Account

Who you are is a node; what you may do is an edge.

• tested Sign in with Google pandoPando's only sign-in path. test/account.test.js asserts the security boundary in the Google path: a token with no address, or one Google marks unverified, is refused, and the token is checked against this application rather than accepted from any issuer.test/account.test.js
• tested A user is a node in the same graph as the bullets pandoPando axiom 1.test/perm.test.js
• tested A permission is an edge between a user node and a content node pandoPando axiom 2.test/perm.test.js
• tested zweice@gmail.com is admin pandotest/account.test.js asserts the administrator list is read from configuration at every sign-in, survives spaces, a trailing comma and mixed case, invents nobody from an empty entry, and is written back for an account that already exists so adding an address takes effect without a database edit.test/account.test.js
• verified A free tier with a node capTwo thousand bullets, and the refusal says so in words: "this outline is at its 2000 bullet limit". An admin is never capped, because the free tier bounds what a stranger can store on somebody else’s disk and the person whose disk it is is not a stranger. Measured: 1800 bullets draw their first row in 674ms, and every bullet is a row.persona: packing /pricing
• verified Signed-in sessions survive a reload pandopersona: stranger
• tested Sign out pandotest/account.test.js asserts the route ends the session server-side and replaces the cookie with one that is expired, HttpOnly and scoped to the whole site. A cookie that is only emptied is still a cookie the browser keeps and sends.test/account.test.js
• verified A settings screen for appearance, writing and dates pandoEvery setting is a prop on the user node, because a user is a node (Axiom 1). That is why they follow you to your phone with no syncing code.persona: keeping
• verified Trash: restore what was deletedA query, not a store. Deletion is a last-writer-wins field carrying the time it happened, so nothing was removed and restoring writes null into the same field.persona: keeping /help/hotkeys
• tested Mirrors do not count against the free tier pandoThe count is over live nodes and a mirror is an edge. The same fact as "a mirror is not a copy". test/account.test.js asserts mirroring produces no node.create at all - it is a second edge to the same node - and that the counter the limit is taken against does not move when a bullet is mirrored twice. A mirror implemented as a copy would pass every visual check and quietly charge for it.test/account.test.js