release / govulncheck (push) Successful in 39s
release / web (push) Successful in 1m8s
release / go (push) Successful in 1m30s
release / integration (push) Successful in 4m37s
release / android (push) Successful in 5m56s
release / Build signed APK (releases and dev) (push) Successful in 5m55s
release / Attach APK to the Release (tag releases only) (push) Skipped
release / Build + push container image (push) Successful in 1m23s
release / Verify release artifacts (tag releases only) (push) Skipped
`minstrel admin reset-password` copied the new login password into subsonic_password, which is stored in plain text because Subsonic t/s sign-in needs it. Every account recovered through the CLI had its login password readable in the database, and changing the password later left the copy behind. - reset-password now changes only password_hash. - Migration 0064 clears every subsonic_password, removing the copies. - Settings gets a Subsonic password card: the server generates a random password, shows it once, and it can be regenerated or turned off (GET/POST/DELETE /api/me/subsonic-password, audited). Generated rather than user-chosen so it can never be a reused password. - docs/security.md describes the separate password instead of the known issue. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
415 lines
17 KiB
TypeScript
415 lines
17 KiB
TypeScript
import { afterEach, describe, expect, test, vi } from 'vitest';
|
|
import { render, screen, fireEvent, waitFor, within } from '@testing-library/svelte';
|
|
import { readable, writable } from 'svelte/store';
|
|
import type { LBStatus } from '$lib/api/listenbrainz';
|
|
|
|
vi.mock('$lib/api/listenbrainz', () => ({
|
|
createLBStatusQuery: vi.fn(),
|
|
createTokenMutation: vi.fn(),
|
|
createEnabledMutation: vi.fn(),
|
|
setListenBrainzToken: vi.fn(),
|
|
setListenBrainzEnabled: vi.fn()
|
|
}));
|
|
|
|
vi.mock('$lib/api/me', () => ({
|
|
updateProfile: vi.fn(),
|
|
changePassword: vi.fn(),
|
|
// Default to a resolved value so the page's $effect doesn't crash
|
|
// on `.then()` of undefined when individual tests don't override.
|
|
regenerateAPIToken: vi.fn(),
|
|
getSubsonicPasswordStatus: vi.fn(),
|
|
generateSubsonicPassword: vi.fn(),
|
|
clearSubsonicPassword: vi.fn()
|
|
}));
|
|
|
|
// Mutable holder so individual tests can inject populated metrics;
|
|
// vi.mock is hoisted, hence vi.hoisted for the shared reference.
|
|
const metricsMock = vi.hoisted(() => ({
|
|
data: { window_days: 30, baseline: null, groups: [] } as unknown
|
|
}));
|
|
|
|
vi.mock('$lib/api/metrics', () => ({
|
|
createRecommendationMetricsQuery: () => ({
|
|
subscribe: (run: (v: unknown) => void) => {
|
|
run({ isPending: false, isError: false, data: metricsMock.data });
|
|
return () => {};
|
|
}
|
|
})
|
|
}));
|
|
|
|
import SettingsPage from './+page.svelte';
|
|
import {
|
|
createLBStatusQuery,
|
|
createTokenMutation,
|
|
createEnabledMutation,
|
|
setListenBrainzToken,
|
|
setListenBrainzEnabled
|
|
} from '$lib/api/listenbrainz';
|
|
import {
|
|
updateProfile,
|
|
changePassword,
|
|
regenerateAPIToken,
|
|
getSubsonicPasswordStatus,
|
|
generateSubsonicPassword,
|
|
clearSubsonicPassword
|
|
} from '$lib/api/me';
|
|
|
|
