate.
+func midnightUTC(d store.LocalDate) time.Time {
+	if d.IsZero() {
+		panic("household: zero date")
+	}
+	y, m, day := d.Date()
+	return time.Date(y, m, day, 0, 0, 0, 0, time.UTC)
+}
+
+// monday returns weekStart as midnight UTC, or an error if it is not a Monday.
+func monday(weekStart store.LocalDate) (time.Time, error) {
+	if weekStart.IsZero() {
+		return time.Time{}, errors.New("household: zero week start")
+	}
+	t := midnightUTC(weekStart)
+	if t.Weekday() != time.Monday {
+		return time.Time{}, fmt.Errorf("household: week start %s is a %s, want Monday", weekStart, t.Weekday())
+	}
+	return t, nil
+}

internal/household/week_test.go

@@ -0,0 +1,311 @@
+package household
+
+import (
+	"strings"
+	"testing"
+	"time"
+
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/store"
+)
+
+// TestMain runs the package with the process zone set to UTC, so any use of
+// time.Local in place of the household zone shows up as a failure.
+func TestMain(m *testing.M) {
+	time.Local = time.UTC
+	m.Run()
+}
+
+func loadZone(t *testing.T, name string) *time.Location {
+	t.Helper()
+	loc, err := time.LoadLocation(name)
+	if err != nil {
+		t.Fatalf("LoadLocation(%q): %v", name, err)
+	}
+	return loc
+}
+
+func date(t *testing.T, s string) store.LocalDate {
+	t.Helper()
+	d, err := store.ParseLocalDate(s)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return d
+}
+
+func utc(t *testing.T, s string) time.Time {
+	t.Helper()
+	ts, err := time.Parse(time.RFC3339, s)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return ts
+}
+
+func TestTodayUsesHouseholdZone(t *testing.T) {
+	chicago := loadZone(t, "America/Chicago")
+	auckland := loadZone(t, "Pacific/Auckland")
+	for _, tc := range []struct {
+		now  string
+		loc  *time.Location
+		want string
+	}{
+		// 2026-10-05T04:30Z is Sunday 23:30 in Chicago (CDT, UTC−5) and
+		// Monday 17:30 in Auckland (NZDT, UTC+13).
+		{"2026-10-05T04:30:00Z", chicago, "2026-10-04"},
+		{"2026-10-05T04:30:00Z", auckland, "2026-10-05"},
+		// 2026-10-04T11:30Z is Sunday 06:30 in Chicago and already Monday
+		// 00:30 in Auckland.
+		{"2026-10-04T11:30:00Z", chicago, "2026-10-04"},
+		{"2026-10-04T11:30:00Z", auckland, "2026-10-05"},
+	} {
+		if got := Today(utc(t, tc.now), tc.loc).String(); got != tc.want {
+			t.Errorf("Today(%s, %s) = %s, want %s", tc.now, tc.loc, got, tc.want)
+		}
+	}
+}
+
+func TestSundayNightMondayMorningWeekAssignment(t *testing.T) {
+	for _, tc := range []struct {
+		zone, now     string
+		wantDay       string
+		wantWeekStart string
+		wantPeriodKey string
+		wantWeekday   time.Weekday
+	}{
+		// Sunday 23:59 local belongs to the week that started the previous
+		// Monday; one minute later, Monday 00:00 starts a new week.
+		{"America/Chicago", "2026-10-12T04:59:00Z", "2026-10-11", "2026-10-05", "2026-W41", time.Sunday},
+		{"America/Chicago", "2026-10-12T05:00:00Z", "2026-10-12", "2026-10-12", "2026-W42", time.Monday},
+		{"Pacific/Auckland", "2026-10-11T10:59:00Z", "2026-10-11", "2026-10-05", "2026-W41", time.Sunday},
+		{"Pacific/Auckland", "2026-10-11T11:00:00Z", "2026-10-12", "2026-10-12", "2026-W42", time.Monday},
+	} {
+		loc := loadZone(t, tc.zone)
+		now := utc(t, tc.now)
+		if wd := now.In(loc).Weekday(); wd != tc.wantWeekday {
+			t.Fatalf("%s in %s is %s, want %s", tc.now, tc.zone, wd, tc.wantWeekday)
+		}
+		today := Today(now, loc)
+		if today.String() != tc.wantDay {
+			t.Errorf("Today(%s, %s) = %s, want %s", tc.now, tc.zone, today, tc.wantDay)
+		}
+		if got := WeekStart(today).String(); got != tc.wantWeekStart {
+			t.Errorf("WeekStart(%s) = %s, want %s", today, got, tc.wantWeekStart)
+		}
+		if got := PeriodKey(today); got != tc.wantPeriodKey {
+			t.Errorf("PeriodKey(%s) = %s, want %s", today, got, tc.wantPeriodKey)
+		}
+	}
+}
+
+func TestWeekStartEveryWeekday(t *testing.T) {
+	for _, d := range []string{
+		"2026-10-05", "2026-10-06", "2026-10-07", "2026-10-08",
+		"2026-10-09", "2026-10-10", "2026-10-11",
+	} {
+		if got := WeekStart(date(t, d)).String(); got != "2026-10-05" {
+			t.Errorf("WeekStart(%s) = %s, want 2026-10-05", d, got)
+		}
+	}
+	if got := WeekStart(date(t, "2026-10-12")).String(); got != "2026-10-12" {
+		t.Errorf("WeekStart(2026-10-12) = %s, want 2026-10-12", got)
+	}
+}
+
+func TestWeekDays(t *testing.T) {
+	days, err := WeekDays(date(t, "2026-09-28"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := []string{
+		"2026-09-28", "2026-09-29", "2026-09-30", "2026-10-01",
+		"2026-10-02", "2026-10-03", "2026-10-04",
+	}
+	for i, d := range days {
+		if d.String() != want[i] {
+			t.Errorf("WeekDays[%d] = %s, want %s", i, d, want[i])
+		}
+	}
+}
+
+func TestWeekDaysAcrossDSTChange(t *testing.T) {
+	// Chicago falls back on Sunday 2026-11-01 and Auckland springs forward on
+	// Sunday 2026-09-27; neither shifts the dates of those weeks.
+	for _, tc := range []struct{ start, last string }{
+		{"2026-10-26", "2026-11-01"},
+		{"2026-09-21", "2026-09-27"},
+		{"2026-03-02", "2026-03-08"},
+	} {
+		days, err := WeekDays(date(t, tc.start))
+		if err != nil {
+			t.Fatal(err)
+		}
+		if days[0].String() != tc.start || days[6].String() != tc.last {
+			t.Errorf("WeekDays(%s) = %s … %s, want %s … %s", tc.start, days[0], days[6], tc.start, tc.last)
+		}
+	}
+}
+
+func TestISOWeekYearBoundary(t *testing.T) {
+	for _, tc := range []struct{ day, weekStart, key string }{
+		{"2026-12-27", "2026-12-21", "2026-W52"},
+		{"2026-12-28", "2026-12-28", "2026-W53"},
+		{"2026-12-31", "2026-12-28", "2026-W53"},
+		{"2027-01-01", "2026-12-28", "2026-W53"},
+		{"2027-01-03", "2026-12-28", "2026-W53"},
+		{"2027-01-04", "2027-01-04", "2027-W01"},
+		{"2027-01-10", "2027-01-04", "2027-W01"},
+		{"2026-01-01", "2025-12-29", "2026-W01"},
+		{"2026-10-07", "2026-10-05", "2026-W41"},
+	} {
+		d := date(t, tc.day)
+		if got := WeekStart(d).String(); got != tc.weekStart {
+			t.Errorf("WeekStart(%s) = %s, want %s", tc.day, got, tc.weekStart)
