refactor(user): check only the shape of a tile id

Core and the Frontend skip ids they do not know; Core never shares the overview or the activity.

src/test/java/auth_service/modules/user/api/UserControllerTest.java

@@ -467,19 +467,32 @@ class UserControllerTest extends AbstractWebMvcTest {
         verify(userService).updateProfileTiles(1L, List.of(new Tile("STATS_PILE", "M")));
     }
 
-    // A dashboard tile is no profile tile and the other way round; activity and the game count stay private.
+    // Core and the Frontend know the tiles; Auth checks only the shape (Core keeps activity and the overview private).
+    @Test
+    void updateTiles_ANewTileIdIsPassedThrough() throws Exception {
+        SecurityContextHolder.getContext().setAuthentication(new UsernamePasswordAuthenticationToken(
+                new UserPrincipal("1", null), null, Collections.emptyList()));
+
+        mockMvc.perform(put("/api/users/settings/profile-tiles")
+                        .contentType(MediaType.APPLICATION_JSON)
+                        .content("{\"tiles\":[{\"id\":\"STATS_NEW_GROUP\",\"size\":\"M\"}]}"))
+                .andExpect(status().isNoContent());
+
+        verify(userService).updateProfileTiles(1L, List.of(new Tile("STATS_NEW_GROUP", "M")));
+    }
+
     @ParameterizedTest
     @ValueSource(strings = {
-            "dashboard-tiles|{\"tiles\":[{\"id\":\"SUMMARY\",\"size\":\"M\"}]}",
+            "dashboard-tiles|{\"tiles\":[{\"id\":\"stats_pile\",\"size\":\"M\"}]}",
+            "dashboard-tiles|{\"tiles\":[{\"id\":\"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\",\"size\":\"M\"}]}",
             "dashboard-tiles|{\"tiles\":[{\"id\":\"PLAYING\",\"size\":\"XL\"}]}",
             "dashboard-tiles|{\"tiles\":[{\"id\":\"PLAYING\"}]}",
             "dashboard-tiles|{\"tiles\":[null]}",
-            "profile-tiles|{\"tiles\":[{\"id\":\"ACTIVITY\",\"size\":\"M\"}]}",
-            "profile-tiles|{\"tiles\":[{\"id\":\"STATS_OVERVIEW\",\"size\":\"M\"}]}",
+            "profile-tiles|{\"tiles\":[{\"id\":\"\",\"size\":\"M\"}]}",
             "profile-tiles|{\"tiles\":null}",
             "profile-tiles|{}"
     })
-    void updateTiles_UnknownIdBadSizeOrMissing_IsRejected(String pathAndBody) throws Exception {
+    void updateTiles_BadIdBadSizeOrMissing_IsRejected(String pathAndBody) throws Exception {
         SecurityContextHolder.getContext().setAuthentication(new UsernamePasswordAuthenticationToken(
                 new UserPrincipal("1", null), null, Collections.emptyList()));
         String[] parts = pathAndBody.split("\\|", 2);

src/test/java/auth_service/modules/user/persistence/UserRepositoryTest.java

@@ -357,6 +357,23 @@ class UserRepositoryTest extends AbstractPersistenceTest {
         assertNull(findByEmail("reset@example.com").orElseThrow().getSettings().getDashboardTiles());
     }
 
+    @Test
+    void updateTiles_TheLongestIdAuthAcceptsIsStored() {
+        UserEntity userEntity = persisted(UserEntity.builder()
+                .email("longtile@example.com")
+                .password("password")
+                .enabled(true)
+                .registrationDate(LocalDateTime.now())
+                .build());
+        List<Tile> profile = List.of(new Tile("STATS_" + "A".repeat(24), "M"));
+
+        userRepository.update(userEntity.getId(), user -> user.getSettings().setProfileTiles(profile));
+        entityManager.flush();
+        entityManager.clear();
+
+        assertEquals(profile, findByEmail("longtile@example.com").orElseThrow().getSettings().getProfileTiles());
+    }
+
     private void updateSettings(long userId, String displayName, UserSettings settings) {
         userRepository.update(userId, user -> {
             user.setDisplayName(displayName);