admin/felhom-controller
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

v0.126.4: edge-safe error statuses + native-alert ban — writeDiskJSON maps 502/504→500 (CF swallows those bodies; the M1 refusal reached the operator as a JSON SyntaxError popup), M1 refusal = typed errLastUsableDrive → 409; all 29 native alert() swept to showAlert + native_confirm_gate now bans alert( (F-11 class complete)

Browse Source
This commit is contained in:
authentik Default Admin
2026-07-13 14:13:05 +02:00
parent 6136461de6
commit c739003379
10 changed files with 147 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files
controller/internal/web/agent_disk_handlers.go
+8
View File
@@ -84,6 +84,14 @@ func (s *Server) ProbeAgentChannel(ctx context.Context) (constructionErr bool, e
// writeDiskJSON writes the standard {ok,data,error} envelope used by the disk API.
func writeDiskJSON(w http.ResponseWriter, status int, ok bool, errMsg string, data interface{}) {
// Cloudflare replaces origin 502/504 bodies with its OWN HTML error page (no passthru on
// this plan) — the page JS then fails to parse JSON and the customer sees a SyntaxError
// alert instead of the Hungarian message (live-hit 2026-07-13: the M1 decommission refusal
// surfaced as "<!DOCTYPE ... is not valid JSON"). App-level JSON errors must never leave
// the origin as 502/504; 500 carries the body through the edge intact.
if status == http.StatusBadGateway || status == http.StatusGatewayTimeout {
status = http.StatusInternalServerError
}
w.Header().Set("Content-Type", "application/json")
w.WriteHeader(status)
resp := map[string]interface{}{"ok": ok}
controller/internal/web/edge_safe_status_test.go
+68
View File
@@ -0,0 +1,68 @@
package web
import (
"context"
"errors"
"net/http"
"net/http/httptest"
"strings"
"testing"
"gitea.dooplex.hu/admin/felhom-controller/internal/settings"
)
// v0.126.4 — two defects surfaced by the 0.87.0 wizard leg's decommission attempt:
// 1. writeDiskJSON emitted app-level errors as 502 — Cloudflare replaces origin 502/504
// bodies with its own HTML error page, so the browser saw "<!DOCTYPE ..." instead of the
// Hungarian refusal and threw a JSON SyntaxError alert.
// 2. The M1 last-usable-drive refusal (a POLICY verdict) was indistinguishable from a real
// agent-gateway failure.
// COMPANION red-proofs: (1) remove the 502→500 map in writeDiskJSON → the status assertions
// fail; (2) return a non-sentinel fmt.Errorf from the mustBlock branch → the errors.Is
// assertion fails.
func TestWriteDiskJSON_EdgeSafeStatus(t *testing.T) {
cases := []struct {
in int
want int
}{
{http.StatusBadGateway, http.StatusInternalServerError}, // CF would swallow 502
{http.StatusGatewayTimeout, http.StatusInternalServerError}, // CF would swallow 504
{http.StatusConflict, http.StatusConflict}, // policy refusals pass as-is
{http.StatusBadRequest, http.StatusBadRequest},
{http.StatusOK, http.StatusOK},
}
for _, c := range cases {
rr := httptest.NewRecorder()
writeDiskJSON(rr, c.in, false, "hiba szöveg", nil)
if rr.Code != c.want {
t.Errorf("writeDiskJSON(%d): got status %d, want %d (502/504 must never leave the origin — CF replaces their body)", c.in, rr.Code, c.want)
}
if !strings.Contains(rr.Body.String(), `"hiba szöveg"`) {
t.Errorf("writeDiskJSON(%d): JSON body lost", c.in)
}
}
}
// The M1 refusal is the TYPED sentinel (so the handler can map it to 409, which crosses the
// CF edge with its body intact), and it must refuse BEFORE any side-effect: no soft-mark, no
// agent call.
func TestFinalizeDecommission_LastDriveRefusalIsTypedAndSideEffectFree(t *testing.T) {
s := testServer(t)
_ = s.settings.AddStoragePath(settings.StoragePath{Path: "/mnt/only", Schedulable: true, IsDefault: true})
agent := &mockAgent{}
err := s.finalizeDecommissionWith(context.Background(), agent, "/mnt/only", "")
if err == nil {
t.Fatal("decommissioning the last usable drive must be refused (M1)")
}
if !errors.Is(err, errLastUsableDrive) {
t.Fatalf("refusal must be the typed errLastUsableDrive sentinel (409 mapping), got: %v", err)
}
if s.settings.IsDecommissioned("/mnt/only") {
t.Error("refusal must precede the soft-mark side-effect")
}
if len(agent.decommissionCalls) != 0 {
t.Errorf("agent must not be called on refusal, got %v", agent.decommissionCalls)
}
}
controller/internal/web/storage_handlers.go
+13 -2
View File
@@ -419,7 +419,13 @@ func (s *Server) handleStorageDecommission(w http.ResponseWriter, r *http.Reques
}
}
if err := s.finalizeDecommission(r.Context(), req.Where, ""); err != nil {
writeDiskJSON(w, http.StatusBadGateway, false, err.Error(), nil)
// The M1 policy refusal is a 409 (CONFLICT with current state), not a gateway
// failure — and 409 passes the CF edge with its JSON body intact.