+		}
+		if got := PeriodKey(d); got != tc.key {
+			t.Errorf("PeriodKey(%s) = %s, want %s", tc.day, got, tc.key)
+		}
+	}
+	days, err := WeekDays(date(t, "2026-12-28"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if days[6].String() != "2027-01-03" {
+		t.Errorf("W53 Sunday = %s, want 2027-01-03", days[6])
+	}
+}
+
+func TestWeekLabel(t *testing.T) {
+	for _, tc := range []struct{ start, want string }{
+		{"2026-10-05", "Week 41 · Oct 5 – 11"},
+		{"2026-09-28", "Week 40 · Sep 28 – Oct 4"},
+		{"2026-12-28", "Week 53 · Dec 28 – Jan 3"},
+		{"2027-01-04", "Week 1 · Jan 4 – 10"},
+	} {
+		got, err := WeekLabel(date(t, tc.start))
+		if err != nil {
+			t.Fatal(err)
+		}
+		if got != tc.want {
+			t.Errorf("WeekLabel(%s) = %q, want %q", tc.start, got, tc.want)
+		}
+	}
+}
+
+func TestWeekStartRequired(t *testing.T) {
+	for _, d := range []store.LocalDate{date(t, "2026-10-07"), date(t, "2026-10-11"), {}} {
+		if _, err := WeekDays(d); err == nil {
+			t.Errorf("WeekDays(%s) succeeded, want error", d)
+		}
+		if _, err := WeekLabel(d); err == nil {
+			t.Errorf("WeekLabel(%s) succeeded, want error", d)
+		}
+	}
+}
+
+func TestZeroDatePanics(t *testing.T) {
+	for name, fn := range map[string]func(){
+		"WeekStart": func() { WeekStart(store.LocalDate{}) },
+		"PeriodKey": func() { PeriodKey(store.LocalDate{}) },
+	} {
+		func() {
+			defer func() {
+				if recover() == nil {
+					t.Errorf("%s(zero) did not panic", name)
+				}
+			}()
+			fn()
+		}()
+	}
+}
+
+func TestLocalTime(t *testing.T) {
+	for _, tc := range []struct {
+		zone, day, hhmm string
+		want            string // UTC instant
+		wantWall        string // local wall clock of the result
+	}{
+		// Ordinary days.
+		{"America/Chicago", "2026-10-05", "18:30", "2026-10-05T23:30:00Z", "2026-10-05 18:30 CDT"},
+		{"America/Chicago", "2026-12-28", "00:00", "2026-12-28T06:00:00Z", "2026-12-28 00:00 CST"},
+		{"Pacific/Auckland", "2026-10-05", "18:30", "2026-10-05T05:30:00Z", "2026-10-05 18:30 NZDT"},
+		{"Pacific/Auckland", "2026-07-01", "23:59", "2026-07-01T11:59:00Z", "2026-07-01 23:59 NZST"},
+
+		// Chicago spring forward, Sunday 2026-03-08: 02:00 CST → 03:00 CDT.
+		{"America/Chicago", "2026-03-08", "01:59", "2026-03-08T07:59:00Z", "2026-03-08 01:59 CST"},
+		{"America/Chicago", "2026-03-08", "02:00", "2026-03-08T08:00:00Z", "2026-03-08 03:00 CDT"},
+		{"America/Chicago", "2026-03-08", "02:30", "2026-03-08T08:30:00Z", "2026-03-08 03:30 CDT"},
+		{"America/Chicago", "2026-03-08", "03:00", "2026-03-08T08:00:00Z", "2026-03-08 03:00 CDT"},
+		{"America/Chicago", "2026-03-08", "03:30", "2026-03-08T08:30:00Z", "2026-03-08 03:30 CDT"},
+
+		// Chicago fall back, Sunday 2026-11-01: 02:00 CDT → 01:00 CST, so
+		// 01:00–01:59 happens twice; the first (CDT) occurrence is chosen.
+		{"America/Chicago", "2026-11-01", "00:59", "2026-11-01T05:59:00Z", "2026-11-01 00:59 CDT"},
+		{"America/Chicago", "2026-11-01", "01:00", "2026-11-01T06:00:00Z", "2026-11-01 01:00 CDT"},
+		{"America/Chicago", "2026-11-01", "01:30", "2026-11-01T06:30:00Z", "2026-11-01 01:30 CDT"},
+		{"America/Chicago", "2026-11-01", "02:00", "2026-11-01T08:00:00Z", "2026-11-01 02:00 CST"},
+
+		// Auckland spring forward, Sunday 2026-09-27: 02:00 NZST → 03:00 NZDT.
+		{"Pacific/Auckland", "2026-09-27", "01:59", "2026-09-26T13:59:00Z", "2026-09-27 01:59 NZST"},
+		{"Pacific/Auckland", "2026-09-27", "02:30", "2026-09-26T14:30:00Z", "2026-09-27 03:30 NZDT"},
+		{"Pacific/Auckland", "2026-09-27", "03:00", "2026-09-26T14:00:00Z", "2026-09-27 03:00 NZDT"},
+
+		// Auckland fall back, Sunday 2026-04-05: 03:00 NZDT → 02:00 NZST, so
+		// 02:00–02:59 happens twice; the first (NZDT) occurrence is chosen.
+		{"Pacific/Auckland", "2026-04-05", "01:59", "2026-04-04T12:59:00Z", "2026-04-05 01:59 NZDT"},
+		{"Pacific/Auckland", "2026-04-05", "02:30", "2026-04-04T13:30:00Z", "2026-04-05 02:30 NZDT"},
+		{"Pacific/Auckland", "2026-04-05", "03:00", "2026-04-04T15:00:00Z", "2026-04-05 03:00 NZST"},
+	} {
+		loc := loadZone(t, tc.zone)
+		got, err := LocalTime(loc, date(t, tc.day), tc.hhmm)
+		if err != nil {
+			t.Fatalf("LocalTime(%s, %s, %s): %v", tc.zone, tc.day, tc.hhmm, err)
+		}
+		if !got.Equal(utc(t, tc.want)) {
+			t.Errorf("LocalTime(%s, %s, %s) = %s, want %s", tc.zone, tc.day, tc.hhmm, got.UTC().Format(time.RFC3339), tc.want)
+		}
+		if wall := got.Format("2006-01-02 15:04 MST"); wall != tc.wantWall {
+			t.Errorf("LocalTime(%s, %s, %s) wall = %s, want %s", tc.zone, tc.day, tc.hhmm, wall, tc.wantWall)
+		}
+		if got.Location() != loc {
+			t.Errorf("LocalTime(%s, …) location = %s, want %s", tc.zone, got.Location(), loc)
+		}
+	}
+}
+
+func TestLocalTimeDeterministic(t *testing.T) {
+	// The same ambiguous or skipped input always resolves to the same instant.
+	chicago := loadZone(t, "America/Chicago")
+	for _, tc := range []struct{ day, hhmm string }{{"2026-03-08", "02:30"}, {"2026-11-01", "01:30"}} {
+		first, err := LocalTime(chicago, date(t, tc.day), tc.hhmm)
+		if err != nil {
+			t.Fatal(err)
+		}
+		for range 100 {
+			again, err := LocalTime(chicago, date(t, tc.day), tc.hhmm)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if !again.Equal(first) {
+				t.Fatalf("LocalTime(%s, %s) = %s then %s", tc.day, tc.hhmm, first, again)
+			}
+		}
+	}
+}
+
+func TestLocalTimeRejectsInvalid(t *testing.T) {
+	chicago := loadZone(t, "America/Chicago")
+	d := date(t, "2026-10-05")
+	for _, hhmm := range []string{
+		"", "9:30", "09:3", "24:00", "23:60", "09:30:00", "0930", " 09:30", "09:30 ", "9am", "-1:00",
+	} {
+		if got, err := LocalTime(chicago, d, hhmm); err == nil {
+			t.Errorf("LocalTime(%q) = %s, want error", hhmm, got)
+		} else if !strings.Contains(err.Error(), "HH:MM") {
+			t.Errorf("LocalTime(%q) error %q does not name the HH:MM form", hhmm, err)
+		}
+	}
+	if _, err := LocalTime(chicago, store.LocalDate{}, "09:30"); err == nil {
+		t.Error("LocalTime(zero date) succeeded")
+	}
+}

