Cars: arrange the garage, and choose what a car's page shows

Three things you can now set up rather than live with.

The garage takes a drag: cards reorder as you drag across them and the
arrangement saves on drop — or on dragend, since a card released in the
gap between cards never produces a drop and would otherwise revert on
the next load. It is a per-user list of car ids on the profile, so it
covers cars shared with you and never reorders anybody else's garage;
the API returns /api/cars in that order, so a client only sends the new
one back. Pointer-only: touch browsers don't fire the native drag
events, and this is not worth a dependency.

A car's page is now configurable from the gear in its header: which tabs
it shows, and which of the 14 Information rows. Both belong to the car,
so everyone it is shared with sees the same page — Fuel off on an EV
stays off for all of them — and setting them needs write access. Stored
as the hidden sets, so anything added in a later release is on by
default. PUT /api/cars/{id}/view is its own endpoint precisely so an
ordinary save of the car form, which sends every other field, can never
reveal something that was deliberately switched off. Information itself
can't be hidden: a page with no tabs left would be a dead end.

The connected-service cards fold away, remembered per device, so a
provider that reports eight sections can be trimmed to the two worth
watching. A failed section keeps a short badge in its collapsed header
and puts the provider's own message — a few hundred characters of JSON,
which used to stretch the page sideways — inside the body with
everything else.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

API Server/internal/api/carorder_test.go

@@ -0,0 +1,92 @@
+package api
+
+import (
+	"testing"
+
+	"drivervault/apiserver/internal/models"
+)
+
+// The garage arrangement is a per-user list of car ids, so it has to cope with
+// lists that no longer line up with the cars the user actually has: a car sold
+// since the last drag leaves a stale id, a car added or shared since leaves an
+// id missing. These cover both directions plus the input cleaning.
+
+func ids(cars []models.Car) []string {
+	out := make([]string, len(cars))
+	for i, c := range cars {
+		out[i] = c.ID
+	}
+	return out
+}
+
+func carsWithIDs(list ...string) []models.Car {
+	out := make([]models.Car, len(list))
+	for i, id := range list {
+		out[i] = models.Car{ID: id}
+	}
+	return out
+}
+
+func TestApplyCarOrder(t *testing.T) {
+	for _, tc := range []struct {
+		name  string
+		cars  []string
+		order []string
+		want  []string
+	}{
+		{"arranged", []string{"a", "b", "c"}, []string{"c", "a", "b"}, []string{"c", "a", "b"}},
+		{"no arrangement keeps default order", []string{"a", "b", "c"}, nil, []string{"a", "b", "c"}},
+		{
+			// A car added or shared since the last drag isn't in the list; it
+			// belongs at the end rather than jumping into the middle.
+			"unarranged cars go last in their existing order",
+			[]string{"a", "b", "new1", "new2"}, []string{"b", "a"},
+			[]string{"b", "a", "new1", "new2"},
+		},
+		{
+			// A car that was sold since the last drag just drops out.
+			"stale ids are ignored",
+			[]string{"a", "b"}, []string{"gone", "b", "a"},
+			[]string{"b", "a"},
+		},
+		{"single car is untouched", []string{"a"}, []string{"b", "a"}, []string{"a"}},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			cars := carsWithIDs(tc.cars...)
+			applyCarOrder(cars, tc.order)
+			got := ids(cars)
+			if len(got) != len(tc.want) {
+				t.Fatalf("order = %v, want %v", got, tc.want)
+			}
+			for i := range got {
+				if got[i] != tc.want[i] {
+					t.Fatalf("order = %v, want %v", got, tc.want)
+				}
+			}
+		})
+	}
+}
+
+func TestNormalizeCarOrder(t *testing.T) {
+	got, err := normalizeCarOrder([]string{" a ", "", "b", "a", "   ", "c"})
+	if err != nil {
+		t.Fatalf("normalizeCarOrder: %v", err)
+	}
+	want := []string{"a", "b", "c"} // trimmed, blanks dropped, first "a" wins
+	if len(got) != len(want) {
+		t.Fatalf("normalized = %v, want %v", got, want)
+	}
+	for i := range got {
+		if got[i] != want[i] {
+			t.Fatalf("normalized = %v, want %v", got, want)
+		}
+	}
+
+	tooLong := make([]string, maxCarOrder+1)
+	for i := range tooLong {
+		tooLong[i] = "c"
+	}
+	if _, err := normalizeCarOrder(tooLong); err == nil {
+		t.Error("normalizeCarOrder accepted a list over the cap, want an error")
+	}
+}

