v4: users can't rename themselves, /settings lays out again, and its selectors fit a phone — PATCH /api/me refuses a username with a 400 and changes nothing else in that request; a name changes only through PATCH /api/users/:key/username, which needs user:manage, from /@name/manage. The old name still stays an alias for good. renameUser lost its 30-day limit and its exempt flag, and RENAME_LIMITS holds the slug limit alone. /settings shows the username as plain text, and the rename hint left the catalogs. The settings grid sized its control column to its widest content, the rename hint, which stretched every control under it; that column now takes the remaining width and each control keeps its own size. A segmented control wraps instead of overflowing; in a settings row on a phone it takes the full width, and one of more than 4 options (the styles) lays out in two even rows. .btn-border turned red on hover, so Settings, Manage, Retry and Back looked like Log out; it is now neutral (Smooth's accent is red too), and only Log out takes the new btn-border--danger, muted until hovered red. A <button> and a <Link> .btn-border are now the same height. API.md and the module docs say who renames; the backend tests rename through the moderator route and check a self-rename is refused, and the malformed-name check moved to the manage tab's test. 254 backend and 667 frontend tests pass, and tsc, deno check and doc:lint are clean; Smooth, Brutalist, GeoCities and Kanagawa were checked in screenshots at desktop and phone widths.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

api/test/routes/users.test.ts

@@ -23,7 +23,12 @@ import type {
   SelfUser,
   UserSuggestion,
 } from "../../../shared/user.ts";
-import { assert, assertEquals, assertFalse } from "@std/assert";
+import {
+  assert,
+  assertEquals,
+  assertFalse,
+  assertNotEquals,
+} from "@std/assert";
 import {
   createPasswordResetToken,
   verifyJWT,
@@ -69,7 +74,7 @@ test("public profile: by @name in any case or id, without private fields", async
   assertFalse("passwordHash" in me.data);
 });
 
-test("PATCH /api/me: description, email and username only", async () => {
+test("PATCH /api/me: description and email only", async () => {
   const user = await createUser();
   const taken = await createUser();
   const res = await patch<SelfUser>("/api/me", {
@@ -618,17 +623,19 @@ test("settings: signed in only, and a bad value or unknown key is refused", asyn
 // ── Usernames and paths ──────────────────────────────────────────────────────
 
 test("renaming: the old name redirects for good, and nobody else can take it", async () => {
+  const admin = await createUser({ role: "admin" });
   const bob = await createUser();
   const old = bob.username;
   const renamed = uniqueName("robert");
   const dump = insertDump({ userId: bob.id, title: "Never gonna" });
   const playlist = insertPlaylist({ userId: bob.id, title: "Sunday mix" });
+  const rename = (key: string, username: string) =>
+    patch<PublicUser>(`/api/users/${key}/username`, {
+      auth: admin.auth,
+      json: { username },
+    });
 
-  const res = await patch<SelfUser>("/api/me", {
-    auth: bob.auth,
-    json: { username: renamed },
-  });
-  assertEquals(res.data.username, renamed);
+  assertEquals((await rename(bob.id, renamed)).data.username, renamed);
 
   // The old name, in any case, still answers the user, under the new one.
   for (const name of [old, old.toUpperCase(), renamed]) {
@@ -648,7 +655,7 @@ test("renaming: the old name redirects for good, and nobody else can take it", a
     assertEquals([p.data.id, p.data.ownerUsername], [playlist.id, renamed]);
   }
 
-  // Nobody can register or rename to the old name, in any case.
+  // Nobody can register or be renamed to the old name, in any case.
   const other = await createUser();
   const register = await post("/api/users", {
     json: {
@@ -659,19 +666,9 @@ test("renaming: the old name redirects for good, and nobody else can take it", a
     },
   });
   assertEquals(register.status, 409);
-  assertEquals(
-    (await patch("/api/me", { auth: other.auth, json: { username: old } }))
-      .status,
-    409,
-  );
+  assertEquals((await rename(other.id, old)).status, 409);
   // Nor to a current one.
-  assertEquals(
-    (await patch("/api/me", {
-      auth: other.auth,
-      json: { username: renamed },
-    })).status,
-    409,
-  );
+  assertEquals((await rename(other.id, renamed)).status, 409);
   // Signing in takes the current name only.
   assertEquals(
     (await post("/api/sessions", {
@@ -681,60 +678,43 @@ test("renaming: the old name redirects for good, and nobody else can take it", a
   );
 });
 
