add account preferences model and API endpoints for user settings

backend/authentication/api.py

@@ -9,7 +9,7 @@ from rest_framework.authtoken.models import Token
 from rest_framework.authtoken.views import ObtainAuthToken
 from rest_framework.response import Response
 
-from authentication.models import ToolshedUser
+from authentication.models import ToolshedUser, AccountPreference
 from authentication.signature_auth import SignatureAuthenticationLocal
 from files.models import File
 from files.serializers import FileSerializer
@@ -17,6 +17,48 @@ from hostadmin.models import Domain
 
 router = routers.SimpleRouter()
 
+# Schema for the account-level preferences a client may store on the server (see
+# AccountPreference). Device-level preferences are never sent here - they stay in the
+# browser's local storage since they describe the device, not the account.
+PREFERENCE_DEFINITIONS = [
+    {
+        'key': 'ui.compact_mode',
+        'type': 'boolean',
+        'default': False,
+        'label': 'Compact mode',
+        'description': 'Show denser item rows and reduce spacing in lists.',
+    },
+    {
+        'key': 'ui.default_search_scope',
+        'type': 'enum',
+        'options': ['inventory', 'friends', 'all'],
+        'default': 'inventory',
+        'label': 'Default search scope',
+        'description': 'Choose where the global search starts.',
+    },
+    {
+        'key': 'notifications.desktop_enabled',
+        'type': 'boolean',
+        'default': True,
+        'label': 'Desktop notifications',
+        'description': 'Enable in-browser notifications for important updates.',
+    },
+    {
+        'key': 'files.max_upload_mb',
+        'type': 'integer',
+        'default': 25,
+        'label': 'Default upload size limit (MB)',
+        'description': 'Used as a prefill hint in upload dialogs.',
+    },
+    {
+        'key': 'ui.experimental_flags',
+        'type': 'json',
+        'default': {},
+        'label': 'Experimental flags',
+        'description': 'Optional JSON toggles for feature previews.',
+    },
+]
+
 
 class UserAuthToken(ObtainAuthToken):
 
@@ -129,6 +171,42 @@ def registerUser(request):
         return Response({'errors': {'domain': 'Domain does not exist or is not open for registration'}}, status=400)
 
 
+@api_view(['GET'])
+@permission_classes([])
+@authentication_classes([])
+def preference_definitions(request):
+    """Return the schema (types, defaults, labels) for the account preferences clients may set."""
+    return Response(PREFERENCE_DEFINITIONS)
+
+
+@api_view(['GET', 'PUT'])
+@permission_classes([IsAuthenticated])
+@authentication_classes([SignatureAuthenticationLocal])
+def account_preferences(request):
+    """Get or bulk-upsert the authenticated user's account-level preferences.
+
+    GET returns the current preferences as a {key: value} dict. PUT accepts a {key: value}
+    dict of one or more preferences to set/overwrite; unspecified keys are left untouched.
+    """
+    if request.method == 'PUT':
+        if not isinstance(request.data, dict):
+            return Response({'detail': 'Expected an object of key/value pairs.'}, status=400)
+        for key, value in request.data.items():
+            AccountPreference.objects.update_or_create(user=request.user, key=key, defaults={'value': value})
+
+    preferences = {pref.key: pref.value for pref in request.user.preferences.all()}
+    return Response(preferences)
+
+
+@api_view(['DELETE'])
+@permission_classes([IsAuthenticated])
+@authentication_classes([SignatureAuthenticationLocal])
+def account_preference_detail(request, key):
+    """Reset a single account-level preference back to its default by deleting it."""
+    AccountPreference.objects.filter(user=request.user, key=key).delete()
+    return Response(status=204)
+
+
 router.register(r'users', UserViewSet)
 
 urlpatterns = [
@@ -136,4 +214,7 @@ urlpatterns = [
     path('user/', getUserInfo),
     path('register/', registerUser),
     path('token/', UserAuthToken.as_view()),
+    path('preferences/', preference_definitions),
+    path('self/preferences/', account_preferences),
+    path('self/preferences/<str:key>/', account_preference_detail),
 ]