Document interests and preferences, and tutorial completion

[ariesclark]

Closes #605.

• GET/PUT /auth/user/interestsAndPreferences (getInterestsAndPreferences, updateInterestsAndPreferences). PUT merges: true turns a key on, false removes it, and unknown keys or non-boolean values are ignored. A body that is not a JSON object answers 400. The key the issue lists as Scifi is SciFi.
• POST/DELETE /users/{userId}/tutorial (completeUserTutorial, clearUserTutorials), plus the X-Platform and X-Store headers that build a tutorial's key ({platform}:{store}:v1) on all three methods. DELETE clears every platform tutorial and keeps custom ones such as the onboarding world's. Both answer 403 for another user.

[Copilot]

Copilot review overview

🟡 Changes recommended

The interests/preferences PUT requestBody schema/description is inconsistent with the documented and tested permissive input behavior, and the TutorialKey description omits the “null” platform substitution behavior.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1 · 2

Open (3)

• PUT schema too strict for update request behavior · New
• Request body description matches response, not PUT updates · New
• Missing null fallback for unrecognized X-Platform values · New

What changed in this PR

This PR extends the VRChat OpenAPI specification and test suite to cover new onboarding-related behavior: user “interests and preferences” storage plus tutorial completion/clearing keyed by platform/store headers.

Changes:

• Adds /auth/user/interestsAndPreferences GET/PUT operations with associated schema and response examples.
• Adds /users/{userId}/tutorial POST/DELETE operations and documents X-Platform/X-Store header behavior.
• Expands test/arazzo.yaml with workflows covering authenticated/unauthenticated access and lifecycle behavior for both features.

File	Description
test/​arazzo.yaml	Adds workflows to exercise interests/preferences and tutorial-key behavior (including platform/store header keying).
openapi/​components/​schemas/​TutorialKey.yaml	Updates TutorialKey description to describe platform/store-derived tutorial keys and custom tutorial keys.
openapi/​components/​schemas/​InterestsAndPreferences.yaml	Introduces an InterestsAndPreferences object schema for the new endpoint.
openapi/​components/​responses/​users/​CompleteTutorialForbiddenError.yaml	Adds a 403 response example for completing another user’s tutorial.
openapi/​components/​responses/​users/​ClearTutorialsForbiddenError.yaml	Adds a 403 response example for clearing another user’s tutorial completions.
openapi/​components/​responses/​authentication/​UpdateInterestsAndPreferencesResponse.yaml	Adds the success response example for updating interests/preferences.
openapi/​components/​responses/​authentication/​UpdateInterestsAndPreferencesParseError.yaml	Adds the 400 response example for invalid interests/preferences bodies.
openapi/​components/​responses/​authentication/​GetInterestsAndPreferencesResponse.yaml	Adds GET response examples for “all off” and “all on” states.
openapi/​components/​paths/​users.yaml	Adds POST/DELETE operations under /users/{userId}/tutorial and attaches the new header parameters.
openapi/​components/​paths/​authentication.yaml	Adds the /auth/user/interestsAndPreferences path and operations.
openapi/​components/​paths.yaml	Registers /auth/user/interestsAndPreferences in the root paths map.
openapi/​components/​parameters.yaml	Adds reusable X-Platform and X-Store header parameters.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.