Add DB-backed application tokens for the update endpoint

spec/requests/update_controller_spec.rb

@@ -43,4 +43,93 @@ RSpec.describe "GET /update", type: :request do
     expect(response).to have_http_status(:ok)
     expect(response.body).to eq("Updated")
   end
+
+  it "rejects a database token in :env mode" do
+    allow(WarpEngine.config).to receive(:application_token_owner_class).and_return("TestOwner")
+    token = create(:application_token)
+
+    get "/update", headers: { "X-Update-Secret" => token.plain_token },
+                   params: { platform: "tic80", name: "game", version: "1.0" }
+
+    expect(response).to have_http_status(:unauthorized)
+  end
+
+  context "with update_secret_source :database" do
+    before do
+      allow(WarpEngine.config).to receive(:update_secret_source).and_return(:database)
+      allow(WarpEngine.config).to receive(:application_token_owner_class).and_return("TestOwner")
+    end
+
+    def stub_updater
+      updater = instance_double(WarpEngine::SoftwareUpdater::Tic80Service)
+      allow(WarpEngine::SoftwareUpdater::Tic80Service).to receive(:new).and_return(updater)
+      allow(updater).to receive(:update)
+    end
+
+    it "runs the updater with a valid token and stamps last_used_at" do
+      stub_updater
+      token = create(:application_token)
+
+      get "/update", headers: { "X-Update-Secret" => token.plain_token },
+                     params: { platform: "tic80", name: "game", version: "1.0" }
+
+      expect(response).to have_http_status(:ok)
+      expect(response.body).to eq("Updated")
+      expect(token.reload.last_used_at).to be_present
+    end
+
+    it "accepts the token via the secret param" do
+      stub_updater
+      token = create(:application_token)
+
+      get "/update", params: { secret: token.plain_token, platform: "tic80", name: "game", version: "1.0" }
+
+      expect(response).to have_http_status(:ok)
+    end
+
+    it "rejects the ENV shared secret" do
+      get "/update", headers: { "X-Update-Secret" => "s3cret" },
+                     params: { platform: "tic80", name: "game", version: "1.0" }
+
+      expect(response).to have_http_status(:unauthorized)
+    end
+
+    it "rejects a token without the update scope" do
+      token = create(:application_token, scopes: [ "deploy" ])
+
+      get "/update", headers: { "X-Update-Secret" => token.plain_token },
+                     params: { platform: "tic80", name: "game", version: "1.0" }
+
+      expect(response).to have_http_status(:unauthorized)
+    end
+
+    it "rejects an expired token" do
+      token = create(:application_token, :expired)
+
+      get "/update", headers: { "X-Update-Secret" => token.plain_token },
+                     params: { platform: "tic80", name: "game", version: "1.0" }
+
+      expect(response).to have_http_status(:unauthorized)
+    end
+
+    it "rejects a revoked token" do
+      token = create(:application_token)
+      token.revoke!
+
+      get "/update", headers: { "X-Update-Secret" => token.plain_token },
+                     params: { platform: "tic80", name: "game", version: "1.0" }
+
+      expect(response).to have_http_status(:unauthorized)
+    end
+
+    it "rejects every request when no owner class is configured" do
+      token = create(:application_token)
+      allow(WarpEngine.config).to receive(:application_token_owner_class).and_return(nil)
+
+      get "/update", headers: { "X-Update-Secret" => token.plain_token },
+                     params: { platform: "tic80", name: "game", version: "1.0" }
+
+      expect(response).to have_http_status(:unauthorized)
+    end
+  end
 end