internal/household/zone.go

@@ -0,0 +1,28 @@
+package household
+
+import (
+	"errors"
+	"fmt"
+	"time"
+
+	// Embeds the IANA zone database in the binary, so zones load the same
+	// way in a minimal image with no /usr/share/zoneinfo.
+	_ "time/tzdata"
+)
+
+// LoadZone loads the IANA zone name, such as "America/New_York". The empty
+// name and "Local", which time.LoadLocation maps to UTC and the process zone,
+// are refused: the household zone is never implied.
+func LoadZone(name string) (*time.Location, error) {
+	if name == "" {
+		return nil, errors.New("time zone is empty (want an IANA zone such as America/New_York)")
+	}
+	if name == "Local" {
+		return nil, errors.New(`time zone "Local" is not an IANA zone (want e.g. America/New_York)`)
+	}
+	loc, err := time.LoadLocation(name)
+	if err != nil {
+		return nil, fmt.Errorf("unknown time zone %q (want an IANA zone such as America/New_York)", name)
+	}
+	return loc, nil
+}

internal/secretbox/secretbox.go

@@ -0,0 +1,81 @@
+// Package secretbox encrypts secrets at rest with AES-256-GCM. It is the only
+// owner of secret encryption: every _ct column holds a token produced by
+// Box.Encrypt, laid out as nonce ‖ ciphertext.
+//
+// Errors from this package never contain plaintext, ciphertext or key
+// material.
+package secretbox
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/rand"
+	"encoding/base64"
+	"errors"
+	"fmt"
+)
+
+// KeySize is the decoded key length in bytes (AES-256).
+const KeySize = 32
+
+var (
+	// ErrKeyEncoding means the key is not valid standard base64.
+	ErrKeyEncoding = errors.New("secretbox: key is not valid standard base64")
+	// ErrKeyLength means the decoded key is not exactly KeySize bytes.
+	ErrKeyLength = errors.New("secretbox: key must decode to exactly 32 bytes")
+	// ErrMalformed means a token is too short to hold a nonce and tag.
+	ErrMalformed = errors.New("secretbox: token is too short")
+	// ErrDecrypt means a token failed authentication: it was corrupted or
+	// sealed under a different key.
+	ErrDecrypt = errors.New("secretbox: token failed authentication")
+)
+
+// Box seals and opens secrets under one key. It is safe for concurrent use.
+type Box struct {
+	aead cipher.AEAD
+}
+
+// New returns a Box for encodedKey, the standard-base64 encoding of a
+// KeySize-byte key.
+func New(encodedKey string) (*Box, error) {
+	key, err := base64.StdEncoding.Strict().DecodeString(encodedKey)
+	if err != nil {
+		// The decoder's error is not wrapped: it describes the key's content.
+		return nil, ErrKeyEncoding
+	}
+	if len(key) != KeySize {
+		return nil, fmt.Errorf("%w, got %d", ErrKeyLength, len(key))
+	}
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return nil, fmt.Errorf("secretbox: %w", err)
+	}
+	aead, err := cipher.NewGCM(block)
+	if err != nil {
+		return nil, fmt.Errorf("secretbox: %w", err)
+	}
+	return &Box{aead: aead}, nil
+}
+
+// Encrypt seals plaintext under a fresh random nonce and returns
+// nonce ‖ ciphertext.
+func (b *Box) Encrypt(plaintext []byte) ([]byte, error) {
+	nonce := make([]byte, b.aead.NonceSize(), b.aead.NonceSize()+len(plaintext)+b.aead.Overhead())
+	if _, err := rand.Read(nonce); err != nil {
+		return nil, fmt.Errorf("secretbox: generate nonce: %w", err)
+	}
+	return b.aead.Seal(nonce, nonce, plaintext, nil), nil
+}
+
+// Decrypt authenticates and opens a token produced by Encrypt.
+func (b *Box) Decrypt(token []byte) ([]byte, error) {
+	n := b.aead.NonceSize()
+	if len(token) < n+b.aead.Overhead() {
+		return nil, ErrMalformed
+	}
+	plaintext, err := b.aead.Open(nil, token[:n], token[n:], nil)
+	if err != nil {
+		return nil, ErrDecrypt
+	}
+	return plaintext, nil
+}

