v0.324.0: the database password comes back with the data (R-1106, R-127b, R-926); restic 0.19.1 (R-1107); R-1108, R-1065, R-1017; dashboard hardening (R-983, R-976)

controller/internal/web/plex_claim_test.go

@@ -81,3 +81,47 @@ func TestPlexDonePress_RefusedWhileUnclaimed(t *testing.T) {
 		t.Fatalf("„Kész” on a claimed Plex: HTTP %d, want 200", c)
 	}
 }
+
+// R-1065: a claim that Plex confirms schedules the media wiring (which sets the libraries — it could
+// not while Plex was unclaimed); a claim Plex refuses, or one Plex never reports as claimed, does not.
+// The consequence asserted is the armed wiring timer — the same one a media app coming up arms.
+// COMPANION RED-PROOF: drop the RunMediaWiringSoon call in applyPlexClaim → the claimed case fails.
+func TestPlexClaim_TriggersMediaWiring(t *testing.T) {
+	oldClaim, oldClaimed, oldPoll := plexClaim, plexClaimed, plexClaimPoll
+	t.Cleanup(func() { plexClaim, plexClaimed, plexClaimPoll = oldClaim, oldClaimed, oldPoll })
+	plexClaimPoll = 0
+	for _, c := range []struct {
+		name       string
+		status     int
+		claimed    bool
+		wantErr    bool
+		wantWiring bool
+	}{
+		{"claimed", http.StatusOK, true, false, true},
+		{"plex refused the code", http.StatusUnauthorized, true, true, false},
+		{"plex never says claimed", http.StatusOK, false, true, false},
+	} {
+		t.Run(c.name, func(t *testing.T) {
+			s := gateHarness(t)
+			t.Cleanup(func() {
+				s.mediaMu.Lock()
+				if s.mediaSoonTmr != nil {
+					s.mediaSoonTmr.Stop()
+				}
+				s.mediaMu.Unlock()
+			})
+			plexClaim = func(string) (int, error) { return c.status, nil }
+			plexClaimed = func() bool { return c.claimed }
+			err := s.applyPlexClaim("claim-AbCdEf123456789xyz")
+			if (err != nil) != c.wantErr {
+				t.Fatalf("applyPlexClaim err=%v, want error=%v", err, c.wantErr)
+			}
+			s.mediaMu.Lock()
+			armed := s.mediaSoonTmr != nil
+			s.mediaMu.Unlock()
+			if armed != c.wantWiring {
+				t.Errorf("media wiring scheduled=%v, want %v", armed, c.wantWiring)
+			}
+		})
+	}
+}