# Authentik Migration Test

Test that upgrading from 10.1.4+2025.10.2 (using `media:/media` mount) to 10.2.0+2026.2.1 (using `media:/data/media` mount) works correctly and preserves data.

## Overview

1. Deploy the old version
2. Seed test data into the media volume
3. Upgrade to the new version
4. Verify media files are accessible at the new path

## Steps

### 1. Deploy old version

Check out the pre-migration tag and deploy:

```bash
cd ~/.abra/recipes/authentik
git checkout 10.1.4+2025.10.2
```

Deploy:

```bash
abra app deploy authentik.<DOMAIN_SUFFIX> --chaos --force --no-input
```

Wait for the app to become healthy:

```bash
abra app ps authentik.<DOMAIN_SUFFIX> --chaos --no-input -m
```

### 2. Seed test data into the media volume

Create a marker file in the old `/media` volume:

```bash
script -qefc "abra app run authentik.<DOMAIN_SUFFIX> app -- sh -c 'echo migration-test-marker > /media/test-migration-marker.txt && echo created'" /dev/null
```

Verify the file was created:

```bash
script -qefc "abra app run authentik.<DOMAIN_SUFFIX> app -- cat /media/test-migration-marker.txt" /dev/null
```

Expected output: `migration-test-marker`

Record existing files in `/media` for comparison:

```bash
script -qefc "abra app run authentik.<DOMAIN_SUFFIX> app -- ls -la /media/" /dev/null
```

### 3. Upgrade to new version

Switch to the new version (with `media:/data/media` mount point change):

```bash
cd ~/.abra/recipes/authentik
git checkout <new-tag-or-branch>
```

Deploy the upgrade:

```bash
abra app deploy authentik.<DOMAIN_SUFFIX> --chaos --force --no-input
```

Wait for convergence (authentik runs database migrations on startup):

```bash
sleep 60
abra app ps authentik.<DOMAIN_SUFFIX> --chaos --no-input -m
```

### 4. Verify post-upgrade state

#### 4a. Health check

```bash
python3 recipe-info/authentik/tests/health_check.py
```

#### 4b. Marker file preserved at new path

The mount point change means `media:/data/media` — files that were at the volume root now appear under `/data/media/`:

```bash
script -qefc "abra app run authentik.<DOMAIN_SUFFIX> app -- cat /data/media/test-migration-marker.txt" /dev/null
```

Expected output: `migration-test-marker`

#### 4c. Directory listing

Verify the old files are now under `/data/media/`:

```bash
script -qefc "abra app run authentik.<DOMAIN_SUFFIX> app -- ls -la /data/media/" /dev/null
```

Compare with the listing from step 2 — all files from the old `/media/` should now appear under `/data/media/`.

#### 4d. Version label

```bash
abra app ps authentik.<DOMAIN_SUFFIX> --chaos --no-input -m
```

Confirm the version label shows `10.2.0+2026.2.1`.

#### 4e. Full test suite

```bash
python3 recipe-info/authentik/tests/health_check.py
python3 recipe-info/authentik/tests/oidc_integration.py
```

### 5. Clean up test marker

```bash
script -qefc "abra app run authentik.<DOMAIN_SUFFIX> app -- rm /data/media/test-migration-marker.txt" /dev/null
```

## Pass/fail criteria

| Check | Expected |
|-------|----------|
| Pre-upgrade health check | HTTP 200 |
| Marker file created in old `/media` | `migration-test-marker` |
| Post-upgrade health check | HTTP 200 |
| Marker file at `/data/media/test-migration-marker.txt` | `migration-test-marker` |
| `/data/media/` contains old files | Matches pre-upgrade listing |
| Version label updated | `10.2.0+2026.2.1` |
| OIDC integration test | PASS |

All checks must pass for the migration test to pass.