feat: add encrypted sync user management

Adds full CRUD for sync users (create/list/detail/edit) behind admin
auth and CSRF protection. Passwords are encrypted at rest and never
decrypted into a template context; only emails may be decrypted for
display on the edit form. Blank password fields on edit preserve the
existing encrypted password.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

tests/web/test_users.py

@@ -0,0 +1,236 @@
+from fastapi.testclient import TestClient
+
+from app.db.repositories import UserRepository
+from app.security.credentials import CredentialCipher
+
+
+def login(client: TestClient) -> None:
+    page = client.get("/login")
+    csrf = extract_csrf(page.text)
+    response = client.post(
+        "/login",
+        data={"password": "admin-secret", "csrf_token": csrf},
+        follow_redirects=False,
+    )
+    assert response.status_code == 303
+
+
+def extract_csrf(html: str) -> str:
+    marker = 'name="csrf_token" value="'
+    start = html.index(marker) + len(marker)
+    end = html.index('"', start)
+    return html[start:end]
+
+
+def create_user_via_http(client: TestClient) -> int:
+    page = client.get("/users/new")
+    csrf = extract_csrf(page.text)
+    response = client.post(
+        "/users",
+        data={
+            "csrf_token": csrf,
+            "name": "Max",
+            "mywhoosh_email": "max@example.com",
+            "mywhoosh_password": "mw-secret",
+            "garmin_email": "max-garmin@example.com",
+            "garmin_password": "garmin-secret",
+            "enabled": "on",
+        },
+        follow_redirects=False,
+    )
+    assert response.status_code == 303
+    location = response.headers["location"]
+    return int(location.rsplit("/", 1)[-1])
+
+
+def test_create_user_encrypts_credentials_and_never_renders_them(client: TestClient) -> None:
+    login(client)
+    page = client.get("/users/new")
+    assert page.status_code == 200
+    csrf = extract_csrf(page.text)
+    response = client.post(
+        "/users",
+        data={
+            "csrf_token": csrf,
+            "name": "Max",
+            "mywhoosh_email": "max@example.com",
+            "mywhoosh_password": "mw-secret",
+            "garmin_email": "max-garmin@example.com",
+            "garmin_password": "garmin-secret",
+            "enabled": "on",
+        },
+        follow_redirects=True,
+    )
+    assert response.status_code == 200
+    assert "mw-secret" not in response.text
+    assert "garmin-secret" not in response.text
+
+
+def test_create_user_persists_encrypted_credentials(client: TestClient) -> None:
+    login(client)
+    user_id = create_user_via_http(client)
+
+    with client.app.state.session_factory() as session:
+        user = UserRepository(session).get(user_id)
+        assert user is not None
+        assert user.mywhoosh_email_enc != "max@example.com"
+        assert user.mywhoosh_password_enc != "mw-secret"
+
+        cipher = CredentialCipher(client.app.state.settings.credential_encryption_key)
+        assert cipher.decrypt(user.mywhoosh_email_enc) == "max@example.com"
+        assert cipher.decrypt(user.mywhoosh_password_enc) == "mw-secret"
+        assert cipher.decrypt(user.garmin_email_enc) == "max-garmin@example.com"
+        assert cipher.decrypt(user.garmin_password_enc) == "garmin-secret"
+
+
+def test_edit_page_never_renders_passwords(client: TestClient) -> None:
+    login(client)
+    user_id = create_user_via_http(client)
+
+    page = client.get(f"/users/{user_id}/edit")
+    assert page.status_code == 200
+    assert "mw-secret" not in page.text
+    assert "garmin-secret" not in page.text
+    # emails may be shown for display
+    assert "max@example.com" in page.text
+    assert "max-garmin@example.com" in page.text
+
+
+def test_edit_user_blank_password_preserves_existing_password(client: TestClient) -> None:
+    login(client)
+    user_id = create_user_via_http(client)
+
+    edit_page = client.get(f"/users/{user_id}/edit")
+    csrf = extract_csrf(edit_page.text)
+    response = client.post(
+        f"/users/{user_id}",
+        data={
+            "csrf_token": csrf,
+            "name": "Max Updated",
+            "mywhoosh_email": "max@example.com",
+            "mywhoosh_password": "",
+            "garmin_email": "max-garmin@example.com",
