phase: 92_theme_save_and_coverage

**Phase 92 final verification pass — all green.** This pass re-verified the completed tasks (all 5 task files already in `complete/`) against every completion criterion; no defects found, nothing to fix. - Verified: 9th identity var `grid_line` end-to-end (migration `0015` at head, model/`theming.py`/schemas/API, 422 + built-in→NULL tests present); `styles.css` zero hardcoded literals outside `:root` + derived `--brand-*` vars; 9th picker in theme form; wordmark themed; `theme.js` save/reset/re-show/mount live-sync; dedicated E2E suite + phase-91 suite updated. - `uv run pytest --cov=app --cov-report=term-missing` → **1845 passed, exit 0, TOTAL 99%** (>90%) - `uv run ruff check .` → clean; `uv run pyright` → 0 errors, 0 warnings - `uv run pytest tests/e2e/test_theme_save_and_coverage.py -v --no-cov` → **3 passed** (save-live, reset-live, whole-site) - `uv run pytest tests/e2e/test_admin_theme_tab.py -v --no-cov` → **5 passed** - Criteria: (1) Save/Reset repaint open page, no nav, SPA-nav survives, pre-paint intact ✅; (2) both `rg` gates green (only `:root` + documented `#fff` Stop label; zero SVG hex attrs), grid/selection/hovers/wash/wordmark E2E-proven ✅; (3) no-op contract live-checked: row-less `/` = no tag + exact A1 CSP, grid-only row = 9-var tag in `COLOR_FIELDS` order + sha256 CSP, with-row ≡ row-less bytes ✅; (4) full suite/coverage/lint/both E2E ✅; (5) commit left to the harness per instructions. - Deviations (previously made, probe-verified, kept): live repaint uses CSSOM `<html>` overrides because Chromium blocks `<style>` textContent mutations under the locked sha256-only CSP (tag text still mirrors the next load; `<html>` style exact-saved after Save, empty after Reset); wordmark themed via 3 `.brand-mark` CSS rules instead of inline styles (task 03's inline attrs were CSP-blocked — fixed during task 04). - Next pending phase: none — `todo/` contains only `92_theme_save_and_coverage`.
2026-09-10 00:23:08 -04:00
parent d22d260b8b
commit df91c6316c
49 changed files with 2282 additions and 189 deletions
@@ -796,7 +796,7 @@ def test_middleware_themed_injects_tag_before_head_on_every_page(db: Session) ->
    ``/``, the non-shell ``/document.html``, and the dynamic
    ``/shared/<token>`` (the prefix branch) — carries EXACTLY ONE
    ``<style id="bor-theme">`` IMMEDIATELY before ``</head>`` (a leading
-    newline, nothing between), with all 8 ``--*`` vars in ``COLOR_FIELDS``
+    newline, nothing between), with all 9 ``--*`` vars in ``COLOR_FIELDS``
    order and the changed value; the ``?v=`` asset rewrite still applies
    alongside."""
    db.execute(text("DELETE FROM ui_settings"))
@@ -819,7 +819,7 @@ def test_middleware_themed_injects_tag_before_head_on_every_page(db: Session) ->
            # (nothing between the tag and the close).
            assert "\n" + tag + "</head>" in r.text
            assert r.text.index(tag) == r.text.index("</head>") - len(tag)
-            # All 8 vars, COLOR_FIELDS order, the changed value present.
+            # All 9 vars, COLOR_FIELDS order, the changed value present.
            declared = re.search(r'<style id="bor-theme">:root\{([^}]*)\}</style>', r.text)
            assert declared is not None
            names = re.findall(r"--([a-z-]+):", declared.group(1))
@@ -842,6 +842,40 @@ def test_middleware_themed_injects_tag_before_head_on_every_page(db: Session) ->
        db.commit()


+def test_middleware_grid_only_change_tag_carries_grid_line(db: Session) -> None:
+    """Phase 92 (task 01): the 9th identity variable — the OTHER 8 colors
+    at built-in + ONLY ``grid_line`` set still breaks the no-op contract:
+    the tag is NON-empty and carries ALL 9 vars (``--grid-line:`` with
+    the changed value, the rest their built-ins, ``COLOR_FIELDS`` order)
+    with the matching style-src CSP hash."""
+    db.execute(text("DELETE FROM ui_settings"))
+    db.add(UiSettings(id=1, grid_line="#123123"))
+    db.commit()
+    try:
+        colors = dict(theming.BUILTIN_COLORS)
+        colors["grid_line"] = "#123123"  # one changed color, rest built-in
+        tag = theming.theme_style_tag(colors)
+        assert tag != ""  # the no-op contract holds ONLY for all-built-in
+        assert "--grid-line:#123123;" in tag
+        client = TestClient(_theme_page_app())
+        r = client.get("/")
+        assert r.status_code == 200
+        assert r.text.count('id="bor-theme"') == 1
+        assert "\n" + tag + "</head>" in r.text
+        # All 9 vars, COLOR_FIELDS order (grid_line between line and brand).
+        declared = re.search(r'<style id="bor-theme">:root\{([^}]*)\}</style>', r.text)
+        assert declared is not None
+        names = re.findall(r"--([a-z-]+):", declared.group(1))
+        assert names == [k.replace("_", "-") for k in theming.COLOR_FIELDS]
+        assert names.index("grid-line") == 5
+        assert r.headers["content-security-policy"] == (
+            f"{CSP}; style-src 'self' '{theming.theme_csp_hash(tag)}'"
+        )
+    finally:
+        db.execute(text("DELETE FROM ui_settings"))
+        db.commit()
+
+
@pytest.mark.parametrize(
    ("what",),
    [("session",), ("resolver",)],