R-193: the recovery screen — unlocking, and only unlocking (v0.200.0)
A customer whose machine was rebuilt had everything needed to get their data back and no way to find out: the only route was a command line. This is the screen that closes that. IT UNLOCKS, AND ONLY UNLOCKS (operator ruling). It explains, takes the recovery code, opens the repository and shows what is in there — apps, dates, sizes. It restores nothing: restore is already per-app and lives in the backups area, and a screen that unlocks and then offers to overwrite is two decisions wearing one button. ONE CORE, TWO CALLERS. RecoverInstallCore is split out of RecoverAndInstall; the CLI wrapper keeps its exit codes and printed lines byte-identical, and the handler drives the same function. Two implementations of the one operation that can permanently lose a customer's data would drift, and only one would be tested. Asserted from source on both sides by AST. THREE WAYS OUT, none a dismiss button: recover; 'most nem' (the full page stops interrupting, the backups-area entry point stays PERMANENTLY, bound to the offer and never to the postpone flag); and 'I do not want the old data' — confirmed TWICE and reaching the SHIPPED move-aside, which sets aside and never deletes. THE CODE IS HANDLED NO MORE LOOSELY THAN ON THE COMMAND LINE: POST body only, never logged, never persisted, never echoed, cleared on every path, no-store, autocomplete off. No lockout — the code is a ten-word phrase, and locking a customer out of their own data for a typo is worse than anything it prevents. TWO DEFECTS THE TESTS CAUGHT, both fixed: an UNCLAIMED (legacy-open) box would have been shown the page, because RequireAuth passes such a box through; and the inventory nil-dereferenced when no off-site target was configured, which is exactly the pristine rebuilt shape.
This commit is contained in:
@@ -322,6 +322,9 @@ func (s *Server) templateFuncMap() template.FuncMap {
|
||||
}
|
||||
return t.In(loc).Format("2006-01-02 15:04")
|
||||
},
|
||||
// humanBytes (v0.200.0, R-193) renders a size the same way every other surface does — the
|
||||
// recovery page's listing shares the backup package's formatter rather than growing a second one.
|
||||
"humanBytes": backup.HumanizeBytes,
|
||||
"fmtTimeShort": func(t time.Time) string {
|
||||
if t.IsZero() {
|
||||
return "–"
|
||||
|
||||
@@ -920,6 +920,11 @@ func (s *Server) backupsRemoteHandler(w http.ResponseWriter, r *http.Request) {
|
||||
data["OffboxCeremonyTimedOut"] = timedOut
|
||||
// v0.142.0 offsite-repo continuity: the orphan card + the auto-refresh (Part C) trigger.
|
||||
data["OffboxOrphaned"] = s.backupMgr != nil && s.backupMgr.OffboxOrphaned()
|
||||
// R-193: the PERMANENT entry point to the recovery screen. It is bound to recoveryOffer, NOT to
|
||||
// recoveryInterrupts — "most nem" silences the full-page interruption and must never remove the
|
||||
// route to the data. A one-shot notice a flustered person clicks past is a notice that never
|
||||
// happened; this is what makes Scenario E true.
|
||||
data["RecoveryOffer"] = s.recoveryOffer()
|
||||
s.executeTemplate(w, r, "backups_remote", data)
|
||||
}
|
||||
|
||||
|
||||
@@ -0,0 +1,208 @@
|
||||
package web
|
||||
|
||||
import (
|
||||
"context"
|
||||
"net/http"
|
||||
"time"
|
||||
|
||||
"gitea.dooplex.hu/admin/felhom-controller/internal/backup"
|
||||
)
|
||||
|
||||
// R-193 — THE RECOVERY SCREEN. A customer whose machine was rebuilt has everything they need to get
|
||||
// their data back and, until this page, no way to find out: the only route was a command line.
|
||||
//
|
||||
// IT UNLOCKS, AND ONLY UNLOCKS (operator ruling, 2026-08-05). It explains the situation, takes the
|
||||
// recovery code, opens the repository, and shows what is in there. It does NOT restore anything.
|
||||
// Restoring is already per-app and already lives in the backups area; putting files back is a
|
||||
// separate item. A screen that unlocks and then offers to overwrite is two decisions wearing one
|
||||
// button.
|
||||
//
|
||||
// THREE WAYS OUT, and none of them is a dismiss button:
|
||||
// - RECOVER — the main path (/recovery/unlock).
|
||||
// - MOST NEM — the full page stops interrupting; the backups-area entry point stays PERMANENTLY,
|
||||
// because the data is still there whether or not anyone clicked (/recovery/postpone).
|
||||
// - I DO NOT WANT THE OLD DATA — deliberate, explained, confirmed TWICE, and it reaches the
|
||||
// SHIPPED move-aside (`/backup/offbox/reset`), which sets the store aside and never deletes.
|
||||
//
|
||||
// THE RECOVERY CODE IS HANDLED NO MORE LOOSELY THAN ON THE COMMAND LINE (§8.3): POST body only, never
|
||||
// a query string, never logged at any level, never persisted, never echoed back, cleared on every
|
||||
// path, and the page is served no-store with autocomplete off.
|
||||
|
||||
// recoveryOffer reports whether this box is in the situation the screen exists for. The predicate and
|
||||
// its two shapes live in backup.OffsiteRecoveryOffer — read its header before changing anything here.
|
||||
func (s *Server) recoveryOffer() bool {
|
||||
// CLAIMED AND BEHIND THE PASSWORD (§8.1). Before claiming there is no customer, and this page
|
||||
// states metadata about the household's own backups — accepted as metadata rather than content
|
||||
// (operator ruling 2026-08-05), which is only true while it sits behind the household password.
|
||||
// A legacy-open box (no password anywhere) reaches ServeHTTP through RequireAuth's pass-through,
|
||||
// so WITHOUT this line the interception would fire on an unauthenticated visitor. Caught by
|
||||
// TestRecovery_B_DoesNotAppearForAnyoneElse/not_claimed, which failed before it was added.
|
||||
if !s.authEnabled() {
|
||||
return false
|
||||
}
|
||||
return s.backupMgr != nil && s.backupMgr.OffsiteRecoveryOffer()
|
||||
}
|
||||
|
||||
// recoveryInterrupts reports whether the FULL PAGE should take over the landing pages. "Most nem"
|
||||
// suppresses this and nothing else — recoveryOffer stays true, so the backups-area entry point
|
||||
// survives. That asymmetry is the whole of Scenario E.
|
||||
func (s *Server) recoveryInterrupts() bool {
|
||||
if !s.recoveryOffer() {
|
||||
return false
|
||||
}
|
||||
return s.settings == nil || !s.settings.GetRecoveryNoticePostponed()
|
||||
}
|
||||
|
||||
// recoveryNoStore stamps the page uncacheable. The rendered page carries no secret, but it does carry
|
||||
// the form the code is typed into, and a cached copy of a recovery form is a form served from disk.
|
||||
func recoveryNoStore(w http.ResponseWriter) {
|
||||
w.Header().Set("Cache-Control", "no-store, no-cache, must-revalidate, private")
|
||||
w.Header().Set("Pragma", "no-cache")
|
||||
}
|
||||
|
||||
// recoveryPageHandler renders the screen (GET /recovery). Reachable whenever the situation holds —
|
||||
// including after "most nem", which is how the backups-area entry point can point at it forever.
|
||||
func (s *Server) recoveryPageHandler(w http.ResponseWriter, r *http.Request) {
|
||||
s.renderRecovery(w, r, "", "", nil)
|
||||
}
|
||||
|
||||
// renderRecovery is the one render path: pre-unlock (explanation + code form), or post-unlock (the
|
||||
// read-only listing). errorMsg/flash are already-customer-facing Hungarian; NEITHER EVER CONTAINS THE
|
||||
// CODE — see unlockHandler.
