From 1ca1ca9d0c0e05399d530cb7063609411656975c Mon Sep 17 00:00:00 2001
From: saopig1 <4x7sw862st@gmail.com>
Date: Sat, 30 May 2026 14:06:59 +0800
Subject: [PATCH] test(perm): assert /me capabilities+bots; dry backfill token
 list

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 src/data/database.ts        | 3 ++-
 src/web/api/session.test.ts | 6 ++++++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/src/data/database.ts b/src/data/database.ts
index 78a721a..49e2caf 100644
--- a/src/data/database.ts
+++ b/src/data/database.ts
@@ -1,4 +1,5 @@
 import Database from "better-sqlite3";
+import { CAPABILITIES, BOTS_ALL } from "./permissions.js";
 
 export interface PlayHistoryEntry {
   botId: string;
@@ -196,7 +197,7 @@ export function backfillMemberPermissions(db: Database.Database): void {
   if (done) return;
   const members = db.prepare("SELECT id FROM users WHERE role = 'member'").all() as { id: string }[];
   const insCap = db.prepare("INSERT OR IGNORE INTO user_permissions (userId, permission) VALUES (?, ?)");
-  const tokens = ["player.control", "player.queue", "bot.manage", "platform.auth", "quality", "bots.all"];
+  const tokens = [...CAPABILITIES, BOTS_ALL];
   const tx = db.transaction(() => {
     for (const m of members) {
       for (const t of tokens) insCap.run(m.id, t);
diff --git a/src/web/api/session.test.ts b/src/web/api/session.test.ts
index cd7970f..1a0e76a 100644
--- a/src/web/api/session.test.ts
+++ b/src/web/api/session.test.ts
@@ -102,6 +102,12 @@ describe("session router", () => {
     const me = await request(app).get("/api/session/me").set("Cookie", cookie);
     expect(me.status).toBe(200);
     expect(me.body.username).toBe("alice");
+    // alice is the first user (an admin), so /me exposes all capabilities and full bot access.
+    expect(Array.isArray(me.body.capabilities)).toBe(true);
+    expect(me.body.capabilities).toEqual(
+      expect.arrayContaining(["player.control", "player.queue", "bot.manage", "platform.auth", "quality"])
+    );
+    expect(me.body.bots).toBe("all");
 
     const anon = await request(app).get("/api/session/me");
     expect(anon.status).toBe(401);