Add first-run admin setup and independent password and API token rotation

test_server.py

@@ -1,6 +1,9 @@
 import json
 import threading
 import unittest
+import tempfile
+import secrets
+import time
 import urllib.request
 import urllib.error
 from unittest.mock import patch
@@ -8,7 +11,13 @@ from server import Server, HardwareProvider
 
 class Tests(unittest.TestCase):
     def setUp(self):
-        self.server=Server(0)
+        self.state=tempfile.TemporaryDirectory()
+        self.server=Server(0,state_dir=self.state.name)
+        self.password=secrets.token_urlsafe(32)
+        self.api_token=secrets.token_urlsafe(32)
+        record=self.server.credentials.setup(self.password,self.api_token)
+        self.server.sessions['test-session']=dict(expires=time.monotonic()+300,revision=record['password']['hash'])
+        self.cookie='deck_session=test-session'
         self.thread=threading.Thread(target=self.server.serve_forever)
         self.thread.start()
         self.url=f'http://127.0.0.1:{self.server.server_port}'
@@ -17,8 +26,9 @@ class Tests(unittest.TestCase):
         self.server.demo.stop()
         self.server.server_close()
         self.thread.join()
+        self.state.cleanup()
     def request(self,path,method='GET',headers=None):
-        req=urllib.request.Request(self.url+'/api/v1/'+path,method=method,headers=headers or {})
+        req=urllib.request.Request(self.url+'/api/v1/'+path,method=method,headers={"Cookie":self.cookie,**(headers or {})})
         with urllib.request.urlopen(req) as r:return json.load(r)
     def test_lifecycle(self):
         self.assertEqual(self.request('status')['demo']['state'],'stopped')