feat(import-export): export/import non-sensitive preferences

src/app/components/settings/settings.component.spec.ts

@@ -2,6 +2,7 @@ import { TestBed } from '@angular/core/testing';
 import { environment } from '../../../environments/environment';
 import { ImportExportService } from '../../services/import-export.service';
 import { TmdbCredential, TmdbSettingsService } from '../../services/tmdb-settings.service';
+import { ProviderSettingsService } from '../../services/provider-settings.service';
 import { SettingsComponent } from './settings.component';
 import { vi, afterEach, beforeEach } from 'vitest';
 
@@ -413,4 +414,61 @@ describe('SettingsComponent', () => {
     expect(fixture.nativeElement.textContent).toContain('— Built');
     expect(fixture.nativeElement.textContent).toContain('unknown');
   });
+
+  it('syncs provider signals after successful import', async () => {
+    const providerMock = {
+      isEnabled: vi.fn().mockReturnValue(false),
+      isAdultIncluded: vi.fn().mockReturnValue(false),
+      getAdultDisplayMode: vi.fn().mockReturnValue('blur' as const),
+      getTitlePreference: vi.fn().mockReturnValue(['romaji', 'english', 'native'] as const),
+    };
+    TestBed.configureTestingModule({
+      providers: [
+        {
+          provide: ImportExportService,
+          useValue: {
+            exportData: vi.fn(),
+            getRecoveryBackups: vi.fn().mockResolvedValue([]),
+            exportRecoveryBackup: vi.fn().mockResolvedValue(undefined),
+            importData: vi.fn().mockResolvedValue(undefined),
+          },
+        },
+        {
+          provide: TmdbSettingsService,
+          useValue: {
+            token: vi.fn(() => ''),
+            key: vi.fn(() => ''),
+            getCredential: vi.fn(() => null),
+            saveCredentials: vi.fn(),
+            clearCredentials: vi.fn(),
+          },
+        },
+        { provide: ProviderSettingsService, useValue: providerMock },
+      ],
+    });
+    const exportService = TestBed.inject(ImportExportService);
+    vi.spyOn(window, 'confirm').mockReturnValue(true);
+    const fixture = TestBed.createComponent(SettingsComponent);
+    expect(fixture.componentInstance.includeAdult()).toBe(false);
+
+    // Simulate import changing provider settings on disk
+    providerMock.isAdultIncluded.mockReturnValue(true);
+    providerMock.isEnabled.mockReturnValue(true);
+    providerMock.getAdultDisplayMode.mockReturnValue('hide' as const);
+    providerMock.getTitlePreference.mockReturnValue(['native', 'english', 'romaji'] as const);
+
+    const target = {
+      files: [
+        new File(['{"a":1}'], 'export.json', { type: 'application/json' }),
+      ] as unknown as FileList,
+      value: '',
+    };
+    await fixture.componentInstance.onFileSelected({ target } as unknown as Event);
+    expect(exportService.importData).toHaveBeenCalledOnce();
+    expect(fixture.componentInstance.includeAdult()).toBe(true);
+    expect(fixture.componentInstance.tmdbEnabled()).toBe(true);
+    expect(fixture.componentInstance.adultDisplayMode()).toBe('hide');
+    expect(fixture.componentInstance.titleOrder()).toEqual(['native', 'english', 'romaji']);
+    expect(fixture.componentInstance.successMessage()).toBe('Data imported successfully');
+  });
 });

src/app/components/settings/settings.component.ts

@@ -589,6 +589,7 @@ export class SettingsComponent implements OnInit {
 
     try {
       await this.importExportService.importData(file);
+      this.syncProviderSignals();
       this.successMessage.set('Data imported successfully');
       setTimeout(() => this.successMessage.set(null), 3000);
       input.value = '';
@@ -599,4 +600,13 @@ export class SettingsComponent implements OnInit {
       input.value = '';
     }
   }
+
+  private syncProviderSignals(): void {
+    this.tmdbEnabled.set(this.providerSettingsService.isEnabled('tmdb'));
+    this.jikanEnabled.set(this.providerSettingsService.isEnabled('jikan'));
+    this.anilistEnabled.set(this.providerSettingsService.isEnabled('anilist'));
+    this.includeAdult.set(this.providerSettingsService.isAdultIncluded());
+    this.adultDisplayMode.set(this.providerSettingsService.getAdultDisplayMode());
+    this.titleOrder.set(this.providerSettingsService.getTitlePreference());
+  }
 }

