feat(server/m7-user-mgmt): self-service /me endpoints (U3)

Four authenticated endpoints for the user's own account: - PUT /api/me/password — change own password. Caller must supply current_password (verified via bcrypt). Distinct from admin-driven reset (which doesn't require knowing the old). Audits ActionPasswordChangeSelf. - PUT /api/me/profile — set display_name + email. Both fields are nullable; empty string clears, omitted leaves unchanged. Email is lowercased before store + format-validated. Unique violation → 409 email_taken. - GET /api/me/api-token — returns current API token (for copy-paste into Subsonic clients). - POST /api/me/api-token — regenerates token. Old one stops working immediately. Audits ActionTokenRegenerate. All four use the existing RequireUser middleware on the authed sub-router; audit writes are best-effort (logged on failure). Tests cover happy paths, wrong-password 401, password-too-short 400, email-invalid 400, email-taken 409, clear-by-empty-string, omit-leaves-unchanged, token GET + regen. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-07 12:38:48 -04:00
parent a509ec538b
commit aa73c93f85
7 changed files with 636 additions and 0 deletions
@@ -0,0 +1,83 @@
+package api
+
+import (
+	"bytes"
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"testing"
+
+	"github.com/go-chi/chi/v5"
+	"golang.org/x/crypto/bcrypt"
+)
+
+func newMePasswordRouter(h *handlers) chi.Router {
+	r := chi.NewRouter()
+	r.Put("/api/me/password", h.handleChangePassword)
+	return r
+}
+
+func TestChangePassword_Happy(t *testing.T) {
+	if os.Getenv("MINSTREL_TEST_DATABASE_URL") == "" {
+		t.Skip("MINSTREL_TEST_DATABASE_URL not set")
+	}
+	h, pool := testHandlers(t)
+	user := seedUser(t, pool, "chpw1", "oldpassword1", false)
+
+	body := `{"current_password":"oldpassword1","new_password":"newpassword1"}`
+	req := httptest.NewRequest(http.MethodPut, "/api/me/password", bytes.NewReader([]byte(body)))
+	req = withUser(req, user)
+	rec := httptest.NewRecorder()
+	newMePasswordRouter(h).ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusNoContent {
+		t.Fatalf("status = %d, want 204; body=%s", rec.Code, rec.Body.String())
+	}
+
+	// Verify DB row was updated — new password should match.
+	var hash string
+	if err := pool.QueryRow(context.Background(),
+		"SELECT password_hash FROM users WHERE id = $1", user.ID).Scan(&hash); err != nil {
+		t.Fatalf("read hash: %v", err)
+	}
+	if err := bcrypt.CompareHashAndPassword([]byte(hash), []byte("newpassword1")); err != nil {
+		t.Errorf("new password does not match DB hash: %v", err)
+	}
+}
+
+func TestChangePassword_WrongCurrent_401(t *testing.T) {
+	if os.Getenv("MINSTREL_TEST_DATABASE_URL") == "" {
+		t.Skip("MINSTREL_TEST_DATABASE_URL not set")
+	}
+	h, pool := testHandlers(t)
+	user := seedUser(t, pool, "chpw2", "correctpw1", false)
+
+	body := `{"current_password":"wrongpassword","new_password":"newpassword1"}`
+	req := httptest.NewRequest(http.MethodPut, "/api/me/password", bytes.NewReader([]byte(body)))
+	req = withUser(req, user)
+	rec := httptest.NewRecorder()
+	newMePasswordRouter(h).ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusUnauthorized {
+		t.Errorf("status = %d, want 401 (wrong_password)", rec.Code)
+	}
+}
+
+func TestChangePassword_TooShort_400(t *testing.T) {
+	if os.Getenv("MINSTREL_TEST_DATABASE_URL") == "" {
+		t.Skip("MINSTREL_TEST_DATABASE_URL not set")
+	}
+	h, pool := testHandlers(t)
+	user := seedUser(t, pool, "chpw3", "somepassword1", false)
+
+	body := `{"current_password":"somepassword1","new_password":"short"}`
+	req := httptest.NewRequest(http.MethodPut, "/api/me/password", bytes.NewReader([]byte(body)))
+	req = withUser(req, user)
+	rec := httptest.NewRecorder()
+	newMePasswordRouter(h).ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusBadRequest {
+		t.Errorf("status = %d, want 400 (password_too_short)", rec.Code)
+	}
+}