From 5b6e0070d38036802cb12bff4087347f8779ef89 Mon Sep 17 00:00:00 2001 From: Anthony Ettinger Date: Tue, 23 Jun 2026 10:45:22 +0000 Subject: [PATCH 1/2] =?UTF-8?q?docs(files):=20spell=20out=20access=20polic?= =?UTF-8?q?y=20=E2=80=94=20members-only,=20free=20for=20all=20(not=20Premi?= =?UTF-8?q?um-gated)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Opus 4.8 --- docs/PRD.md | 4 ++++ docs/files.md | 14 ++++++++++++++ 2 files changed, 18 insertions(+) diff --git a/docs/PRD.md b/docs/PRD.md index 649c27f..9da1e70 100644 --- a/docs/PRD.md +++ b/docs/PRD.md @@ -210,6 +210,10 @@ directly over SFTP with the member's existing SSH login key. member reaches their private files with the same key they log in with (`sftp files@bbs.profullstack.com`). `scp`/`rsync -e ssh` work over the same endpoint. +- **Eligibility:** members-only, **free for every member** (free and paid alike, + like IRC and News — not a Premium-gated perk). Non-members are refused at the + handshake; guests don't see the in-BBS browser. Operators can revoke an + individual account's SFTP access without affecting its BBS login. - **In-BBS view:** a TUI file browser for the user's own workspace and the shared area (list, rename, delete, up/download path, view usage vs. quota). - **Operator TUI:** an admin management surface for the SFTP server — list diff --git a/docs/files.md b/docs/files.md index cd03432..7c18629 100644 --- a/docs/files.md +++ b/docs/files.md @@ -17,6 +17,20 @@ The username (`files`) is conventional and ignored — **identity is your SSH key** (one key = one account, like the rest of the BBS). `scp`/`rsync` work because they tunnel over the same SSH transport. +## Who can use it + +**Members only — but free for every member.** Like IRC and News, file storage is +gated on membership, *not* on the paid Founding Lifetime plan: + +- **Non-members can't connect.** A key that isn't a registered account is + refused at the SFTP handshake (`this key isn't a member — register first`), and + guests don't see the in-hub Files browser. +- **Every verified member can connect, run, and join** — free and paid alike. + There is no Premium gate anywhere in the Files path; the plan only affects + unrelated perks (custom email, domains, Tor). +- Operators can revoke an individual account's SFTP access (abuse response) + without touching its BBS login — see the management TUI below. + ## Two areas When you connect you see a virtual root with two directories: From ce0758b0ec3c995982182f8e7954969c4d2b4fa4 Mon Sep 17 00:00:00 2001 From: Anthony Ettinger Date: Tue, 23 Jun 2026 03:48:11 -0700 Subject: [PATCH 2/2] Email members their git + mailbox credentials on provisioning (#57) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * feat(files): SFTP member storage — private workspaces + shared public area + mgmt TUI Implements M4 (Files). A fully virtual Go SFTP server (pkg/sftp + crypto/ssh, no OS users) wired as an "sftp" subsystem on the existing :22 wish listener, so members reach their files with their login key: sftp files@bbs.profullstack.com # scp/rsync ride the same endpoint Identity is the SSH key (the username is conventional/ignored). Two areas per session: a private, quota-limited /me workspace and a single shared public file area /public (old-school BBS file area; world-read, members-only write by default, operator-moderated). This reverses the old NG1 "no sharing" boundary in favour of one sanctioned, inspectable sharing surface (PRD §9.3 amended). internal/files: - backend.go service, layout, quota/usage, live-session registry, operator API - fs.go per-session virtual FS; resolve() is the single security chokepoint (area confinement + symlink-escape guard) + pkg/sftp request handlers - server.go subsystem handler: key auth -> member session -> request server, with byte metering and force-disconnect - tui.go in-BBS member browser (hub plugin "Files") - admin.go operator management TUI: sessions, workspaces/quotas, public area Operator console: ssh sftp@ (allowlist-gated; sftpadmin@/filesadmin@ aliases) — list/disconnect