admin
f037be7a6a
gates / gates (push) Successful in 48s
R-970: /api/config, /api/config/hash, /api/config/apply removed (they read and replaced controller.yaml with every secret, reachable with the box's own hub API key, unsigned; nothing called them). The hub-key Bearer door on /api/selfupdate/ and /api/geo/ and the matching CSRF exemption are gone; the dashboard keeps using those with a session. The route table is buildMux, so a test drives the real one. Data tab: the export password field is autocomplete=new-password with a non-login name; the 2nd copy's status rows that repeated the form are gone (the no-target reason moves into the form). R-1103: app_fields.html loses its installed-only branches (no page serves them since R-1095); the tests that rendered that dead path are retired, their rules asserted on the settings tab (R-694 moved there). Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
46 lines
1.9 KiB
Go
46 lines
1.9 KiB
Go
package web
|
|
|
|
import (
|
|
"net/http"
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
|
|
"gitea.dooplex.hu/admin/felhom-controller/internal/stacks"
|
|
)
|
|
|
|
// R-694 (v0.275.0) — an installed app whose admin login was GENERATED by a restore: the page shows no value and no eye
|
|
// for it and says the old password is the one that works; an app without that record shows the eye.
|
|
//
|
|
// v0.322.0 (R-1103): moved from the install form (which no longer renders for an installed app, R-1095) to the settings
|
|
// tab, through the production route (s.ServeHTTP) on a real stack manager.
|
|
// RED-PROOF (2026-10-16, REPORT): with the `{{- if .Restored}}` branch removed from the login panel, this failed at
|
|
// „the restored login is offered for reveal".
|
|
func TestR694_TheSettingsTabDoesNotOfferAGeneratedLogin(t *testing.T) {
|
|
s := tuningHarness(t, tuningEnv())
|
|
dir := filepath.Join(s.cfg.Paths.StacksDir, "calibre-web")
|
|
if err := stacks.SaveAppConfig(dir, &stacks.AppConfig{Deployed: true, Env: tuningEnv(), RestoredLogins: []string{"ADMIN_PASSWORD"}}, nil, nil); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
_ = s.stackMgr.ScanStacks()
|
|
rec := appGet(t, s, "/apps/calibre-web/settings")
|
|
if rec.Code != http.StatusOK {
|
|
t.Fatalf("GET settings = %d", rec.Code)
|
|
}
|
|
body := rec.Body.String()
|
|
if strings.Contains(body, tuningPassword) {
|
|
t.Fatal("the restore-generated password is in the page")
|
|
}
|
|
if strings.Contains(body, `data-login-reveal="ADMIN_PASSWORD"`) {
|
|
t.Fatal("the restored login is offered for reveal")
|
|
}
|
|
if !strings.Contains(body, `data-login-restored="ADMIN_PASSWORD"`) {
|
|
t.Fatal("the page does not say to use the old password")
|
|
}
|
|
// Control: without the record the same app offers the eye.
|
|
plain := tuningHarness(t, tuningEnv())
|
|
if b := appGet(t, plain, "/apps/calibre-web/settings").Body.String(); !strings.Contains(b, `data-login-reveal="ADMIN_PASSWORD"`) || strings.Contains(b, `data-login-restored`) {
|
|
t.Fatal("control: an app without restored_logins does not offer its eye")
|
|
}
|
|
}
|