yang rui 7513f16e0e
feat(settings): persist account preferences across browsers (#5397)
* feat(settings): persist account preferences across browsers

* docs(settings): scope preference guidance to user persistence

* fix(settings): preserve SSR and fence custom-agent defaults

* test: include user persistence in scoped guidance inventory

* fix(settings): sync explicit edits and preserve local tab updates
2026-09-14 07:25:41 +08:00

706 B

User persistence

user_preferences stores independent (user_id, key) rows in the shared SQL database. PATCH upserts only supplied keys in one transaction; null resets a field, disjoint edits commute, and same-field writes are last-commit-wins.

The Gateway's GET/PATCH /api/v1/auth/preferences allows only notification enablement, the default model, conversation mode, and reasoning effort. It requires a browser session plus X-Expected-User-Id matching that session (a stale-tab guard, never an authorization source); PAT, internal, and auth-disabled callers are rejected. Never persist arbitrary agent context or credentials through this API. See backend/docs/API.md for the HTTP contract.