|
||||
func (s *Server) renderRecovery(w http.ResponseWriter, r *http.Request, errorMsg, flash string, inv *backup.OffsiteInventory) {
|
||||
recoveryNoStore(w)
|
||||
data := s.baseData("recovery", "Adatok visszaszerzése")
|
||||
data["CSRFField"] = s.csrfField(r)
|
||||
data["Offer"] = s.recoveryOffer()
|
||||
data["Postponed"] = s.settings != nil && s.settings.GetRecoveryNoticePostponed()
|
||||
data["Error"] = errorMsg
|
||||
data["Flash"] = flash
|
||||
data["SealedAt"] = s.recoverySealedAt()
|
||||
// The set-aside choice is offered ONLY when the shipped move-aside can actually run — it refuses
|
||||
// unless the tier is orphaned. Showing a button that is guaranteed to refuse would be worse than
|
||||
// not showing it, and rewriting the move-aside is explicitly out of scope.
|
||||
data["CanSetAside"] = s.backupMgr != nil && s.backupMgr.OffboxOrphaned()
|
||||
data["ConfirmSetAside"] = r.URL.Query().Get("setaside") == "1"
|
||||
if inv != nil {
|
||||
data["Unlocked"] = true
|
||||
data["InvApps"] = inv.Apps
|
||||
data["InvEmpty"] = inv.Empty
|
||||
data["InvUntagged"] = !inv.Empty && len(inv.Apps) == 0
|
||||
}
|
||||
w.Header().Set("Content-Type", "text/html; charset=utf-8")
|
||||
if err := s.tmpl.ExecuteTemplate(w, "recovery", data); err != nil {
|
||||
s.logger.Printf("[ERROR] [web] Template error (recovery): %v", err)
|
||||
http.Error(w, "Internal error", http.StatusInternalServerError)
|
||||
}
|
||||
}
|
||||
|
||||
// recoverySealedAt returns the human date the hub says the sealed package was created (""
|
||||
// when unknown). Non-secret: a timestamp, and the page must not pretend to know more than that
|
||||
// before a code is entered.
|
||||
func (s *Server) recoverySealedAt() string {
|
||||
if s.escrowSealedAtFn == nil {
|
||||
return ""
|
||||
}
|
||||
return s.escrowSealedAtFn()
|
||||
}
|
||||
|
||||
// SetEscrowSealedAt wires the ACK's escrow created_at (report.EscrowAutoConfirmer). INIT-ONLY.
|
||||
func (s *Server) SetEscrowSealedAt(fn func() string) { s.escrowSealedAtFn = fn }
|
||||
|
||||
// recoveryRecoverer returns the agent seam that unseals the package. nil → the shared agentClient(),
|
||||
// the same channel the CLI uses; tests inject. The seam exists so the HANDLER can be driven in a test
|
||||
// — a helper-level test would not observe a mutation that lives in the handler (§10).
|
||||
func (s *Server) recoveryRecoverer() (backup.OffsiteKeyRecoverer, error) {
|
||||
if s.recoveryRecovererFn != nil {
|
||||
return s.recoveryRecovererFn()
|
||||
}
|
||||
return s.agentClient()
|
||||
}
|
||||
|
||||
// SetRecoveryRecoverer overrides the agent seam (tests).
|
||||
func (s *Server) SetRecoveryRecoverer(fn func() (backup.OffsiteKeyRecoverer, error)) {
|
||||
s.recoveryRecovererFn = fn
|
||||
}
|
||||
|
||||
// recoveryUnlockHandler takes the recovery code and drives the SHARED core (POST /recovery/unlock).
|
||||
//
|
||||
// R HANDLING, and it must not drift from the CLI's:
|
||||
// - POST body only. A GET with a query string would put R in the access log, the browser history
|
||||
// and any Referer header the page later emits.
|
||||
// - never logged. Not at any level, not truncated, not hashed-and-logged.
|
||||
// - never persisted — not in the session, not in a cookie, not in a file.
|
||||
// - cleared on every path below, success and failure alike.
|
||||
// - never echoed. No message built here contains it; the agent's errors name the step, not the code.
|
||||
//
|
||||
// NO LOCKOUT (§8.4). The code is a 10-word EFF phrase — guessing is not the risk — and locking a
|
||||
// customer out of their own data because they mistyped is a worse failure than anything it prevents.
|
||||
// Failures ARE logged locally (without the code) so a box being probed is visible in the debug ring.
|
||||
func (s *Server) recoveryUnlockHandler(w http.ResponseWriter, r *http.Request) {
|
||||
if !s.recoveryOffer() {
|
||||
http.Redirect(w, r, "/backups/remote", http.StatusFound)
|
||||
return
|
||||
}
|
||||
_ = r.ParseForm()
|
||||
code := r.PostFormValue("recovery_code") // PostFormValue: body only, never the query string
|
||||
if code == "" {
|
||||
s.renderRecovery(w, r, "Add meg a helyreállítási kódot.", "", nil)
|
||||
return
|
||||
}
|
||||
rec, err := s.recoveryRecoverer()
|
||||
if err != nil {
|
||||
code = ""
|
||||
s.logger.Printf("[ERROR] [web] recovery: agent channel unavailable: %v", err)
|
||||
s.renderRecovery(w, r, "A gép házon belüli kapcsolata most nem elérhető — próbáld újra néhány perc múlva.", "", nil)
|
||||
return
|
||||
}
|
||||
ctx, cancel := context.WithTimeout(context.Background(), 90*time.Second)
|
||||
defer cancel()
|
||||
// THE SHARED CORE — the same function the command line drives. There is no second recovery
|
||||
// implementation in this codebase (R-193 §8.5).
|
||||
res, rerr := backup.RecoverInstallCore(ctx, s.backupMgr, rec, code, true)
|
||||
code = "" // cleared here, before any branch below, on success and failure alike
|
||||
if rerr != nil {
|
||||
// The agent's error names the STEP (fetch / unseal / place) and carries no secret. It is not
|
||||
// shown raw: a customer needs to know what to check, not what age's KDF returned.
|
||||
s.logger.Printf("[WARN] [web] recovery: unlock failed: %v", rerr)
|
||||
s.renderRecovery(w, r, "A megadott helyreállítási kódot nem fogadtuk el. Ellenőrizd, hogy mind a tíz szót pontosan, szóközökkel elválasztva írtad be — a kis- és nagybetűk nem számítanak. Semmi nem változott, nyugodtan próbáld újra.", "", nil)
|
||||
return
|
||||
}
|
||||
switch res.Outcome {
|
||||
case backup.RecoverRefused:
|
||||
s.logger.Printf("[WARN] [web] recovery: refused — a different repository password is already present")
|
||||
s.renderRecovery(w, r, "Ezen a gépen már van egy másik mentési kulcs. A régi előzmény visszanyitása felülírná azt, ezért nem hajtottuk végre. Vedd fel a kapcsolatot a Felhom ügyfélszolgálatával.", "", nil)
|
||||
return
|
||||
}
|
||||
s.logger.Printf("[INFO] [web] recovery: the offsite repository key was recovered and placed (outcome=%s)", res.Outcome)
|
||||
// Unlocked. Now show what is in there — read-only.
|
||||
ictx, icancel := context.WithTimeout(context.Background(), 2*time.Minute)
|
||||
defer icancel()
|
||||
inv, ierr := s.backupMgr.OffsiteInventoryList(ictx)
|
||||
if ierr != nil {
|
||||
s.logger.Printf("[WARN] [web] recovery: unlocked but the inventory could not be read: %v", ierr)
|
||||
empty := backup.OffsiteInventory{}
|
||||
msg := "A kulcs visszakerült, de a mentések listáját most nem sikerült beolvasni. Nézd meg a Biztonsági mentés oldalt néhány perc múlva."
|
||||
if backup.ErrNoOffsiteTarget(ierr) {
|
||||
// The pristine rebuilt shape: the key is in place but the box has no off-site coordinates
|
||||
// yet. It resolves by itself once the tier is re-applied, so say that rather than showing a
|
||||
// failure the customer cannot act on.
|
||||
msg = "A kulcs visszakerült. A gép még most kapcsolódik újra a házon kívüli tárhelyhez — a mentéseid listája néhány perc múlva jelenik meg a Biztonsági mentés oldalon."