API Server/internal/api/cars.go

@@ -6,6 +6,8 @@ import (
 	"fmt"
 	"net/http"
 	"net/url"
+	"sort"
+	"strings"
 
 	"drivervault/apiserver/internal/models"
 )
@@ -136,9 +138,41 @@ func (s *Server) listCars(w http.ResponseWriter, r *http.Request) {
 		out = append(out, m)
 	}
 
+	// Hand the garage back in the order the user arranged it. Best effort: if the
+	// profile can't be read, the default order (owned by name, then shared) still
+	// renders a usable garage.
+	if rec, err := s.fetchUser(r, me); err == nil {
+		applyCarOrder(out, rec.carOrder())
+	}
+
 	writeJSON(w, http.StatusOK, out)
 }
 
+// applyCarOrder sorts cars into the user's arranged order, in place. Cars the
+// arrangement doesn't mention — a car added or shared since the last drag — keep
+// their relative order and follow the arranged ones, so a new car shows up at
+// the end rather than jumping into the middle.
+func applyCarOrder(cars []models.Car, order []string) {
+	if len(order) == 0 || len(cars) < 2 {
+		return
+	}
+	rank := make(map[string]int, len(order))
+	for i, id := range order {
+		rank[id] = i
+	}
+	sort.SliceStable(cars, func(i, j int) bool {
+		ri, oki := rank[cars[i].ID]
+		rj, okj := rank[cars[j].ID]
+		if oki != okj {
+			return oki // an arranged car sorts before an unarranged one
+		}
+		if !oki {
+			return false // both unarranged: leave them as they are
+		}
+		return ri < rj
+	})
+}
+
 func (s *Server) getCar(w http.ResponseWriter, r *http.Request) {
 	level, rec, err := s.carAccessLevel(r.Context(), s.currentUserID(r), r.PathValue("id"))
 	if err != nil {
@@ -206,6 +240,103 @@ func (s *Server) updateCar(w http.ResponseWriter, r *http.Request) {
 	writeJSON(w, http.StatusOK, m)
 }
 
