admin
f17e1979bd
gates / gates (push) Successful in 49s
Each successful run prunes its tier, so a compromised controller calling POST /backup in a loop pushed out every pre-compromise restore point. A tier with a cadence of at most 24 h now allows 3 successful runs per rolling 24 h (night, a press, the next night); a longer tier 1 per max(cadence - 24 h, cadence/2), 6 days for the weekly off-site tier. Only successes count. A refusal is a 429, a WARN, saved, and for 24 h a critical host-report status that the hub turns into its existing operator-only agent_capability_degraded event. The success history and the refusal are kept in the R-894 state file, so a restart does not reset the cap. No sudoers change. Tests TestBackupCap_* and the state, status and wiring tests, red-proved.
68 lines
2.5 KiB
Go
68 lines
2.5 KiB
Go
package main
|
|
|
|
import (
|
|
"go/ast"
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
|
|
"gitea.dooplex.hu/admin/felhom-agent/internal/capability"
|
|
)
|
|
|
|
// R-973: a cadence-cap refusal becomes a CRITICAL degraded status — what the hub's existing
|
|
// agent_capability_degraded event (operator-only) keys on — and clears when the refusal ages out.
|
|
func TestBackupCapStatus_RefusalIsCriticalDegraded(t *testing.T) {
|
|
at := time.Date(2026, 10, 18, 3, 0, 0, 0, time.UTC)
|
|
s := backupCapStatus(func() (string, int, time.Time, bool) { return "felhom-pbs", 9201, at, true })
|
|
if !s.Critical || s.Status != capability.StatusDegraded || !strings.Contains(s.Reason, "9201") || !strings.Contains(s.Reason, "felhom-pbs") {
|
|
t.Fatalf("a refusal must raise a critical degraded status naming the guest and the tier: %+v", s)
|
|
}
|
|
if s := backupCapStatus(func() (string, int, time.Time, bool) { return "", 0, time.Time{}, false }); s.Status != capability.StatusOK || !s.Critical {
|
|
t.Fatalf("no refusal → ok (and still critical, so a later refusal alerts): %+v", s)
|
|
}
|
|
if s := backupCapStatus(nil); s.Status != capability.StatusOK {
|
|
t.Fatalf("no local API → ok: %+v", s)
|
|
}
|
|
}
|
|
|
|
// Wiring (the built-but-never-wired class): runDaemon's capability probe appends backupCapStatus, and the
|
|
// late-bound source is set from the local API server.
|
|
//
|
|
// COMPANION RED-PROOF (observed 2026-10-18): delete `backupCapRefusal = localSrv.BackupCapRefusal` →
|
|
// "runDaemon never binds backupCapRefusal to the local API server". Restored.
|
|
func TestR973_CapRefusalIsWiredIntoTheReport(t *testing.T) {
|
|
_, f := parseMain(t)
|
|
var appended, bound bool
|
|
for _, d := range f.Decls {
|
|
fd, ok := d.(*ast.FuncDecl)
|
|
if !ok || fd.Name == nil || fd.Name.Name != "runDaemon" || fd.Body == nil {
|
|
continue
|
|
}
|
|
ast.Inspect(fd.Body, func(n ast.Node) bool {
|
|
switch x := n.(type) {
|
|
case *ast.CallExpr:
|
|
if id, ok := x.Fun.(*ast.Ident); ok && id.Name == "backupCapStatus" && len(x.Args) == 1 {
|
|
if a, ok := x.Args[0].(*ast.Ident); ok && a.Name == "backupCapRefusal" {
|
|
appended = true
|
|
}
|
|
}
|
|
case *ast.AssignStmt:
|
|
if len(x.Lhs) == 1 && len(x.Rhs) == 1 {
|
|
if l, ok := x.Lhs[0].(*ast.Ident); ok && l.Name == "backupCapRefusal" {
|
|
if sel, ok := x.Rhs[0].(*ast.SelectorExpr); ok && sel.Sel.Name == "BackupCapRefusal" {
|
|
bound = true
|
|
}
|
|
}
|
|
}
|
|
}
|
|
return true
|
|
})
|
|
}
|
|
if !appended {
|
|
t.Fatal("runDaemon's capability probe does not call backupCapStatus(backupCapRefusal)")
|
|
}
|
|
if !bound {
|
|
t.Fatal("runDaemon never binds backupCapRefusal to the local API server")
|
|
}
|
|
}
|