4 Commits

Include renames

Author	SHA1	Message	Date
bvandeusenandClaude Opus 5.5	d191a28217	docs: server comments say what the code does, not how it came to be (#6277) ... Comment blocks in cmd/minstrel and 30 smaller internal packages, rewritten to rule 32's standard with each citation read in context: task, milestone and rule ids go, and so do the stories they were attached to ("used to", "Before #N", measurements from one install, quotes, pointers to Fabled Librarian's records and to docs/superpowers files that are not in the repo). Where a story wrapped a real constraint, the constraint stays as a present-tense fact. Comments that had gone stale are corrected: - taste.Config: the tuned values are overlaid by internal/recsettings; it is no longer "a later follow-up". - StorageConfig: the data dir holds art, caches and the stream secret, not only playlist covers. - the Subsonic album list and getUser comments describe what they do today rather than a milestone that would change it. Checked: the non-comment token stream of every changed file matches HEAD, and gofmt -l is empty. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-23 12:15:05 -04:00
bvandeusenandClaude Opus 5.5	327d49428f	feat(auth): store Subsonic API keys hashed; a new key is shown once (M462 #4983) ... users.api_token held each user's apiKey in plaintext and was looked up by equality, so a leaked row or backup handed out working keys. Migration 0063 replaces it with api_token_hash (sha256, hex), computed in place from the existing keys so every Subsonic client keeps working. The key can no longer be read back: GET /api/me/api-token is gone, and POST returns the new key once. Settings shows it right after Regenerate with a copy button and a "won't be shown again" note. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 09:42:35 -04:00
bvandeusenandClaude Opus 4.7	937a1930ad	test: add dbtest.ResetDB helper that preserves admin user ... Integration tests previously TRUNCATEd the users table at setup, which wiped the operator's admin login every time the suite ran against a Postgres instance shared with their dev environment. This commit: - Adds internal/dbtest/reset.go exposing ResetDB(t, pool) and TestUserPrefix. ResetDB truncates every data table EXCEPT users, then deletes only users whose username starts with TestUserPrefix. - Migrates 9 test files (subsonic/scrobble, subsonic/star, recommendation/candidates, scrobble/queue, similarity/worker, playevents/writer, playsessions/service, api/auth, api/me) to call ResetDB instead of issuing TRUNCATE-with-users. - Renames hardcoded test usernames to use TestUserPrefix so ResetDB cleans them between runs. seedUser in api/auth_test now prefixes internally; existing call sites pass bare names. - Leaves auth/bootstrap_test.go alone — it legitimately tests first-time admin bootstrap and must wipe users. Verified locally: full integration suite with -p 1 runs cleanly under the existing MINSTREL_TEST_DATABASE_URL setup, and the admin row in the shared dev DB survives the run. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-04-29 11:55:06 -04:00
bvandeusen	73d3962fff	feat(playsessions): add FindOrCreate session service (30-min rolling window) ... Per spec §6: returns existing session id when last_event_at is within timeout; inserts a new session otherwise. Touch updates last_event_at and increments track_count so callers can assume FindOrCreate == one play started.	2026-04-25 22:30:12 -04:00