Files
minstrel/internal/subsonic/scrobble_test.go
T
bvandeusenandClaude Opus 5.5 327d49428f
test-web / test (push) Successful in 2m4s
test-go / test (push) Successful in 2m23s
test-go / integration (push) Successful in 5m28s
release / Build signed APK (releases and dev) (push) Successful in 6m29s
release / Build + push container image (push) Successful in 29s
release / Verify release artifacts (tag releases only) (push) Skipped
feat(auth): store Subsonic API keys hashed; a new key is shown once (M462 #4983)
users.api_token held each user's apiKey in plaintext and was looked up by
equality, so a leaked row or backup handed out working keys. Migration
0063 replaces it with api_token_hash (sha256, hex), computed in place
from the existing keys so every Subsonic client keeps working.

The key can no longer be read back: GET /api/me/api-token is gone, and
POST returns the new key once. Settings shows it right after Regenerate
with a copy button and a "won't be shown again" note.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-06 09:42:35 -04:00

118 lines
3.3 KiB
Go

package subsonic
import (
"context"
"io"
"log/slog"
"net/http"
"net/http/httptest"
"net/url"
"os"
"testing"
"time"
"github.com/jackc/pgx/v5/pgxpool"
"git.fabledsword.com/bvandeusen/minstrel/internal/db"
"git.fabledsword.com/bvandeusen/minstrel/internal/db/dbq"
"git.fabledsword.com/bvandeusen/minstrel/internal/dbtest"
"git.fabledsword.com/bvandeusen/minstrel/internal/playevents"
)
func testScrobblePool(t *testing.T) (*pgxpool.Pool, dbq.User, dbq.Track) {
t.Helper()
if testing.Short() {
t.Skip("skipping in -short mode")
}
dsn := os.Getenv("MINSTREL_TEST_DATABASE_URL")
if dsn == "" {
t.Skip("MINSTREL_TEST_DATABASE_URL not set")
}
if err := db.Migrate(dsn, slog.New(slog.NewTextHandler(io.Discard, nil))); err != nil {
t.Fatalf("migrate: %v", err)
}
pool, err := pgxpool.New(context.Background(), dsn)
if err != nil {
t.Fatalf("pool: %v", err)
}
t.Cleanup(pool.Close)
dbtest.ResetDB(t, pool)
q := dbq.New(pool)
u, err := q.CreateUser(context.Background(), dbq.CreateUserParams{
Username: dbtest.TestUserPrefix + "tester", PasswordHash: "x", ApiTokenHash: "x", IsAdmin: false,
})
if err != nil {
t.Fatalf("user: %v", err)
}
a, _ := q.UpsertArtist(context.Background(), dbq.UpsertArtistParams{Name: "X", SortName: "X"})
al, _ := q.UpsertAlbum(context.Background(), dbq.UpsertAlbumParams{Title: "X", SortTitle: "X", ArtistID: a.ID})
tr, _ := q.UpsertTrack(context.Background(), dbq.UpsertTrackParams{
Title: "Y", AlbumID: al.ID, ArtistID: a.ID, FilePath: "/tmp/scrob.flac", DurationMs: 100_000,
})
return pool, u, tr
}
func newScrobbleHandlers(pool *pgxpool.Pool) *mediaHandlers {
logger := slog.New(slog.NewTextHandler(io.Discard, nil))
w := playevents.NewWriter(pool, logger, 30*time.Minute, 0.5, 30000)
return newMediaHandlers(pool, w, logger)
}
func TestHandleScrobble_SubmissionFalseInsertsOpenPlayEvent(t *testing.T) {
pool, user, track := testScrobblePool(t)
m := newScrobbleHandlers(pool)
q := url.Values{}
q.Set("id", uuidToID(track.ID))
q.Set("submission", "false")
req := httptest.NewRequest(http.MethodGet, "/rest/scrobble?"+q.Encode(), nil)
ctx := context.WithValue(req.Context(), userCtxKey, user)
w := httptest.NewRecorder()
m.handleScrobble(w, req.WithContext(ctx))
if w.Code != http.StatusOK {
t.Fatalf("status = %d", w.Code)
}
rows, _ := pool.Query(context.Background(),
"SELECT id FROM play_events WHERE user_id=$1 AND ended_at IS NULL", user.ID)
defer rows.Close()
count := 0
for rows.Next() {
count++
}
if count != 1 {
t.Errorf("open play_events count = %d, want 1", count)
}
}
func TestHandleScrobble_SubmissionTrueWritesCompletedPlay(t *testing.T) {
pool, user, track := testScrobblePool(t)
m := newScrobbleHandlers(pool)
q := url.Values{}
q.Set("id", uuidToID(track.ID))
q.Set("submission", "true")
req := httptest.NewRequest(http.MethodGet, "/rest/scrobble?"+q.Encode(), nil)
ctx := context.WithValue(req.Context(), userCtxKey, user)
w := httptest.NewRecorder()
m.handleScrobble(w, req.WithContext(ctx))
if w.Code != http.StatusOK {
t.Fatalf("status = %d", w.Code)
}
rows, _ := pool.Query(context.Background(),
"SELECT ended_at IS NOT NULL FROM play_events WHERE user_id=$1", user.ID)
defer rows.Close()
closed := 0
for rows.Next() {
var c bool
_ = rows.Scan(&c)
if c {
closed++
}
}
if closed != 1 {
t.Errorf("closed play_events = %d, want 1", closed)
}
}