function mockStatusStore(data: LBStatus) {
|
|
return readable({ data, isPending: false, isError: false });
|
|
}
|
|
|
|
function mockMutationStore(mutateFn: (vars: unknown) => void = vi.fn()) {
|
|
return readable({ isPending: false, mutate: mutateFn, mutateAsync: vi.fn() });
|
|
}
|
|
|
|
afterEach(() => {
|
|
vi.clearAllMocks();
|
|
metricsMock.data = { window_days: 30, baseline: null, groups: [] };
|
|
});
|
|
|
|
describe('Settings page — ListenBrainz', () => {
|
|
test('token-not-set state renders input + Save button', async () => {
|
|
(createLBStatusQuery as ReturnType<typeof vi.fn>).mockReturnValue(
|
|
mockStatusStore({ enabled: false, token_set: false, last_scrobbled_at: null })
|
|
);
|
|
(createTokenMutation as ReturnType<typeof vi.fn>).mockReturnValue(mockMutationStore());
|
|
(createEnabledMutation as ReturnType<typeof vi.fn>).mockReturnValue(mockMutationStore());
|
|
render(SettingsPage);
|
|
await waitFor(() =>
|
|
expect(screen.getByPlaceholderText(/paste your lb token/i)).toBeInTheDocument()
|
|
);
|
|
expect(screen.getByRole('button', { name: /^save$/i })).toBeInTheDocument();
|
|
});
|
|
|
|
test('token-set state renders masked + Clear button', async () => {
|
|
(createLBStatusQuery as ReturnType<typeof vi.fn>).mockReturnValue(
|
|
mockStatusStore({ enabled: false, token_set: true, last_scrobbled_at: null })
|
|
);
|
|
(createTokenMutation as ReturnType<typeof vi.fn>).mockReturnValue(mockMutationStore());
|
|
(createEnabledMutation as ReturnType<typeof vi.fn>).mockReturnValue(mockMutationStore());
|
|
render(SettingsPage);
|
|
await waitFor(() => expect(screen.getByText(/\(set\)/)).toBeInTheDocument());
|
|
expect(screen.getByText('clear')).toBeInTheDocument();
|
|
});
|
|
|
|
test('Save button calls setListenBrainzToken with typed value', async () => {
|
|
(createLBStatusQuery as ReturnType<typeof vi.fn>).mockReturnValue(
|
|
mockStatusStore({ enabled: false, token_set: false, last_scrobbled_at: null })
|
|
);
|
|
const mutateFn = vi.fn();
|
|
(createTokenMutation as ReturnType<typeof vi.fn>).mockReturnValue(mockMutationStore(mutateFn));
|
|
(createEnabledMutation as ReturnType<typeof vi.fn>).mockReturnValue(mockMutationStore());
|
|
render(SettingsPage);
|
|
const input = await screen.findByPlaceholderText(/paste your lb token/i);
|
|
await fireEvent.input(input, { target: { value: 'mytoken' } });
|
|
await fireEvent.click(screen.getByRole('button', { name: /^save$/i }));
|
|
await waitFor(() => expect(mutateFn).toHaveBeenCalledWith('mytoken', expect.anything()));
|
|
});
|
|
|
|
test('Enabled checkbox is disabled when no token', async () => {
|
|
(createLBStatusQuery as ReturnType<typeof vi.fn>).mockReturnValue(
|
|
mockStatusStore({ enabled: false, token_set: false, last_scrobbled_at: null })
|
|
);
|
|
(createTokenMutation as ReturnType<typeof vi.fn>).mockReturnValue(mockMutationStore());
|
|
(createEnabledMutation as ReturnType<typeof vi.fn>).mockReturnValue(mockMutationStore());
|
|
render(SettingsPage);
|
|
const checkbox = await screen.findByRole('checkbox');
|
|
expect(checkbox).toBeDisabled();
|
|
});
|
|
|
|
test('Last-scrobbled-at renders when present', async () => {
|
|
(createLBStatusQuery as ReturnType<typeof vi.fn>).mockReturnValue(
|
|
