Fix setup persistence and load persisted runtime configuration

backend/tests/test_main.py

@@ -4,10 +4,13 @@ import asyncio
 from pathlib import Path
 from unittest.mock import AsyncMock, MagicMock, patch
 
+import aiosqlite
 from httpx import ASGITransport, AsyncClient
 
 from app.config import Settings
+from app.db import init_db
 from app.main import CORSMiddleware, _lifespan, create_app
+from app.services import setup_service
 
 
 def test_create_app_configures_cors_from_settings() -> None:
@@ -120,6 +123,61 @@ async def test_lifespan_initialises_and_cleans_up_shared_resources(tmp_path: Pat
     mock_scheduler.shutdown.assert_called_once_with(wait=False)
 
 
+async def test_startup_overrides_settings_from_persisted_setup(tmp_path: Path) -> None:
+    """Startup should replace env defaults with values persisted by setup."""
+    env_settings = Settings(
+        database_path=str(tmp_path / "pointer.db"),
+        fail2ban_socket="/tmp/fake_fail2ban.sock",
+        fail2ban_config_dir=str(tmp_path / "fail2ban"),
+        session_secret="test-startup-secret",
+        session_duration_minutes=60,
+        timezone="UTC",
+        log_level="debug",
+    )
+    app = create_app(settings=env_settings)
+
+    runtime_db_path = str(tmp_path / "runtime.db")
+    db = await aiosqlite.connect(env_settings.database_path)
+    db.row_factory = aiosqlite.Row
+    await init_db(db)
+    await setup_service.run_setup(
+        db,
+        master_password="supersecret123",
+        database_path=runtime_db_path,
+        fail2ban_socket="/tmp/persisted.sock",
+        timezone="Europe/Berlin",
+        session_duration_minutes=123,
+    )
+    await db.close()
+
+    mock_scheduler = MagicMock()
+    mock_scheduler.start = MagicMock()
+    mock_scheduler.shutdown = MagicMock()
+
+    mock_http_session = MagicMock()
+    mock_http_session.close = AsyncMock()
+
+    with (
+        patch("app.startup.ensure_jail_configs"),
+        patch("app.startup.aiohttp.ClientSession", return_value=mock_http_session),
+        patch("app.startup.AsyncIOScheduler", return_value=mock_scheduler),
+        patch("app.services.geo_service.init_geoip"),
+        patch("app.services.geo_service.load_cache_from_db", new=AsyncMock(return_value=None)),
+        patch("app.services.geo_service.count_unresolved", new=AsyncMock(return_value=0)),
+        patch("app.tasks.health_check.register"),
+        patch("app.tasks.blocklist_import.register"),
+        patch("app.tasks.geo_cache_flush.register"),
+        patch("app.tasks.geo_re_resolve.register"),
+        patch("app.tasks.history_sync.register"),
+    ):
+        async with _lifespan(app):
+            assert app.state.settings.database_path == runtime_db_path
+            assert app.state.settings.fail2ban_socket == "/tmp/persisted.sock"
+            assert app.state.settings.timezone == "Europe/Berlin"
+            assert app.state.settings.session_duration_minutes == 123
+            assert Path(runtime_db_path).exists()
+
+
 async def test_concurrent_requests_use_request_scoped_db_connections(tmp_path: Path) -> None:
     """Concurrent requests each open and close their own database connection."""
     settings = Settings(
@@ -167,7 +225,8 @@ async def test_concurrent_requests_use_request_scoped_db_connections(tmp_path: P
     ):
         transport = ASGITransport(app=app)
         async with AsyncClient(transport=transport, base_url="http://test") as client:
-            responses = await asyncio.gather(*(client.get("/api/setup") for _ in range(5)))
+            app.state.setup_complete_cached = True
+            responses = await asyncio.gather(*(client.post("/api/auth/logout") for _ in range(5)))
 
     assert len(connections) == 5
     assert len({id(connection) for connection in connections}) == 5

backend/tests/test_routers/test_setup.py

@@ -143,6 +143,28 @@ class TestPostSetup:
         assert response.status_code == 201
 
 
+class TestPostSetupRuntimeState:
+    async def test_updates_runtime_settings_after_setup(
+        self, app_and_client: tuple[object, AsyncClient]
+    ) -> None:
+        """App state should reflect setup settings immediately after setup."""
+        app, client = app_and_client
+        payload = {
+            "master_password": "supersecret123",
+            "database_path": "bangui.db",
+            "fail2ban_socket": "/tmp/persisted.sock",
+            "timezone": "Europe/Berlin",
+            "session_duration_minutes": 90,
+        }
+
+        response = await client.post("/api/setup", json=payload)
+        assert response.status_code == 201
+        assert app.state.settings.database_path == payload["database_path"]
+        assert app.state.settings.fail2ban_socket == payload["fail2ban_socket"]
+        assert app.state.settings.timezone == payload["timezone"]
+        assert app.state.settings.session_duration_minutes == payload["session_duration_minutes"]
+
+
 class TestSetupRedirectMiddleware:
     """Verify that the setup-redirect middleware enforces setup-first."""
 
@@ -316,8 +338,9 @@ class TestLifespanDatabaseDirectoryCreation:
             patch("app.tasks.blocklist_import.register"),
             patch("app.tasks.geo_cache_flush.register"),
             patch("app.tasks.geo_re_resolve.register"),
-            patch("app.main.AsyncIOScheduler", return_value=mock_scheduler),
-            patch("app.main.ensure_jail_configs"),
+            patch("app.tasks.history_sync.register"),
+            patch("app.startup.AsyncIOScheduler", return_value=mock_scheduler),
+            patch("app.startup.ensure_jail_configs"),
         ):
             async with _lifespan(app):
                 assert nested_db.parent.exists(), (
@@ -359,8 +382,9 @@ class TestLifespanDatabaseDirectoryCreation:
             patch("app.tasks.blocklist_import.register"),
             patch("app.tasks.geo_cache_flush.register"),
             patch("app.tasks.geo_re_resolve.register"),
-            patch("app.main.AsyncIOScheduler", return_value=mock_scheduler),
-            patch("app.main.ensure_jail_configs"),
+            patch("app.tasks.history_sync.register"),
+            patch("app.startup.AsyncIOScheduler", return_value=mock_scheduler),
+            patch("app.startup.ensure_jail_configs"),
         ):
             # Should not raise FileExistsError or similar.
             async with _lifespan(app):
@@ -409,8 +433,9 @@ class TestLifespanSetupCache:
             patch("app.tasks.blocklist_import.register"),
             patch("app.tasks.geo_cache_flush.register"),
             patch("app.tasks.geo_re_resolve.register"),
-            patch("app.main.AsyncIOScheduler", return_value=mock_scheduler),
-            patch("app.main.ensure_jail_configs"),
+            patch("app.tasks.history_sync.register"),
+            patch("app.startup.AsyncIOScheduler", return_value=mock_scheduler),
+            patch("app.startup.ensure_jail_configs"),
         ):
             async with _lifespan(app):
                 assert app.state.setup_complete_cached is True