4 Commits

Include renames

Author	SHA1	Message	Date
bvandeusenandClaude Opus 5.5	327d49428f	feat(auth): store Subsonic API keys hashed; a new key is shown once (M462 #4983) ... users.api_token held each user's apiKey in plaintext and was looked up by equality, so a leaked row or backup handed out working keys. Migration 0063 replaces it with api_token_hash (sha256, hex), computed in place from the existing keys so every Subsonic client keeps working. The key can no longer be read back: GET /api/me/api-token is gone, and POST returns the new key once. Settings shows it right after Regenerate with a copy button and a "won't be shown again" note. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 09:42:35 -04:00
bvandeusenandClaude Opus 4.7	53a02322fb	fix: A2 (relax art-source CHECK) + D + E integration residual ... A2 — migration 0030: the albums/artists art `*_source` CHECK was a fixed provider-ID allowlist fighting the extensible coverart.Register registry (per-provider migration churn at 0016/0018/0020; rejected test stub providers → ~11 enricher tests failed). Relax to "NULL or non-empty"; the registry is the source of truth. Same brittleness class as the #433 discovery-mix CHECK. D — lidarr Approve resolves metadata/quality profiles (JSON arrays) before the add; the test stubs returned {"id":1} for every path, so ListMetadataProfiles failed to unmarshal → 500/Approve errors. Make the lidarrrequests + admin_requests stubs path-aware (arrays for /metadataprofile, /qualityprofile). E: - auth: requireUser (prelude.go) emitted code "auth_required"; the canonical code is "unauthenticated" (operator decision). Change the code; drop the now-dead "auth_required" web error-copy key ("unauthenticated" already has copy). - playlists_system_test wrapped the real auth.RequireUser middleware but only injected withUser() context → 401. Like every other api handler test, drop the middleware and rely on requireUser(). - admin_users dup-username test seeded "test-existing" (seedUser prefixes) but POSTed "existing" → no collision; POST the prefixed name. - me_timezone test decoded a top-level {"code"} but the envelope is {"error":{"code"}}; decode the nested shape. - audit test asserted compact JSON; Postgres jsonb::text is spaced. - put-lidarr-config tests predated the missing_defaults gate (correct handler behavior); supply the required defaults in the bodies. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-17 20:22:30 -04:00
bvandeusen	db37deb6f8	test(lidarrrequests): expand coverage on Service.Approve + Reconciler ... - Adds Service tests for ListPending/ListByStatus/ListForUser, the album- and unknown-kind validation branches, and an Approve happy path with a stub Lidarr server that exercises both default-snapshot and override- snapshot persistence. - Adds Reconciler tests for Run (short tick + cancel), the album-not-yet- in-library no-op branch, and the track-kind 'parent album present but no tracks yet' branch. Combined coverage on internal/lidarr*, lidarrconfig, lidarrrequests now 86.5% (lidarrrequests 81.5%), meeting the per-package >=80% target in spec section 8.	2026-04-30 10:58:21 -04:00
bvandeusenandClaude Sonnet 4.6	b11fc117e7	feat(lidarrrequests): request lifecycle service (create/list/approve/reject/cancel) ... Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-29 17:12:03 -04:00