mockStatusStore({ enabled: true, token_set: true, last_scrobbled_at: '2026-04-28T03:00:00Z' })
|
|
);
|
|
(createTokenMutation as ReturnType<typeof vi.fn>).mockReturnValue(mockMutationStore());
|
|
(createEnabledMutation as ReturnType<typeof vi.fn>).mockReturnValue(mockMutationStore());
|
|
render(SettingsPage);
|
|
await waitFor(() =>
|
|
expect(screen.getByText(/last scrobbled:/i)).toBeInTheDocument()
|
|
);
|
|
});
|
|
});
|
|
|
|
// Shared setup for cards that don't need LB state
|
|
function setupPage() {
|
|
(createLBStatusQuery as ReturnType<typeof vi.fn>).mockReturnValue(
|
|
mockStatusStore({ enabled: false, token_set: false, last_scrobbled_at: null })
|
|
);
|
|
(createTokenMutation as ReturnType<typeof vi.fn>).mockReturnValue(mockMutationStore());
|
|
(createEnabledMutation as ReturnType<typeof vi.fn>).mockReturnValue(mockMutationStore());
|
|
}
|
|
|
|
describe('Settings page — Profile card', () => {
|
|
test('Save profile calls updateProfile with form values', async () => {
|
|
setupPage();
|
|
(updateProfile as ReturnType<typeof vi.fn>).mockResolvedValue({});
|
|
render(SettingsPage);
|
|
await fireEvent.input(screen.getByLabelText(/display name/i), { target: { value: 'Alice' } });
|
|
await fireEvent.input(screen.getByLabelText(/email/i), { target: { value: 'alice@example.com' } });
|
|
await fireEvent.click(screen.getByRole('button', { name: /save profile/i }));
|
|
await waitFor(() =>
|
|
expect(updateProfile).toHaveBeenCalledWith(
|
|
expect.objectContaining({ display_name: 'Alice', email: 'alice@example.com' })
|
|
)
|
|
);
|
|
});
|
|
|
|
test('Save profile shows toast on success', async () => {
|
|
setupPage();
|
|
(updateProfile as ReturnType<typeof vi.fn>).mockResolvedValue({});
|
|
render(SettingsPage);
|
|
await fireEvent.click(screen.getByRole('button', { name: /save profile/i }));
|
|
await waitFor(() => expect(screen.getByTestId('toast').textContent).toMatch(/profile saved/i));
|
|
});
|
|
});
|
|
|
|
describe('Settings page — Password card', () => {
|
|
test('mismatched passwords show toast and do not call changePassword', async () => {
|
|
setupPage();
|
|
render(SettingsPage);
|
|
await fireEvent.input(screen.getByLabelText(/current password/i), { target: { value: 'oldpw1234' } });
|
|
await fireEvent.input(screen.getByLabelText(/new password/i), { target: { value: 'newpw1234' } });
|
|
await fireEvent.input(screen.getByLabelText(/confirm/i), { target: { value: 'different1' } });
|
|
await fireEvent.click(screen.getByRole('button', { name: /change password/i }));
|
|
expect(changePassword).not.toHaveBeenCalled();
|
|
await waitFor(() => expect(screen.getByTestId('toast').textContent).toMatch(/do not match/i));
|
|
});
|
|
|
|
test('matched passwords call changePassword(current, new)', async () => {
|
|
setupPage();
|
|
(changePassword as ReturnType<typeof vi.fn>).mockResolvedValue(undefined);
|
|
render(SettingsPage);
|
|
await fireEvent.input(screen.getByLabelText(/current password/i), { target: { value: 'oldpw1234' } });
|
|
await fireEvent.input(screen.getByLabelText(/new password/i), { target: { value: 'newpw1234' } });
|
|
await fireEvent.input(screen.getByLabelText(/confirm/i), { target: { value: 'newpw1234' } });
|
|