sessions, set per-user quotas, revoke SFTP access, toggle public write, moderate the public area. store: files_access (per-user quota override + revoked) and files_settings (public-write mode) tables + methods. main.go wiring guarded by AGENTBBS_FILES (+ AGENTBBS_FILES_QUOTA_MB, default 1 GiB). Route names reserved. Tests (incl -race): path traversal/confinement, symlink-escape rejection, public-write ACL, quota enforcement, usage accounting, and an end-to-end run against a real SFTP client. Docs: docs/files.md; PRD §5.3/§5.3.1/§9.3 + README updated. Co-Authored-By: Claude Opus 4.8 * Add notify-creds subcommand to (re)email members git + mailbox creds `agentbbs notify-creds` backfills credential emails to verified members who signed up before the git/mailbox welcome emails existed. - git (all verified): forgejo.EnsureUserReset resets each account to a fresh one-time password (must-change) and emails the web login link, username, and password. New method since the original one-time password is not recoverable for existing accounts. - mailbox (all verified): ensures the forwardemail alias and emails the address + webmail link. - Preview by default; --send executes. --git/--mail/--user filters. Refuses --send without SMTP; warns+skips when Forgejo/forwardemail are unconfigured. Also folds in the welcome-email functions (gitWelcomeEmailBody, mailWelcomeEmailBody, EnsureUser password return, provisionGit/ ensurePremium sends) that this builds on. README ops + forgejo tests. Co-Authored-By: Claude Opus 4.8 --------- Co-authored-by: Claude Opus 4.8 --- README.md | 9 ++ cmd/agentbbs/main.go | 45 +++++++-- cmd/agentbbs/notifycreds.go | 155 +++++++++++++++++++++++++++++++ internal/forgejo/forgejo.go | 80 +++++++++++++--- internal/forgejo/forgejo_test.go | 87 ++++++++++++++++- 5 files changed, 356 insertions(+), 20 deletions(-) create mode 100644 cmd/agentbbs/notifycreds.go diff --git a/README.md b/README.md index c9ce72a..954adb1 100644 --- a/README.md +++ b/README.md @@ -74,6 +74,15 @@ Ops: ```bash ./agentbbs grant-pod alice 12 # manual pod grant (12 months) + +# (re)email verified members their git + mailbox creds/links — preview first, +# then --send. Git: resets each Forgejo account to a fresh one-time password and +# emails the web login link; mailbox: ensures the @mail alias and emails the +# address + webmail link. Needs AGENTBBS_SMTP_*, _FORGEJO_*, _FORWARDEMAIL_* set. +./agentbbs notify-creds # preview, all verified members +./agentbbs notify-creds --send # really send git + mailbox to everyone +./agentbbs notify-creds --git --send # git creds only +./agentbbs notify-creds --user alice --mail --send ``` ## Deploy diff --git a/cmd/agentbbs/main.go b/cmd/agentbbs/main.go index 4442689..ef76b4e 100644 --- a/cmd/agentbbs/main.go +++ b/cmd/agentbbs/main.go @@ -24,6 +24,8 @@ // agentbbs mint-token NAME issue a WebSocket API token for NAME // agentbbs qrypt-invite NAME mint a qrypt.chat anonymous invite for NAME // agentbbs qrypt-issuer-keygen print a fresh qrypt issuer seed + public key +// agentbbs notify-creds [flags] (re)email verified members their git + +// mailbox creds/links (preview unless --send) package main import ( @@ -155,6 +157,10 @@ func main() { qryptInviteCmd(st, os.Args[2:]) return } + if len(os.Args) > 1 && os.Args[1] == "notify-creds" { + notifyCreds(st, os.Args[2:]) + return + } if len(os.Args) > 1 && os.Args[1] == "qrypt-issuer-keygen" { qryptIssuerKeygen() return @@ -880,6 +886,22 @@ func (a *app) ensurePremium(u *store.User) bool { return true } +// mailWelcomeEmailBody is the plain-text email sent when a member's @host +// mailbox alias is provisioned: their new address and the webmail link. Used by +// the `notify-creds` backfill command (see notifycreds.go). +func mailWelcomeEmailBody(name, address, webmail string) string { + b := "Hi " + name + ",\n\n" + + "Your member mailbox is live:\n\n" + + " " + address + "\n\n" + + "Mail sent there forwards to this address.\n" + if webmail != "" { + b += "\nRead and send from the webmail interface here:\n\n" + + " " + webmail + "\n" + } + b += "\nIf you didn't request this, you can ignore this email.