bvandeusen
64582b21e3
Bootstrap was creating password_hash + api_token but leaving subsonic_password nil, which meant Subsonic clients (Feishin, Symfonium) got ErrTokenNotSupported on t+s auth — the server had no plaintext to hash against. Mirror the bootstrap password into subsonic_password so the admin can sign in to Subsonic clients with the same credential printed on first boot. Plaintext at rest is the cost of Subsonic's legacy auth; matches Navidrome's posture. Also folds in the local dev compose tweaks: dedicated bridge network with postgres unpublished from the host, and a bind-mount aimed at the operator's real library path. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
99 lines
2.9 KiB
Go
99 lines
2.9 KiB
Go
package auth
|
|
|
|
import (
|
|
"context"
|
|
"io"
|
|
"log/slog"
|
|
"os"
|
|
"testing"
|
|
|
|
"github.com/jackc/pgx/v5/pgxpool"
|
|
"golang.org/x/crypto/bcrypt"
|
|
|
|
"git.fabledsword.com/bvandeusen/minstrel/internal/config"
|
|
"git.fabledsword.com/bvandeusen/minstrel/internal/db"
|
|
"git.fabledsword.com/bvandeusen/minstrel/internal/db/dbq"
|
|
)
|
|
|
|
// TestBootstrap_Integration exercises the admin-bootstrap flow against a real
|
|
// Postgres. Gated on MINSTREL_TEST_DATABASE_URL, skipped in -short mode.
|
|
func TestBootstrap_Integration(t *testing.T) {
|
|
if testing.Short() {
|
|
t.Skip("skipping bootstrap integration in -short mode")
|
|
}
|
|
dsn := os.Getenv("MINSTREL_TEST_DATABASE_URL")
|
|
if dsn == "" {
|
|
t.Skip("MINSTREL_TEST_DATABASE_URL not set; skipping")
|
|
}
|
|
ctx := context.Background()
|
|
logger := slog.New(slog.NewTextHandler(io.Discard, nil))
|
|
|
|
if err := db.Migrate(dsn, logger); err != nil {
|
|
t.Fatalf("Migrate: %v", err)
|
|
}
|
|
|
|
pool, err := pgxpool.New(ctx, dsn)
|
|
if err != nil {
|
|
t.Fatalf("pool: %v", err)
|
|
}
|
|
t.Cleanup(pool.Close)
|
|
|
|
// Start from a known-empty users table. Other tests that insert users
|
|
// must run in isolation; a shared compose pg is fine for solo dev.
|
|
if _, err := pool.Exec(ctx, "TRUNCATE users RESTART IDENTITY CASCADE"); err != nil {
|
|
t.Fatalf("truncate: %v", err)
|
|
}
|
|
|
|
cfg := config.AdminBootstrapConfig{Username: "admin", Password: "hunter2"}
|
|
if err := Bootstrap(ctx, pool, cfg, logger); err != nil {
|
|
t.Fatalf("Bootstrap: %v", err)
|
|
}
|
|
|
|
q := dbq.New(pool)
|
|
user, err := q.GetUserByUsername(ctx, "admin")
|
|
if err != nil {
|
|
t.Fatalf("GetUserByUsername: %v", err)
|
|
}
|
|
if !user.IsAdmin {
|
|
t.Error("bootstrapped user not marked admin")
|
|
}
|
|
if user.ApiToken == "" {
|
|
t.Error("api_token empty")
|
|
}
|
|
if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte("hunter2")); err != nil {
|
|
t.Errorf("bcrypt compare: %v", err)
|
|
}
|
|
if user.SubsonicPassword == nil || *user.SubsonicPassword != "hunter2" {
|
|
t.Errorf("subsonic_password = %v, want \"hunter2\"", user.SubsonicPassword)
|
|
}
|
|
|
|
byToken, err := q.GetUserByAPIToken(ctx, user.ApiToken)
|
|
if err != nil {
|
|
t.Fatalf("GetUserByAPIToken: %v", err)
|
|
}
|
|
if byToken.Username != "admin" {
|
|
t.Errorf("token lookup returned %q", byToken.Username)
|
|
}
|
|
|
|
// Second call must be a no-op because users table is non-empty.
|
|
if err := Bootstrap(ctx, pool, cfg, logger); err != nil {
|
|
t.Fatalf("Bootstrap (second call): %v", err)
|
|
}
|
|
count, err := q.CountUsers(ctx)
|
|
if err != nil {
|
|
t.Fatalf("CountUsers: %v", err)
|
|
}
|
|
if count != 1 {
|
|
t.Errorf("expected exactly 1 user after idempotent bootstrap, got %d", count)
|
|
}
|
|
}
|
|
|
|
// TestBootstrap_NoUsernameSkips verifies the no-config path without needing
|
|
// a database connection.
|
|
func TestBootstrap_NoUsernameSkips(t *testing.T) {
|
|
err := Bootstrap(context.Background(), nil, config.AdminBootstrapConfig{}, slog.New(slog.NewTextHandler(io.Discard, nil)))
|
|
if err != nil {
|
|
t.Errorf("empty config should return nil, got %v", err)
|
|
}
|
|
}
|