paskal / tg-spam / 24914110479

83%

master: 79%

push

github

restore configurable basic-auth user

The previous review-fix squash hardcoded the basic auth username to
"tg-spam" inside checkBasicAuth and dropped both `s.AuthUser` on
webapi.Server and `AuthUser` on ServerSettings. That breaks downstream
deployments (e.g. tg-spam-manager) that proxy the bot UI with
per-instance credentials and rely on a configurable username; their
existing bots store `auth_user` in the per-bot settings DB and the
sudden hardcode forces a manual migration.

This restores the field on both the runtime Config and the persisted
ServerSettings, threads it through main.go, and updates checkBasicAuth
to look up the active user with the same precedence as the hash:
AppSettings.Server.AuthUser → startup AuthUser → "tg-spam" default.
The default preserves the post-squash behaviour for any deployment
that doesn't set AuthUser, so this is fully backwards compatible.

Tests cover the three precedence cases plus the existing rejection
path.

16 of 16 new or added lines in 2 files covered. (100.0%)

7860 of 9456 relevant lines covered (83.12%)

231.87 hits per line