fix: harden DynDNS recovery and publish v1.5.1

internal/updateagent/controller_test.go

@@ -103,3 +103,30 @@ func TestControllerValidatesRequestsAndRunsOnlyOneUpdate(t *testing.T) {
 		t.Fatalf("update did not complete: %#v", controller.Status())
 	}
 }
+
+func TestControllerAcceptsAnonymousButRejectsPartialCredentials(t *testing.T) {
+	t.Parallel()
+	runner := &blockingRunner{started: make(chan updateprotocol.Request, 1), release: make(chan struct{})}
+	defer close(runner.release)
+	controller := NewController(runner, slog.New(slog.NewTextHandler(io.Discard, nil)))
+	for _, credentials := range []string{`,"registry_username":"user"`, `,"registry_token":"secret-token"`} {
+		response := httptest.NewRecorder()
+		controller.Handler().ServeHTTP(response, httptest.NewRequest(http.MethodPost, "/v1/update", strings.NewReader(`{"version":"v2.0.0","current_version":"v1.5.0"`+credentials+`}`)))
+		if response.Code != 400 {
+			t.Fatal("partial credentials accepted")
+		}
+	}
+	response := httptest.NewRecorder()
+	controller.Handler().ServeHTTP(response, httptest.NewRequest(http.MethodPost, "/v1/update", strings.NewReader(`{"version":"v2.0.0","current_version":"v1.5.0"}`)))
+	if response.Code != 202 || !controller.Status().AnonymousPull {
+		t.Fatalf("anonymous update rejected: %d", response.Code)
+	}
+	select {
+	case request := <-runner.started:
+		if request.RegistryToken != "" || request.RegistryUsername != "" {
+			t.Fatal("anonymous request changed")
+		}
+	case <-time.After(time.Second):
+		t.Fatal("anonymous runner not started")
+	}
+}