peter 513dd8175a fix(auth): becoming admin through ADMIN_EMAILS drops the password, on any sign-in ...

The promotion revoke guessed from today's SMTP state whether the password was trustworthy, and ran
only when the account was adopted. Both guesses failed: a row verified while SMTP was off stays
"verified" after SMTP is configured, and a later sign-in matched by Google identity promoted the
account with no revoke at all. Either way a stranger's password and session could become admin.

Now one rule, where the promotion happens: when ADMIN_EMAILS turns a non-admin account into an
admin and it holds a password, the password goes and every session ends; the owner, signed in
through Google at that moment, sets a new one in Settings. An account that already is admin keeps
its password. Tests: the activated squat, the SMTP case, the later sign-in (all three red without
the rule) and an admin's own sign-in.

2026-10-05 01:13:06 +02:00

..

fixtures

feat!: remove direct messaging (chat)

2026-10-05 00:19:38 +02:00

conftest.py

fix(gate): the plan-code guard catches bare sprint and phase codes, and the purge takes the P ones

2026-10-05 00:50:36 +02:00

test_abuse_limits.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_adapters.py

fix: name the error yt-dlp actually raises for a cookie-emptied client set

2026-09-16 04:29:13 +02:00

test_admin_invites.py

fix(api): a token hiccup is not "reconnect"; reorders and approvals are one unit each

2026-09-19 19:19:29 +02:00

test_admin_logs.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_admin_pending_access.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_audit_count_rows.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_auth_session.py

fix(auth): Google adoption revokes the password of a never-activated account

2026-10-05 00:19:50 +02:00

test_autotag_orphans.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_autotag_topics.py

feat(i18n): the server's closed English vocabularies named in the reader's language (E30 S2)

2026-09-29 21:21:19 +02:00

test_body_limit.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_canonical_patterns.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_channel_backfill.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_channel_details_refresh.py

fix(channels): a channel YouTube no longer returns is not asked for on every view

2026-09-27 13:58:23 +02:00

test_channel_list_index_only.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_channel_subscribe_upstream.py

fix(logs): deep-review round 1 — say each failure once, and scrub it everywhere

2026-09-18 03:16:15 +02:00

test_channel_tags.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_collation.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_config_commit_ownership.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_db_lane.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_debug_sessions.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_diagnostics.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_discover.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_download_credentials.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_download_deprioritize.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_download_errors.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_download_failure_catalog.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_download_job_locks.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_download_limits.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_download_output.py

fix(downloads): classify media_kind from a file probe, not yt-dlp info

2026-08-30 03:32:14 +02:00

test_download_ref_count.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_download_share_notice.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_download_transitions.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_downloads_finalize.py

style: apply ruff format across backend + scripts (line-length 100)

2026-08-23 07:43:06 +02:00

test_email_alerts.py

feat(email): write to people in their own language (E9.5 S7)

2026-09-04 20:29:33 +02:00

test_email_canonical.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_email_html_part.py

feat(email): write to people in their own language (E9.5 S7)

2026-09-04 20:29:33 +02:00

test_empty_listing_guards.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_facebook_impersonation.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_failure_lines.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_feed_cursor.py

test: a handler that flushes a write and never commits it fails its test

2026-09-19 19:19:30 +02:00

test_feed_fallback.py

fix(sync): only a refusal about the channel spends its fallback window

2026-09-19 05:54:19 +02:00

test_feed_keyset.py

style: apply ruff format across backend + scripts (line-length 100)

2026-08-23 07:43:06 +02:00

test_feed_relevance_window.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_feed_sort_indexes.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_feed_views.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_ffmpeg_callbacks.py

style: apply ruff format across backend + scripts (line-length 100)

2026-08-23 07:43:06 +02:00

test_followed_channels.py

fix(sync): read a dark RSS feed through the API instead

2026-09-19 04:51:31 +02:00

test_formats.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_gc.py

perf(downloads): de-prioritize worker transcodes + idle-back-off polls to stop LAN slowdown

2026-08-28 02:37:56 +02:00

test_google_callback.py

fix(auth): becoming admin through ADMIN_EMAILS drops the password, on any sign-in

2026-10-05 01:13:06 +02:00

test_hls_reaper.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_http_details.py

fix(i18n): every refusal the API answers is structured and said in the reader's language

2026-09-19 07:34:17 +02:00

test_last_login.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_like_literals.py

fix(search): typed text is a literal in every LIKE pattern

2026-09-19 01:33:32 +02:00

test_links.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_log_pii.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_logger_names.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_login_states.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_logs.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_logsink.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_mail_language.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_maintenance_lifecycle.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_me_email_flag.py

fix: address the feature review — accurate copy, reachable controls, real coverage

2026-09-01 23:31:49 +02:00

test_me_search_source.py

fix(search): the live-search tooltip says what a search costs

2026-10-04 17:53:19 +02:00

test_migration_0098.py

fix(migrations): dropping the demo also takes its reset job's interval-change audit rows

2026-10-05 00:19:50 +02:00

test_migration_rerun_invalid_index.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_migrations.py

style: apply ruff format across backend + scripts (line-length 100)

