feat(sidebar): de faste visninger kan sorteres, og rækkefølgen følger kontoen

I dag, Kommende, Venter og Indbakken kan trækkes i den rækkefølge, man vil have
dem. På kontoen frem for i browseren: sidebjælkens bredde er en kendsgerning om
skærmen, og svaret på en telefon er ikke svaret på en skærm — men hvilken
rækkefølge man vil have dem i, er en kendsgerning om personen.

En liste af nøgler frem for et tal pr. visning. Ukendte nøgler droppes og
manglende føjes til sidst, så en visning kan tilføjes eller fjernes uden at
strande nogens rækkefølge — hvilket allerede er sket én gang, da Færdige
forlod menuen.

To ting, prøverne fandt undervejs, og begge var mine:

Rækken som trækgreb gjorde alt indeni trækbart, og sidebjælken er allerede
modtager for opgaver — en opgave trukket til I dag holdt op med at lande, fordi
rækken havde taget gestussen. Et lille greb tager ingenting, før man griber det.
Og drop-håndteringen slugte begivenheden, før den tjekkede, om den overhovedet
var en menuflytning.

Migration 0019.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

internal/httpapi/auth_handlers.go

@@ -32,6 +32,7 @@ type userJSON struct {
 	// about the work and not about the screen — the sidebar's width is the
 	// opposite case and stays in localStorage.
 	SidebarCollapsed []string `json:"sidebar_collapsed"`
+	NavOrder         []string `json:"nav_order"`
 	CreatedAt        string   `json:"created_at"`
 }
 
@@ -42,10 +43,14 @@ func toUserJSON(u *store.User) userJSON {
 	if collapsed == nil {
 		collapsed = []string{}
 	}
+	order := u.NavOrder
+	if order == nil {
+		order = []string{}
+	}
 	return userJSON{
 		ID: u.ID, Email: u.Email, Name: u.Name, AvatarColor: u.AvatarColor,
 		Timezone: u.Timezone, Locale: u.Locale, IsAdmin: u.IsAdmin,
-		TOTPEnabled: u.TOTPEnabled, SidebarCollapsed: collapsed,
+		TOTPEnabled: u.TOTPEnabled, SidebarCollapsed: collapsed, NavOrder: order,
 		CreatedAt: u.CreatedAt.Format(time.RFC3339),
 	}
 }
@@ -83,6 +88,30 @@ func (s *Server) handleSetSidebarSections(w http.ResponseWriter, r *http.Request
 	w.WriteHeader(http.StatusNoContent)
 }
 
+// handleSetNavOrder records the order of the fixed views in the sidebar.
+//
+// Its own route for the same reason as the folds: this writes on every drop, and
+// sharing the profile's path would make a reorder send a name and a timezone it
+// was never asked to change.
+func (s *Server) handleSetNavOrder(w http.ResponseWriter, r *http.Request) {
+	var req struct {
+		Order []string `json:"order"`
+	}
+	if err := decodeJSON(w, r, &req); err != nil {
+		return
+	}
+	if len(req.Order) > 20 {
+		writeError(w, http.StatusBadRequest, CodeBadRequest, "too many entries")
+		return
+	}
+	user := userFrom(r.Context())
+	if err := s.db.SetNavOrder(r.Context(), user.ID, req.Order); err != nil {
+		s.storeError(w, r, "set nav order", err)
+		return
+	}
+	w.WriteHeader(http.StatusNoContent)
+}
+
 // --- sign in -----------------------------------------------------------------
 
 type loginRequest struct {

internal/httpapi/server.go

@@ -178,6 +178,7 @@ func New(cfg *config.Config, db *store.DB, log *slog.Logger, web fs.FS) *Server
 				r.Get("/me", s.handleMe)
 				r.Patch("/me", s.handleUpdateProfile)
 				r.Put("/sidebar-sections", s.handleSetSidebarSections)
+				r.Put("/nav-order", s.handleSetNavOrder)
 				r.Post("/logout", s.handleLogout)
 				r.Post("/password/change", s.handleChangePassword)
 				r.Post("/totp/setup", s.handleTOTPSetup)