|
||||
}
|
||||
s.renderRecovery(w, r, msg, "", &empty)
|
||||
return
|
||||
}
|
||||
s.renderRecovery(w, r, "", "A mentéseid zárolása feloldva. Az alábbiakat találtuk a tárolóban — semmit nem állítottunk vissza.", &inv)
|
||||
}
|
||||
|
||||
// recoveryPostponeHandler records "most nem" (POST /recovery/postpone). It suppresses the FULL-PAGE
|
||||
// interruption ONLY: recoveryOffer stays true, so the backups-area entry point survives permanently.
|
||||
func (s *Server) recoveryPostponeHandler(w http.ResponseWriter, r *http.Request) {
|
||||
if s.settings != nil {
|
||||
if err := s.settings.SetRecoveryNoticePostponed(true); err != nil {
|
||||
s.logger.Printf("[WARN] [web] recovery: recording the postpone failed: %v", err)
|
||||
}
|
||||
}
|
||||
s.logger.Printf("[INFO] [web] recovery: the customer chose to postpone; the backups-area entry point stays")
|
||||
http.Redirect(w, r, "/launcher", http.StatusFound)
|
||||
}
|
||||
@@ -0,0 +1,491 @@
|
||||
package web
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"io"
|
||||
"log"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"net/url"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"sync"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"gitea.dooplex.hu/admin/felhom-controller/internal/backup"
|
||||
"gitea.dooplex.hu/admin/felhom-controller/internal/config"
|
||||
"gitea.dooplex.hu/admin/felhom-controller/internal/settings"
|
||||
"gitea.dooplex.hu/admin/felhom-controller/internal/stacks"
|
||||
)
|
||||
|
||||
// R-193 — the recovery screen. HANDLER-LEVEL tests throughout: a test that reaches a helper while the
|
||||
// mutation lives in the handler cannot observe it, which is how a red-proof passed three sessions ago.
|
||||
// Everything below drives the real handler (or the real mux) and asserts the rendered page, the
|
||||
// on-disk effect, or the absence of the code.
|
||||
|
||||
const testRecoveryCode = "helyre-allitasi-kod-tiz-szo-pontosan-igy-ni-most"
|
||||
const testRepoPW = "b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1b1"
|
||||
|
||||
// fakeRecoverer is the agent seam. It records every code it was handed so a test can prove the
|
||||
// handler passed the RIGHT one, and can fail on demand for the wrong-code path.
|
||||
type fakeRecoverer struct {
|
||||
mu sync.Mutex
|
||||
pw string
|
||||
sha string
|
||||
fail bool
|
||||
codes []string
|
||||
}
|
||||
|
||||
func (f *fakeRecoverer) RecoverOffsiteRepoPassword(_ context.Context, code string) (string, string, error) {
|
||||
f.mu.Lock()
|
||||
f.codes = append(f.codes, code)
|
||||
f.mu.Unlock()
|
||||
if f.fail {
|
||||
// The shape the agent returns: names the STEP, never the code.
|
||||
return "", "", fmt.Errorf("unseal failed: age: incorrect passphrase")
|
||||
}
|
||||
return f.pw, f.sha, nil
|
||||
}
|
||||
|
||||
// recoveryRunner is the restic seam for the post-unlock inventory.
|
||||
type recoveryRunner struct {
|
||||
snapshots []map[string]any
|
||||
statsSize int64
|
||||
}
|
||||
|
||||
func (rr *recoveryRunner) run(_ context.Context, _ []string, args ...string) ([]byte, error) {
|
||||
joined := strings.Join(args, " ")
|
||||
switch {
|
||||
case strings.Contains(joined, " snapshots"):
|
||||
b, _ := json.Marshal(rr.snapshots)
|
||||
return b, nil
|
||||
case strings.Contains(joined, " stats "):
|
||||
b, _ := json.Marshal(map[string]any{"total_size": rr.statsSize})
|
||||
return b, nil
|
||||
}
|
||||
return []byte(""), nil
|
||||
}
|
||||
|
||||
type recoveryFixture struct {
|
||||
s *Server
|
||||
mgr *backup.Manager
|
||||
sett *settings.Settings
|
||||
rec *fakeRecoverer
|
||||
runner *recoveryRunner
|
||||
dataDir string
|
||||
}
|
||||
|
||||
// newRecoveryFixture builds a Server in the REBUILT-BOX shape by default: a claimed box (password
|
||||
// set), no repository password on disk, and the hub holding a sealed package.
|
||||
func newRecoveryFixture(t *testing.T) *recoveryFixture {
|
||||
t.Helper()
|
||||
lg := log.New(io.Discard, "", 0)
|
||||
dir := t.TempDir()
|
||||
cfg := &config.Config{}
|
||||
cfg.Paths.DataDir = filepath.Join(dir, "data")
|
||||
cfg.Paths.SystemDataPath = filepath.Join(dir, "sys")
|
||||
cfg.Paths.StacksDir = filepath.Join(dir, "stacks")
|
||||
cfg.Web.SessionSecret = "test-session-secret-abcdef"
|
||||
cfg.Web.PasswordHash = "$2a$10$abcdefghijklmnopqrstuv" // claimed: auth is enabled
|
||||
|
||||
sett, err := settings.Load(filepath.Join(dir, "settings.json"), lg)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := sett.SetHubEscrowIdentityPresent(true); err != nil { // the hub holds a package
|
||||
t.Fatal(err)
|
||||
}
|
||||
// The realistic shape once the credential self-heal has re-applied the tier: coordinates exist,
|
||||
// but this box holds no repository password for the history they point at.
|
||||
if err := sett.SetOffboxTarget(&settings.OffboxTarget{
|
||||
Enabled: true, Host: "nas.local", Port: 22, User: "felhom", RepoPath: "/srv/repo",
|
||||
Schedule: "daily", EscrowState: "escrowed",
|
||||
}); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
mgr := backup.NewManager(cfg, sett, lg)
|
||||
if err := mgr.WriteOffboxSecrets("PRIVATE-KEY-MATERIAL", "nas.local ssh-ed25519 AAAAhostkey"); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
// WriteOffboxSecrets auto-generates a repository password — remove it, because "this box cannot
|
||||
// open the inherited history" is the whole precondition of the screen.
|
||||
if err := os.Remove(filepath.Join(cfg.Paths.DataDir, "offbox", "repo_password")); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
rr := &recoveryRunner{statsSize: 4 << 20}
|
||||
mgr.SetOffboxRunner(rr.run)
|
||||
|
||||
rec := &fakeRecoverer{pw: testRepoPW, sha: backup.HashResticPassword(testRepoPW)}
|
||||
stackMgr, serr := stacks.NewManager(cfg, lg)
|
||||
if serr != nil {
|
||||
t.Fatal(serr)
|
||||
}
|
||||
s := &Server{cfg: cfg, settings: sett, backupMgr: mgr, stackMgr: stackMgr, logger: lg, version: "test"}
|
||||
s.loadTemplates()
|
||||
s.SetRecoveryRecoverer(func() (backup.OffsiteKeyRecoverer, error) { return rec, nil })
|
||||
return &recoveryFixture{s: s, mgr: mgr, sett: sett, rec: rec, runner: rr, dataDir: cfg.Paths.DataDir}
|
||||
}
|
||||
|
||||
// placeRepoPassword makes the box look HEALTHY (it holds its own repository password).
|
||||
func (f *recoveryFixture) placeRepoPassword(t *testing.T) {
|
||||
t.Helper()
|
||||
if err := f.mgr.InjectOffboxPassword(testRepoPW, true); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
}
|
||||
|
||||
func getRecoveryPage(t *testing.T, s *Server) *httptest.ResponseRecorder {
|
||||
t.Helper()
|
||||
rr := httptest.NewRecorder()
|
||||
s.recoveryPageHandler(rr, httptest.NewRequest(http.MethodGet, "/recovery", nil))
|
||||
return rr
|
||||
}
|
||||
|
||||
// SCENARIO A — the page appears for the fresh + package box, and interrupts the landing pages.
