@@ -34,0 +50,4 @@
+    # Needed for flash messages (session cookies). Override via the environment
+    # in production; a per-installation secret becomes mandatory with the
+    # authentication work tracked in issue #25.
+    app.config["SECRET_KEY"] = os.environ.get("YUNJIN_SECRET_KEY", "yunjin-insecure-dev-secret")

@@ -43,6 +54,43 @@ def manage_tags() -> str:
     )
 
 
+@bp.route("/display", methods=["POST"])

@@ -46,0 +63,4 @@
+
+    """
+    db = get_db()
+    user_id = 1  # Default user for now (Phase 6 will add multi-user, see issue #25)

@@ -46,0 +82,4 @@
+
+    custom_css = request.form.get("custom_css", "")
+
+    settings_db.set_setting(db, user_id=user_id, key="theme", value=theme)

@@ -46,0 +71,4 @@
+        return redirect(url_for("settings.manage_tags"))
+
+    font_family = request.form.get("font_family", "")
+    if font_family not in _VALID_FONT_FAMILIES:

@@ -46,0 +80,4 @@
+        flash("Invalid base font size. Use a value like 16px or 1.125rem.", "error")
+        return redirect(url_for("settings.manage_tags"))
+
+    custom_css = request.form.get("custom_css", "")

@@ -46,0 +85,4 @@
+    settings_db.set_setting(db, user_id=user_id, key="theme", value=theme)
+    settings_db.set_setting(db, user_id=user_id, key="font_family", value=font_family)
+    settings_db.set_setting(db, user_id=user_id, key="font_size", value=font_size)
+    settings_db.set_setting(db, user_id=user_id, key="custom_css", value=custom_css)

@@ -13,0 +46,4 @@
+def _inject_display_settings() -> dict[str, str | None]:
+    """Expose the current user's display settings to all templates."""
+    db = get_db()
+    user_id = 1  # Default user for now (Phase 6 will add multi-user, see issue #25)

@@ -13,0 +39,4 @@
+        return secret_file.read_text(encoding="utf-8")
+
+    secret_file.parent.mkdir(parents=True, exist_ok=True)
+    secret_file.write_text(secrets.token_hex(32), encoding="utf-8")

@@ -43,6 +55,52 @@ def manage_tags() -> str:
     )
 
 
+@bp.route("/display", methods=["POST"])

@@ -46,0 +64,4 @@
+
+    """
+    db = get_db()
+    user_id = 1  # Default user for now (Phase 6 will add multi-user, see issue #25)

@@ -46,0 +84,4 @@
+    custom_css = request.form.get("custom_css", "")
+    # Neutralise </style> sequences so the stored CSS can never close its
+    # <style> element and inject markup (CSS backslash escape for '<').
+    custom_css = _STYLE_BREAKOUT_PATTERN.sub(lambda _match: "\\3C/style", custom_css)

@@ -0,0 +28,4 @@
+    conn.commit()
+
+
+def save_settings(conn: sqlite3.Connection, user_id: int, values: dict[str, str]) -> None:

@@ -13,0 +47,4 @@
+def _inject_display_settings() -> dict[str, str | None]:
+    """Expose the current user's display settings to all templates."""
+    db = get_db()
+    user_id = 1  # Default user for now (Phase 6 will add multi-user, see issue #25)

@@ -13,0 +39,4 @@
+        return secret_file.read_text(encoding="utf-8")
+
+    secret_file.parent.mkdir(parents=True, exist_ok=True)
+    secret_file.write_text(secrets.token_hex(32), encoding="utf-8")

@@ -147,1 +148,3 @@
-        assert row["featured_image"] == sample_media[0].url
+        # Articles order newest-first (issue #19), so the featured image
+        # comes from the newest article's media.
+        assert row["featured_image"] == sample_media[2].url

@@ -0,0 +98,4 @@
+    )
+    rows = cursor.fetchall()
+
+    return {row[0]: row[1] for row in rows}

@@ -13,1 +20,4 @@
 
+_VALID_THEMES = frozenset({"system", "light", "dark"})
+_VALID_FONT_FAMILIES = frozenset({"", "atkinson"})
+_FONT_SIZE_PATTERN = re.compile(r"^\d+(\.\d+)?(px|rem|%)$")

@@ -46,0 +71,4 @@
+        flash("Invalid theme selection.", "error")
+        return redirect(url_for("settings.manage_tags"))
+
+    font_family = request.form.get("font_family", "")

@@ -429,0 +521,4 @@
+        """Test that a failure mid-write leaves no partial update behind."""
+        first = users.create_user(db_conn, "dave")
+
+        with pytest.raises(sqlite3.ProgrammingError):

@@ -43,6 +55,57 @@ def manage_tags() -> str:
     )
 
 
+@bp.route("/display", methods=["POST"])

@@ -46,0 +67,4 @@
+    user_id = 1  # Default user for now (Phase 6 will add multi-user, see issue #25)
+
+    db = get_db()
+    user_id = 1  # Default user for now (Phase 6 will add multi-user, see issue #25)

@@ -46,0 +98,4 @@
+        custom_css = request.form["custom_css"]
+        # Neutralise </style> sequences so the stored CSS can never close its
+        # <style> element and inject markup (CSS backslash escape for '<').
+        values["custom_css"] = _STYLE_BREAKOUT_PATTERN.sub(lambda _match: "\\3C/style", custom_css)

@@ -46,0 +64,4 @@
+
+    """
+    db = get_db()
+    user_id = 1  # Default user for now (Phase 6 will add multi-user, see issue #25)

@@ -46,0 +95,4 @@
+        values["font_size"] = font_size
+
+    if "custom_css" in request.form:
+        custom_css = request.form["custom_css"]