internal/secretbox/secretbox_test.go

@@ -0,0 +1,200 @@
+package secretbox
+
+import (
+	"bytes"
+	"crypto/rand"
+	"encoding/base64"
+	"errors"
+	"strings"
+	"testing"
+)
+
+// newKey returns a fresh random key and its standard-base64 encoding.
+func newKey(t *testing.T) ([]byte, string) {
+	t.Helper()
+	key := make([]byte, KeySize)
+	if _, err := rand.Read(key); err != nil {
+		t.Fatal(err)
+	}
+	return key, base64.StdEncoding.EncodeToString(key)
+}
+
+func newBox(t *testing.T) (*Box, []byte, string) {
+	t.Helper()
+	key, encoded := newKey(t)
+	box, err := New(encoded)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return box, key, encoded
+}
+
+// assertNoLeak fails if err's message contains any of the secrets, either
+// raw or base64-encoded.
+func assertNoLeak(t *testing.T, err error, secrets ...[]byte) {
+	t.Helper()
+	msg := err.Error()
+	for _, s := range secrets {
+		if len(s) == 0 {
+			continue
+		}
+		for _, form := range []string{string(s), base64.StdEncoding.EncodeToString(s), base64.RawStdEncoding.EncodeToString(s)} {
+			if strings.Contains(msg, form) {
+				t.Errorf("error %q leaks secret material %q", msg, form)
+			}
+		}
+	}
+}
+
+func TestRoundTrip(t *testing.T) {
+	box, _, _ := newBox(t)
+	for _, plaintext := range [][]byte{
+		[]byte("ya29.oauth-refresh-token"),
+		{},
+		bytes.Repeat([]byte{0x00, 0xff}, 4096),
+	} {
+		token, err := box.Encrypt(plaintext)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if len(plaintext) > 0 && bytes.Contains(token, plaintext) {
+			t.Errorf("token contains the plaintext")
+		}
+		got, err := box.Decrypt(token)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if !bytes.Equal(got, plaintext) {
+			t.Errorf("Decrypt = %q, want %q", got, plaintext)
+		}
+	}
+}
+
+func TestTokenLayout(t *testing.T) {
+	box, _, _ := newBox(t)
+	plaintext := []byte("secret")
+	token, err := box.Encrypt(plaintext)
+	if err != nil {
+		t.Fatal(err)
+	}
+	// nonce (12) ‖ ciphertext (len(plaintext)) ‖ GCM tag (16).
+	if want := 12 + len(plaintext) + 16; len(token) != want {
+		t.Errorf("token length = %d, want %d", len(token), want)
+	}
+}
+
+func TestEncryptUsesFreshNonce(t *testing.T) {
+	box, _, _ := newBox(t)
+	plaintext := []byte("same plaintext")
+	a, err := box.Encrypt(plaintext)
+	if err != nil {
+		t.Fatal(err)
+	}
+	b, err := box.Encrypt(plaintext)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if bytes.Equal(a, b) {
+		t.Fatal("two encryptions of the same plaintext are identical")
+	}
+	if bytes.Equal(a[:12], b[:12]) {
+		t.Error("two encryptions reused the same nonce")
+	}
+}
+
+func TestDecryptRejectsFlippedByte(t *testing.T) {
+	box, key, encoded := newBox(t)
+	plaintext := []byte("do-not-leak-me")
+	token, err := box.Encrypt(plaintext)
+	if err != nil {
+		t.Fatal(err)
+	}
+	// Flip one bit in every position: nonce, ciphertext and tag.
+	for i := range token {
+		tampered := bytes.Clone(token)
+		tampered[i] ^= 0x01
+		got, err := box.Decrypt(tampered)
+		if !errors.Is(err, ErrDecrypt) {
+			t.Fatalf("byte %d flipped: Decrypt = %q, %v; want ErrDecrypt", i, got, err)
+		}
+		if got != nil {
+			t.Errorf("byte %d flipped: Decrypt returned plaintext alongside the error", i)
+		}
+		assertNoLeak(t, err, plaintext, key, []byte(encoded), tampered)
+	}
+}
+
+func TestDecryptRejectsWrongKey(t *testing.T) {
+	box, key, encoded := newBox(t)
+	other, otherKey, otherEncoded := newBox(t)
+	plaintext := []byte("do-not-leak-me")
+	token, err := box.Encrypt(plaintext)
+	if err != nil {
+		t.Fatal(err)
+	}
+	got, err := other.Decrypt(token)
+	if !errors.Is(err, ErrDecrypt) {
+		t.Fatalf("Decrypt with wrong key = %q, %v; want ErrDecrypt", got, err)
+	}
+	assertNoLeak(t, err, plaintext, key, []byte(encoded), otherKey, []byte(otherEncoded), token)
+}
+
+func TestDecryptRejectsShortToken(t *testing.T) {
+	box, _, _ := newBox(t)
+	for _, n := range []int{0, 1, 12, 12 + 15} {
+		token := bytes.Repeat([]byte{0xab}, n)
+		if _, err := box.Decrypt(token); !errors.Is(err, ErrMalformed) {
+			t.Errorf("Decrypt(%d bytes) error = %v, want ErrMalformed", n, err)
+		}
+	}
+}
+
+func TestNewRejectsBadKey(t *testing.T) {
+	key, _ := newKey(t)
+	tests := []struct {
+		name    string
+		encoded string
+		want    error
+	}{
+		{"empty", "", ErrKeyLength},
+		{"not base64", "not*base64!" + strings.Repeat("A", 33), ErrKeyEncoding},
+		{"url-safe alphabet", strings.Repeat("_-", 22), ErrKeyEncoding},
+		{"unpadded", base64.RawStdEncoding.EncodeToString(key), ErrKeyEncoding},
+		{"raw key bytes", string(key), ErrKeyEncoding},
+		{"too short", base64.StdEncoding.EncodeToString(key[:31]), ErrKeyLength},
+		{"too long", base64.StdEncoding.EncodeToString(append(bytes.Clone(key), 0x00)), ErrKeyLength},
+		{"AES-128 length", base64.StdEncoding.EncodeToString(key[:16]), ErrKeyLength},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			box, err := New(tt.encoded)
+			if !errors.Is(err, tt.want) {
+				t.Fatalf("New error = %v, want %v", err, tt.want)
+			}
+			if box != nil {
+				t.Error("New returned a Box alongside the error")
+			}
+			assertNoLeak(t, err, key, []byte(tt.encoded))
+		})
+	}
+}
+
+func TestNewAcceptsBase64Key(t *testing.T) {
+	key, encoded := newKey(t)
+	box, err := New(encoded)
+	if err != nil {
+		t.Fatal(err)
+	}
+	// A Box built from the same key opens tokens sealed by the first.
+	token, err := box.Encrypt([]byte("x"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	again, err := New(base64.StdEncoding.EncodeToString(key))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := again.Decrypt(token); err != nil {
+		t.Errorf("same key failed to decrypt: %v", err)
+	}
+}

internal/secureurl/secureurl.go

@@ -1,32 +0,0 @@
-// Package secureurl holds the one transport rule for URLs that carry
-// credentials or session cookies: HTTPS, or plain HTTP to a loopback host for
-// local development and tests.
-package secureurl
-
-import (
-	"errors"
-	"fmt"
-	"net/url"
-	"strings"
-)
-
-// loopbackHosts are the only hosts plain HTTP is allowed for, compared
-// case-insensitively. url.URL's Hostname strips the brackets from "[::1]".
-var loopbackHosts = map[string]bool{"localhost": true, "127.0.0.1": true, "::1": true}
-
-// Check reports an error unless u is an absolute https:// URL, or an http://
-// URL whose host is localhost, 127.0.0.1 or ::1.
-func Check(u *url.URL) error {
-	switch {
-	case u.Hostname() == "":
-		return errors.New("URL has no host")
-	case u.Scheme == "https":
-		return nil
-	case u.Scheme == "http" && loopbackHosts[strings.ToLower(u.Hostname())]:
-		return nil
-	case u.Scheme == "http":
-		return errors.New("plain http:// is allowed only for localhost, 127.0.0.1 or [::1]; use https://")
-	default:
-		return fmt.Errorf("unsupported scheme %q (want https://)", u.Scheme)
-	}
-}