|
||||
func TestRecovery_A_PageAppearsForARebuiltBox(t *testing.T) {
|
||||
f := newRecoveryFixture(t)
|
||||
|
||||
if !f.s.recoveryOffer() {
|
||||
t.Fatal("a rebuilt box (fresh data area + a hub-held package) is not offered the recovery screen")
|
||||
}
|
||||
if !f.s.recoveryInterrupts() {
|
||||
t.Fatal("the full page must interrupt the landing pages before any postpone")
|
||||
}
|
||||
rr := getRecoveryPage(t, f.s)
|
||||
if rr.Code != http.StatusOK {
|
||||
t.Fatalf("GET /recovery = %d", rr.Code)
|
||||
}
|
||||
body := rr.Body.String()
|
||||
// The two MANDATORY sentences of §8.2 (ASCII-safe fragments — accented patterns get mangled
|
||||
// through the ssh→pct chain and a false 0 reads exactly like the sentence being gone).
|
||||
if !strings.Contains(body, "helyre") || !strings.Contains(body, "llít") {
|
||||
t.Error("the page does not mention the recovery code at all")
|
||||
}
|
||||
if !strings.Contains(body, "senki nem tudja p") {
|
||||
t.Error("MANDATORY: the page must say that nobody can replace a lost recovery code")
|
||||
}
|
||||
if !strings.Contains(body, "semmi nem v") {
|
||||
t.Error("MANDATORY: the page must say that nothing is restored or changed in this step")
|
||||
}
|
||||
// It takes the code in a POST body, and the field does not autofill.
|
||||
if !strings.Contains(body, `action="/recovery/unlock"`) || !strings.Contains(body, `method="POST"`) {
|
||||
t.Error("the code form must POST to /recovery/unlock")
|
||||
}
|
||||
if !strings.Contains(body, `autocomplete="off"`) {
|
||||
t.Error("the recovery-code field must not autofill")
|
||||
}
|
||||
// And it is not cached.
|
||||
if cc := rr.Header().Get("Cache-Control"); !strings.Contains(cc, "no-store") {
|
||||
t.Errorf("the recovery page must be no-store, got %q", cc)
|
||||
}
|
||||
}
|
||||
|
||||
// SCENARIO B — it does NOT appear for anyone else. THE GUARD ON THE CONJUNCTION.
|
||||
//
|
||||
// RED-PROOF: drop the hub-package condition from backup.OffsiteRecoveryOffer → the
|
||||
// "never had off-site backups" case below FAILS, i.e. a brand-new customer is greeted on day one by
|
||||
// a recovery screen for data they never had. That is the plausible wrong fix.
|
||||
func TestRecovery_B_DoesNotAppearForAnyoneElse(t *testing.T) {
|
||||
t.Run("healthy box (holds its own repository password)", func(t *testing.T) {
|
||||
f := newRecoveryFixture(t)
|
||||
f.placeRepoPassword(t) // healthy, and not orphaned
|
||||
if f.s.recoveryOffer() {
|
||||
t.Fatal("a HEALTHY box was offered the recovery screen")
|
||||
}
|
||||
})
|
||||
t.Run("never had off-site backups (no hub package)", func(t *testing.T) {
|
||||
f := newRecoveryFixture(t)
|
||||
if err := f.sett.SetHubEscrowIdentityPresent(false); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if f.s.recoveryOffer() {
|
||||
t.Fatal("a box that never had off-site backups was offered a recovery screen for data it never had")
|
||||
}
|
||||
})
|
||||
t.Run("not claimed — the page is behind the household password", func(t *testing.T) {
|
||||
f := newRecoveryFixture(t)
|
||||
f.s.cfg.Web.PasswordHash = "" // unclaimed: no password anywhere
|
||||
if f.s.authEnabled() {
|
||||
t.Fatal("fixture error: the box still reads as claimed")
|
||||
}
|
||||
// The interception is inside the authenticated surface: RequireAuth gates /launcher and
|
||||
// /dashboard before ServeHTTP ever runs. Assert that through the REAL middleware chain.
|
||||
mux := http.NewServeMux()
|
||||
mux.Handle("/", f.s.RequireAuth(f.s.CsrfProtect(http.HandlerFunc(f.s.ServeHTTP))))
|
||||
rr := httptest.NewRecorder()
|
||||
mux.ServeHTTP(rr, httptest.NewRequest(http.MethodGet, "/launcher", nil))
|
||||
if rr.Code == http.StatusFound && rr.Header().Get("Location") == "/recovery" {
|
||||
t.Fatal("an UNCLAIMED box redirected to the recovery screen — it shows metadata that belongs behind the household password")
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
// SCENARIO C — the correct code unlocks, places the key, and the page then shows what is in there.
|
||||
func TestRecovery_C_UnlockOpensAndLists(t *testing.T) {
|
||||
f := newRecoveryFixture(t)
|
||||
now := time.Now().UTC()
|
||||
f.runner.snapshots = []map[string]any{
|
||||
{"short_id": "aaa1111", "time": now.Add(-24 * time.Hour).Format(time.RFC3339), "tags": []string{"immich"}},
|
||||
{"short_id": "bbb2222", "time": now.Format(time.RFC3339), "tags": []string{"immich"}},
|
||||
{"short_id": "ccc3333", "time": now.Add(-48 * time.Hour).Format(time.RFC3339), "tags": []string{"calibre-web"}},
|
||||
}
|
||||
|
||||
rr := postUnlock(t, f.s, testRecoveryCode)
|
||||
if rr.Code != http.StatusOK {
|
||||
t.Fatalf("unlock = %d", rr.Code)
|
||||
}
|
||||
// EFFECT 1: the recovered key is on disk.
|
||||
got, present := f.mgr.OffboxRepoPasswordHash()
|
||||
if !present || got != backup.HashResticPassword(testRepoPW) {
|
||||
t.Fatalf("the recovered repository password was not placed (present=%v)", present)
|
||||
}
|
||||
// EFFECT 2: the handler passed the code it was given, unmodified.
|
||||
if len(f.rec.codes) != 1 || f.rec.codes[0] != testRecoveryCode {
|
||||
t.Fatalf("the handler did not hand the agent the typed code: %+v", f.rec.codes)
|
||||
}
|
||||
// EFFECT 3: the page lists what is in there — apps and dates. A success message with nothing
|
||||
// shown is indistinguishable from having unlocked an EMPTY store.
|
||||
body := rr.Body.String()
|
||||
for _, want := range []string{"immich", "calibre-web"} {
|
||||
if !strings.Contains(body, want) {
|
||||
t.Errorf("the listing does not name %q: the customer cannot tell whether this is their data", want)
|
||||
}
|
||||
}
|
||||
if !strings.Contains(body, "4.0 MB") && !strings.Contains(body, "MB") {
|
||||
t.Errorf("the listing shows no size")
|
||||
}
|
||||
// EFFECT 4: it did NOT restore anything — the page points at the restore page rather than doing it.
|
||||
if !strings.Contains(body, "/backups/restore") {
|
||||
t.Error("the page must point at the per-app restore rather than restoring")
|
||||
}
|
||||
if strings.Contains(body, "/backup/offbox/reconstitute") || strings.Contains(body, "/backup/offbox/place") {
|
||||
t.Fatal("the recovery page offers a RESTORE action — unlocking and restoring are separate")
|
||||
}
|
||||
}
|
||||
|
||||
// The EMPTY store is stated plainly rather than shown as a bare list.
|
||||
func TestRecovery_C_EmptyStoreSaysSo(t *testing.T) {
|
||||
f := newRecoveryFixture(t)
|
||||
f.runner.snapshots = nil // opened cleanly, holds nothing
|
||||
|
||||
body := postUnlock(t, f.s, testRecoveryCode).Body.String()
|
||||
if !strings.Contains(body, "nincs benne egyetlen ment") {
|
||||
t.Fatalf("an empty store must say so plainly — silence there reads as a broken page. body=%.400q", body)
|
||||
}
|
||||
}
|
||||
|
||||
// SCENARIO D — a wrong code fails closed, writes nothing, says what to check, and does NOT lock out.