+// hideableCarTabs are the car-detail tabs that can be switched off. "info" is
+// deliberately absent: it is the car itself, and a page with no tabs left would
+// be a dead end.
+var hideableCarTabs = map[string]bool{
+	"provider": true, "services": true, "technical": true, "maintenance": true,
+	"fuel": true, "documents": true, "parts": true, "reminders": true,
+}
+
+// hideableCarFields are the Information rows that can be switched off — every
+// one of them, since unlike the tabs there is no row the page needs to keep.
+// Mirrors the car.info.* labels the web app renders.
+var hideableCarFields = map[string]bool{
+	"oilSpec": true, "transmissionOil": true, "differentialOil": true,
+	"brakeFluid": true, "coolant": true, "odometer": true, "serviceInterval": true,
+	"nextDue": true, "registrationPlate": true, "registrationCountry": true,
+	"vin": true, "fuelType": true, "buildDate": true, "firstRegistration": true,
+}
+
+// normalizeHidden validates a switched-off set against the keys that exist.
+// Unknown keys are rejected rather than ignored: they can only come from a stale
+// or wrong client, and dropping them silently would hide the mistake while the
+// tab or field stayed visible.
+func normalizeHidden(in []string, allowed map[string]bool, what string) ([]string, error) {
+	out := make([]string, 0, len(in))
+	seen := make(map[string]bool, len(in))
+	for _, key := range in {
+		key = strings.TrimSpace(key)
+		if key == "" || seen[key] {
+			continue
+		}
+		if !allowed[key] {
+			return nil, fmt.Errorf("%q is not a car %s that can be hidden", key, what)
+		}
+		seen[key] = true
+		out = append(out, key)
+	}
+	return out, nil
+}
+
+// PUT /api/cars/{id}/view — choose what this car's page shows: which tabs, and
+// which rows of the Information tab. Body: {hiddenTabs?: [...], hiddenFields?:
+// [...]}; only the sets present are written, so a client can update one without
+// knowing the other. Its own endpoint rather than fields on the car edit, so an
+// ordinary save of the car form — which sends every other field — can never
+// reveal something somebody deliberately switched off. Needs write access: the
+// choice belongs to the car, so it is the same permission as editing it.
+func (s *Server) updateCarView(w http.ResponseWriter, r *http.Request) {
+	var in struct {
+		HiddenTabs   *[]string `json:"hiddenTabs"`
+		HiddenFields *[]string `json:"hiddenFields"`
+	}
+	if err := decodeJSON(r, &in); err != nil {
+		writeError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+	level, _, err := s.carAccessLevel(r.Context(), s.currentUserID(r), r.PathValue("id"))
+	if err != nil {
+		writePBError(w, err)
+		return
+	}
+	if !canWrite(level) {
+		writeError(w, http.StatusForbidden, "you cannot edit this car")
+		return
+	}
+
+	payload := map[string]any{}
+	if in.HiddenTabs != nil {
+		tabs, err := normalizeHidden(*in.HiddenTabs, hideableCarTabs, "tab")
+		if err != nil {
+			writeError(w, http.StatusBadRequest, err.Error())
+			return
+		}
+		payload["hidden_tabs"] = tabs
+	}
+	if in.HiddenFields != nil {
+		fields, err := normalizeHidden(*in.HiddenFields, hideableCarFields, "field")
+		if err != nil {
+			writeError(w, http.StatusBadRequest, err.Error())
+			return
+		}
+		payload["hidden_fields"] = fields
+	}
+	if len(payload) == 0 {
+		writeError(w, http.StatusBadRequest, "no changes provided")
+		return
+	}
+
+	var rec carRecord
+	if err := s.pb.Update(r.Context(), colCars, r.PathValue("id"), payload, &rec); err != nil {
+		writePBError(w, err)
+		return
+	}
+	m := rec.toModel()
+	m.Access = level
+	writeJSON(w, http.StatusOK, m)
+}
+
 func (s *Server) deleteCar(w http.ResponseWriter, r *http.Request) {
 	level, _, err := s.carAccessLevel(r.Context(), s.currentUserID(r), r.PathValue("id"))
 	if err != nil {

API Server/internal/api/cartabs_test.go

@@ -0,0 +1,86 @@
+package api
+
+import "testing"
+
+// What a car's page shows — which tabs, and which rows of the Information tab —
+// is stored on the car as the hidden sets, so the validation has to keep those
+// sets to keys the page actually renders. Information itself stays out of the
+// hideable tabs: a car with no tabs left would be a dead end.
+
+func TestNormalizeHiddenTabs(t *testing.T) {
+	got, err := normalizeHidden([]string{" fuel ", "parts", "fuel", ""}, hideableCarTabs, "tab")
+	if err != nil {
+		t.Fatalf("normalizeHidden: %v", err)
+	}
+	want := []string{"fuel", "parts"} // trimmed, blanks dropped, deduped
+	assertKeys(t, got, want)
+
+	// Clearing the list is how a car goes back to showing everything.
+	if empty, err := normalizeHidden(nil, hideableCarTabs, "tab"); err != nil || len(empty) != 0 {
+		t.Errorf("normalizeHidden(nil) = %v, %v; want empty and no error", empty, err)
+	}
+
+	// Information is the car itself; hiding it would leave a page with no tabs.
+	if _, err := normalizeHidden([]string{"info"}, hideableCarTabs, "tab"); err == nil {
+		t.Error("normalizeHidden allowed hiding the info tab, want an error")
+	}
+	// A key from a stale or wrong client is an error, not something to drop
+	// quietly while the tab stays visible.
+	if _, err := normalizeHidden([]string{"fuel", "nonsense"}, hideableCarTabs, "tab"); err == nil {
+		t.Error("normalizeHidden accepted an unknown tab, want an error")
+	}
+
+	// The hideable set is the contract the web app's HIDEABLE_TABS mirrors:
+	// every tab the car page renders beside Information.
+	for _, key := range []string{"provider", "services", "technical", "maintenance", "fuel", "documents", "parts", "reminders"} {
+		if !hideableCarTabs[key] {
+			t.Errorf("tab %q should be hideable", key)
+		}
+	}
+	if len(hideableCarTabs) != 8 {
+		t.Errorf("hideableCarTabs has %d entries, want the 8 tabs beside Information", len(hideableCarTabs))
+	}
+}
+
+func TestNormalizeHiddenFields(t *testing.T) {
+	got, err := normalizeHidden([]string{"vin", " differentialOil ", "vin"}, hideableCarFields, "field")
+	if err != nil {
+		t.Fatalf("normalizeHidden: %v", err)
+	}
+	assertKeys(t, got, []string{"vin", "differentialOil"})
+
+	if _, err := normalizeHidden([]string{"oilSpec", "nonsense"}, hideableCarFields, "field"); err == nil {
+		t.Error("normalizeHidden accepted an unknown field, want an error")
+	}
+	// A tab key is not a field key — the two sets are validated separately.
+	if _, err := normalizeHidden([]string{"fuel"}, hideableCarFields, "field"); err == nil {
+		t.Error("normalizeHidden accepted a tab key as a field, want an error")
+	}
+
+	// Every Information row the web app renders must be hideable; unlike the
+	// tabs there is no row the page has to keep.
+	for _, key := range []string{
+		"oilSpec", "transmissionOil", "differentialOil", "brakeFluid", "coolant",
+		"odometer", "serviceInterval", "nextDue", "registrationPlate",
+		"registrationCountry", "vin", "fuelType", "buildDate", "firstRegistration",
+	} {
+		if !hideableCarFields[key] {
+			t.Errorf("field %q should be hideable", key)
+		}
+	}
+	if len(hideableCarFields) != 14 {
+		t.Errorf("hideableCarFields has %d entries, want the 14 Information rows", len(hideableCarFields))
+	}
+}
+
+func assertKeys(t *testing.T, got, want []string) {
+	t.Helper()
+	if len(got) != len(want) {
+		t.Fatalf("keys = %v, want %v", got, want)
+	}
+	for i := range got {
+		if got[i] != want[i] {
+			t.Fatalf("keys = %v, want %v", got, want)
+		}
+	}
+}