internal/secureurl/secureurl_test.go

@@ -1,40 +0,0 @@
-package secureurl
-
-import (
-	"net/url"
-	"testing"
-)
-
-func TestCheck(t *testing.T) {
-	t.Parallel()
-	tests := []struct {
-		raw string
-		ok  bool
-	}{
-		{"https://meals.example.com", true},
-		{"https://auth.example.com/application/o/mealquest/", true},
-		{"https://192.0.2.10:8443", true},
-		{"http://localhost:8080", true},
-		{"http://LOCALHOST:8080", true},
-		{"http://127.0.0.1:8080/path", true},
-		{"http://[::1]:8080", true},
-		{"http://[::1]", true},
-		{"http://meals.example.com", false},
-		{"http://192.0.2.10", false},
-		{"http://127.0.0.2", false},
-		{"http://localhost.example.com", false},
-		{"http://0.0.0.0:8080", false},
-		{"ftp://localhost", false},
-		{"https://", false},
-		{"meals.example.com", false},
-	}
-	for _, tc := range tests {
-		u, err := url.Parse(tc.raw)
-		if err != nil {
-			t.Fatal(err)
-		}
-		if err := Check(u); (err == nil) != tc.ok {
-			t.Errorf("Check(%q) error = %v, want ok=%v", tc.raw, err, tc.ok)
-		}
-	}
-}

internal/server/server.go

@@ -3,6 +3,7 @@ package server
 
 import (
 	"encoding/json"
+	"errors"
 	"io/fs"
 	"log/slog"
 	"net/http"
@@ -10,21 +11,20 @@ import (
 	"github.com/go-chi/chi/v5"
 
 	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/frontend"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/household"
 )
 
 // reservedPrefixes are owned by the API router and are never answered with the
 // SPA's index.html.
 var reservedPrefixes = []string{"/api", "/auth", "/media", "/health"}
 
-// RouteMounter registers its own routes on the router.
-type RouteMounter interface {
-	Mount(r chi.Router)
-}
-
 // NewRouter returns the HTTP handler for the service. version is reported by
-// GET /health; auth mounts the /auth routes; assets is the web build served
-// for every other GET.
-func NewRouter(logger *slog.Logger, version string, auth RouteMounter, assets fs.FS) (http.Handler, error) {
+// GET /health; assets is the web build served for every other GET; settings
+// serves /api/v1/settings/household.
+func NewRouter(logger *slog.Logger, version string, assets fs.FS, settings *household.SettingsService) (http.Handler, error) {
+	if settings == nil {
+		return nil, errors.New("server: nil household settings service")
+	}
 	notFound := apiErrorHandler(logger, http.StatusNotFound, "not_found", "not found")
 	methodNotAllowed := apiErrorHandler(logger, http.StatusMethodNotAllowed, "method_not_allowed", "method not allowed")
 
@@ -38,14 +38,16 @@ func NewRouter(logger *slog.Logger, version string, auth RouteMounter, assets fs
 	r.NotFound(notFound)
 
 	r.Get("/health", health(logger, version))
-	auth.Mount(r)
 	r.Route("/api", func(r chi.Router) {
 		r.MethodNotAllowed(methodNotAllowed)
 		r.NotFound(notFound)
+		r.Route("/v1", func(r chi.Router) {
+			r.Get("/settings/household", getHouseholdSettings(logger, settings))
+			r.Patch("/settings/household", patchHouseholdSettings(logger, settings))
+		})
 	})
-	// Catch-all for the PWA. Unknown /auth paths and /media (no routes yet)
-	// reach the frontend handler, which passes them to notFound rather than
-	// the SPA fallback.
+	// Catch-all for the PWA. /auth and /media have no routes yet; the frontend
+	// handler passes them to notFound rather than the SPA fallback.
 	r.Method(http.MethodGet, "/*", web)
 	r.Method(http.MethodHead, "/*", web)
 	return r, nil
@@ -63,19 +65,8 @@ type apiError struct {
 
 // apiErrorHandler responds with status and a fixed, non-retryable API error.
 func apiErrorHandler(logger *slog.Logger, status int, code, message string) http.HandlerFunc {
-	body, err := json.Marshal(errorBody{Error: apiError{
-		Code:    code,
-		Message: message,
-	}})
-	if err != nil {
-		panic(err) // fixed string and bool fields cannot fail to marshal
-	}
 	return func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
-		w.WriteHeader(status)
-		if _, err := w.Write(body); err != nil {
-			logger.WarnContext(r.Context(), "write error response", "code", code, "error", err)
-		}
+		writeError(w, r, logger, status, code, message)
 	}
 }
 

internal/server/server_test.go

@@ -1,6 +1,7 @@
 package server
 
 import (
+	"context"
 	"encoding/json"
 	"io"
 	"log/slog"
@@ -11,7 +12,9 @@ import (
 	"testing"
 	"testing/fstest"
 
-	"github.com/go-chi/chi/v5"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/household"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/store"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/migrations"
 )
 
 const (
@@ -21,42 +24,53 @@ const (
 )
 
 func newTestRouter(t *testing.T, version string) http.Handler {
+	t.Helper()
+	return newTestRouterWith(t, version, newTestSettings(t))
+}
+
+func newTestRouterWith(t *testing.T, version string, settings *household.SettingsService) http.Handler {
 	t.Helper()
 	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
 	assets := fstest.MapFS{
 		"index.html":             {Data: []byte(fixtureIndex)},
 		"assets/index-AbC123.js": {Data: []byte(fixtureAsset)},
 	}
-	r, err := NewRouter(logger, version, stubAuth{}, assets)
+	r, err := NewRouter(logger, version, assets, settings)
 	if err != nil {
 		t.Fatal(err)
 	}
 	return r
 }
 
-// stubAuth mounts a fixed GET /auth/login in place of the real auth flow.
-type stubAuth struct{}
-
-func (stubAuth) Mount(r chi.Router) {
-	r.Get("/auth/login", func(w http.ResponseWriter, _ *http.Request) {
-		io.WriteString(w, "stub login")
+// newTestSettings returns a settings service over a migrated temp database
+// seeded with zone America/New_York.
+func newTestSettings(t *testing.T) *household.SettingsService {
+	t.Helper()
+	ctx := context.Background()
+	st, err := store.Open(ctx, t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		if err := st.Close(); err != nil {
+			t.Error(err)
+		}
 	})
+	if err := store.Migrate(ctx, st.Writer, migrations.FS); err != nil {
+		t.Fatal(err)
+	}
+	if err := household.SeedSettings(ctx, st, "America/New_York"); err != nil {
+		t.Fatal(err)
+	}
+	return household.NewSettingsService(st)
 }
 