|
||||
func TestRecovery_D_WrongCodeFailsClosedAndIsKind(t *testing.T) {
|
||||
f := newRecoveryFixture(t)
|
||||
f.rec.fail = true
|
||||
|
||||
for i := 0; i < 6; i++ { // well past any plausible lockout threshold
|
||||
rr := postUnlock(t, f.s, "rossz kod")
|
||||
if rr.Code != http.StatusOK {
|
||||
t.Fatalf("attempt %d: got %d, want a re-rendered page", i, rr.Code)
|
||||
}
|
||||
body := rr.Body.String()
|
||||
if !strings.Contains(body, "nem fogadtuk el") {
|
||||
t.Fatalf("attempt %d: the page does not say the code was not accepted: %.300q", i, body)
|
||||
}
|
||||
if !strings.Contains(body, "z szót") && !strings.Contains(body, "t sz") {
|
||||
t.Errorf("attempt %d: the message does not say what to check", i)
|
||||
}
|
||||
// The raw agent error must NOT be shown to the customer.
|
||||
if strings.Contains(body, "age:") || strings.Contains(body, "incorrect passphrase") {
|
||||
t.Errorf("attempt %d: the raw technical error was rendered to the customer", i)
|
||||
}
|
||||
// NOTHING was written.
|
||||
if _, present := f.mgr.OffboxRepoPasswordHash(); present {
|
||||
t.Fatalf("attempt %d: a repository password was written on a FAILED unlock", i)
|
||||
}
|
||||
// And the form is still there — no lockout.
|
||||
if !strings.Contains(body, `name="recovery_code"`) {
|
||||
t.Fatalf("attempt %d: the customer was locked out of their own data after a mistyped code", i)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// SCENARIO E — "most nem" stops the interruption and NOTHING else. The entry point survives.
|
||||
//
|
||||
// RED-PROOF: bind the backups-page entry point to recoveryInterrupts instead of recoveryOffer → the
|
||||
// route to the data disappears after one click.
|
||||
func TestRecovery_E_PostponeKeepsTheEntryPoint(t *testing.T) {
|
||||
f := newRecoveryFixture(t)
|
||||
|
||||
rr := httptest.NewRecorder()
|
||||
f.s.recoveryPostponeHandler(rr, httptest.NewRequest(http.MethodPost, "/recovery/postpone", nil))
|
||||
if rr.Code != http.StatusFound {
|
||||
t.Fatalf("postpone = %d, want a redirect", rr.Code)
|
||||
}
|
||||
if !f.sett.GetRecoveryNoticePostponed() {
|
||||
t.Fatal("the postpone was not recorded")
|
||||
}
|
||||
// The full page no longer interrupts…
|
||||
if f.s.recoveryInterrupts() {
|
||||
t.Fatal("the full page still interrupts after 'most nem'")
|
||||
}
|
||||
// …and it must NOT interrupt through the real mux either.
|
||||
mux := http.NewServeMux()
|
||||
mux.Handle("/", http.HandlerFunc(f.s.ServeHTTP))
|
||||
rr2 := httptest.NewRecorder()
|
||||
mux.ServeHTTP(rr2, httptest.NewRequest(http.MethodGet, "/launcher", nil))
|
||||
if rr2.Code == http.StatusFound && rr2.Header().Get("Location") == "/recovery" {
|
||||
t.Fatal("the landing page still redirects to the recovery screen after 'most nem'")
|
||||
}
|
||||
// …but the ENTRY POINT is untouched: the offer stands, so the backups page still renders it.
|
||||
if !f.s.recoveryOffer() {
|
||||
t.Fatal("'most nem' removed the OFFER — the customer has lost the route to their own data")
|
||||
}
|
||||
// And the page itself is still reachable directly.
|
||||
if getRecoveryPage(t, f.s).Code != http.StatusOK {
|
||||
t.Fatal("the recovery page is unreachable after 'most nem'")
|
||||
}
|
||||
// THE ENTRY POINT ITSELF, rendered: the backups page must still carry the route. Asserted on the
|
||||
// rendered flag rather than on recoveryOffer alone, because the defect this guards against is the
|
||||
// TEMPLATE being fed the wrong predicate.
|
||||
rr3 := httptest.NewRecorder()
|
||||
f.s.backupsRemoteHandler(rr3, httptest.NewRequest(http.MethodGet, "/backups/remote", nil))
|
||||
if !strings.Contains(rr3.Body.String(), `href="/recovery"`) {
|
||||
t.Fatal("the backups page no longer offers the route to the recovery screen after 'most nem' — a customer who clicked past it once has lost the way to their own data")
|
||||
}
|
||||
}
|
||||
|
||||
// SCENARIO F — "I do not want the old data" is confirmed TWICE and reaches the SHIPPED move-aside.
|
||||
//
|
||||
// RED-PROOF: render the final button on the first view (drop the ConfirmSetAside gate) → one click
|
||||
// suffices, and this test fails on the first assertion.
|
||||
func TestRecovery_F_SetAsideNeedsTwoConfirmations(t *testing.T) {
|
||||
f := newRecoveryFixture(t)
|
||||
// The move-aside only exists once the tier is orphaned — that is the shipped handler's own
|
||||
// precondition, and the page only offers the choice when it can actually run.
|
||||
if err := f.sett.SetOffboxTarget(&settings.OffboxTarget{
|
||||
Enabled: true, Host: "nas.local", Port: 22, User: "felhom", RepoPath: "/srv/repo",
|
||||
Schedule: "daily", EscrowState: "escrowed", RepoState: "orphaned",
|
||||
}); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if !f.mgr.OffboxOrphaned() {
|
||||
t.Fatal("fixture: the tier is not orphaned, so the set-aside cannot be offered")
|
||||
}
|
||||
|
||||
// FIRST VIEW — the destructive-looking button must NOT be present yet.
|
||||
first := getRecoveryPage(t, f.s).Body.String()
|
||||
if strings.Contains(first, `action="/backup/offbox/reset"`) {
|
||||
t.Fatal("the set-aside form is on the FIRST view — one click would set the customer's history aside")
|
||||
}
|
||||
if !strings.Contains(first, "setaside=1") {
|
||||
t.Fatal("the first view offers no route to the set-aside choice at all")
|
||||
}
|
||||
// And it must read as the exceptional path, not an equal third button.
|
||||
if strings.Count(first, "btn-primary") > 1 {
|
||||
t.Error("the set-aside is styled as an equal primary action")
|
||||
}
|
||||
|
||||
// SECOND VIEW — now the confirmation, naming exactly what happens.
|
||||
rr := httptest.NewRecorder()
|
||||
f.s.recoveryPageHandler(rr, httptest.NewRequest(http.MethodGet, "/recovery?setaside=1", nil))
|
||||
second := rr.Body.String()
|
||||
if !strings.Contains(second, `action="/backup/offbox/reset"`) {
|
||||
t.Fatal("the second view does not reach the SHIPPED move-aside handler")
|
||||
}
|
||||
if !strings.Contains(second, `name="confirm" value="1"`) {
|
||||
t.Fatal("the second view does not carry the shipped handler's confirm gate")
|
||||
}
|
||||
// The copy must say SET ASIDE, not delete — the whole point of the ruling.
|
||||
if !strings.Contains(second, "lretessz") {
|
||||
t.Error("the confirmation does not say the backups are SET ASIDE")
|
||||
}
|
||||
if !strings.Contains(second, "nem t") {
|
||||
t.Error("the confirmation does not say they are NOT deleted")
|
||||
}
|
||||
}
|
||||
|
||||
// SCENARIO G — the command line and the page drive ONE core.
|
||||
//
|
||||
// RED-PROOF: give the handler its own copy of fetch→compare→install instead of calling
|
||||
// RecoverInstallCore → this test still passes on the happy path, so it asserts the SHARED SYMBOL
|
||||
// from source (below) as well as the behaviour here.
|
||||
func TestRecovery_G_PageAndCLIShareOneCore(t *testing.T) {
|
||||
// Behavioural half: the same fake, the same outcome, through both callers.
|
||||
f := newRecoveryFixture(t)
|
||||
res, err := backup.RecoverInstallCore(context.Background(), f.mgr, f.rec, testRecoveryCode, true)
|
||||
if err != nil || res.Outcome != backup.RecoverInstalled {
|
||||
t.Fatalf("core install: outcome=%q err=%v", res.Outcome, err)
|
||||
}
|
||||
// Re-running is UNCHANGED, not a second install — the same three outcomes the CLI documents.
