fix: stabilize software updates

internal/appupdate/manager_test.go

@@ -21,10 +21,11 @@ import (
 
 func TestManagerKeepsUpdateReminderWhenGiteaBecomesUnavailable(t *testing.T) {
 	t.Parallel()
-	const token = "test-token-that-must-stay-secret"
+	const credential = " test-password-or-token-that-must-stay-secret "
 	var unavailable atomic.Bool
 	api := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.Header.Get("Authorization") != "token "+token {
+		username, password, ok := r.BasicAuth()
+		if !ok || username != "registry-user" || password != credential {
 			http.Error(w, "unauthorized", http.StatusUnauthorized)
 			return
 		}
@@ -33,7 +34,7 @@ func TestManagerKeepsUpdateReminderWhenGiteaBecomesUnavailable(t *testing.T) {
 			return
 		}
 		w.Header().Set("Content-Type", "application/json")
-		_, _ = w.Write([]byte(`{"tag_name":"v1.4.2","html_url":"https://example.invalid/releases/v1.4.2","draft":false,"prerelease":false}`))
+		_, _ = w.Write([]byte(`{"tag_name":"v1.4.3","html_url":"https://example.invalid/releases/v1.4.3","draft":false,"prerelease":false}`))
 	}))
 	defer api.Close()
 
@@ -59,22 +60,22 @@ func TestManagerKeepsUpdateReminderWhenGiteaBecomesUnavailable(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if err := manager.SaveCredential(ctx, "registry-user", token); err != nil {
+	if err := manager.SaveCredential(ctx, "registry-user", credential); err != nil {
 		t.Fatal(err)
 	}
 	if err := manager.CheckNow(ctx); err != nil {
 		t.Fatal(err)
 	}
 	state := manager.State()
-	if !state.UpdateAvailable || state.LatestVersion != "v1.4.2" || state.LastError != "" {
+	if !state.UpdateAvailable || state.LatestVersion != "v1.4.3" || state.LastError != "" || state.CredentialUsername != "registry-user" {
 		t.Fatalf("new release was not detected: %#v", state)
 	}
 	settings, err := database.GetSoftwareUpdateSettings(ctx)
 	if err != nil {
 		t.Fatal(err)
 	}
-	if strings.Contains(string(settings.TokenCiphertext), token) {
-		t.Fatal("registry token was stored as plaintext")
+	if strings.Contains(string(settings.TokenCiphertext), credential) {
+		t.Fatal("registry credential was stored as plaintext")
 	}
 
 	unavailable.Store(true)
@@ -82,11 +83,36 @@ func TestManagerKeepsUpdateReminderWhenGiteaBecomesUnavailable(t *testing.T) {
 		t.Fatal("unavailable Gitea endpoint was reported as successful")
 	}
 	state = manager.State()
-	if !state.UpdateAvailable || state.LatestVersion != "v1.4.2" || state.LastError == "" {
+	if !state.UpdateAvailable || state.LatestVersion != "v1.4.3" || state.LastError == "" {
 		t.Fatalf("temporary outage removed the last known update reminder: %#v", state)
 	}
 }
 
+func TestManagerFallsBackToTokenAuthentication(t *testing.T) {
+	t.Parallel()
+	const credential = "fallback-api-token"
+	var requests atomic.Int32
+	api := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		requests.Add(1)
+		if r.Header.Get("Authorization") != "token "+credential {
+			http.Error(w, "unauthorized", http.StatusUnauthorized)
+			return
+		}
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{"tag_name":"v2.0.0","html_url":"https://example.invalid/releases/v2.0.0","draft":false,"prerelease":false}`))
+	}))
+	defer api.Close()
+
+	manager := &Manager{apiURL: api.URL, httpClient: api.Client()}
+	release, err := manager.fetchLatest(context.Background(), "registry-user", credential)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if release.TagName != "v2.0.0" || requests.Load() != 2 {
+		t.Fatalf("token fallback was not used: release=%#v requests=%d", release, requests.Load())
+	}
+}
+
 func TestAgentCompatibilityStartsAtStableV14Protocol(t *testing.T) {
 	t.Parallel()
 	tests := []struct {