-func TestAuthRoutesMounted(t *testing.T) {
+func TestNewRouterRequiresSettings(t *testing.T) {
 	t.Parallel()
 
-	router := newTestRouter(t, "dev")
-	rec := httptest.NewRecorder()
-	router.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/auth/login", nil))
-	if rec.Code != http.StatusOK || rec.Body.String() != "stub login" {
-		t.Errorf("GET /auth/login = %d %q, want the mounted handler", rec.Code, rec.Body.String())
-	}
-
-	rec = httptest.NewRecorder()
-	router.ServeHTTP(rec, httptest.NewRequest(http.MethodPost, "/auth/login", nil))
-	if rec.Code != http.StatusMethodNotAllowed {
-		t.Errorf("POST /auth/login status = %d, want 405", rec.Code)
+	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
+	if _, err := NewRouter(logger, "dev", fstest.MapFS{"index.html": {}}, nil); err == nil {
+		t.Fatal("NewRouter accepted a nil settings service")
 	}
 }
 
@@ -127,7 +141,7 @@ func TestReservedPathsNotFound(t *testing.T) {
 		{http.MethodGet, "/api"},
 		{http.MethodGet, "/api/unknown"},
 		{http.MethodPost, "/api/unknown"},
-		{http.MethodGet, "/auth/unknown"},
+		{http.MethodGet, "/auth/callback"},
 		{http.MethodGet, "/media/photo.jpg"},
 		{http.MethodGet, "/health/deep"},
 		{http.MethodGet, "/auth/../quests/42"},

internal/server/settings.go

@@ -0,0 +1,128 @@
+package server
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"log/slog"
+	"net/http"
+
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/actor"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/household"
+)
+
+// maxSettingsBody bounds a PATCH /settings/household request body.
+const maxSettingsBody = 16 << 10
+
+// settingsPatch is the PATCH /settings/household body. Every field is
+// optional; unknown fields and null values are refused.
+type settingsPatch struct {
+	Timezone         *string `json:"timezone"`
+	DinnerTime       *string `json:"dinner_time"`
+	ReminderTime     *string `json:"reminder_time"`
+	ReviewTime       *string `json:"review_time"`
+	PlanDraftDow     *int    `json:"plan_draft_dow"`
+	PlanDraftTime    *string `json:"plan_draft_time"`
+	SuggestionsDow   *int    `json:"suggestions_dow"`
+	SuggestionsTime  *string `json:"suggestions_time"`
+	ChatAutosendDow  *int    `json:"chat_autosend_dow"`
+	ChatAutosendTime *string `json:"chat_autosend_time"`
+}
+
+func getHouseholdSettings(logger *slog.Logger, svc *household.SettingsService) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		settings, err := svc.Get(r.Context())
+		if err != nil {
+			logger.ErrorContext(r.Context(), "get household settings", "error", err)
+			writeError(w, r, logger, http.StatusInternalServerError, "internal", "internal error")
+			return
+		}
+		writeJSON(w, r, logger, http.StatusOK, settings)
+	}
+}
+
+func patchHouseholdSettings(logger *slog.Logger, svc *household.SettingsService) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		patch, err := decodeSettingsPatch(http.MaxBytesReader(w, r.Body, maxSettingsBody))
+		if err != nil {
+			writeError(w, r, logger, http.StatusBadRequest, "invalid_request", err.Error())
+			return
+		}
+		settings, err := svc.Update(r.Context(), household.SettingsPatch(patch), actor.From(r.Context()))
+		var invalid *household.ValidationError
+		if errors.As(err, &invalid) {
+			writeError(w, r, logger, http.StatusBadRequest, "invalid_settings", invalid.Error())
+			return
+		}
+		if err != nil {
+			logger.ErrorContext(r.Context(), "update household settings", "error", err)
+			writeError(w, r, logger, http.StatusInternalServerError, "internal", "internal error")
+			return
+		}
+		writeJSON(w, r, logger, http.StatusOK, settings)
+	}
+}
+
+// decodeSettingsPatch reads a single JSON object, refusing unknown fields,
+// null values and trailing data.
+func decodeSettingsPatch(body io.Reader) (settingsPatch, error) {
+	data, err := io.ReadAll(body)
+	if err != nil {
+		var tooLarge *http.MaxBytesError
+		if errors.As(err, &tooLarge) {
+			return settingsPatch{}, fmt.Errorf("request body exceeds %d bytes", tooLarge.Limit)
+		}
+		return settingsPatch{}, errors.New("cannot read request body")
+	}
+
+	var fields map[string]json.RawMessage
+	if err := json.Unmarshal(data, &fields); err != nil || fields == nil {
+		return settingsPatch{}, errors.New("request body must be a JSON object")
+	}
+	for name, raw := range fields {
+		if bytes.Equal(raw, []byte("null")) {
+			return settingsPatch{}, fmt.Errorf("%s: must not be null", name)
+		}
+	}
+
+	var patch settingsPatch
+	dec := json.NewDecoder(bytes.NewReader(data))
+	dec.DisallowUnknownFields()
+	if err := dec.Decode(&patch); err != nil {
+		var typeErr *json.UnmarshalTypeError
+		if errors.As(err, &typeErr) {
+			return settingsPatch{}, fmt.Errorf("%s: want a JSON %s", typeErr.Field, typeErr.Type)
+		}
+		return settingsPatch{}, fmt.Errorf("invalid settings: %v", err)
+	}
+	return patch, nil
+}
+
+func writeJSON(w http.ResponseWriter, r *http.Request, logger *slog.Logger, status int, v any) {
+	body, err := json.Marshal(v)
+	if err != nil {
+		logger.ErrorContext(r.Context(), "encode response", "error", err)
+		writeError(w, r, logger, http.StatusInternalServerError, "internal", "internal error")
+		return
+	}
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(status)
+	if _, err := w.Write(body); err != nil {
+		logger.WarnContext(r.Context(), "write response", "error", err)
+	}
+}
+
+// writeError responds with status and a non-retryable API error.
+func writeError(w http.ResponseWriter, r *http.Request, logger *slog.Logger, status int, code, message string) {
+	body, err := json.Marshal(errorBody{Error: apiError{Code: code, Message: message}})
+	if err != nil {
+		panic(err) // string and bool fields cannot fail to marshal
+	}
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(status)
+	if _, err := w.Write(body); err != nil {
+		logger.WarnContext(r.Context(), "write error response", "code", code, "error", err)
+	}
+}