API Server/internal/api/me.go

@@ -35,6 +35,28 @@ type userRecord struct {
 	Role                string `json:"role"`
 	Organization        string `json:"organization"`
 	Created             string `json:"created"`
+
+	// Garage arrangement. Raw because PocketBase hands back whatever a json field
+	// holds — null on a record that has never been arranged, and "" on one
+	// PocketBase stored as an empty value — neither of which is a []string.
+	CarOrder json.RawMessage `json:"car_order"`
+}
+
+// carOrder decodes the stored garage arrangement, treating anything unexpected
+// as "not arranged yet" rather than failing the whole profile read.
+func (rec userRecord) carOrder() []string { return decodeStringList(rec.CarOrder) }
+
+// decodeStringList reads a PocketBase json field that holds a list of strings,
+// treating anything unexpected as empty rather than failing the whole read.
+func decodeStringList(raw json.RawMessage) []string {
+	if len(raw) == 0 {
+		return nil
+	}
+	var out []string
+	if err := json.Unmarshal(raw, &out); err != nil {
+		return nil
+	}
+	return out
 }
 
 func (rec userRecord) toModel() models.User {
@@ -54,6 +76,7 @@ func (rec userRecord) toModel() models.User {
 		Created:    rec.Created,
 
 		Organization: rec.Organization,
+		CarOrder:     rec.carOrder(),
 	}
 	if t := parsePBDate(rec.DeletionRequestedAt); !t.IsZero() {
 		u.DeletionRequestedAt = &t
@@ -102,13 +125,41 @@ func (s *Server) handleGetMe(w http.ResponseWriter, r *http.Request) {
 }
 