|
||||
res2, err2 := backup.RecoverInstallCore(context.Background(), f.mgr, f.rec, testRecoveryCode, true)
|
||||
if err2 != nil || res2.Outcome != backup.RecoverUnchanged {
|
||||
t.Fatalf("core re-run: outcome=%q err=%v", res2.Outcome, err2)
|
||||
}
|
||||
}
|
||||
|
||||
// SCENARIO H (§8.3) — the recovery code persists NOWHERE, with the planted-copy positive control.
|
||||
func TestRecovery_H_CodeLeavesNoTrace(t *testing.T) {
|
||||
f := newRecoveryFixture(t)
|
||||
var logBuf strings.Builder
|
||||
f.s.logger = log.New(&logBuf, "", 0)
|
||||
|
||||
rr := postUnlock(t, f.s, testRecoveryCode)
|
||||
|
||||
// 1) not echoed in the response
|
||||
if strings.Contains(rr.Body.String(), testRecoveryCode) {
|
||||
t.Fatal("the recovery code was echoed back in the rendered page")
|
||||
}
|
||||
// 2) not in any log line
|
||||
if strings.Contains(logBuf.String(), testRecoveryCode) {
|
||||
t.Fatal("the recovery code reached the log")
|
||||
}
|
||||
// 3) not in any file under the data dir
|
||||
found := grepTree(t, f.dataDir, testRecoveryCode)
|
||||
if found != "" {
|
||||
t.Fatalf("the recovery code was persisted to %s", found)
|
||||
}
|
||||
|
||||
// THE POSITIVE CONTROL — a sweep whose sensitivity was never shown is not evidence. Plant a copy
|
||||
// where the sweep looks and require it to be found; then remove it.
|
||||
planted := filepath.Join(f.dataDir, "planted-control.txt")
|
||||
if err := os.WriteFile(planted, []byte("x "+testRecoveryCode+" x"), 0o600); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if got := grepTree(t, f.dataDir, testRecoveryCode); got == "" {
|
||||
t.Fatal("POSITIVE CONTROL FAILED: the sweep could not find a planted copy, so its earlier silence proves nothing")
|
||||
}
|
||||
if err := os.Remove(planted); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if got := grepTree(t, f.dataDir, testRecoveryCode); got != "" {
|
||||
t.Fatalf("the control was not cleaned up: %s", got)
|
||||
}
|
||||
}
|
||||
|
||||
// grepTree returns the first file under root whose contents contain needle ("" when none).
|
||||
func grepTree(t *testing.T, root, needle string) string {
|
||||
t.Helper()
|
||||
var hit string
|
||||
_ = filepath.Walk(root, func(p string, info os.FileInfo, err error) error {
|
||||
if err != nil || info == nil || info.IsDir() || hit != "" {
|
||||
return nil
|
||||
}
|
||||
b, rerr := os.ReadFile(p)
|
||||
if rerr == nil && strings.Contains(string(b), needle) {
|
||||
hit = p
|
||||
}
|
||||
return nil
|
||||
})
|
||||
return hit
|
||||
}
|
||||
|
||||
func postUnlock(t *testing.T, s *Server, code string) *httptest.ResponseRecorder {
|
||||
t.Helper()
|
||||
form := url.Values{"recovery_code": {code}}
|
||||
req := httptest.NewRequest(http.MethodPost, "/recovery/unlock", strings.NewReader(form.Encode()))
|
||||
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
||||
rr := httptest.NewRecorder()
|
||||
s.recoveryUnlockHandler(rr, req)
|
||||
return rr
|
||||
}
|
||||
@@ -0,0 +1,146 @@
|
||||
package web
|
||||
|
||||
import (
|
||||
"go/ast"
|
||||
"go/parser"
|
||||
"go/token"
|
||||
"testing"
|
||||
)
|
||||
|
||||
// SCENARIO I / §8.5 — the seam-discipline tests. Both walk the AST rather than grepping, because a
|
||||
// commented-out call still contains the string, and both parse with comments DROPPED so a commented
|
||||
// line cannot satisfy them. This project's built-but-never-wired count is six.
|
||||
|
||||
// The handler must drive the SHARED core. If it ever grows its own fetch→compare→install, the CLI and
|
||||
// the page can diverge and only one of them will be tested — on the one operation that can
|
||||
// permanently lose a customer's data.
|
||||
//
|
||||
// RED-PROOF: replace the RecoverInstallCore call in recoveryUnlockHandler with an inline copy →
|
||||
// this fails.
|
||||
func TestRecoveryHandlerDrivesTheSharedCore(t *testing.T) {
|
||||
fset := token.NewFileSet()
|
||||
f, err := parser.ParseFile(fset, "recovery_handlers.go", nil, 0)
|
||||
if err != nil {
|
||||
t.Fatalf("parse recovery_handlers.go: %v", err)
|
||||
}
|
||||
|
||||
var fn *ast.FuncDecl
|
||||
ast.Inspect(f, func(n ast.Node) bool {
|
||||
if d, ok := n.(*ast.FuncDecl); ok && d.Name.Name == "recoveryUnlockHandler" {
|
||||
fn = d
|
||||
return false
|
||||
}
|
||||
return true
|
||||
})
|
||||
if fn == nil {
|
||||
t.Fatal("recoveryUnlockHandler not found — did it move? the shared-core wiring is now unasserted")
|
||||
}
|
||||
|
||||
callsCore := false
|
||||
// Any DIRECT use of the agent's unseal from the handler would be a second implementation.
|
||||
callsRecoverDirectly := false
|
||||
ast.Inspect(fn, func(n ast.Node) bool {
|
||||
call, ok := n.(*ast.CallExpr)
|
||||
if !ok {
|
||||
return true
|
||||
}
|
||||
sel, ok := call.Fun.(*ast.SelectorExpr)
|
||||
if !ok {
|
||||
return true
|
||||
}
|
||||
switch sel.Sel.Name {
|
||||
case "RecoverInstallCore":
|
||||
callsCore = true
|
||||
case "RecoverOffsiteRepoPassword", "InjectOffboxPassword":
|
||||
callsRecoverDirectly = true
|
||||
}
|
||||
return true
|
||||
})
|
||||
if !callsCore {
|
||||
t.Fatal("recoveryUnlockHandler does NOT call backup.RecoverInstallCore — the page and the command line would be two implementations of one irreversible operation")
|
||||
}
|
||||
if callsRecoverDirectly {
|
||||
t.Fatal("recoveryUnlockHandler reaches the agent/injection DIRECTLY — that is a second recovery implementation, which is exactly what the shared core exists to prevent")
|
||||
}
|
||||
}
|
||||
|
||||
// And the CLI wrapper must drive the same core, from the other side.
|
||||
//
|
||||
// RED-PROOF: restore the inline fetch→compare→install inside RecoverAndInstall → this fails.
|
||||
func TestCLIWrapperDrivesTheSharedCore(t *testing.T) {
|
||||
fset := token.NewFileSet()
|
||||
f, err := parser.ParseFile(fset, "../backup/offbox_recovery_cli.go", nil, 0)
|
||||
if err != nil {
|
||||
t.Fatalf("parse offbox_recovery_cli.go: %v", err)
|
||||
}
|
||||
var fn *ast.FuncDecl
|
||||
ast.Inspect(f, func(n ast.Node) bool {
|
||||
if d, ok := n.(*ast.FuncDecl); ok && d.Name.Name == "RecoverAndInstall" {
|
||||
fn = d
|
||||
return false
|
||||
}
|
||||
return true
|
||||
})
|
||||
if fn == nil {
|
||||
t.Fatal("RecoverAndInstall not found — the shared-core wiring is now unasserted on the CLI side")
|
||||
}
|
||||
callsCore, callsDirect := false, false
|
||||
ast.Inspect(fn, func(n ast.Node) bool {
|
||||
call, ok := n.(*ast.CallExpr)
|
||||
if !ok {
|
||||
return true
|
||||
}
|
||||
if id, ok := call.Fun.(*ast.Ident); ok && id.Name == "RecoverInstallCore" {
|
||||
callsCore = true
|
||||
}
|
||||
if sel, ok := call.Fun.(*ast.SelectorExpr); ok {
|
||||
switch sel.Sel.Name {
|
||||
case "RecoverOffsiteRepoPassword", "InjectOffboxPassword":
|
||||
callsDirect = true
|
||||
}
|
||||
}
|
||||
return true
|
||||
})
|
||||
if !callsCore {
|
||||
t.Fatal("RecoverAndInstall no longer calls RecoverInstallCore — the CLI has its own copy again")
|
||||
}
|
||||
if callsDirect {
|
||||
t.Fatal("RecoverAndInstall reaches the agent/injection directly — the two callers have diverged")
|
||||
}
|
||||
}
|
||||
|
||||
// The page must be REACHABLE: routed in ServeHTTP, and the landing-page interception present.