+            "garmin_password": "",
+            "enabled": "on",
+        },
+        follow_redirects=True,
+    )
+    assert response.status_code == 200
+    assert "mw-secret" not in response.text
+    assert "garmin-secret" not in response.text
+
+    with client.app.state.session_factory() as session:
+        user = UserRepository(session).get(user_id)
+        assert user is not None
+        assert user.name == "Max Updated"
+        cipher = CredentialCipher(client.app.state.settings.credential_encryption_key)
+        assert cipher.decrypt(user.mywhoosh_password_enc) == "mw-secret"
+        assert cipher.decrypt(user.garmin_password_enc) == "garmin-secret"
+
+
+def test_edit_user_replaces_password_when_submitted(client: TestClient) -> None:
+    login(client)
+    user_id = create_user_via_http(client)
+
+    edit_page = client.get(f"/users/{user_id}/edit")
+    csrf = extract_csrf(edit_page.text)
+    response = client.post(
+        f"/users/{user_id}",
+        data={
+            "csrf_token": csrf,
+            "name": "Max",
+            "mywhoosh_email": "max@example.com",
+            "mywhoosh_password": "new-mw-secret",
+            "garmin_email": "max-garmin@example.com",
+            "garmin_password": "",
+            "enabled": "on",
+        },
+        follow_redirects=True,
+    )
+    assert response.status_code == 200
+    assert "new-mw-secret" not in response.text
+
+    with client.app.state.session_factory() as session:
+        user = UserRepository(session).get(user_id)
+        assert user is not None
+        cipher = CredentialCipher(client.app.state.settings.credential_encryption_key)
+        assert cipher.decrypt(user.mywhoosh_password_enc) == "new-mw-secret"
+        assert cipher.decrypt(user.garmin_password_enc) == "garmin-secret"
+
+
+def test_user_detail_page_shows_no_secrets(client: TestClient) -> None:
+    login(client)
+    user_id = create_user_via_http(client)
+
+    response = client.get(f"/users/{user_id}")
+    assert response.status_code == 200
+    assert "mw-secret" not in response.text
+    assert "garmin-secret" not in response.text
+    assert "max@example.com" not in response.text
+    assert "max-garmin@example.com" not in response.text
+    assert "Max" in response.text
+
+
+def test_unknown_user_returns_404_for_detail(client: TestClient) -> None:
+    login(client)
+    response = client.get("/users/999999")
+    assert response.status_code == 404
+
+
+def test_unknown_user_returns_404_for_edit(client: TestClient) -> None:
+    login(client)
+    response = client.get("/users/999999/edit")
+    assert response.status_code == 404
+
+
+def test_unknown_user_returns_404_for_update(client: TestClient) -> None:
+    login(client)
+    page = client.get("/users/new")
+    csrf = extract_csrf(page.text)
+    response = client.post(
+        "/users/999999",
+        data={
+            "csrf_token": csrf,
+            "name": "Nobody",
+            "mywhoosh_email": "a@example.com",
+            "mywhoosh_password": "",
+            "garmin_email": "b@example.com",
+            "garmin_password": "",
+            "enabled": "on",
+        },
+    )
+    assert response.status_code == 404
+
+
+def test_create_user_requires_admin(client: TestClient) -> None:
+    response = client.get("/users/new", follow_redirects=False)
+    assert response.status_code == 303
+    assert response.headers["location"] == "/login"
+
+
+def test_create_user_rejects_invalid_csrf(client: TestClient) -> None:
+    login(client)
+    response = client.post(
+        "/users",
+        data={
+            "csrf_token": "invalid-token",
+            "name": "Max",
+            "mywhoosh_email": "max@example.com",
+            "mywhoosh_password": "mw-secret",
+            "garmin_email": "max-garmin@example.com",
+            "garmin_password": "garmin-secret",
+            "enabled": "on",
+        },
+    )
+    assert response.status_code == 403
+
+
+def test_dashboard_lists_created_user_without_secrets(client: TestClient) -> None:
+    login(client)
+    create_user_via_http(client)
+
+    response = client.get("/")
+    assert response.status_code == 200
+    assert "Max" in response.text
+    assert "mw-secret" not in response.text
+    assert "garmin-secret" not in response.text