Add safe repository password rotation

internal/api/server.go

@@ -46,6 +46,8 @@ func New(socket string, svc *service.Service, log *slog.Logger) *Server {
 	mux.HandleFunc("POST /v1/repositories/{id}/test", s.testRepository)
 	mux.HandleFunc("POST /v1/repositories/{id}/init", s.initRepository)
 	mux.HandleFunc("POST /v1/repositories/{id}/unlock", s.unlockRepository)
+	mux.HandleFunc("POST /v1/repositories/{id}/password", s.changeRepositoryPassword)
+	mux.HandleFunc("POST /v1/repositories/{id}/password/adopt", s.adoptRepositoryPassword)
 	mux.HandleFunc("POST /v1/repositories/{id}/{action}", s.maintenance)
 	mux.HandleFunc("GET /v1/repositories/stats", s.repositoryStats)
 	mux.HandleFunc("GET /v1/repositories/{id}/snapshots", s.snapshots)
@@ -192,6 +194,34 @@ func (s *Server) unlockRepository(w http.ResponseWriter, r *http.Request) {
 	}
 	writeJSON(w, 200, map[string]bool{"ok": true})
 }
+func (s *Server) changeRepositoryPassword(w http.ResponseWriter, r *http.Request) {
+	s.repositoryPasswordAction(w, r, false)
+}
+func (s *Server) adoptRepositoryPassword(w http.ResponseWriter, r *http.Request) {
+	s.repositoryPasswordAction(w, r, true)
+}
+func (s *Server) repositoryPasswordAction(w http.ResponseWriter, r *http.Request, adopt bool) {
+	var body struct {
+		Password string `json:"password"`
+	}
+	if err := decode(r, &body); err != nil {
+		writeError(w, err)
+		return
+	}
+	ctx, cancel := context.WithTimeout(r.Context(), 5*time.Minute)
+	defer cancel()
+	var err error
+	if adopt {
+		err = s.service.AdoptRepositoryPassword(ctx, r.PathValue("id"), body.Password)
+	} else {
+		err = s.service.ChangeRepositoryPassword(ctx, r.PathValue("id"), body.Password)
+	}
+	if err != nil {
+		writeError(w, err)
+		return
+	}
+	writeJSON(w, 200, map[string]bool{"ok": true})
+}
 func (s *Server) repositoryAction(w http.ResponseWriter, r *http.Request, initialize bool) {
 	ctx, cancel := context.WithTimeout(r.Context(), 2*time.Minute)
 	defer cancel()