status := http.StatusBadGateway
if errors.Is(err, errLastUsableDrive) {
status = http.StatusConflict
}
writeDiskJSON(w, status, false, err.Error(), nil)
return
}
writeDiskJSON(w, http.StatusOK, true, "", map[string]any{"decommissioned": true, "where": req.Where, "stopped_apps": stopped})
@@ -429,6 +435,11 @@ func (s *Server) handleStorageDecommission(w http.ResponseWriter, r *http.Reques
}
}
// errLastUsableDrive is the M1 refusal (never leave zero default) — a POLICY verdict, not a
// gateway failure. The decommission handler maps it to 409 so the JSON refusal reaches the
// browser intact (a 502 would be swallowed by the Cloudflare edge error page).
var errLastUsableDrive = errors.New("ez az egyetlen használható tárhely — a leszerelés megtagadva (előbb adj hozzá vagy állíts be másik alapértelmezett meghajtót)")
// finalizeDecommission resolves the agent client then soft-marks + decommissions (see *With).
func (s *Server) finalizeDecommission(ctx context.Context, where, migratedTo string) error {
agent, err := s.agentClient()
@@ -448,7 +459,7 @@ func (s *Server) finalizeDecommissionWith(ctx context.Context, agent diskAgent,
// flips IsDefault/Schedulable on `where`).
promote, mustBlock := defaultPromotionTarget(s.settings.GetStoragePaths(), where, migratedTo)
if mustBlock {
return fmt.Errorf("ez az egyetlen használható tárhely — a leszerelés megtagadva (előbb adj hozzá vagy állíts be másik alapértelmezett meghajtót)")
return errLastUsableDrive
}
if err := s.settings.SetDecommissioned(where, migratedTo); err != nil {
return fmt.Errorf("nyilvántartás frissítése sikertelen: %w", err)
controller/internal/web/templates/app_info.html
+3 -3
View File
@@ -101,11 +101,11 @@ function appMigWatch(){
function appMigrate(btn,app,label){
var sel=document.getElementById('app-migrate-target');
var target=sel?sel.value:'';
if(!target){ alert('Válassz céltárhelyet.'); return; }
if(!target){ showAlert('Válassz céltárhelyet.'); return; }
felhomConfirm(btn,'Áthelyezed a(z) '+label+' adatait ide: '+target+'? Az alkalmazás rövid időre leáll. A régi adatok csak sikeres áthelyezés után törlődnek.',function(){
fetch('/api/storage/migrate-app',{method:'POST',headers:Object.assign({'Content-Type':'application/json'},csrfHeaders()),body:JSON.stringify({app:app,target:target})})
.then(function(r){return r.json();}).then(function(d){ if(d.ok){ appMigWatch(); } else { alert('Hiba: '+(d.error||'ismeretlen')); } })
.catch(function(e){ alert('Hiba: '+e); });
.then(function(r){return r.json();}).then(function(d){ if(d.ok){ appMigWatch(); } else { showAlert('Hiba: '+(d.error||'ismeretlen')); } })
.catch(function(e){ showAlert('Hiba: '+e); });
});
}
(function(){ fetch('/api/storage/migrate/status').then(function(r){return r.json();}).then(function(d){ if(d.data&&d.data.job){ appMigWatch(); } }).catch(function(){}); })();
controller/internal/web/templates/debug.html
+4 -4
View File
@@ -475,9 +475,9 @@ function simulateDisconnect(btn, path) {
headers: Object.assign({'Content-Type':'application/json'}, csrfHeaders()),
body: JSON.stringify({path: path})
}).then(function(r){return r.json()}).then(function(data) {
if (!data.ok) alert('Hiba: ' + (data.error || 'ismeretlen'));
if (!data.ok) showAlert('Hiba: ' + (data.error || 'ismeretlen'));
loadWatchdogStatus();
}).catch(function(e) { alert('Hiba: ' + e.message); });
}).catch(function(e) { showAlert('Hiba: ' + e.message); });
});
}
function simulateReconnect(path) {
@@ -486,9 +486,9 @@ function simulateReconnect(path) {
headers: Object.assign({'Content-Type':'application/json'}, csrfHeaders()),
body: JSON.stringify({path: path})
}).then(function(r){return r.json()}).then(function(data) {
if (!data.ok) alert('Hiba: ' + (data.error || 'ismeretlen'));
if (!data.ok) showAlert('Hiba: ' + (data.error || 'ismeretlen'));
loadWatchdogStatus();
}).catch(function(e) { alert('Hiba: ' + e.message); });
}).catch(function(e) { showAlert('Hiba: ' + e.message); });
}
// ── Section 5: Hub ──
controller/internal/web/templates/deploy.html
+2 -2
View File
@@ -165,14 +165,14 @@
var data = await resp.json();
if (!data.ok) {
