feat: add user icon library and in-game selection

app/gateway-api/test/accountIconDailyCas.integration.test.ts

@@ -154,4 +154,48 @@ integration('account icon daily PostgreSQL CAS', () => {
             sanctions: { warningCount: 1 },
         });
     });
+
+    it('serializes the five-slot library and preserves retired rows', async () => {
+        const users = createPostgresUserRepository(db);
+        const start = new Date('2026-08-03T00:00:00.000Z');
+        await db.userIcon.deleteMany({ where: { userId } });
+        await db.appUser.update({
+            where: { id: userId },
+            data: { picture: 'default.jpg', imageServer: 0, iconUpdatedAt: null, iconRetiredAt: null },
+        });
+
+        for (let index = 0; index < 5; index += 1) {
+            const now = new Date(start.getTime() + index * 86_400_000);
+            await expect(
+                users.addIconForWindow(
+                    userId,
+                    `postgres-library-${index}.png`,
+                    1,
+                    now,
+                    new Date(now.getTime() - 86_400_000),
+                    5
+                )
+            ).resolves.toMatchObject({ ok: true });
+        }
+        await expect(
+            users.addIconForWindow(
+                userId,
+                'postgres-library-sixth.png',
+                1,
+                new Date(start.getTime() + 5 * 86_400_000),
+                new Date(start.getTime() + 4 * 86_400_000),
+                5
+            )
+        ).resolves.toEqual({ ok: false, reason: 'LIMIT' });
+
+        const icons = await users.listIcons(userId);
+        const retiredAt = new Date(start.getTime() + 6 * 86_400_000);
+        await expect(
+            users.retireIconForWindow(userId, icons[0]!.id, retiredAt, new Date(retiredAt.getTime() - 7 * 86_400_000))
+        ).resolves.toMatchObject({ ok: true });
+        await expect(users.listIcons(userId)).resolves.toHaveLength(4);
+        await expect(users.listIcons(userId, true)).resolves.toContainEqual(
+            expect.objectContaining({ picture: 'postgres-library-0.png', retiredAt: retiredAt.toISOString() })
+        );
+    });
 });

app/gateway-api/test/authFlow.test.ts

@@ -781,7 +781,7 @@ describe('account self service', () => {
         expect(flushPublisher.publishUserFlush).toHaveBeenCalledWith(user.id, 'account-icon-deleted');
     });
 
-    it('uses the Asia/Seoul day boundary and preserves Ref delete-to-upload behavior', async () => {
+    it('uses a rolling 24-hour upload window and preserves delete-to-upload behavior', async () => {
         const iconDir = await fs.mkdtemp(path.join(os.tmpdir(), 'sammo-account-icon-kst-'));
         const png = await sharp({
             create: {
@@ -809,11 +809,17 @@ describe('account self service', () => {
             });
 
             vi.setSystemTime(new Date('2026-07-31T15:00:00.000Z'));
-            const deleted = await caller.account.deleteIcon({ sessionToken: session.sessionToken });
-            expect(deleted.revision).toBe('2026-07-31T15:00:00.000Z');
+            await expect(caller.account.deleteIcon({ sessionToken: session.sessionToken })).rejects.toMatchObject({
+                code: 'TOO_MANY_REQUESTS',
+            });
+
+            vi.setSystemTime(new Date('2026-08-01T00:00:00.000Z'));
+            const nextSession = await sessions.createSession(user);
+            const deleted = await caller.account.deleteIcon({ sessionToken: nextSession.sessionToken });
+            expect(deleted.revision).toBe('2026-08-01T00:00:00.000Z');
 
             const changed = await caller.account.changeIcon({
-                sessionToken: session.sessionToken,
+                sessionToken: nextSession.sessionToken,
                 imageData: `data:image/png;base64,${png.toString('base64')}`,
             });
             expect(new Date(changed.revision).getTime()).toBeGreaterThan(new Date(deleted.revision).getTime());

app/gateway-api/test/userIconLibrary.test.ts

@@ -0,0 +1,102 @@
+import { describe, expect, it } from 'vitest';
+
+import { createInMemoryUserRepository } from '../src/auth/inMemoryUserRepository.js';
+
+const DAY_MS = 24 * 60 * 60 * 1000;
+
+describe('user icon library', () => {
+    it('keeps five immutable active icons and enforces the rolling upload window', async () => {
+        const users = createInMemoryUserRepository();
+        const user = await users.createUser({ username: 'five-icons', password: 'password' });
+        const start = new Date('2026-08-01T00:00:00.000Z');
+
+        for (let index = 0; index < 5; index += 1) {
+            const now = new Date(start.getTime() + index * DAY_MS);
+            const stored = await users.addIconForWindow(
+                user.id,
+                `immutable-${index}.png`,
+                1,
+                now,
+                new Date(now.getTime() - DAY_MS),
+                5
+            );
+            expect(stored.ok).toBe(true);
+            if (index === 0) {
+                const blocked = await users.addIconForWindow(
+                    user.id,
+                    'too-soon.png',
+                    1,
+                    new Date(now.getTime() + DAY_MS - 1),
+                    new Date(now.getTime() - 1),
+                    5
+                );
+                expect(blocked).toEqual({ ok: false, reason: 'COOLDOWN' });
+            }
+        }
+
+        const icons = await users.listIcons(user.id);
+        expect(icons.map((icon) => icon.picture)).toEqual([
+            'immutable-0.png',
+            'immutable-1.png',
+            'immutable-2.png',
+            'immutable-3.png',
+            'immutable-4.png',
+        ]);
+        const overLimit = await users.addIconForWindow(
+            user.id,
+            'sixth.png',
+            1,
+            new Date(start.getTime() + 5 * DAY_MS),
+            new Date(start.getTime() + 4 * DAY_MS),
+            5
+        );
+        expect(overLimit).toEqual({ ok: false, reason: 'LIMIT' });
+    });
+
+    it('retires without deleting the durable record and allows retirement only every seven days', async () => {
+        const users = createInMemoryUserRepository();
+        const user = await users.createUser({ username: 'retire-icons', password: 'password' });
+        const firstAt = new Date('2026-08-01T00:00:00.000Z');
+        const first = await users.addIconForWindow(
+            user.id,
+            'hall-of-fame.png',
+            1,
+            firstAt,
+            new Date(firstAt.getTime() - DAY_MS),
+            5
+        );
+        expect(first.ok).toBe(true);
+        if (!first.ok) return;
+        const secondAt = new Date(firstAt.getTime() + DAY_MS);
+        const second = await users.addIconForWindow(
+            user.id,
+            'next.png',
+            1,
+            secondAt,
+            new Date(secondAt.getTime() - DAY_MS),
+            5
+        );
+        expect(second.ok).toBe(true);
+        if (!second.ok) return;
+
+        const retired = await users.retireIconForWindow(
+            user.id,
+            first.icon.id,
+            secondAt,
+            new Date(secondAt.getTime() - 7 * DAY_MS)
+        );
+        expect(retired.ok).toBe(true);
+        expect(await users.listIcons(user.id)).toHaveLength(1);
+        expect(await users.listIcons(user.id, true)).toContainEqual(
+            expect.objectContaining({ picture: 'hall-of-fame.png', retiredAt: secondAt.toISOString() })
+        );
+
+        const blocked = await users.retireIconForWindow(
+            user.id,
+            second.icon.id,
+            new Date(secondAt.getTime() + 7 * DAY_MS - 1),
+            new Date(secondAt.getTime() - 1)
+        );
+        expect(blocked).toEqual({ ok: false, reason: 'COOLDOWN' });
+    });
+});