chrisandClaude Opus 5.5
586acdbeab
- Followers/following lists (paginated), 'follows you', remove a follower - Blocking severs follows both ways and hides each user from the other (profile 404s, search, follows); the blocker sees activity hidden - Reports for moderation (App Store guideline 1.2) - First account on a server becomes admin; admins see the report queue, resolve reports, and suspend accounts (signs out, blocks login, hides the profile, stops sharing). set-role script to promote/demote - users.onboardedAt drives first-run onboarding; existing accounts are backfilled as already onboarded. Empty PATCH /me no longer 500s - Remove Spotify account sign-in and polling: Spotify caps new apps at 5 accounts, so Spotify arrives via its Last.fm/ListenBrainz link or the Android reader. App-level catalog search stays for exact links - Shared: QR code generation and profile-link parsing (verified with jsQR) - Integration test timeout raised; password hashing is slow by design Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MzFywujuH9TiuXbr9vjoX8
64 lines
3.1 KiB
TypeScript
64 lines
3.1 KiB
TypeScript
import { createHash } from 'node:crypto';
|
|
import { eq } from 'drizzle-orm';
|
|
import { afterEach, describe, expect, it, vi } from 'vitest';
|
|
import { db, schema } from '../src/db';
|
|
import { decrypt } from '../src/lib/crypto';
|
|
import { lastfmSignature } from '../src/providers/lastfm';
|
|
import { bearer, createUser, json, routeFetch, useTestApp } from './helpers';
|
|
|
|
const app = useTestApp();
|
|
afterEach(() => vi.unstubAllGlobals());
|
|
|
|
const stateFrom = (url: string) => decodeURIComponent(url).match(/state=([^&]+)/)![1]!;
|
|
|
|
describe('Last.fm sign-in', () => {
|
|
it('signs requests per the Last.fm rules: sorted name+value pairs, secret appended, md5', () => {
|
|
const expected = createHash('md5').update('api_keykmethodmtokent' + 's').digest('hex');
|
|
expect(lastfmSignature({ token: 't', method: 'm', api_key: 'k' }, 's')).toBe(expected);
|
|
});
|
|
|
|
it('runs the web auth flow and stores the username and session key', async () => {
|
|
let sessionUrl = '';
|
|
vi.stubGlobal(
|
|
'fetch',
|
|
routeFetch([[/auth\.getSession/, (url) => ((sessionUrl = url), json({ session: { name: 'RJ', key: 'sk-123', subscriber: 0 } }))]]),
|
|
);
|
|
const { token, user } = await createUser(app(), 'alice');
|
|
const start = await app().inject({
|
|
method: 'POST',
|
|
url: '/connections/lastfm/authorize',
|
|
headers: bearer(token),
|
|
payload: { client: 'mobile', returnTo: 'musicshare://settings' },
|
|
});
|
|
const authUrl = new URL(start.json().url);
|
|
expect(authUrl.host).toBe('www.last.fm');
|
|
expect(authUrl.searchParams.get('api_key')).toBe('test-lastfm-key');
|
|
const cb = new URL(authUrl.searchParams.get('cb')!);
|
|
expect(cb.href).toMatch(/^https:\/\/api\.test\/connections\/lastfm\/callback\?state=/);
|
|
|
|
const done = await app().inject({ url: `/connections/lastfm/callback?state=${stateFrom(cb.href)}&token=lfm-token` });
|
|
expect(done.statusCode).toBe(302);
|
|
expect(done.headers.location).toBe('musicshare://settings?connected=lastfm');
|
|
|
|
const params = new URL(sessionUrl).searchParams;
|
|
expect(params.get('api_sig')).toBe(
|
|
lastfmSignature({ api_key: 'test-lastfm-key', method: 'auth.getSession', token: 'lfm-token' }, 'test-lastfm-secret'),
|
|
);
|
|
const [row] = await db.select().from(schema.connections).where(eq(schema.connections.userId, user.id));
|
|
expect(row).toMatchObject({ provider: 'lastfm', externalUserId: 'RJ' });
|
|
expect(decrypt(row!.accessTokenEnc!)).toBe('sk-123');
|
|
});
|
|
|
|
it('returns to the app with an error if the user cancels', async () => {
|
|
const { token } = await createUser(app(), 'alice');
|
|
const start = await app().inject({ method: 'POST', url: '/connections/lastfm/authorize', headers: bearer(token), payload: { client: 'web' } });
|
|
const state = stateFrom(new URL(start.json().url).searchParams.get('cb')!);
|
|
const done = await app().inject({ url: `/connections/lastfm/callback?state=${state}` });
|
|
expect(done.headers.location).toMatch(/^http:\/\/web\.test\/settings\?error=/);
|
|
});
|
|
|
|
it('rejects replayed or forged states', async () => {
|
|
expect((await app().inject({ url: '/connections/lastfm/callback?state=forged&token=x' })).statusCode).toBe(400);
|
|
});
|
|
});
|