Document accounts, settings sync and their build variables

README.md

@@ -68,7 +68,7 @@ Packaged release builds check a dedicated Tauri feed at `update-feed/latest.json
 
 The `Release Switchify PC` workflow accepts existing `v<version>` tags, renders release-only updater configuration, and publishes signed Apple-silicon macOS and x64 Windows artifacts into one GitHub release. It updates the dedicated feed only after both platform packages pass verification. It does not alter the public C# `v0.10.0` release or its `latest.yml` feed.
 
-Before the workflow can run, configure `TAURI_UPDATER_PUBLIC_KEY`, `APPLE_SIGNING_IDENTITY`, and `CERTUM_CERT_THUMBPRINT` as repository variables; configure the Tauri updater private key/password and platform signing credentials as protected secrets. The Windows job targets the self-hosted signing runner with SimplySign available. Private signing material is never generated by or committed to this repository.
+Before the workflow can run, configure `TAURI_UPDATER_PUBLIC_KEY`, `APPLE_SIGNING_IDENTITY`, `CERTUM_CERT_THUMBPRINT`, `SWITCHIFY_SUPABASE_URL`, and `SWITCHIFY_SUPABASE_PUBLISHABLE_KEY` as repository variables; configure the Tauri updater private key/password and platform signing credentials as protected secrets. The Windows job targets the self-hosted signing runner with SimplySign available. Private signing material is never generated by or committed to this repository.
 
 ## Diagnostics
 
@@ -80,6 +80,32 @@ Protocol v1 clients may attach an optional `deviceName` to an authenticated `con
 
 Anonymous diagnostic telemetry is disabled until the user explicitly opts in. Opt-in creates an opaque installation UUID and permits best-effort health reports plus sanitized error reports; retryable error reports are bounded to 20, and opting out deletes the identifier and queue immediately. Builds expose telemetry only when `SWITCHIFY_TELEMETRY_ENDPOINT` is an HTTPS endpoint and `TIMBERLOGS_API_KEY` is supplied from release configuration. Neither value is committed to the repository. See the [privacy policy](https://switchifyapp.com/privacy).
 
+## Accounts and settings sync
+
+Signing in on the Account page (the account entry at the bottom of the sidebar) brings a user's settings to their other computers. It uses the same Supabase accounts as Switchify on Android: the user enters their email and the 6-digit code it receives; there is no password. The schema, migrations, and database tests live in the private `switchifyapp/switchify-supabase` repository.
+
+- **What syncs:** pointer, repeat, dwell and cursor settings; custom switch profiles; switch bindings including their keys; point scan and scan preferences; keyboard layout; and remote switch slots. The document is versioned and parsed strictly; a copy written by a newer Switchify PC is never overwritten, and this install asks to be updated instead.
+- **What never syncs:** the BLE desktop ID, paired devices and pairing tokens, telemetry consent and install ID, setup progress, and start with system.
+- **How:** changes upload a few seconds after they settle, other computers' changes are checked every five minutes and on Sync now, and every write is conditional on the server-owned revision, so concurrent changes merge by section (profiles by ID) instead of overwriting each other; if both computers change the same section (or profile), the account's copy wins, though an edit is never lost to a deletion. The first sync on a computer whose settings differ from the account asks which to keep.
+- **Secrets:** requests are made from Rust, so the webview's content security policy stays closed. The refresh token is kept in the OS keychain (service `com.enaboapps.switchify.pc.account`); access tokens stay in memory. Tokens and codes are never logged or sent to the webview. The merge base is kept in `settings-sync.json` in the application configuration folder and contains no secrets.
+
+Accounts are compiled in from two build-time variables, which release builds require:
+
+| Name | Value |
+| --- | --- |
+| `SWITCHIFY_SUPABASE_URL` | `https://<project-ref>.supabase.co` (must be HTTPS) |
+| `SWITCHIFY_SUPABASE_PUBLISHABLE_KEY` | The project's `sb_publishable_…` key |
+
+Both are public values (the Android app embeds them too) and are set as repository variables. Builds without them, including ordinary development builds, have no Account page and show the version in the sidebar instead. To try accounts locally, export both variables before `npm run tauri dev`; note that a dev build signs in against whichever project they name.
+
+Automated tests use fake transports and never touch the network or the keychain. Two ignored tests run end to end against a local stack from `switchify-supabase` (`supabase start`). The account test reads its sign-in code from the stack's Mailpit inbox (`SWITCHIFY_LOCAL_MAILPIT_URL`, default `http://127.0.0.1:54324`); the sync test signs up test users with a password:
+
+```bash
+SWITCHIFY_LOCAL_SUPABASE_URL=http://127.0.0.1:54321 \
+SWITCHIFY_LOCAL_SUPABASE_KEY=<local publishable key> \
+cargo test --manifest-path src-tauri/Cargo.toml local_stack -- --ignored
+```
+
 ## Windows UIAccess package
 
 Windows grants UIAccess only to a trusted, signed executable installed in a secure location. Sign in to SimplySign Desktop, expose the Certum code-signing certificate, and set its thumbprint before packaging:

docs/macos-releases.md

@@ -36,6 +36,8 @@ Configure these environment variables:
 | `APPLE_SIGNING_IDENTITY` | Full `Developer ID Application: … (TEAMID)` identity |
 | `APPLE_TEAM_ID` | Apple Developer team ID from the identity |
 | `TIMBERLOGS_ENDPOINT` | Production HTTPS telemetry endpoint |
+| `SWITCHIFY_SUPABASE_URL` | Supabase project URL for accounts and settings sync (HTTPS) |
+| `SWITCHIFY_SUPABASE_PUBLISHABLE_KEY` | Supabase publishable key (public, `sb_publishable_…`) |
 
 Configure `TAURI_UPDATER_PUBLIC_KEY` as a repository variable. Keep an encrypted offline backup of the updater private key and password: installed applications cannot accept future updates if that key is lost.