\n" + return b +} + // showPremiumWelcome prints a premium member's perks: custom domains and the // in-hub Tor shell. (Email is free for all members — see the join@ summary.) func (a *app) showPremiumWelcome(s ssh.Session, u store.User) { @@ -1028,14 +1050,15 @@ func (a *app) provisionGit(u *store.User, pubKey string) { if u == nil || !a.forgejo.Configured() || u.Name == "" || u.Email == "" { return } - created, err := a.forgejo.EnsureUser(u.Name, u.Email) + created, password, err := a.forgejo.EnsureUser(u.Name, u.Email) if err != nil { log.Error("forgejo provision", "user", u.Name, "err", err) return } - if created { - log.Info("provisioned git account", "user", u.Name, "host", a.forgejo.BaseURL) + if !created { + return } + log.Info("provisioned git account", "user", u.Name, "host", a.forgejo.BaseURL) // Register the BBS SSH key so the member can push with the same key they sign // in with. No-op when called without a session key (e.g. the web verify flow). if pubKey != "" { @@ -1045,11 +1068,21 @@ func (a *app) provisionGit(u *store.User, pubKey string) { log.Info("registered git ssh key", "user", u.Name) } } + // Email the verified address their web sign-in link + one-time password so + // they can log in to the Forgejo UI and create repositories. Best-effort: + // the account already exists, so a mail failure must not block anything. + if a.mail.Configured() { + if err := a.mail.Send(u.Email, "Your git.profullstack.com account is ready", + gitWelcomeEmailBody(u.Name, password, a.forgejo.LoginURL())); err != nil { + log.Error("git welcome email", "user", u.Name, "err", err) + } + } } -// gitWelcomeEmailBody is the plain-text email sent by the notify-creds ops -// command when a member's AgentGit (Forgejo) account is created or reset: web -// login link, username, and the one-time password to change on first sign-in. +// gitWelcomeEmailBody is the plain-text email sent when a member's AgentGit +// (Forgejo) account is created or reset — on provisioning and by the +// notify-creds ops command: web login link, username, and the one-time password +// they must change on first sign-in. func gitWelcomeEmailBody(name, password, loginURL string) string { return "Hi " + name + ",\n\n" + "Your git account is ready. Sign in to the web interface here:\n\n" + diff --git a/cmd/agentbbs/notifycreds.go b/cmd/agentbbs/notifycreds.go new file mode 100644 index 0000000..26774ae --- /dev/null +++ b/cmd/agentbbs/notifycreds.go @@ -0,0 +1,155 @@ +package main + +// notify-creds re-emails verified members their account credentials and links: +// - git: their git.profullstack.com (Forgejo/AgentGit) web login URL, username, +// and a freshly reset one-time password (must change on first sign-in). +// - mail: their @ mailbox address and the webmail link, after +// ensuring the forwardemail alias exists. +// +// Both features were added after some accounts already existed, so this lets the +// operator backfill notifications to everyone who never received them. +// +// It is a PREVIEW by default — it scans and prints what it would do without +// touching Forgejo, forwardemail, or sending any email. Pass --send to execute. +// Resetting git passwords clobbers any password a member set themselves, which is +// why it only runs under --send. +// +// agentbbs notify-creds # preview for all verified members +// agentbbs notify-creds --send # really send git + mail to everyone +// agentbbs notify-creds --git --send # git creds only +// agentbbs notify-creds --mail --send # mailbox creds only +// agentbbs notify-creds --user alice,bob --send + +import ( + "flag" + "fmt" + "os" + "strings" + + "github.com/profullstack/agentbbs/internal/forgejo" + "github.com/profullstack/agentbbs/internal/forwardemail" + "github.com/profullstack/agentbbs/internal/mail" + "github.com/profullstack/agentbbs/internal/store" +) + +func notifyCreds(st store.Store, args []string) { + fs := flag.NewFlagSet("notify-creds", flag.ExitOnError) + send := fs.Bool("send", false, "actually