internal/server/settings_test.go

@@ -0,0 +1,174 @@
+package server
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/actor"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/household"
+)
+
+const settingsPath = "/api/v1/settings/household"
+
+func serve(t *testing.T, h http.Handler, req *http.Request) (*httptest.ResponseRecorder, map[string]any) {
+	t.Helper()
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if ct := rec.Header().Get("Content-Type"); ct != "application/json" {
+		t.Errorf("Content-Type = %q, want application/json", ct)
+	}
+	var body map[string]any
+	if err := json.Unmarshal(rec.Body.Bytes(), &body); err != nil {
+		t.Fatalf("decode body %q: %v", rec.Body.String(), err)
+	}
+	return rec, body
+}
+
+func TestGetHouseholdSettings(t *testing.T) {
+	t.Parallel()
+
+	rec, body := serve(t, newTestRouter(t, "dev"), httptest.NewRequest(http.MethodGet, settingsPath, nil))
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200: %s", rec.Code, rec.Body)
+	}
+	want := map[string]any{
+		"timezone":                "America/New_York",
+		"dinner_time":             "17:30",
+		"reminder_time":           "16:30",
+		"review_time":             "09:00",
+		"plan_draft_dow":          float64(5),
+		"plan_draft_time":         "09:00",
+		"suggestions_dow":         float64(0),
+		"suggestions_time":        "08:00",
+		"chat_autosend_dow":       float64(6),
+		"chat_autosend_time":      "08:00",
+		"onboarding_completed_at": nil,
+		"updates_seen_at":         nil,
+		"updated_by":              nil,
+	}
+	for k, v := range want {
+		got, ok := body[k]
+		if !ok || got != v {
+			t.Errorf("%s = %#v (present %v), want %#v", k, got, ok, v)
+		}
+	}
+	for _, k := range []string{"created_at", "updated_at"} {
+		if s, ok := body[k].(string); !ok || s == "" {
+			t.Errorf("%s = %#v, want a timestamp", k, body[k])
+		}
+	}
+	if len(body) != len(want)+2 {
+		t.Errorf("body has %d fields, want %d: %v", len(body), len(want)+2, body)
+	}
+}
+
+func TestPatchHouseholdSettings(t *testing.T) {
+	t.Parallel()
+	settings := newTestSettings(t)
+	router := newTestRouterWith(t, "dev", settings)
+
+	var notified []household.Settings
+	settings.Subscribe(func(s household.Settings) { notified = append(notified, s) })
+
+	req := httptest.NewRequest(http.MethodPatch, settingsPath,
+		strings.NewReader(`{"timezone":"Europe/Berlin","dinner_time":"18:00","plan_draft_dow":4}`))
+	req = req.WithContext(actor.With(req.Context(), "sam"))
+	rec, body := serve(t, router, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200: %s", rec.Code, rec.Body)
+	}
+	for k, v := range map[string]any{
+		"timezone":       "Europe/Berlin",
+		"dinner_time":    "18:00",
+		"plan_draft_dow": float64(4),
+		"reminder_time":  "16:30", // unchanged
+		"updated_by":     "sam",
+	} {
+		if body[k] != v {
+			t.Errorf("%s = %#v, want %#v", k, body[k], v)
+		}
+	}
+	if len(notified) != 1 || notified[0].Timezone != "Europe/Berlin" {
+		t.Errorf("subscriber notified with %+v, want one change to Europe/Berlin", notified)
+	}
+
+	_, body = serve(t, router, httptest.NewRequest(http.MethodGet, settingsPath, nil))
+	if body["timezone"] != "Europe/Berlin" || body["updated_by"] != "sam" {
+		t.Errorf("GET after PATCH = %v", body)
+	}
+}
+
+func TestPatchHouseholdSettingsRejected(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name string
+		body string
+		code string
+		in   string // the error message must contain this
+	}{
+		{"bad timezone", `{"timezone":"Mars/Olympus_Mons"}`, "invalid_settings", "timezone"},
+		{"bad time", `{"dinner_time":"25:00"}`, "invalid_settings", "dinner_time"},
+		{"unpadded time", `{"reminder_time":"9:30"}`, "invalid_settings", "reminder_time"},
+		{"bad dow", `{"suggestions_dow":7}`, "invalid_settings", "suggestions_dow"},
+		{"negative dow", `{"chat_autosend_dow":-1}`, "invalid_settings", "chat_autosend_dow"},
+		{"empty object", `{}`, "invalid_settings", "no settings to change"},
+		{"fractional dow", `{"plan_draft_dow":5.5}`, "invalid_request", "plan_draft_dow"},
+		{"string dow", `{"plan_draft_dow":"5"}`, "invalid_request", "plan_draft_dow"},
+		{"numeric time", `{"dinner_time":1730}`, "invalid_request", "dinner_time"},
+		{"null value", `{"timezone":null}`, "invalid_request", "timezone"},
+		{"unknown field", `{"dinner":"17:30"}`, "invalid_request", "dinner"},
+		{"read-only field", `{"updated_by":"someone"}`, "invalid_request", "updated_by"},
+		{"not an object", `["timezone"]`, "invalid_request", "JSON object"},
+		{"null body", `null`, "invalid_request", "JSON object"},
+		{"trailing data", `{"dinner_time":"18:00"} {}`, "invalid_request", "JSON object"},
+		{"malformed", `{"dinner_time":`, "invalid_request", "JSON object"},
+		{"too large", `{"timezone":"` + strings.Repeat("a", maxSettingsBody) + `"}`, "invalid_request", "exceeds"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			settings := newTestSettings(t)
+			router := newTestRouterWith(t, "dev", settings)
+			notified := 0
+			settings.Subscribe(func(household.Settings) { notified++ })
+
+			rec, body := serve(t, router, httptest.NewRequest(http.MethodPatch, settingsPath, strings.NewReader(tt.body)))
+			if rec.Code != http.StatusBadRequest {
+				t.Fatalf("status = %d, want 400: %s", rec.Code, rec.Body)
+			}
+			apiErr, ok := body["error"].(map[string]any)
+			if !ok || len(body) != 1 || len(apiErr) != 3 {
+				t.Fatalf("body = %s, want {\"error\":{code,message,retryable}}", rec.Body)
+			}
+			if apiErr["code"] != tt.code || apiErr["retryable"] != false {
+				t.Errorf("error = %v, want code %q, retryable false", apiErr, tt.code)
+			}
+			if msg, _ := apiErr["message"].(string); !strings.Contains(msg, tt.in) {
+				t.Errorf("message %q does not contain %q", msg, tt.in)
+			}
+			if notified != 0 {
+				t.Errorf("rejected PATCH notified subscribers %d times", notified)
+			}
+			_, after := serve(t, router, httptest.NewRequest(http.MethodGet, settingsPath, nil))
+			if after["timezone"] != "America/New_York" || after["dinner_time"] != "17:30" || after["updated_by"] != nil {
+				t.Errorf("rejected PATCH changed settings: %v", after)
+			}
+		})
+	}
+}
+
+func TestHouseholdSettingsMethodNotAllowed(t *testing.T) {
+	t.Parallel()
+
+	rec, body := serve(t, newTestRouter(t, "dev"), httptest.NewRequest(http.MethodPut, settingsPath, strings.NewReader(`{}`)))
+	if rec.Code != http.StatusMethodNotAllowed {
+		t.Errorf("status = %d, want 405", rec.Code)
+	}
+	if apiErr, _ := body["error"].(map[string]any); apiErr["code"] != "method_not_allowed" {
+		t.Errorf("body = %v", body)
+	}
+}

internal/store/migrate_test.go

@@ -175,8 +175,8 @@ func TestMigrateEmbeddedMigrations(t *testing.T) {
 	if err := Migrate(context.Background(), s.Writer, migrations.FS); err != nil {
 		t.Fatal(err)
 	}
-	if got := versions(migrationRows(t, s)); got != "0000_bootstrap,0001_init" {
-		t.Errorf("versions = %q, want 0000_bootstrap,0001_init", got)
+	if got := versions(migrationRows(t, s)); got != "0000_bootstrap,0001_init,0002_household_settings_updated_by" {
+		t.Errorf("versions = %q, want 0000_bootstrap,0001_init,0002_household_settings_updated_by", got)
 	}
 }
 
