umputun / tg-spam / 24625754234

83%

push

github

fix(server): skip random password when SERVER_AUTH_HASH is set (#394)

* fix(server): skip random password when SERVER_AUTH_HASH is set

When SERVER_AUTH was left at its "auto" default but SERVER_AUTH_HASH was
explicitly set, activateServer still generated a random plain password.
The inner authMiddleware then required that unknown password, breaking
login to /, /check, and other gated routes when only AUTH_HASH was
configured.

With AuthHash present, leave authPassswd empty so authMiddleware short-
circuits and only bcrypt hash auth is enforced. Also drop a dead local
authHash that was only logged, never used.

Related to #381

* test(server): tighten auth-hash regression coverage and doc clarity

- extract runActivateServerForTest helper
- split Test_activateServerAuthHashOnly into 4 sub-tests covering webUI
  and authApi routes with both correct and wrong passwords, asserting
  exact StatusOK / StatusUnauthorized codes
- add Test_activateServerAuthHashOverridesExplicitPasswd pinning hash-
  wins precedence when both SERVER_AUTH and SERVER_AUTH_HASH are set
- reword inline comment in activateServer to accurately describe the
  two-layer auth mechanism
- update README to drop stale "hash is printed" wording and state that
  --server.auth-hash alone is sufficient

9 of 9 new or added lines in 1 file covered. (100.0%)

6995 of 8433 relevant lines covered (82.95%)

258.2 hits per line