src/app/services/import-export.service.spec.ts

@@ -2,6 +2,7 @@ import { TestBed } from '@angular/core/testing';
 import { ImportExportService } from './import-export.service';
 import { StorageService } from './storage.service';
 import { ImageStorageService } from './image-storage.service';
+import { ProviderSettingsService } from './provider-settings.service';
 import { vi, afterEach } from 'vitest';
 
 describe('ImportExportService', () => {
@@ -16,6 +17,10 @@ describe('ImportExportService', () => {
     exportImages: ReturnType<typeof vi.fn>;
     parseExportedImages: ReturnType<typeof vi.fn>;
   };
+  let providerSettings: {
+    exportSettings: ReturnType<typeof vi.fn>;
+    importSettings: ReturnType<typeof vi.fn>;
+  };
 
   function readBlobText(blob: Blob): Promise<string> {
     return new Promise<string>((resolve) => {
@@ -38,11 +43,23 @@ describe('ImportExportService', () => {
         .mockResolvedValue([{ id: 'poster-1', type: 'image/png', data: 'base64-data' }]),
       parseExportedImages: vi.fn().mockResolvedValue([]),
     };
+    providerSettings = {
+      exportSettings: vi.fn().mockReturnValue({
+        tmdb: false,
+        jikan: true,
+        anilist: false,
+        includeAdult: true,
+        titlePreference: ['native', 'english', 'romaji'],
+        adultDisplayMode: 'hide',
+      }),
+      importSettings: vi.fn(),
+    };
 
     TestBed.configureTestingModule({
       providers: [
         { provide: StorageService, useValue: storageService },
         { provide: ImageStorageService, useValue: imageStorage },
+        { provide: ProviderSettingsService, useValue: providerSettings },
       ],
     });
     importExportService = TestBed.inject(ImportExportService);
@@ -74,7 +91,71 @@ describe('ImportExportService', () => {
       expect(JSON.parse(text)).toEqual({
         data: exportPayload,
         images: [{ id: 'poster-1', type: 'image/png', data: 'base64-data' }],
+        preferences: {
+          providerSettings: {
+            tmdb: false,
+            jikan: true,
+            anilist: false,
+            includeAdult: true,
+            titlePreference: ['native', 'english', 'romaji'],
+            adultDisplayMode: 'hide',
+          },
+        },
+      });
+    });
+
+    it('always includes non-sensitive preferences and never leaks tokens', async () => {
+      storageService.getData.mockReturnValue({ items: [] });
+      // Simulate tokens in localStorage – service must not read them
+      const store: Record<string, string> = {};
+      const mockStorage = {
+        getItem: (k: string) => store[k] ?? null,
+        setItem: (k: string, v: string) => {
+          store[k] = v;
+        },
+        removeItem: (k: string) => {
+          delete store[k];
+        },
+        clear: () => {
+          for (const k of Object.keys(store)) delete store[k];
+        },
+      } as unknown as Storage;
+      Object.defineProperty(window, 'localStorage', {
+        value: mockStorage,
+        writable: true,
+        configurable: true,
+      });
+      Object.defineProperty(globalThis, 'localStorage', {
+        value: mockStorage,
+        writable: true,
+        configurable: true,
+      });
+      window.localStorage.setItem('tmdbReadAccessToken', 'secret-token');
+      window.localStorage.setItem('tmdbApiKey', 'secret-key');
+      const { createObjectURL } = mockDownload();
+
+      await importExportService.exportData();
+
+      const blob = createObjectURL.mock.calls[0][0] as Blob;
+      const text = await readBlobText(blob);
+      expect(text).not.toContain('secret-token');
+      expect(text).not.toContain('secret-key');
+      expect(text).not.toContain('tmdbReadAccessToken');
+      expect(text).not.toContain('tmdbApiKey');
+      const parsed = JSON.parse(text) as {
+        preferences: { providerSettings: Record<string, unknown> };
+      };
+      expect(parsed.preferences.providerSettings).toEqual({
+        tmdb: false,
+        jikan: true,
+        anilist: false,
+        includeAdult: true,
+        titlePreference: ['native', 'english', 'romaji'],
+        adultDisplayMode: 'hide',
       });
+      expect(providerSettings.exportSettings).toHaveBeenCalledOnce();
+      window.localStorage.removeItem('tmdbReadAccessToken');
+      window.localStorage.removeItem('tmdbApiKey');
     });
   });
 
