Offer codes to unlinked Discord accounts and reserve the skin id "new"

A Discord sign-in without a Minecraft link had no code form, so the old
/skins and /drinks links left those players stuck. Profile now shows
"Enter code" for them.

A staff skin named "New" would get the id "new" and be hidden behind
/profile/skins/new; no such skin exists on either site, and the id is now
reserved.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: ryanbarlow97

backend/src/skins/naming.py

@@ -18,6 +18,8 @@
         "undefined",
         "admin",
         "tfmc",
+        # Profile's editor is /profile/skins/new, so no skin can be called that.
+        "new",
     }
 )
 

backend/src/skins/test_naming.py

@@ -0,0 +1,16 @@
+"""Skin ids that would clash with the site's own addresses."""
+
+import pytest
+
+from src.skins.naming import SlugError, build_staff_submission_id, build_submission_id
+
+
+def test_a_staff_skin_cannot_take_the_editor_address():
+    with pytest.raises(SlugError):
+        build_staff_submission_id("New")
+    assert build_staff_submission_id("New", "dev") == "dev_new"
+    assert build_staff_submission_id("New Moon") == "new_moon"
+
+
+def test_player_skins_called_new_keep_their_name_prefix():
+    assert build_submission_id("Steve", "New") == "steve_new"

frontend/app/components/profile/ProfilePanel.test.tsx

@@ -908,3 +908,21 @@ it("opens the code form for old skin and drink links", async () => {
   expect(form.hidden).toBe(false);
   expect(form.textContent).toContain("/token create profile, skin or drink");
 });
+
+it("lets a Discord account without a Minecraft link open a wardrobe with a code", async () => {
+  vi.mocked(getAccount).mockResolvedValue(account());
+  vi.mocked(signInWithCode).mockImplementation(async () => {
+    setSkinsSession(SKIN_CODE);
+    return { tab: "skins", profile: null };
+  });
+  vi.mocked(getCodeWardrobe).mockResolvedValue({ items: [SKIN], can_start: READY });
+  render(<ProfilePanel tab="skins" />);
+  const toggle = await screen.findByRole("button", { name: "Enter code" });
+  // Old /skins links land here with the form open.
+  expect(toggle.getAttribute("aria-expanded")).toBe("true");
+  fireEvent.change(screen.getByLabelText("Log in with code"), { target: { value: "SKIN-CODE" } });
+  fireEvent.click(screen.getByRole("button", { name: "Enter" }));
+  expect(await screen.findByRole("link", { name: /Emberfang/ })).toBeTruthy();
+  expect(screen.getAllByRole("tab").map((tab) => tab.textContent)).toEqual(["Skins", "Linked accounts"]);
+  expect(screen.queryByRole("button", { name: "Enter code" })).toBeNull();
+});

frontend/app/components/profile/ProfilePanel.tsx

@@ -390,6 +390,17 @@ export default function ProfilePanel({
 
   if (holding) return <ProfilePlaceholder shape={shape} tab={initialTab} />;
 
+  const codeForm = (
+    <>
+      <p className="text-sm text-[var(--tfmc-mist)]">
+        Run <code className="text-[var(--tfmc-accent)]">/token create profile</code>,{" "}
+        <code className="text-[var(--tfmc-accent)]">skin</code> or{" "}
+        <code className="text-[var(--tfmc-accent)]">drink</code> in game, then enter the code.
+      </p>
+      <ProfileRedeemForm onRedeemed={onRedeemed} />
+    </>
+  );
+
   if (!account && !session && !codeTabs.length) {
     // Without Discord sign-in the code is the only way in, so it shows open.
     const codeOpen = showCode || load.kind !== "signed_out";
@@ -429,12 +440,7 @@ export default function ProfilePanel({
           </>
         ) : null}
         <div id={codeId} hidden={!codeOpen} className="mt-8 max-w-md">
-          <p className="text-sm text-[var(--tfmc-mist)]">
-            Run <code className="text-[var(--tfmc-accent)]">/token create profile</code>,{" "}
-            <code className="text-[var(--tfmc-accent)]">skin</code> or{" "}
-            <code className="text-[var(--tfmc-accent)]">drink</code> in game, then enter the code.
-          </p>
-          <ProfileRedeemForm onRedeemed={onRedeemed} />
+          {codeForm}
         </div>
       </>
     );
@@ -511,6 +517,29 @@ export default function ProfilePanel({
         </p>
       ) : null}
 
+      {/* Signed in without a Minecraft link: a code still opens Profile or a wardrobe. */}
+      {!contentTabs && !codeTabs.length ? (
+        <>
+          <p className="mt-3 flex flex-wrap items-center justify-between gap-3 text-sm text-[var(--tfmc-mist)]">
+            <span>
+              Have a <code className="text-[var(--tfmc-accent)]">/token create</code> code?
+            </span>
+            <button
+              type="button"
+              onClick={() => setShowCode((open) => !open)}
+              aria-expanded={showCode}
+              aria-controls={codeId}
+              className={quietButtonClass}
+            >
+              Enter code
+            </button>
+          </p>
+          <div id={codeId} hidden={!showCode} className="mt-4 max-w-md">
+            {codeForm}
+          </div>
+        </>
+      ) : null}
+
       {actionError || notice ? (
         <p className="mt-6 text-sm text-[#e8a0a0]" role="alert">
           {actionError || notice}