A profile that is yours and nobody else's

Every signed-in person has a profile page: their login name, where their

sign-in codes are sent, a few lines about themselves, a picture, and a

read-only list of the compartments they belong to. The interesting part is

not what it shows but what it cannot show. There is no way to ask for

somebody else's profile, because the database itself limits a session to

one row — the person's own — rather than the vault relying on every future

query to remember a filter. Changing where sign-in codes go and changing a

password both re-require the current password, since a session that could

redirect the codes could hand over the account. And a profile picture is

untrusted input the vault will later serve back to a browser, so the vault

decides what a picture is from the file's own bytes, never from its name

or from the type the browser claimed for it.

A picture is whatever its bytes say it is, not what it is called

Given a picture whose name and declared type disagree with its contents
When the vault decides what format it is
Then the vault answers with the format the bytes say

A drawing that can carry a script is refused by name

Given a file that is an SVG drawing dressed as a photograph
When the vault decides what format it is
Then the vault refuses it and says the word SVG

A file that is not a picture at all is refused

Given a file that is not a picture but opens like one
When the vault decides what format it is
Then the vault refuses it as not a picture

A bio longer than the vault accepts is refused before it is stored

Given a person writing a bio longer than the vault accepts
When they save it
Then the vault refuses the bio and says how long one may be

A picture size limit always applies, even unconfigured

Given a deployment that never configured a picture size limit
When the vault asks how large a picture may be
Then a limit still applies

A picture size limit that makes no sense is refused, not ignored

Given a deployment that configured a picture size limit of zero
When the vault asks how large a picture may be
Then the vault refuses to run with that limit

A person sees their own account and the compartments they belong tostack

Given a running vault with two people who each belong to a compartment
When the first person opens their profile
Then they see their own login name and their own compartment
And they see nothing belonging to the other person

Given a running vault with two people who each belong to a compartment
When the first person changes their email with the wrong password
Then the vault refuses and the email is unchanged

A picture uploaded is a picture served back, to its owner alonestack

Given a running vault with two people who each belong to a compartment
When the first person uploads a profile picture
Then the vault serves that picture back to them
And the other person's request for a picture finds none