Close data leaks: remove anonymous user creation, hide private playlists, validate uploads and clamp gateway ranges

2026-09-24 05:00:21 +02:00
parent c8fe28b07b
commit c8e9c7790e
34 changed files with 374 additions and 553 deletions
@@ -44,6 +44,23 @@ public sealed class ApiTestFixture : WebApplicationFactory<Program>, IAsyncLifet

    public HttpClient CreateAnonymousClient() => CreateClient();

+    public async Task<long> SeedUserAsync(long? userId = null, string? name = null)
+    {
+        var id = userId ?? Random.Shared.NextInt64(1, long.MaxValue);
+        var userName = name ?? $"user-{id}";
+
+        using var scope = Services.CreateScope();
+        var database = scope.ServiceProvider.GetRequiredService<Musify.Infrastructure.Persistence.Database>();
+        database.Users.Add(new Musify.Domain.Entities.User
+        {
+            Id = id,
+            Name = userName,
+            NormalizedName = userName.ToUpperInvariant()
+        });
+        await database.SaveChangesAsync();
+        return id;
+    }
+
    public HttpClient CreateAuthenticatedClient(long userId, string userName = "test-user")
    {
        var client = CreateClient();