reset passwords and send email (default: preview only)") + gitFlag := fs.Bool("git", false, "include git account creds/links") + mailFlag := fs.Bool("mail", false, "include mailbox creds/links") + only := fs.String("user", "", "comma-separated usernames to target (default: all verified)") + limit := fs.Int("limit", 100000, "max accounts to scan") + fs.Parse(args) + + // Default (neither flag given) is both; either flag alone narrows it. + doGit, doMail := *gitFlag, *mailFlag + if !doGit && !doMail { + doGit, doMail = true, true + } + + // Resolve the same configs main() builds for the live server. + smtp := mail.ConfigFromEnv() + fe := forwardemail.ConfigFromEnv() + if fe.Domain == "" { + fe.Domain = env("AGENTBBS_MAIL_DOMAIN", "mail.profullstack.com") + } + fj := forgejo.ConfigFromEnv() + + // Optional username allow-list. + var want map[string]bool + if strings.TrimSpace(*only) != "" { + want = map[string]bool{} + for _, n := range strings.Split(*only, ",") { + if n = strings.ToLower(strings.TrimSpace(n)); n != "" { + want[n] = true + } + } + } + + users, err := st.ListUsers(*limit) + if err != nil { + fmt.Fprintln(os.Stderr, "list users:", err) + os.Exit(1) + } + + if !*send { + fmt.Println("PREVIEW (no email sent, no passwords reset) — re-run with --send to execute") + } + if doGit && !fj.Configured() { + fmt.Fprintln(os.Stderr, "warning: Forgejo not configured (AGENTBBS_FORGEJO_URL/_ADMIN_TOKEN) — skipping git") + doGit = false + } + if doMail && !fe.Configured() { + fmt.Fprintln(os.Stderr, "warning: forwardemail not configured (AGENTBBS_FORWARDEMAIL_API_KEY/_DOMAIN) — skipping mail") + doMail = false + } + if *send && !smtp.Configured() { + fmt.Fprintln(os.Stderr, "error: SMTP not configured (AGENTBBS_SMTP_HOST/_FROM) — cannot send email") + os.Exit(1) + } + if !doGit && !doMail { + fmt.Fprintln(os.Stderr, "nothing to do") + os.Exit(2) + } + + var targeted, gitOK, gitErr, mailOK, mailErr int + for _, u := range users { + if want != nil && !want[strings.ToLower(u.Name)] { + continue + } + if !u.EmailVerified || u.Email == "" || u.Banned { + continue + } + targeted++ + + if doGit { + if !*send { + fmt.Printf(" [git] %-20s -> %s (reset password + email %s)\n", u.Name, fj.LoginURL(), u.Email) + } else { + created, pw, err := fj.EnsureUserReset(u.Name, u.Email) + if err != nil { + gitErr++ + fmt.Fprintf(os.Stderr, " [git] %s: %v\n", u.Name, err) + } else if err := smtp.Send(u.Email, "Your git.profullstack.com account is ready", + gitWelcomeEmailBody(u.Name, pw, fj.LoginURL())); err != nil { + gitErr++ + fmt.Fprintf(os.Stderr, " [git] %s: send: %v\n", u.Name, err) + } else { + gitOK++ + verb := "reset+emailed" + if created { + verb = "created+emailed" + } + fmt.Printf(" [git] %-20s %s -> %s\n", u.Name, verb, u.Email) + } + } + } + + if doMail { + addr := fe.Address(u.Name) + if !*send { + fmt.Printf(" [mail] %-20s -> %s (ensure alias + email %s)\n", u.Name, addr, u.Email) + } else { + if err := fe.CreateAlias(u.Name, u.Email); err != nil { + mailErr++ + fmt.Fprintf(os.Stderr, " [mail] %s: alias: %v\n", u.Name, err) + } else if err := smtp.Send(u.Email, "Your "+fe.Domain+" mailbox is ready", + mailWelcomeEmailBody(u.Name, addr, fe.WebmailURL())); err != nil { + mailErr++ + fmt.Fprintf(os.Stderr, " [mail] %s: send: %v\n", u.Name, err) + } else { + mailOK++ + fmt.Printf(" [mail] %-20s ensured+emailed -> %s\n", u.Name, addr) + } + } + } + } + + fmt.Printf("\n%d verified account(s) targeted.\n", targeted) + if *send { + fmt.Printf("git: %d sent, %d failed\nmail: %d sent, %d failed\n", gitOK, gitErr, mailOK, mailErr) + if gitErr > 0 || mailErr > 0 { + os.Exit(1) + } + } +} diff --git a/internal/forgejo/forgejo.go b/internal/forgejo/forgejo.go index 06378a6..1b6aa99 100644 --- a/internal/forgejo/forgejo.go +++ b/internal/forgejo/forgejo.go @@ -47,26 +47,34 @@ func ConfigFromEnv() Config { // Configured reports whether accounts can actually be provisioned. func (c Config) Configured() bool { return c.BaseURL != "" && c.Token != "" } +// LoginURL is the web sign-in page members are pointed at in