 type updateMeRequest struct {
-	Name       *string `json:"name"`
-	Bio        *string `json:"bio"`
-	Theme      *string `json:"theme"`
-	Locale     *string `json:"locale"`
-	DateFormat *string `json:"dateFormat"`
-	Currency   *string `json:"currency"`
-	FontSize   *string `json:"fontSize"`
+	Name       *string   `json:"name"`
+	Bio        *string   `json:"bio"`
+	Theme      *string   `json:"theme"`
+	Locale     *string   `json:"locale"`
+	DateFormat *string   `json:"dateFormat"`
+	Currency   *string   `json:"currency"`
+	FontSize   *string   `json:"fontSize"`
+	CarOrder   *[]string `json:"carOrder"`
+}
+
+// maxCarOrder bounds the stored arrangement. listCars fetches at most 200 owned
+// plus 200 shared cars, so this leaves room without letting a client park an
+// unbounded blob on the record.
+const maxCarOrder = 500
+
+// normalizeCarOrder cleans a client-supplied garage arrangement: blanks out,
+// duplicates dropped (first position wins), length capped. The ids are not
+// checked against real cars — that would cost a lookup per entry, and an id for
+// a car the user no longer has is harmless: listCars ignores what it can't
+// match, and the next drag rewrites the list anyway.
+func normalizeCarOrder(in []string) ([]string, error) {
+	if len(in) > maxCarOrder {
+		return nil, fmt.Errorf("carOrder is too long (max %d)", maxCarOrder)
+	}
+	out := make([]string, 0, len(in))
+	seen := make(map[string]bool, len(in))
+	for _, id := range in {
+		id = strings.TrimSpace(id)
+		if id == "" || seen[id] {
+			continue
+		}
+		seen[id] = true
+		out = append(out, id)
+	}
+	return out, nil
 }
 
 var validThemes = map[string]bool{"light": true, "dark": true, "system": true}
@@ -189,6 +240,14 @@ func (s *Server) handleUpdateMe(w http.ResponseWriter, r *http.Request) {
 		}
 		payload["font_size"] = *in.FontSize
 	}
+	if in.CarOrder != nil {
+		ids, err := normalizeCarOrder(*in.CarOrder)
+		if err != nil {
+			writeError(w, http.StatusBadRequest, err.Error())
+			return
+		}
+		payload["car_order"] = ids
+	}
 
 	var rec userRecord
 	if err := s.pb.Update(r.Context(), s.usersCollection(), claims.ID, payload, &rec); err != nil {

API Server/internal/api/records.go

@@ -1,6 +1,7 @@
 package api
 
 import (
+	"encoding/json"
 	"strings"
 	"time"
 
@@ -66,6 +67,12 @@ type carRecord struct {
 	Owner                      string `json:"owner"`
 	Created                    string `json:"created"`
 	Updated                    string `json:"updated"`
+
+	// Switched-off tabs and Information fields. Raw because PocketBase hands back
+	// whatever a json field holds — null on a car nobody has configured — which
+	// is not a []string.
+	HiddenTabs   json.RawMessage `json:"hidden_tabs"`
+	HiddenFields json.RawMessage `json:"hidden_fields"`
 }
 
 func (rec carRecord) toModel() models.Car {
@@ -92,6 +99,8 @@ func (rec carRecord) toModel() models.Car {
 		FirstRegistrationDate:      rec.FirstRegistrationDate,
 		Provider:                   rec.Provider,
 		ProviderVehicleID:          rec.ProviderVehicleID,
+		HiddenTabs:                 decodeStringList(rec.HiddenTabs),
+		HiddenFields:               decodeStringList(rec.HiddenFields),
 		Owner:                      rec.Owner,
 		Created:                    rec.Created,
 		Updated:                    rec.Updated,

API Server/internal/api/server.go

@@ -59,6 +59,7 @@
 //	# cars, service records, parts, shares
 //	GET    /api/cars                   POST   /api/cars
 //	GET    /api/cars/{id}              PATCH  /api/cars/{id}         DELETE /api/cars/{id}
+//	PUT    /api/cars/{id}/view
 //	GET    /api/cars/{id}/provider     POST   /api/cars/{id}/provider
 //	POST   /api/cars/{id}/provider/sync
 //	GET    /api/cars/{id}/service-records
@@ -352,6 +353,7 @@ func (s *Server) Handler() http.Handler {
 	mux.HandleFunc("POST /api/cars", s.createCar)
 	mux.HandleFunc("GET /api/cars/{id}", s.getCar)
 	mux.HandleFunc("PATCH /api/cars/{id}", s.updateCar)
+	mux.HandleFunc("PUT /api/cars/{id}/view", s.updateCarView)
 	mux.HandleFunc("DELETE /api/cars/{id}", s.deleteCar)
 	mux.HandleFunc("GET /api/cars/{id}/service-records", s.listCarServiceRecords)
 	mux.HandleFunc("GET /api/cars/{id}/technical-checks", s.listCarTechnicalChecks)