@@ -188,15 +188,16 @@ func TestMigrateBootstrapThenEmbeddedInitApplies(t *testing.T) {
 		t.Fatal(err)
 	}
 	// A database migrated by the bootstrap-only build upgrades to the
-	// embedded set, which adds 0001_init.sql alongside the unchanged bootstrap.
+	// embedded set, which adds the later migrations alongside the unchanged
+	// bootstrap.
 	if err := Migrate(ctx, s.Writer, fstest.MapFS{"0000_bootstrap.sql": {Data: bootstrap}}); err != nil {
 		t.Fatal(err)
 	}
 	if err := Migrate(ctx, s.Writer, migrations.FS); err != nil {
 		t.Fatal(err)
 	}
-	if got := versions(migrationRows(t, s)); got != "0000_bootstrap,0001_init" {
-		t.Errorf("versions = %q, want 0000_bootstrap,0001_init", got)
+	if got := versions(migrationRows(t, s)); got != "0000_bootstrap,0001_init,0002_household_settings_updated_by" {
+		t.Errorf("versions = %q, want 0000_bootstrap,0001_init,0002_household_settings_updated_by", got)
 	}
 	if !tableExists(t, s, "dinners") {
 		t.Error("table from 0001_init was not created")

internal/store/time.go

@@ -86,6 +86,17 @@ func ParseLocalDate(s string) (LocalDate, error) {
 	return LocalDate{t.Year(), t.Month(), t.Day()}, nil
 }
 
+// LocalDateOf returns the calendar date of t in t's own location.
+func LocalDateOf(t time.Time) LocalDate {
+	y, m, d := t.Date()
+	return LocalDate{y, m, d}
+}
+
+// Date returns the year, month and day of d.
+func (d LocalDate) Date() (year int, month time.Month, day int) {
+	return d.year, d.month, d.day
+}
+
 // String returns the YYYY-MM-DD form.
 func (d LocalDate) String() string {
 	return fmt.Sprintf("%04d-%02d-%02d", d.year, int(d.month), d.day)
@@ -96,11 +107,15 @@ func (d LocalDate) IsZero() bool {
 	return d == LocalDate{}
 }
 
-// Value implements driver.Valuer. The zero LocalDate is an error.
+// Value implements driver.Valuer. The zero LocalDate is an error, as is a
+// year outside 0000–9999, which the four-digit stored form cannot represent.
 func (d LocalDate) Value() (driver.Value, error) {
 	if d.IsZero() {
 		return nil, errors.New("store: zero LocalDate")
 	}
+	if d.year < 0 || d.year > 9999 {
+		return nil, fmt.Errorf("store: LocalDate year %d outside 0000-9999", d.year)
+	}
 	return d.String(), nil
 }
 

internal/store/time_test.go

@@ -102,6 +102,25 @@ func TestLocalDateRoundTrip(t *testing.T) {
 	}
 }
 
+func TestLocalDateOf(t *testing.T) {
+	auckland, err := time.LoadLocation("Pacific/Auckland")
+	if err != nil {
+		t.Fatal(err)
+	}
+	// 2026-10-03T20:00Z is already 2026-10-04 in Auckland (UTC+13).
+	instant := time.Date(2026, time.October, 3, 20, 0, 0, 0, time.UTC)
+	if got := LocalDateOf(instant).String(); got != "2026-10-03" {
+		t.Errorf("LocalDateOf(UTC) = %s, want 2026-10-03", got)
+	}
+	d := LocalDateOf(instant.In(auckland))
+	if got := d.String(); got != "2026-10-04" {
+		t.Errorf("LocalDateOf(Auckland) = %s, want 2026-10-04", got)
+	}
+	if y, m, day := d.Date(); y != 2026 || m != time.October || day != 4 {
+		t.Errorf("Date() = %d-%d-%d, want 2026-10-4", y, m, day)
+	}
+}
+
 func TestLocalDateRejectsInvalid(t *testing.T) {
 	for _, str := range []string{
 		"", "2026-02-30", "2026-02-29", "2026-13-01", "2026-00-10", "2026-10-00",
@@ -119,6 +138,12 @@ func TestLocalDateRejectsInvalid(t *testing.T) {
 	if _, err := (LocalDate{}).Value(); err == nil {
 		t.Error("zero LocalDate Value succeeded")
 	}
+	for _, y := range []int{-1, 10000} {
+		d := LocalDateOf(time.Date(y, time.January, 1, 0, 0, 0, 0, time.UTC))
+		if _, err := d.Value(); err == nil {
+			t.Errorf("LocalDate year %d Value succeeded", y)
+		}
+	}
 	var d LocalDate
 	if err := d.Scan(nil); err == nil {
 		t.Error("Scan(nil) succeeded")

migrations/0002_household_settings_updated_by.sql

@@ -0,0 +1,4 @@
+-- 0002_household_settings_updated_by: record who last changed the household
+-- settings, as dinners and suggestion_batches already do. NULL until the
+-- first change made by a signed-in member.
+ALTER TABLE household_settings ADD COLUMN updated_by TEXT;

migrations/queries/settings.sql

@@ -10,12 +10,12 @@ INSERT INTO household_settings (
 	id, timezone, dinner_time, reminder_time, review_time, plan_draft_dow,
 	plan_draft_time, suggestions_dow, suggestions_time, chat_autosend_dow,
 	chat_autosend_time, onboarding_completed_at, updates_seen_at,
-	created_at, updated_at
+	updated_by, created_at, updated_at
 ) VALUES (
 	1, ?, ?, ?, ?, ?,
 	?, ?, ?, ?,
 	?, ?, ?,
-	?, ?
+	?, ?, ?
 )
 ON CONFLICT (id) DO UPDATE SET
 	timezone = excluded.timezone,
@@ -30,6 +30,7 @@ ON CONFLICT (id) DO UPDATE SET
 	chat_autosend_time = excluded.chat_autosend_time,
 	onboarding_completed_at = excluded.onboarding_completed_at,
 	updates_seen_at = excluded.updates_seen_at,
+	updated_by = excluded.updated_by,
 	updated_at = excluded.updated_at
 RETURNING *;