await fireEvent.click(screen.getByRole('button', { name: /change password/i }));
|
|
await waitFor(() =>
|
|
expect(changePassword).toHaveBeenCalledWith('oldpw1234', 'newpw1234')
|
|
);
|
|
});
|
|
});
|
|
|
|
describe('Settings page — Recommendation metrics card', () => {
|
|
const metric = (key: string, label: string, over: Record<string, unknown> = {}) => ({
|
|
key,
|
|
label,
|
|
plays: 30,
|
|
skips: 3,
|
|
skip_rate: 0.1,
|
|
avg_completion: 0.9,
|
|
low_confidence: false,
|
|
...over
|
|
});
|
|
|
|
test('breakdown rows are collapsed by default and expand on toggle (#1249/#1270)', async () => {
|
|
setupPage();
|
|
metricsMock.data = {
|
|
window_days: 30,
|
|
baseline: metric('manual', 'Manual library plays', { plays: 100 }),
|
|
groups: [
|
|
{
|
|
intent: 'go_to',
|
|
label: 'Go-to surfaces',
|
|
surfaces: [
|
|
metric('for_you', 'For You', {
|
|
plays: 45,
|
|
breakdown: [
|
|
metric('for_you_taste', 'Taste picks'),
|
|
metric('for_you_fresh', 'Fresh picks', {
|
|
plays: 10,
|
|
skip_rate: 0.4,
|
|
low_confidence: true
|
|
}),
|
|
metric('for_you_unattributed', 'Earlier plays', { plays: 5 })
|
|
]
|
|
})
|
|
]
|
|
}
|
|
]
|
|
};
|
|
render(SettingsPage);
|
|
const toggle = await screen.findByRole('button', { name: /for you/i });
|
|
// Collapsed by default: every stamping mix now carries a breakdown,
|
|
// so always-open sub-rows would swamp the surface-level view.
|
|
expect(toggle).toHaveAttribute('aria-expanded', 'false');
|
|
expect(screen.queryByText(/Taste picks/)).not.toBeInTheDocument();
|
|
|
|
await fireEvent.click(toggle);
|
|
expect(toggle).toHaveAttribute('aria-expanded', 'true');
|
|
expect(screen.getByText(/Taste picks/)).toBeInTheDocument();
|
|
expect(screen.getByText(/Fresh picks/)).toBeInTheDocument();
|
|
expect(screen.getByText(/Earlier plays/)).toBeInTheDocument();
|
|
|
|
await fireEvent.click(toggle);
|
|
expect(screen.queryByText(/Taste picks/)).not.toBeInTheDocument();
|
|
});
|
|
|
|
// #2495: the card used to render a delta computed client-side with no notion
|
|
// of uncertainty, so a -12 on 59 plays looked exactly as solid as a -6 on 400.
|
|
// Deltas now arrive from the server with a margin, and an indistinguishable
|
|
// one is marked with "≈" and dimmed rather than coloured.
|
|
test('a delta smaller than its margin is marked as indistinguishable', async () => {
|
|
setupPage();
|
|
metricsMock.data = {
|
|
window_days: 30,
|
|
baseline: metric('manual', 'Manual library plays', { plays: 400, skip_rate: 0.27 }),
|
|
groups: [
|
|
{
|
|
intent: 'discovery',
|
|
label: 'Discovery mixes',
|
|
surfaces: [
|
|
metric('discover', 'Discover', {
|
|
plays: 59,
|
|
skip_rate: 0.153,
|
|
// 13.3pp gap, but the margin at n=59 is wider than the gap.
|
|
skip_delta: { delta_pp: -13.3, margin_pp: 14.5, distinguishable: false },
|
|
completion_delta: { delta_pp: 28.0, margin_pp: 12.1, distinguishable: true }
|
|
})
|
|
]
|
|
}
|
|
]
|
|
};
|
|
render(SettingsPage);
|
|
await waitFor(() => expect(screen.getByText('Discover')).toBeInTheDocument());
|
|
|
|
// Targeted by test id rather than text: the legend below the table also
|
|
// contains a "≈", so matching on the glyph finds the explanation instead of
|
|
// the delta. (It did, on the first attempt at this test.)
