Add player bug reports and profile identity features

tests/profile-appearance.test.ts

@@ -0,0 +1,47 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import { profileUpdateSchema } from "../shared/account";
+import {
+  prefixUpdateSchema,
+  glowColor,
+  defaultGlowColor,
+} from "../shared/profile-appearance";
+test("players may choose a hex glow color but cannot assign badges, roles or rewards", () => {
+  assert.deepEqual(profileUpdateSchema.parse({ glowColor: "#12ABff" }), {
+    glowColor: "#12abff",
+  });
+  assert.equal(
+    profileUpdateSchema.safeParse({ displayName: "Pavel" }).success,
+    true,
+  );
+  for (const body of [
+    {},
+    { role: "moderator" },
+    { bug_finder: true },
+    { name_glow: true },
+    { custom_prefix: "Admin" },
+    { glowColor: "red; background:url(https://example.com)" },
+    { glowColor: "#fff" },
+  ])
+    assert.equal(profileUpdateSchema.safeParse(body).success, false);
+  assert.equal(glowColor("url(example.com)"), defaultGlowColor);
+});
+test("custom prefixes are bounded plain text with a known icon and support explicit removal", () => {
+  assert.deepEqual(
+    prefixUpdateSchema.parse({ prefix: "  Map artist  ", icon: "gem" }),
+    { prefix: "Map artist", icon: "gem" },
+  );
+  assert.equal(
+    prefixUpdateSchema.safeParse({ prefix: null, icon: "star" }).success,
+    true,
+  );
+  for (const body of [
+    { prefix: "", icon: "star" },
+    { prefix: "x".repeat(25), icon: "star" },
+    { prefix: "<script>", icon: "star" },
+    { prefix: "hi\u202e", icon: "star" },
+    { prefix: "Hi", icon: "https://example.com" },
+    { prefix: "Hi", icon: "star", role: "moderator" },
+  ])
+    assert.equal(prefixUpdateSchema.safeParse(body).success, false);
+});