Add user settings cloud sync (GetUserSettings / SetUserSettings)

[Copilot]

• Explore codebase and understand existing patterns
• Run existing tests (40 pass)
• Create migration file for user_settings table (migrations/0004_add_user_settings.sql)
• Add SetUserSettings endpoint to Process.ts
• Add GetUserSettings endpoint to Process.ts
• Add tests for both new endpoints (48 total, all pass)
• Code review feedback addressed (size limit, shape validation, atomic upsert)
• Fix failing test: update SetUserSettings updates existing settings row to simulate PK conflict instead of checking GetTableSize
• CodeQL security scan: 0 alerts

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

---

Summary by cubic

Adds a backend API to sync user settings across devices. Stores per-user settings in D1 and requires a valid phpsessid; the frontend calls it from XMOJ-Script (XMOJ.user.js).

• New Features

  • Endpoints GetUserSettings/SetUserSettings for the logged-in user (JSON object only; 10k max; returns {} when unset; reports corrupted data).
  • D1 persistence in user_settings keyed by user_id.

• Bug Fixes

  • Upsert is insert-first with update on duplicate key to avoid races; duplicate-key detection is more robust and non-uniqueness errors propagate.
  • Tests cover insert/update paths, invalid/corrupted JSON, and the update test simulates a PK conflict to assert the upsert path.

^{Written for commit 267d528. Summary will update on new commits.}

[Copilot]

Pull request overview

Adds authenticated, D1-backed API support for syncing per-user script settings across devices via two new endpoints.

Changes:

• Introduces SetUserSettings to validate and persist a JSON settings object for the authenticated user.
• Introduces GetUserSettings to retrieve stored settings (or {} when none exist) and report corrupted stored data.
• Adds a D1 migration creating the user_settings table and unit tests covering the new endpoints.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File	Description
Source/Process.ts	Adds SetUserSettings / GetUserSettings Process endpoints with JSON validation and D1 persistence.
migrations/0004_add_user_settings.sql	Creates user_settings table keyed by user_id with a JSON-string settings column.
test/process.test.js	Adds tests for insert/update flows, invalid JSON handling, empty settings, and corrupted stored JSON.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[cubic-dev-ai]

1 issue found across 3 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="Source/Process.ts">

<violation number="1" location="Source/Process.ts:1509">
P2: The check-then-insert/update flow is race-prone; concurrent saves can hit a duplicate-key failure on first write for the same user.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[PythonSmall-Q]

@copilot fix failed test

[Copilot]

@copilot fix failed test

Fixed in 791dc79. The test SetUserSettings updates existing settings row was written for the old check-then-insert/update flow, but the code was updated (per review) to use an atomic insert-first/catch-on-conflict approach. Updated the test to simulate a primary key UNIQUE constraint failed error from Insert, which then triggers the Update fallback — matching the actual runtime behaviour.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• registry.npmmirror.com
  • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node node /home/REDACTED/work/_temp/ghcca-node/node/bin/npm install --registry REDACTED (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[PythonSmall-Q]

// Save — serialize all UserScript-Setting-* localStorage keys
RequestAPI("SetUserSettings", {
    Settings: JSON.stringify(
        Object.fromEntries(
            Object.keys(localStorage)
                .filter(k => k.startsWith("UserScript-Setting-"))
                .map(k => [k.replace("UserScript-Setting-", ""), localStorage.getItem(k)])
        )
    )
}, (res) => { /* handle */ });

// Load — restore into localStorage
RequestAPI("GetUserSettings", {}, (res) => {
    if (res.Success) {
        for (const [key, value] of Object.entries(res.Data.Settings))
            localStorage.setItem("UserScript-Setting-" + key, value);
    }
});

[cubic-dev-ai]

1 issue found across 2 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="Source/Process.ts">

<violation number="1" location="Source/Process.ts:1529">
P1: Duplicate-key fallback is unreachable because `ThrowErrorIfFailed` throws `Result`, not `Error`, so existing-user updates can fail instead of running the update path.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[boomzero]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 791dc79c6c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[PythonSmall-Q]

@boomzero