5 Commits

Include renames

Author	SHA1	Message	Date
bvandeusenandClaude Opus 5.5	3bfddd0862	feat(auth): throttle login, register, password reset and Subsonic auth failures (M462 #4976) ... Every password-shaped check was mounted bare, so guessing was limited only by bcrypt cost. A shared in-memory AttemptLimiter now sits in front of them: - login: 10 failures per account and 50 per address per 15 min, checked before the user lookup and bcrypt; 429 with Retry-After. A success clears the account's count but not the address's. - unknown usernames run a dummy bcrypt compare, so timing no longer says which accounts exist. - register: 10 per address per hour; forgot-password: 5 per address and 3 per email per hour (applied whether or not the email matches); reset: 20 failed tokens per address per 15 min. - Subsonic /rest: same limits as login, counting only wrong credentials, since clients authenticate on every request. Web login, register, reset and forgot-password screens say how long to wait; web and Android carry copy for the rate_limited code. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 08:28:29 -04:00
bvandeusen	9c91a342e2	refactor(web/api): errCode + errMessage helpers; 41 sites migrated (W1)	2026-05-07 22:17:45 -04:00
bvandeusen	444144038a	fix(ci): library_test Mount arg + 4 web test selectors + forgot-pw catch ... Five fixes in one commit, all from the U1+U2+U3 push: 1. internal/api/library_test.go's Mount call wasn't updated when U3-T4 added the mailer.Sender param. 17 args, sig wants 18. Adds a trailing nil for the mailer. Same shape of test-fixture lag the project has hit before — flagged as a recurring pattern for the DRY-pass slice. 2. web/src/routes/settings/settings.test.ts mocked $lib/api/me with `getAPIToken: vi.fn()` (no return value). The new /settings API Token card's $effect calls `getAPIToken().then(...)` which threw "Cannot read properties of undefined (reading 'then')" on every ListenBrainz test. Default the mock to mockResolvedValue so any test that doesn't override gets a valid resolution. 3. web/src/routes/admin/users/users.test.ts queried row buttons by /^Delete$/ but T3 added per-user aria-labels ("Delete alice"), so the row buttons' accessible name is no longer "Delete". The modal's confirm button has no aria-label so its name IS "Delete" exactly. Tests now click by per-user aria-label first, then by /^Delete$/ for the modal confirm. 4. Same file: /Set password/i regex matched both the dialog's submit button AND the row's "Reset password for ..." buttons (because regex `Set` matches "ReSet" case-insensitively). Switched to /^Set password$/ exact-match. 5. web/src/routes/reset-password/[token]/reset-password.test.ts had /New password/i which matched both the "New password" and "Confirm new password" labels. Switched to exact-match string selectors. 6. web/src/routes/forgot-password/+page.svelte's onSubmit handler had no catch — a rejected forgotPassword() bubbled as an unhandled rejection in vitest. Added a silent catch since the page intentionally shows the same success message regardless of outcome (no-enumeration posture).	2026-05-07 18:05:30 -04:00
bvandeusen	9ed576a029	fix(ci): pgconn import path + reset-password token type + SMTP label ... Three CI fixes from the U1+U2+U3 push: - internal/api/admin_users.go imported the standalone github.com/jackc/pgconn — that module isn't in go.sum and go vet caught it. Switch to github.com/jackc/pgx/v5/pgconn (the path used elsewhere in the package, e.g. auth_register.go and me_profile.go). - /reset-password/[token] dereferenced page.params.token without the undefined narrowing svelte-kit's typegen requires. Coalesce to '' on read and reject empty token at submit time with a clear error. - /admin/integrations SMTP card had a label without an associated control as the TLS row's leading column header. Switched to a span — the actual checkbox lives in the wrapping label below it.	2026-05-07 17:48:44 -04:00
bvandeusenandClaude Sonnet 4.6	5da2c85f70	feat(web/m7-user-mgmt): /reset-password page + admin SMTP card + tests (U3-T5b) ... Completes the U3 frontend that T5a's crashed dispatch left half-done. - /reset-password/[token] — public; new password + confirm. Calls POST /api/auth/reset-password with the URL's token. invalid_token, password_too_short, and mismatched-passwords surface as inline errors. Success redirects to /login?reset=ok. - /admin/integrations gains an SMTP card (alongside Lidarr) with enabled toggle + all fields + Save and Send-test-email buttons. Password input is a separate state from the loaded form, so empty submission preserves the stored server-side value (matches the backend's empty-password-preserves contract). Test button error codes (no_email_on_file / not_configured / send_failed) surface as actionable toasts. Tests cover both new pages plus extensions to settings + integrations test files for the cards landed in T5a. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-07 17:43:47 -04:00