internal/store/migrations/0019_nav_order.sql

@@ -0,0 +1,13 @@
+-- The order of the fixed views in the sidebar.
+--
+-- On the account rather than in the browser, and for the reason the sidebar's
+-- width is the other way round: a width is a fact about the screen you are at, and
+-- the answer on a phone is not the answer on a monitor. Which order you want I dag,
+-- Kommende, Venter and Indbakken in is a fact about you, and it should be the same
+-- on the laptop as on the phone.
+--
+-- A list of keys rather than a number per row, for the same reason sidebar_collapsed
+-- is: the set of views changes with the program, and a key that no longer exists
+-- costs nothing — the sidebar draws what it recognises and appends anything new at
+-- the end. That is what makes adding a view later not a migration.
+ALTER TABLE users ADD COLUMN nav_order TEXT NOT NULL DEFAULT '[]';

internal/store/users.go

@@ -36,8 +36,13 @@ type User struct {
 	// is as true on the laptop as on the desktop. The sidebar's *width* is the
 	// opposite case and is stored per browser.
 	SidebarCollapsed []string
-	CreatedAt        time.Time
-	UpdatedAt        time.Time
+
+	// NavOrder is the order this person wants the fixed views in, by key. Empty
+	// means the order the program ships with. Unknown keys are ignored and missing
+	// ones are appended, so adding a view later is not a migration.
+	NavOrder  []string
+	CreatedAt time.Time
+	UpdatedAt time.Time
 }
 
 // NormalizeEmail is the one place an address is canonicalised. Addresses arrive
@@ -104,7 +109,7 @@ func (db *DB) UserByID(ctx context.Context, id string) (*User, error) {
 }
 
 const userColumns = `id, email, name, password_hash, totp_secret, totp_enabled,
-	avatar_color, timezone, locale, is_admin, sidebar_collapsed, created_at, updated_at`
+	avatar_color, timezone, locale, is_admin, sidebar_collapsed, nav_order, created_at, updated_at`
 
 func (db *DB) scanUser(ctx context.Context, query string, args ...any) (*User, error) {
 	var u User
@@ -112,11 +117,11 @@ func (db *DB) scanUser(ctx context.Context, query string, args ...any) (*User, e
 	var totpEnabled, isAdmin int
 	var created, updated int64
 
-	var collapsed string
+	var collapsed, navOrder string
 
 	err := db.QueryRowContext(ctx, query, args...).Scan(
 		&u.ID, &u.Email, &u.Name, &u.PasswordHash, &secret, &totpEnabled,
-		&u.AvatarColor, &u.Timezone, &u.Locale, &isAdmin, &collapsed, &created, &updated)
+		&u.AvatarColor, &u.Timezone, &u.Locale, &isAdmin, &collapsed, &navOrder, &created, &updated)
 	if errors.Is(err, sql.ErrNoRows) {
 		return nil, ErrNotFound
 	}
@@ -131,11 +136,34 @@ func (db *DB) scanUser(ctx context.Context, query string, args ...any) (*User, e
 	// worst case is a sidebar that opens fully, which is the state it shipped in.
 	u.SidebarCollapsed = []string{}
 	_ = json.Unmarshal([]byte(collapsed), &u.SidebarCollapsed)
+	u.NavOrder = []string{}
+	_ = json.Unmarshal([]byte(navOrder), &u.NavOrder)
 	u.CreatedAt = time.Unix(created, 0).UTC()
 	u.UpdatedAt = time.Unix(updated, 0).UTC()
 	return &u, nil
 }
 
+// SetNavOrder records the order of the fixed views.
+func (db *DB) SetNavOrder(ctx context.Context, userID string, order []string) error {
+	if order == nil {
+		order = []string{}
+	}
+	raw, err := json.Marshal(order)
+	if err != nil {
+		return err
+	}
+	res, err := db.ExecContext(ctx,
+		`UPDATE users SET nav_order = ?, updated_at = ? WHERE id = ?`,
+		string(raw), time.Now().Unix(), userID)
+	if err != nil {
+		return err
+	}
+	if n, _ := res.RowsAffected(); n == 0 {
+		return ErrNotFound
+	}
+	return nil
+}
+
 // SetSidebarCollapsed records which sidebar headings are folded.
 //
 // Its own method rather than a field on UpdateProfile: that one backs a form with