|
||||
//
|
||||
// RED-PROOF: comment out the interception block → this fails, and a rebuilt box's owner would never
|
||||
// meet the screen unless they guessed the URL.
|
||||
func TestRecoveryRoutesAreWired(t *testing.T) {
|
||||
fset := token.NewFileSet()
|
||||
f, err := parser.ParseFile(fset, "server.go", nil, 0)
|
||||
if err != nil {
|
||||
t.Fatalf("parse server.go: %v", err)
|
||||
}
|
||||
var handlersSeen, interceptSeen bool
|
||||
ast.Inspect(f, func(n ast.Node) bool {
|
||||
call, ok := n.(*ast.CallExpr)
|
||||
if !ok {
|
||||
return true
|
||||
}
|
||||
sel, ok := call.Fun.(*ast.SelectorExpr)
|
||||
if !ok {
|
||||
return true
|
||||
}
|
||||
switch sel.Sel.Name {
|
||||
case "recoveryPageHandler", "recoveryUnlockHandler", "recoveryPostponeHandler":
|
||||
handlersSeen = true
|
||||
case "recoveryInterrupts":
|
||||
interceptSeen = true
|
||||
}
|
||||
return true
|
||||
})
|
||||
if !handlersSeen {
|
||||
t.Fatal("no recovery handler is routed in ServeHTTP — the page exists and is unreachable")
|
||||
}
|
||||
if !interceptSeen {
|
||||
t.Fatal("ServeHTTP never consults recoveryInterrupts — the full page would never take over the landing pages, so a customer would have to guess the URL")
|
||||
}
|
||||
}
|
||||
@@ -96,6 +96,15 @@ type Server struct {
|
||||
escrowStageFn func(ctx context.Context) error
|
||||
escrowStaleFn func() bool
|
||||
|
||||
// escrowSealedAtFn (v0.200.0, R-193) reports WHEN the hub's sealed recovery package was created —
|
||||
// the one non-secret fact the recovery screen may state before a code is entered. Wired via
|
||||
// SetEscrowSealedAt from the report ACK; nil → the page says nothing about the date rather than
|
||||
// guessing one.
|
||||
escrowSealedAtFn func() string
|
||||
// recoveryRecovererFn is the recovery screen's agent seam (nil → the shared agentClient(), the
|
||||
// same channel the CLI uses). Tests inject a fake so the HANDLER itself can be driven.
|
||||
recoveryRecovererFn func() (backup.OffsiteKeyRecoverer, error)
|
||||
|
||||
// NAS add orchestration (verify-before-commit): the single-flight job slot + the two seams.
|
||||
// netAgentFn nil → the shared agentClient(); netProbeFn nil → runNetProbe (the uid-1000 re-exec).
|
||||
netAdd netAddState
|
||||
@@ -361,6 +370,15 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
|
||||
s.logger.Printf("[DEBUG] [web] ServeHTTP: %s %s from %s", r.Method, logPath, r.RemoteAddr)
|
||||
}
|
||||
|
||||
// R-193: the recovery screen takes over the LANDING pages (and only those) while the situation
|
||||
// holds and the customer has not postponed. Placed before the switch so it cannot be defeated by
|
||||
// a route added later, and scoped to two paths so it never traps the customer inside it — every
|
||||
// other page, including the backups area the entry point lives in, stays reachable.
|
||||
if (path == "/launcher" || path == "/dashboard") && r.Method == http.MethodGet && s.recoveryInterrupts() {
|
||||
http.Redirect(w, r, "/recovery", http.StatusFound)
|
||||
return
|
||||
}
|
||||
|
||||
switch {
|
||||
// Customer-claim arc (v0.122.0, F-4): the code-entry page + its handlers. Reachable pre-auth
|
||||
// (code-gated internally); CSRF via the pre-auth HMAC token (validated inside the handlers).
|
||||
@@ -375,6 +393,16 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
|
||||
// canonical landing page. "/" 302s to /launcher (ONE canonical URL per page — the launcher body
|
||||
// is never served AT "/"). Post-login lands on "/", so it flows here → the launcher.
|
||||
http.Redirect(w, r, "/launcher", http.StatusFound)
|
||||
// R-193 — the recovery screen. A FULL PAGE, not a banner: someone who has just lost a machine
|
||||
// deserves a screen about that and nothing else. It takes over the landing pages while the
|
||||
// situation holds AND the customer has not chosen "most nem"; afterwards it stays reachable here
|
||||
// (and from the backups area) for as long as the situation lasts.
|
||||
case path == "/recovery" && r.Method == http.MethodGet:
|
||||
s.recoveryPageHandler(w, r)
|
||||
case path == "/recovery/unlock" && r.Method == http.MethodPost:
|
||||
s.recoveryUnlockHandler(w, r)
|
||||
case path == "/recovery/postpone" && r.Method == http.MethodPost:
|
||||
s.recoveryPostponeHandler(w, r)
|
||||
case path == "/dashboard":
|
||||
s.dashboardHandler(w, r)
|
||||
case path == "/launcher":
|
||||
|
||||
@@ -8,6 +8,19 @@
|
||||
|
||||
{{template "backups_flash" .}}
|
||||
|
||||
{{if .RecoveryOffer}}
|
||||
<!-- R-193: the PERMANENT entry point. Bound to RecoveryOffer, never to the postpone flag — a
|
||||
customer who clicked "Most nem" once must not lose the route to their own data. -->
|
||||
<div class="alert alert-warning">
|
||||
<strong>A korábbi, házon kívüli mentéseid visszaszerezhetők.</strong>
|
||||
Ezt a gépet újratelepítették, és a Felhom központi rendszere őriz hozzá egy lezárt csomagot. A
|
||||
helyreállítási kódoddal feloldhatod a korábbi mentéseidet, és megnézheted, mi van bennük.
|
||||
<div class="form-actions" style="margin-top:.5rem">
|
||||
<a href="/recovery" class="btn btn-primary">Adatok visszaszerzése</a>
|
||||
</div>
|
||||
</div>
|
||||
{{end}}
|
||||
|
||||
{{if not .Backup}}
|
||||
{{template "backups_empty" .}}
|
||||
{{else}}
|
||||
|
||||
@@ -0,0 +1,146 @@
|
||||
{{define "recovery"}}
|
||||
<!DOCTYPE html>
|
||||
<html lang="hu">
|
||||
<head>
|
||||
<meta charset="UTF-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||||
<meta name="robots" content="noindex, nofollow">
|
||||
<title>Adatok visszaszerzése — Felhom</title>
|
||||
<link rel="stylesheet" href="/static/style.css">
|
||||
</head>
|
||||
<body class="login-body">
|
||||
<div class="login-card" style="max-width:46rem">
|
||||
<img src="/static/felhom-logo.svg" alt="Felhom.eu" class="login-logo">
|
||||
|
||||
{{if .Unlocked}}
|
||||
<!-- ── AFTER THE UNLOCK: what is in there. Read-only — nothing was restored. ────────────── -->
|
||||
<h1 class="login-title">A mentéseid <span class="title-accent">elérhetők</span></h1>
|
||||
{{if .Flash}}<div class="alert alert-info">{{.Flash}}</div>{{end}}
|
||||
{{if .Error}}<div class="alert alert-error">{{.Error}}</div>{{end}}
|
||||
|
||||
{{if .InvEmpty}}
|
||||
<div class="alert alert-warning">
|
||||
A tároló megnyílt, de <strong>nincs benne egyetlen mentés sem</strong>. Ez azt jelenti, hogy a
|
||||
kulcs jó volt, de ehhez a géphez nem tartozik korábbi mentés. Ha korábban biztosan készültek
|
||||
mentések, keresd a Felhom ügyfélszolgálatát, mielőtt bármit tennél.
