fix: re-add cwa db immutable (#928)

Fixes #926

shelfmark/config/security.py

@@ -92,7 +92,10 @@ def security_settings() -> list[SettingsField]:
         SelectField(
             key="AUTH_METHOD",
             label="Authentication Method",
-            description="Select the authentication method for accessing Shelfmark.",
+            description=(
+                "Select the authentication method for accessing Shelfmark. "
+                "Restart container after changing Calibre-Web passwords."
+            ),
             options=auth_method_options,
             default="none",
         ),

shelfmark/core/admin_routes.py

@@ -134,7 +134,7 @@ def _sync_all_cwa_users(user_db: UserDB) -> dict[str, int]:
         raise FileNotFoundError(msg)
 
     db_path = os.fspath(CWA_DB_PATH)
-    db_uri = f"file:{db_path}?mode=ro"
+    db_uri = f"file:{db_path}?mode=ro&immutable=1"
     conn = sqlite3.connect(db_uri, uri=True)
     try:
         cur = conn.cursor()

shelfmark/main.py

@@ -2091,7 +2091,7 @@ def api_login() -> Response | tuple[Response, int]:
 
             try:
                 db_path = os.fspath(CWA_DB_PATH)
-                db_uri = f"file:{db_path}?mode=ro"
+                db_uri = f"file:{db_path}?mode=ro&immutable=1"
                 conn = sqlite3.connect(db_uri, uri=True)
                 cur = conn.cursor()
                 cur.execute("SELECT password, role, email FROM user WHERE name = ?", (username,))