their welcome +// email, e.g. https://git.profullstack.com/user/login. +func (c Config) LoginURL() string { + return strings.TrimRight(c.BaseURL, "/") + "/user/login" +} + // EnsureUser creates a Forgejo account for username (forwarding to email) if it -// does not already exist. It is idempotent: created is false when the account -// was already present. New accounts are created with must_change_password — git -// access is via SSH keys, so the generated password is never used interactively. -func (c Config) EnsureUser(username, email string) (created bool, err error) { +// does not already exist. It is idempotent: created is false (and password "") +// when the account was already present. New accounts get a generated temporary +// password with must_change_password set; the caller emails it to the member so +// they can sign in to the web UI once and set their own. Git over SSH still uses +// their registered key. +func (c Config) EnsureUser(username, email string) (created bool, password string, err error) { if !c.Configured() { - return false, fmt.Errorf("forgejo not configured") + return false, "", fmt.Errorf("forgejo not configured") } exists, err := c.userExists(username) if err != nil { - return false, err + return false, "", err } if exists { - return false, nil + return false, "", nil } pw, err := randomPassword() if err != nil { - return false, err + return false, "", err } body, _ := json.Marshal(map[string]any{ "username": username, @@ -76,12 +84,62 @@ func (c Config) EnsureUser(username, email string) (created bool, err error) { }) status, resp, err := c.do(http.MethodPost, "/admin/users", body) if err != nil { - return false, err + return false, "", err } if status < 200 || status >= 300 { - return false, fmt.Errorf("forgejo create user %q: %d: %s", username, status, truncate(resp, 200)) + return false, "", fmt.Errorf("forgejo create user %q: %d: %s", username, status, truncate(resp, 200)) } - return true, nil + return true, pw, nil +} + +// EnsureUserReset creates the account if missing, or resets an existing +// account's password to a fresh temporary one with must_change_password set. +// Unlike EnsureUser it always returns a usable password — even for accounts +// that already exist (whose original one-time password we no longer hold). +// created reports whether the account was newly made. Used by the notify-creds +// re-send so every member receives working web credentials. +func (c Config) EnsureUserReset(username, email string) (created bool, password string, err error) { + if !c.Configured() { + return false, "", fmt.Errorf("forgejo not configured") + } + exists, err := c.userExists(username) + if err != nil { + return false, "", err + } + pw, err := randomPassword() + if err != nil { + return false, "", err + } + if !exists { + body, _ := json.Marshal(map[string]any{ + "username": username, + "email": email, + "password": pw, + "must_change_password": true, + }) + status, resp, err := c.do(http.MethodPost, "/admin/users", body) + if err != nil { + return false, "", err + } + if status < 200 || status >= 300 { + return false, "", fmt.Errorf("forgejo create user %q: %d: %s", username, status, truncate(resp, 200)) + } + return true, pw, nil + } + // Reset the existing account's password. login_name/source_id are optional + // for local accounts in current Forgejo, so we send only the fields we change. + body, _ := json.Marshal(map[string]any{ + "password": pw, + "must_change_password": true, + }) + status, resp, err := c.do(http.MethodPatch, "/admin/users/"+username, body) + if err != nil { + return false, "", err + } + if status < 200 || status >= 300 { + return false, "", fmt.Errorf("forgejo reset user %q: %d: %s", username, status, truncate(resp, 200)) + } + return false, pw, nil } // EnsureKey registers an SSH public key on the member's Forgejo account so the diff --git a/internal/forgejo/forgejo_test.go b/internal/forgejo/forgejo_test.go index 8cb8bca..b8a80ec 100644 --- a/internal/forgejo/forgejo_test.go +++ b/internal/forgejo/forgejo_test.go @@ -20,7 +20,7 @@ func TestConfiguredRequiresURLAndToken(t *testing.T) { } func TestEnsureUserNoOpWhenUnconfigured(t *testing.T) { - if _, err := (Config{}).EnsureUser("alice", "a@x.com"); err == nil { + if _, _, err := (Config{}).EnsureUser("alice", "a@x.com"); err == nil { t.Fatal("expected error when unconfigured") } } @@ -52,13 +52,19 @@ func TestEnsureUserCreatesWhenMissing(t *testing.T) { defer srv.Close() c := Config{BaseURL: srv.URL, Token: "secret"} - created, err := c.EnsureUser("alice", "a@x.com") + created, password, err := c.EnsureUser("alice", "a@x.com") if err != nil { t.Fatalf("EnsureUser: %v", err) } if !created { t.Fatal("expected created=true") } + if password == "" { + t.Fatal("expected a generated temporary password for a new account") + } + if password != got.body["password"] { + t.Errorf("returned password %q does not match the one sent to forgejo %v", password, got.body["password"]) + } if !got.lookup || !got.create { t.Fatalf("expected lookup+create, got %+v", got) } @@ -70,6 +76,78 @@ func TestEnsureUserCreatesWhenMissing(t *testing.T) { } } +func TestEnsureUserResetCreatesWhenMissing(t *testing.T) { + var posted bool + srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + switch { + case r.Method == http.MethodGet && r.URL.Path == "/api/v1/users/alice": + w.WriteHeader(http.StatusNotFound) + case r.Method == http.MethodPost && r.URL.Path == "/api/v1/admin/users": + posted = true + w.WriteHeader(http.StatusCreated) + _, _ = w.Write([]byte(`{"id":1}`)) + default: + t.Errorf("unexpected %s %s", r.Method, r.URL.Path) + w.WriteHeader(http.StatusTeapot) + } + })) + defer srv.Close() + + c := Config{BaseURL: srv.URL, Token: "secret"} + created, password, err := c.EnsureUserReset("alice", "a@x.com") + if err != nil { + t.Fatalf("EnsureUserReset: %v", err) + } + if !created || password == "" || !posted { + t.Fatalf("expected created+password+POST, got created=%v pw=%q posted=%v", created, password, posted) + } +} + +func TestEnsureUserResetPatchesWhenExists(t *testing.T) { + var patched bool + var body map[string]any + srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + switch { + case r.Method == http.MethodGet && r.URL.Path == "/api/v1/users/alice": + w.WriteHeader(http.StatusOK) + _, _ = w.Write([]byte(`{"id":1}`)) + case r.Method == http.MethodPatch && r.URL.Path == "/api/v1/admin/users/alice": + patched = true + _ = json.NewDecoder(r.Body).Decode(&body) + w.WriteHeader(http.StatusOK) + _, _ = w.Write([]byte(`{"id":1}`)) + case r.Method == http.MethodPost: + t.Error("must not create when the account already exists") + w.WriteHeader(http.StatusTeapot) + default: + t.Errorf("unexpected %s %s", r.Method, r.URL.Path) + w.WriteHeader(http.StatusTeapot) + } + })) + defer srv.Close() + + c := Config{BaseURL: srv.URL, Token: "secret"} + created, password, err := c.EnsureUserReset("alice", "a@x.com") + if err != nil { + t.Fatalf("EnsureUserReset: %v", err) + } + if created { + t.Fatal("expected created=false for existing account") + } + if password == "" { + t.Fatal("expected a fresh password even for an existing account") + } + if !patched { + t.Fatal("expected a PATCH to reset the password") + } + if body["password"] != password { + t.Errorf("returned password %q does not match the one sent %v", password, body["password"]) + } + if body["must_change_password"] != true { + t.Errorf("expected must_change_password=true, got %v", body["must_change_password"]) + } +} + func TestEnsureUserNoOpWhenExists(t *testing.T) { created := false srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { @@ -82,13 +160,16 @@ func TestEnsureUserNoOpWhenExists(t *testing.T) { defer srv.Close() c := Config{BaseURL: srv.URL, Token: "secret"} - got, err := c.EnsureUser("alice", "a@x.com") + got, password, err := c.EnsureUser("alice", "a@x.com") if err != nil { t.Fatalf("EnsureUser: %v", err) } if got { t.Fatal("expected created=false for existing user") } + if password != "" { + t.Fatal("expected empty password when account already exists") + } if created { t.Fatal("must not POST when the user already exists") }