|
|
const skip = screen.getByTestId('skip-delta-discover');
|
|
expect(skip).toHaveTextContent('≈-13');
|
|
expect(skip).toHaveAttribute('title', expect.stringContaining('not distinguishable from zero'));
|
|
// It must NOT be coloured as a real regression/improvement.
|
|
expect(skip.className).toContain('opacity-60');
|
|
|
|
// The completion delta clears its margin, so it renders plainly.
|
|
const completion = screen.getByTestId('completion-delta-discover');
|
|
expect(completion).toHaveTextContent('+28');
|
|
expect(completion.className).not.toContain('opacity-60');
|
|
|
|
// And the legend explains the glyph rather than leaving it a mystery.
|
|
expect(screen.getByText(/smaller than its own margin of error/i)).toBeInTheDocument();
|
|
});
|
|
|
|
// A delta is omitted entirely when the samples are too thin for a margin to
|
|
// mean anything — the server decides that, and the cell must simply show the
|
|
// rate rather than a bare "0".
|
|
test('a surface with no delta shows its rate and nothing else', async () => {
|
|
setupPage();
|
|
metricsMock.data = {
|
|
window_days: 30,
|
|
baseline: metric('manual', 'Manual library plays', { plays: 400 }),
|
|
groups: [
|
|
{
|
|
intent: 'go_to',
|
|
label: 'Go-to surfaces',
|
|
surfaces: [metric('radio', 'Radio', { plays: 1, skip_rate: 0 })]
|
|
}
|
|
]
|
|
};
|
|
render(SettingsPage);
|
|
await waitFor(() => expect(screen.getByText('Radio')).toBeInTheDocument());
|
|
expect(screen.queryByTestId('skip-delta-radio')).not.toBeInTheDocument();
|
|
expect(screen.queryByTestId('completion-delta-radio')).not.toBeInTheDocument();
|
|
});
|
|
|
|
test('surfaces without a breakdown render no toggle and no sub-rows', async () => {
|
|
setupPage();
|
|
metricsMock.data = {
|
|
window_days: 30,
|
|
baseline: null,
|
|
groups: [
|
|
{
|
|
intent: 'go_to',
|
|
label: 'Go-to surfaces',
|
|
surfaces: [metric('radio', 'Radio')]
|
|
}
|
|
]
|
|
};
|
|
render(SettingsPage);
|
|
await waitFor(() => expect(screen.getByText('Radio')).toBeInTheDocument());
|
|
expect(screen.queryByRole('button', { name: /radio/i })).not.toBeInTheDocument();
|
|
expect(screen.queryByText(/Taste picks/)).not.toBeInTheDocument();
|
|
});
|
|
});
|
|
|
|
describe('Settings page — API Token card', () => {
|
|
test('first click on Regenerate shows "Click again to confirm"', async () => {
|
|
setupPage();
|
|
render(SettingsPage);
|
|
await fireEvent.click(screen.getByRole('button', { name: /regenerate/i }));
|
|
await waitFor(() =>
|
|
expect(screen.getByRole('button', { name: /click again to confirm/i })).toBeInTheDocument()
|
|
);
|
|
expect(regenerateAPIToken).not.toHaveBeenCalled();
|
|
});
|
|
|
|
test('second click within 5s calls regenerateAPIToken', async () => {
|
|
setupPage();
|
|
(regenerateAPIToken as ReturnType<typeof vi.fn>).mockResolvedValue({ api_token: 'new_tok_xyz' });
|
|
render(SettingsPage);
|
|
await fireEvent.click(screen.getByRole('button', { name: /regenerate/i }));
|
|
await waitFor(() =>
|
|
expect(screen.getByRole('button', { name: /click again to confirm/i })).toBeInTheDocument()
|
|
);
|
|
await fireEvent.click(screen.getByRole('button', { name: /click again to confirm/i }));
|
|
await waitFor(() => expect(regenerateAPIToken).toHaveBeenCalled());
|
|
// The new key is shown once, with a way to copy it.
