feat(web): Last.fm credentials (api key + username) + Settings tab

web/src/app/api/config/route.test.ts

@@ -101,3 +101,32 @@ describe("config DELETE", () => {
     expect(res.status).toBe(200);
   });
 });
+
+describe("config API — Last.fm", () => {
+  it("stores the API key encrypted and username plain", async () => {
+    await PUT(putReq({ lastfmApiKey: "abc123", lastfmUsername: "jonathan" }));
+
+    const key = await prisma.config.findUnique({ where: { key: "lastfm.api_key" } });
+    const username = await prisma.config.findUnique({ where: { key: "lastfm.username" } });
+    expect(key!.secret).toBe(true);
+    expect(key!.value).not.toContain("abc123"); // encrypted envelope
+    expect(username!.secret).toBe(false);
+    expect(username!.value).toBe("jonathan");
+  });
+
+  it("GET masks the API key and reports the username", async () => {
+    await PUT(putReq({ lastfmApiKey: "abc123", lastfmUsername: "jonathan" }));
+    const body = await (await GET()).json();
+    expect(body.lastfmUsername).toBe("jonathan");
+    expect(body.lastfmApiKeySet).toBe(true);
+    expect(JSON.stringify(body)).not.toContain("abc123");
+  });
+
+  it("DELETE clears the API key", async () => {
+    await PUT(putReq({ lastfmApiKey: "abc123" }));
+    const res = await DELETE(delReq("lastfmApiKey"));
+    expect(res.status).toBe(200);
+    expect(await prisma.config.findUnique({ where: { key: "lastfm.api_key" } })).toBeNull();
+    expect((await (await GET()).json()).lastfmApiKeySet).toBe(false);
+  });
+});

web/src/app/api/config/route.ts

@@ -9,6 +9,8 @@ const FIELDS: Record<string, { key: string; secret: boolean }> = {
   qobuzToken: { key: "qobuz.auth_token", secret: true },
   slskdUrl: { key: "slskd.url", secret: false },
   slskdApiKey: { key: "slskd.api_key", secret: true },
+  lastfmApiKey: { key: "lastfm.api_key", secret: true },
+  lastfmUsername: { key: "lastfm.username", secret: false },
 };
 
 export async function PUT(request: Request) {
@@ -40,9 +42,11 @@ export async function GET() {
     qobuzEmail: byKey.get("qobuz.email")?.value ?? "",
     qobuzUserId: byKey.get("qobuz.user_id")?.value ?? "",
     slskdUrl: byKey.get("slskd.url")?.value ?? "",
+    lastfmUsername: byKey.get("lastfm.username")?.value ?? "",
     qobuzPasswordSet: byKey.has("qobuz.password"),
     qobuzTokenSet: byKey.has("qobuz.auth_token"),
     slskdApiKeySet: byKey.has("slskd.api_key"),
+    lastfmApiKeySet: byKey.has("lastfm.api_key"),
   });
 }