task 13: upload API keys in SQLite, Bearer auth, create-client-key CLI

- Add internal/authkeys with SHA-256 hashed tokens and KeyCount gate
- PUT /upload/{host}/{kind} for uptimed files; auth when any key exists
- Daemon -auth-db and Config.AuthDB; plain HTTP unchanged
- CLI: goprecords --create-client-key HOSTNAME (-stats-dir|-auth-db)

Made-with: Cursor

1 files changed, 27 insertions, 0 deletions

diff --git a/internal/cli/cli_test.go b/internal/cli/cli_test.go
index 9fa20e5..ff7b046 100644
--- a/internal/cli/cli_test.go
+++ b/internal/cli/cli_test.go
@@ -147,3 +147,30 @@ func TestStableSubcommandsStillRecognized(t *testing.T) {
 		}
 	}
 }
+
+func TestCreateClientKeyRequiresHostname(t *testing.T) {
+	err := Execute([]string{"--create-client-key"})
+	if err == nil || !strings.Contains(err.Error(), "hostname") {
+		t.Fatalf("expected hostname error, got %v", err)
+	}
+}
+
+func TestCreateClientKeyRequiresStatsOrAuthDB(t *testing.T) {
+	err := Execute([]string{"--create-client-key", "h1"})
+	if err == nil || !strings.Contains(err.Error(), "stats-dir") {
+		t.Fatalf("expected stats-dir/auth-db error, got %v", err)
+	}
+}
+
+func TestCreateClientKeyWritesToken(t *testing.T) {
+	dir := t.TempDir()
+	out := captureStdout(t, func() {
+		if err := Execute([]string{"--create-client-key", "mybox", "-stats-dir", dir}); err != nil {
+			t.Fatal(err)
+		}
+	})
+	tok := strings.TrimSpace(out)
+	if len(tok) < 20 {
+		t.Fatalf("token too short %q", tok)
+	}
+}