@@ -159,6 +240,114 @@ describe('ImportExportService', () => {
 
       await expect(importExportService.importData(file)).rejects.toThrow('Storage busy');
     });
+
+    it('imports old portable export without preferences', async () => {
+      const file = mockFile(JSON.stringify({ data: { items: [] }, images: [] }));
+      imageStorage.parseExportedImages.mockResolvedValue([]);
+      storageService.importDataWithImages.mockResolvedValue(undefined);
+
+      await importExportService.importData(file);
+
+      expect(providerSettings.importSettings).not.toHaveBeenCalled();
+      expect(storageService.importDataWithImages).toHaveBeenCalledWith({ items: [] }, []);
+    });
+
+    it('imports legacy raw data without preferences', async () => {
+      const raw = {
+        schemaVersion: 9,
+        lastModifiedAt: new Date().toISOString(),
+        groups: {},
+        items: {},
+      };
+      const file = mockFile(JSON.stringify(raw));
+      imageStorage.parseExportedImages.mockResolvedValue([]);
+      storageService.importDataWithImages.mockResolvedValue(undefined);
+
+      await importExportService.importData(file);
+
+      expect(providerSettings.importSettings).not.toHaveBeenCalled();
+      expect(storageService.importDataWithImages).toHaveBeenCalledWith(raw, []);
+    });
+
+    it('restores providerSettings when preferences are present', async () => {
+      const providerSettingsPayload = {
+        tmdb: false,
+        jikan: false,
+        anilist: true,
+        includeAdult: true,
+        titlePreference: ['native', 'english', 'romaji'],
+        adultDisplayMode: 'hide',
+      };
+      const payload = {
+        data: { items: [] },
+        images: [],
+        preferences: { providerSettings: providerSettingsPayload },
+      };
+      const file = mockFile(JSON.stringify(payload));
+      storageService.importDataWithImages.mockResolvedValue(undefined);
+      imageStorage.parseExportedImages.mockResolvedValue([]);
+
+      await importExportService.importData(file);
+
+      expect(providerSettings.importSettings).toHaveBeenCalledWith(providerSettingsPayload);
+      expect(storageService.importDataWithImages).toHaveBeenCalledWith({ items: [] }, []);
+    });
+
+    it('ignores invalid preferences without failing the import', async () => {
+      const payload = {
+        data: { items: [] },
+        images: [],
+        preferences: { providerSettings: { tmdb: 'bad', titlePreference: ['bad'] } },
+      };
+      const file = mockFile(JSON.stringify(payload));
+      providerSettings.importSettings.mockImplementation(() => {
+        throw new Error('invalid');
+      });
+      storageService.importDataWithImages.mockResolvedValue(undefined);
+      imageStorage.parseExportedImages.mockResolvedValue([]);
+
+      await expect(importExportService.importData(file)).resolves.toBeUndefined();
+      expect(storageService.importDataWithImages).toHaveBeenCalledWith({ items: [] }, []);
+      expect(providerSettings.importSettings).toHaveBeenCalled();
+    });
+
+    it('never imports sensitive tokens even if injected', async () => {
+      const payload = {
+        data: { items: [] },
+        images: [],
+        preferences: {
+          providerSettings: {
+            tmdb: true,
+            jikan: true,
+            anilist: true,
+            includeAdult: false,
+            titlePreference: ['romaji', 'english', 'native'],
+            adultDisplayMode: 'show',
+          },
+          tmdbReadAccessToken: 'evil-token',
+          tmdbApiKey: 'evil-key',
+        },
+      };
+      const file = mockFile(JSON.stringify(payload));
+      storageService.importDataWithImages.mockResolvedValue(undefined);
+      imageStorage.parseExportedImages.mockResolvedValue([]);
+
+      await importExportService.importData(file);
+
+      expect(providerSettings.importSettings).toHaveBeenCalledWith(
+        expect.objectContaining({
+          tmdb: true,
+          includeAdult: false,
+        }),
+      );
+      // importSettings should only receive providerSettings, never the injected token keys
+      const calledWith = providerSettings.importSettings.mock.calls[0][0] as Record<
+        string,
+        unknown
+      >;
+      expect(calledWith).not.toHaveProperty('tmdbReadAccessToken');
+      expect(calledWith).not.toHaveProperty('tmdbApiKey');
+    });
   });
 
   function mockDownload(): {