feat(account): username with a weekly change limit

[kris1027]

Adds a username to every account: chosen when signing up, changeable on /account at most once a week, and shown in the navbar. Plan and decisions: prompts/account-username.md.

What changes

• Database (20261011120000_account_username.sql): a new profiles table that only its owner can read and update. The database enforces every rule, so writes made directly through the API follow them too:

  • 2–30 ASCII characters (letters, digits, _ . -), no spaces, cannot start or end with . or -;
  • a short list of reserved names;
  • unique regardless of case;
  • a 7-day lock after each change (rolling), enforced by a trigger that also sets the change time itself.

  Nobody can delete their row, so deleting it can't be used to reset the lock.

• username_available(text) is the one security definer function and the one anon can call, so the sign-up form can check a name before the account exists. It returns only a boolean. 140-security-sweep excludes it by exact signature and checks that it returns a boolean.

• Sign up: a required Username field. A taken name is refused before any account is created. If someone takes the name in between the check and sign-up, the person lands on /account?notice=username-taken to choose another.

• /account: a Username section with three states: no username yet, editable, or locked with the unlock time shown in the viewer's own time zone. From lg up the settings sit in two columns (Account and Username on the left, Change password on the right). Change password now asks for the new password twice, and both card buttons line up at the bottom.

• Navbar: shows the username and its first letter in the avatar, and falls back to the email name.

• Privacy: /privacy lists the username, and LEGAL_LAST_UPDATED is now 2026-10-11.

Deploy

The migration only adds objects, so the deployment that is live now keeps working. It must be pushed with supabase db push before this PR is merged (docs/deploy.md). Pushed on 2026-10-11; local and remote migration lists match.

Checks

• pnpm test: 2282 passed
• pnpm test:db: 332 passed (new 170-profiles-username)
• pnpm typecheck, pnpm lint, pnpm db:types:check: clean
• pnpm build: OK; /shows and /movies are still prerendered
• Manual run against the local stack:
  • sign up, with an invalid name refused and a taken name refused without creating an account;
  • /account locked and then unlocked, with the change saved;
  • navbar shows the new name;
  • layout checked at 1280px and 375px;
  • mismatched new passwords are refused.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
bestats	Ready	Preview	Oct 11, 2026 12:00pm UTC