|
|
expect(await screen.findByText('new_tok_xyz')).toBeInTheDocument();
|
|
expect(screen.getByRole('button', { name: /^copy$/i })).toBeInTheDocument();
|
|
});
|
|
|
|
test('no token is shown or fetched before Regenerate', async () => {
|
|
setupPage();
|
|
render(SettingsPage);
|
|
await waitFor(() =>
|
|
expect(screen.getByRole('button', { name: /regenerate/i })).toBeInTheDocument()
|
|
);
|
|
expect(screen.queryByRole('button', { name: /^copy$/i })).toBeNull();
|
|
});
|
|
});
|
|
|
|
describe('Settings page — Subsonic password card', () => {
|
|
function mockLB() {
|
|
(createLBStatusQuery as ReturnType<typeof vi.fn>).mockReturnValue(
|
|
mockStatusStore({ enabled: false, token_set: false, last_scrobbled_at: null })
|
|
);
|
|
(createTokenMutation as ReturnType<typeof vi.fn>).mockReturnValue(mockMutationStore());
|
|
(createEnabledMutation as ReturnType<typeof vi.fn>).mockReturnValue(mockMutationStore());
|
|
}
|
|
|
|
test('with none set, Generate creates one on the first click and shows it once', async () => {
|
|
mockLB();
|
|
(getSubsonicPasswordStatus as ReturnType<typeof vi.fn>).mockResolvedValue({ enabled: false });
|
|
(generateSubsonicPassword as ReturnType<typeof vi.fn>).mockResolvedValue({ password: 'gen_pw_123' });
|
|
render(SettingsPage);
|
|
await waitFor(() => expect(screen.getByText(/no subsonic password is set/i)).toBeInTheDocument());
|
|
expect(screen.queryByRole('button', { name: /turn off/i })).not.toBeInTheDocument();
|
|
|
|
await fireEvent.click(screen.getByRole('button', { name: /^generate$/i }));
|
|
await waitFor(() => expect(generateSubsonicPassword).toHaveBeenCalledTimes(1));
|
|
await waitFor(() => expect(screen.getByText('gen_pw_123')).toBeInTheDocument());
|
|
expect(screen.getByText(/a subsonic password is set/i)).toBeInTheDocument();
|
|
});
|
|
|
|
test('with one set, Regenerate and Turn off each need a second click', async () => {
|
|
mockLB();
|
|
(getSubsonicPasswordStatus as ReturnType<typeof vi.fn>).mockResolvedValue({ enabled: true });
|
|
(clearSubsonicPassword as ReturnType<typeof vi.fn>).mockResolvedValue(undefined);
|
|
render(SettingsPage);
|
|
// The API token card has a Regenerate button too; the Subsonic card's is
|
|
// the one beside Turn off.
|
|
const turnOff = await screen.findByRole('button', { name: /turn off/i });
|
|
const subsonicRegen = within(turnOff.parentElement!).getByRole('button', { name: /^regenerate$/i });
|
|
|
|
await fireEvent.click(subsonicRegen);
|
|
expect(generateSubsonicPassword).not.toHaveBeenCalled();
|
|
expect(subsonicRegen).toHaveTextContent(/click again to confirm/i);
|
|
|
|
await fireEvent.click(turnOff);
|
|
expect(clearSubsonicPassword).not.toHaveBeenCalled();
|
|
await fireEvent.click(turnOff);
|
|
await waitFor(() => expect(clearSubsonicPassword).toHaveBeenCalledTimes(1));
|
|
await waitFor(() => expect(screen.getByText(/no subsonic password is set/i)).toBeInTheDocument());
|
|
});
|
|
});
|