2026-08-23 07:43:06 +02:00

test_my_status_deep.py

fix(stats): the full-history ratio counts the requested channels on both sides

2026-09-29 22:46:04 +02:00

test_naming.py

style: apply ruff format across backend + scripts (line-length 100)

2026-08-23 07:43:06 +02:00

test_not_found_detail.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_notifications.py

style: apply ruff format across backend + scripts (line-length 100)

2026-08-23 07:43:06 +02:00

test_oauth_redirect.py

style: apply ruff format across backend + scripts (line-length 100)

2026-08-23 07:43:06 +02:00

test_og.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_override_dep_convention.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_playlist_add_position.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_playlist_merge.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_playlist_move.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_playlist_position_lock.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_playlist_sync_claim.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_playlist_sync_lock_order.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_plex_admin_routes.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_plex_cards.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_plex_clear_resume_push.py

test: a handler that flushes a write and never commits it fails its test

2026-09-19 19:19:30 +02:00

test_plex_client.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_plex_collection_sort.py

test: a handler that flushes a write and never commits it fails its test

2026-09-19 19:19:30 +02:00

test_plex_collections_filter.py

test: a handler that flushes a write and never commits it fails its test

2026-09-19 19:19:30 +02:00

test_plex_detail.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_plex_discover.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_plex_facets_grid_parity.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_plex_facets.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_plex_field_scoped_search.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_plex_finish.py

fix(api): mutations answer ok; route helpers flush and leave the commit to the handler

2026-09-19 18:21:06 +02:00

test_plex_hls_file_route.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_plex_image_sizes.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_plex_jsonb_normalize.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_plex_keyword_filter.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_plex_lang.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_plex_last_watched_sort.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_plex_overlay.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_plex_paths.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_plex_people_enrich.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_plex_person_bio.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_plex_person.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_plex_playback_class.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_plex_playback_session.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_plex_playlist_add_positions.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_plex_query_conversion.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_plex_stream.py

docs(comments): no WebSocket and no CI in the present tense

2026-10-05 00:50:36 +02:00

test_plex_subtitle_auth.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_plex_subtitle_encoding.py

fix(plex): a stray byte keeps a UTF-8 subtitle UTF-8; untagged and Serbian read as cp1250

2026-09-27 13:58:23 +02:00

test_plex_subtitle_prepare.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_plex_sync_prune.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_plex_sync_txn.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_plex_tmdb.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_plex_watch_reconcile.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_plex_watch_sync.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_progress_bounds.py

fix(api): progress checkpoints past the int4 column are a 422, and idle HLS sessions are reaped on a timer

2026-09-11 18:05:30 +02:00

test_public_unlock_limit.py

fix(uploads): read the body after authenticating, not before it

2026-09-22 01:59:03 +02:00

test_python_engine_contract.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_quota_ownership.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_quota_retention.py

fix(quota): prune quota history past a retention window

2026-10-04 17:53:19 +02:00

test_ratelimit.py

feat!: remove the shared demo account

2026-10-05 00:19:38 +02:00

test_request_models.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_reset_link_states.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_response_checked.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_review_round.py

docs(comments): correct comments the cuts left stale

2026-10-05 00:19:50 +02:00

test_route_conventions.py

feat!: remove the shared demo account

2026-10-05 00:19:38 +02:00

test_run_ffmpeg.py

style: apply ruff format across backend + scripts (line-length 100)

2026-08-23 07:43:06 +02:00

test_saved_views_source.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_scheduler.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_search_scrape_ingest.py

feat!: remove the shared demo account

2026-10-05 00:19:38 +02:00

test_search_scrape.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_security.py

style: apply ruff format across backend + scripts (line-length 100)

2026-08-23 07:43:06 +02:00

test_set_password_link.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_shorts_probe.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_smoke.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_storage.py

style: apply ruff format across backend + scripts (line-length 100)

2026-08-23 07:43:06 +02:00

test_swallowed_exceptions.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_sync_guards.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_sysconfig_describe_queries.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_sysconfig_registry.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_tag_suggest.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_thumbnail_poster.py

style: apply ruff format across backend + scripts (line-length 100)

2026-08-23 07:43:06 +02:00

test_titles.py

style: apply ruff format across backend + scripts (line-length 100)

2026-08-23 07:43:06 +02:00

test_upload.py

fix(gate): the plan-code guard catches bare sprint and phase codes, and the purge takes the P ones

2026-10-05 00:50:36 +02:00

test_urlguard.py

fix(e12): close what round one broke, and revert two fixes that overreached

2026-09-05 04:02:57 +02:00

test_userscope.py

feat!: remove the shared demo account

2026-10-05 00:19:38 +02:00

test_utils.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_welcome_mail.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_worker_knobs.py

fix(worker): obey the stored concurrency and log level, live

2026-10-04 17:53:19 +02:00

test_worker_supervisor.py

fix(logs): deep-review round 2 — a stack names code, not data, and survives a failed write

2026-09-18 22:50:37 +02:00

test_youtube_no_channel.py

fix(logs): keep polling reads and a channel-less account out of the warnings

2026-09-19 04:51:31 +02:00

test_youtube_refusals.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00

test_ytdlp_logging.py

chore(comments): drop epic, sprint and review-round ids from the code

2026-10-05 00:19:39 +02:00