Ignore non-object prefs JSON (#1257)

routes/prefs_routes.py

@@ -12,7 +12,8 @@ def _load():
     """Load the raw prefs file (internal use only)."""
     try:
         with open(PREFS_FILE, "r", encoding="utf-8") as f:
-            return json.load(f)
+            data = json.load(f)
+            return data if isinstance(data, dict) else {}
     except (FileNotFoundError, json.JSONDecodeError):
         return {}
 

tests/test_prefs_routes.py

@@ -0,0 +1,20 @@
+import json
+
+import routes.prefs_routes as prefs_routes
+
+
+def test_load_ignores_non_object_prefs_file(tmp_path, monkeypatch):
+    prefs_file = tmp_path / "user_prefs.json"
+    prefs_file.write_text(json.dumps(["not", "a", "prefs", "object"]), encoding="utf-8")
+    monkeypatch.setattr(prefs_routes, "PREFS_FILE", str(prefs_file))
+
+    assert prefs_routes._load() == {}
+    assert prefs_routes._load_for_user("alice") == {}
+
+
+def test_load_keeps_object_prefs_file(tmp_path, monkeypatch):
+    prefs_file = tmp_path / "user_prefs.json"
+    prefs_file.write_text(json.dumps({"theme": "dark"}), encoding="utf-8")
+    monkeypatch.setattr(prefs_routes, "PREFS_FILE", str(prefs_file))
+
+    assert prefs_routes._load_for_user("alice") == {"theme": "dark"}