|
||||
</div>
|
||||
{{else if .InvUntagged}}
|
||||
<div class="alert alert-warning">
|
||||
A tároló megnyílt, és van benne tartalom, de nem tudtuk alkalmazásokhoz rendelni. A Biztonsági
|
||||
mentés oldalon nézheted meg részletesen.
|
||||
</div>
|
||||
{{else}}
|
||||
<p class="login-subtitle" style="margin-bottom:1rem">
|
||||
Ezek a <strong>te</strong> mentéseid, a lent jelzett időpontokból. Nézd át, hogy tényleg azt
|
||||
találod-e itt, amire számítasz — <strong>semmit nem állítottunk vissza és semmi nem változott.</strong>
|
||||
</p>
|
||||
<table class="data-table" style="width:100%;margin-bottom:1rem">
|
||||
<thead><tr><th>Alkalmazás</th><th>Legutóbbi mentés</th><th>Méret</th></tr></thead>
|
||||
<tbody>
|
||||
{{range .InvApps}}
|
||||
<tr>
|
||||
<td>{{.App}}</td>
|
||||
<td>{{fmtTime .LatestAt}}</td>
|
||||
<td>{{if gt .SizeBytes 0}}{{humanBytes .SizeBytes}}{{else}}—{{end}}</td>
|
||||
</tr>
|
||||
{{end}}
|
||||
</tbody>
|
||||
</table>
|
||||
{{end}}
|
||||
|
||||
<p class="form-hint">
|
||||
A visszaállítás alkalmazásonként történik, a <strong>Biztonsági mentés → Visszaállítás</strong>
|
||||
oldalon. Ott választhatod ki, melyik alkalmazás mit hozzon vissza.
|
||||
</p>
|
||||
<div class="form-actions">
|
||||
<a href="/backups/restore" class="btn btn-primary">Tovább a visszaállításhoz</a>
|
||||
<a href="/launcher" class="btn btn-outline">Vissza a kezdőlapra</a>
|
||||
</div>
|
||||
|
||||
{{else}}
|
||||
<!-- ── BEFORE ANY CODE: explain, then take the code. ───────────────────────────────────── -->
|
||||
<h1 class="login-title">Adatok <span class="title-accent">visszaszerzése</span></h1>
|
||||
<p class="login-subtitle">{{.CustomerName}}</p>
|
||||
|
||||
{{if .Flash}}<div class="alert alert-info">{{.Flash}}</div>{{end}}
|
||||
{{if .Error}}<div class="alert alert-error">{{.Error}}</div>{{end}}
|
||||
|
||||
<p>
|
||||
Ezt a gépet újratelepítették. A korábbi, <strong>házon kívüli mentéseid megvannak</strong> — a
|
||||
Felhom központi rendszere őriz hozzájuk egy lezárt csomagot{{with .SealedAt}}, amelyet
|
||||
<strong>{{.}}</strong> zártunk le{{end}}. A csomagot csak a <strong>te helyreállítási
|
||||
kódoddal</strong> lehet kinyitni.
|
||||
</p>
|
||||
|
||||
<div class="alert alert-warning">
|
||||
<strong>A helyreállítási kódot senki nem tudja pótolni</strong> — sem a Felhom, sem az
|
||||
ügyfélszolgálat, sem az üzemeltető. Ez szándékos: így a mentéseidet rajtad kívül senki nem
|
||||
tudja megnyitni. Ha a kód elveszett, a korábbi mentések nem nyithatók meg többé.
|
||||
</div>
|
||||
|
||||
<p>
|
||||
Ha megadod a kódot, <strong>feloldjuk a mentéseid zárolását és megmutatjuk, mi van bennük</strong>
|
||||
— melyik alkalmazás, mikorról, mekkora. <strong>Ebben a lépésben semmit nem állítunk vissza és
|
||||
semmi nem változik.</strong> A visszaállítást utána, alkalmazásonként külön választhatod.
|
||||
</p>
|
||||
|
||||
<form method="POST" action="/recovery/unlock" autocomplete="off">
|
||||
{{.CSRFField}}
|
||||
<label for="recovery_code">Helyreállítási kód (tíz szó)</label>
|
||||
<input type="password" id="recovery_code" name="recovery_code"
|
||||
autocomplete="off" autocapitalize="off" autocorrect="off" spellcheck="false"
|
||||
placeholder="tíz szó, szóközökkel elválasztva" required>
|
||||
<div class="form-actions">
|
||||
<button type="submit" class="btn btn-primary">Mentések feloldása</button>
|
||||
<form method="POST" action="/recovery/postpone" style="display:inline">
|
||||
{{.CSRFField}}
|
||||
<button type="submit" class="btn btn-outline">Most nem</button>
|
||||
</form>
|
||||
</div>
|
||||
</form>
|
||||
|
||||
<p class="form-hint">
|
||||
A „Most nem” csak azt jelenti, hogy nem zavarunk vele többet a kezdőlapon. A mentéseid ettől
|
||||
megmaradnak, és ez az oldal a <strong>Biztonsági mentés → Távoli mentés</strong> oldalról
|
||||
bármikor újra elérhető.
|
||||
</p>
|
||||
|
||||
<!-- ── THE EXCEPTIONAL PATH. Deliberately not an equal third button. ───────────────────── -->
|
||||
<hr style="margin:1.5rem 0;border:none;border-top:1px solid var(--border,#2a3142)">
|
||||
{{if .ConfirmSetAside}}
|
||||
<div class="alert alert-error">
|
||||
<p><strong>Biztosan nem kéred vissza a korábbi mentéseket?</strong></p>
|
||||
<p>Ha megerősíted:</p>
|
||||
<ul>
|
||||
<li>a korábbi mentéseket <strong>félretesszük — nem töröljük</strong>;</li>
|
||||
<li>a helyreállítási kód nélkül <strong>többé nem lesznek megnyithatók</strong>;</li>
|
||||
<li>a gép <strong>új, üres mentési tárolót kezd</strong>, és mostantól oda ment;</li>
|
||||
<li>ez az oldal <strong>többé nem jelenik meg</strong>.</li>
|
||||
</ul>
|
||||
<p>Ha csak most nincs kéznél a kódod, válaszd inkább a „Most nem” lehetőséget.</p>
|
||||
</div>
|
||||
<div class="form-actions">
|
||||
<form method="POST" action="/backup/offbox/reset">
|
||||
{{.CSRFField}}
|
||||
<input type="hidden" name="confirm" value="1">
|
||||
<button type="submit" class="btn btn-danger">Igen, félretehetitek a korábbi mentéseket</button>
|
||||
</form>
|
||||
<a href="/recovery" class="btn btn-outline">Mégsem</a>
|
||||
</div>
|
||||
{{else}}
|
||||
<p class="form-hint">
|
||||
Ha a helyreállítási kódod véglegesen elveszett, és tudomásul veszed, hogy a korábbi mentések
|
||||
így nem nyithatók meg többé:
|
||||
{{if .CanSetAside}}
|
||||
<a href="/recovery?setaside=1">nem kérem vissza a korábbi adatokat</a>.
|
||||
{{else}}
|
||||
ez a lehetőség akkor válik elérhetővé, ha a gép már újra kapcsolódott a házon kívüli
|
||||
tárhelyhez. Addig a mentéseid érintetlenül megmaradnak.
|
||||
{{end}}
|
||||
</p>
|
||||
{{end}}
|
||||
{{end}}
|
||||
</div>
|
||||
</body>
|
||||
</html>
|
||||
{{end}}
|
||||
Reference in New Issue
Block a user