-test("renaming: once in 30 days, a case change aside, and a moderator is exempt", async () => {
+test("renaming: only by user:manage, at any time, and never by oneself", async () => {
   const user = await createUser();
-  const first = uniqueName("first");
-  assertEquals(
-    (await patch("/api/me", { auth: user.auth, json: { username: first } }))
-      .status,
-    200,
-  );
-  // A change of case alone leaves no alias, so it isn't counted.
-  assertEquals(
-    (await patch<SelfUser>("/api/me", {
-      auth: user.auth,
-      json: { username: first.toUpperCase() },
-    })).data.username,
-    first.toUpperCase(),
-  );
-  const again = await patch("/api/me", {
+  // PATCH /api/me refuses a name, and changes nothing else with it.
+  const self = await patch("/api/me", {
     auth: user.auth,
-    json: { username: uniqueName("second") },
+    json: { username: uniqueName("self"), description: "hi" },
   });
-  assertEquals(again.status, 429);
-  assertEquals(
-    (await patch("/api/me", { auth: user.auth, json: { username: "a b" } }))
-      .status,
-    400,
-  );
+  assertEquals(self.status, 400);
+  const me = await get<SelfUser>("/api/me", { auth: user.auth });
+  assertEquals(me.data.username, user.username);
+  assertNotEquals(me.data.description, "hi");
 
-  // An admin renames anyone at any time, and themselves too.
+  // An admin renames anyone at any time, themselves too.
   const admin = await createUser({ role: "admin" });
-  const third = uniqueName("third");
-  assertEquals(
-    (await patch<PublicUser>(`/api/users/${user.id}/username`, {
+  const rename = (key: string, username: string) =>
+    patch<PublicUser>(`/api/users/${key}/username`, {
       auth: admin.auth,
-      json: { username: third },
-    })).data.username,
-    third,
+      json: { username },
+    });
+  const first = uniqueName("first");
+  const second = uniqueName("second");
+  assertEquals((await rename(user.id, first)).data.username, first);
+  assertEquals((await rename(user.id, second)).data.username, second);
+  // A change of case alone leaves no alias.
+  assertEquals(
+    (await rename(`@${second}`, second.toUpperCase())).data.username,
+    second.toUpperCase(),
   );
   assertEquals(
-    (await patch<PublicUser>(`/api/users/@${third}/username`, {
-      auth: admin.auth,
-      json: { username: first },
-    })).data.username,
+    (await rename(`@${first}`, first)).data.username,
     first,
     "a former name of one's own can be taken back",
   );
-  for (let i = 0; i < 2; i++) {
-    assertEquals(
-      (await patch("/api/me", {
-        auth: admin.auth,
-        json: { username: uniqueName("admin") },
-      })).status,
-      200,
-    );
-  }
+  assertEquals((await rename(user.id, "a b")).status, 400);
+  const adminName = uniqueName("admin");
+  assertEquals((await rename(admin.id, adminName)).data.username, adminName);
+
   // Others may not.
   const moderator = await createUser({ role: "moderator" });
   assertEquals(

api/test/validators/user.test.ts

@@ -44,7 +44,8 @@ Deno.test("isUpdateUserRequest", () => {
   assert(isUpdateUserRequest({ description: "hi", email: "a@b.co" }));
   assertFalse(isUpdateUserRequest({ description: "x".repeat(2001) }));
   assertFalse(isUpdateUserRequest({ email: "nope" }));
-  assertFalse(isUpdateUserRequest({ username: "no spaces" }));
+  // A name changes only through a moderator's PATCH /api/users/:key/username.
+  assertFalse(isUpdateUserRequest({ username: "well_formed" }));
   assertFalse(isUpdateUserRequest({ password: "short" }));
   assertFalse(isUpdateUserRequest({ role: "root" }));
   assertFalse(isUpdateUserRequest("string"));