checkbox.checked = !enable;
alert(data.error || 'Hiba történt');
showAlert(data.error || 'Hiba történt');
} else {
setTimeout(function(){ location.reload(); }, 500);
return;
}
} catch(err) {
checkbox.checked = !enable;
alert('Hálózati hiba');
showAlert('Hálózati hiba');
}
checkbox.disabled = false;
}
controller/internal/web/templates/storage.html
+18 -18
View File
@@ -207,13 +207,13 @@
function storageMigrateAll(source,label){
var sel=document.getElementById('migrate-target-'+source);
var target=sel?sel.value:'';
if(!target){ alert('Válassz céltárolót a legördülő menüből.'); return; }
if(!target){ showAlert('Válassz céltárolót a legördülő menüből.'); return; }
openDialog({title:'Összes adat áthelyezése', confirmLabel:'Áthelyezés',
message:'Áthelyezed a(z) '+label+' ÖSSZES adatát ide: '+target+'?\n\nAz alkalmazások az áthelyezés alatt rövid időre leállnak. A forrás adatai csak az ellenőrzés és a sikeres újraindítás után törlődnek.',
onConfirm:function(){
fetch('/api/storage/migrate',{method:'POST',headers:Object.assign({'Content-Type':'application/json'},csrfHeaders()),body:JSON.stringify({source:source,target:target})})
.then(function(r){return r.json();}).then(function(d){ if(d.ok){ migWatch(); } else { alert('Hiba: '+(d.error||'ismeretlen')); } })
.catch(function(e){ alert('Hiba: '+e); });
.then(function(r){return r.json();}).then(function(d){ if(d.ok){ migWatch(); } else { showAlert('Hiba: '+(d.error||'ismeretlen')); } })
.catch(function(e){ showAlert('Hiba: '+e); });
}});
}
// Resume view: if a migration is STILL IN PROGRESS when the page loads, show the panel and watch.
@@ -408,9 +408,9 @@ window.__registeredPaths=[{{range .StoragePaths}}{{if .Path}}"{{.Path}}",{{end}}
window.registerDrive=async function(where){
try{
var r=await fetch('/api/storage/register',{method:'POST',headers:Object.assign({'Content-Type':'application/json'},csrfHeaders()),body:JSON.stringify({where:where})});
var j=await r.json(); if(!j.ok){ alert('Regisztráció sikertelen: '+(j.error||'')); return; }
var j=await r.json(); if(!j.ok){ showAlert('Regisztráció sikertelen: '+(j.error||'')); return; }
location.reload();
}catch(e){ alert('Hiba: '+e.message); }
}catch(e){ showAlert('Hiba: '+e.message); }
};
window.confirmEject=function(where){
// The confirm name is the drive BASENAME (matches the server's path.Base(where) check); `where` may
@@ -530,12 +530,12 @@ function doStorageDisconnect(path) {
body: JSON.stringify({where: path})
}).then(function(r) { return r.json(); }).then(function(data) {
if (data.ok) {
alert('A meghajtó biztonságosan eltávolítható.');
showAlert('A meghajtó biztonságosan eltávolítható.');
location.reload();
} else {
alert('Hiba: ' + (data.error || 'ismeretlen'));
showAlert('Hiba: ' + (data.error || 'ismeretlen'));
}
}).catch(function(e) { alert('Hiba: ' + e); });
}).catch(function(e) { showAlert('Hiba: ' + e); });
}
function storageReconnect(path) {
var actionsDiv = document.getElementById('storage-actions-' + path);
@@ -548,11 +548,11 @@ function storageReconnect(path) {
if (data.ok) {
location.reload();
} else {
alert('Hiba: ' + (data.error || 'ismeretlen'));
showAlert('Hiba: ' + (data.error || 'ismeretlen'));
if (actionsDiv) actionsDiv.innerHTML = '<button class="btn btn-xs btn-primary" onclick="storageReconnect(\'' + path + '\')">Csatlakoztatás</button>';
}
}).catch(function(e) {
alert('Hiba: ' + e);
showAlert('Hiba: ' + e);
if (actionsDiv) actionsDiv.innerHTML = '<button class="btn btn-xs btn-primary" onclick="storageReconnect(\'' + path + '\')">Csatlakoztatás</button>';
});
}
@@ -564,12 +564,12 @@ function storageRestartApps(path) {
}).then(function(r) { return r.json(); }).then(function(data) {
if (data.ok) {
var r2 = data.restarted || [];
if (r2.length) alert('Elindítva: ' + r2.join(', '));
if (r2.length) showAlert('Elindítva: ' + r2.join(', '));
location.reload();
} else {
alert('Hiba: ' + (data.error || 'ismeretlen'));
showAlert('Hiba: ' + (data.error || 'ismeretlen'));
}
}).catch(function(e) { alert('Hiba: ' + e); });
}).catch(function(e) { showAlert('Hiba: ' + e); });
}
// H2: decommission a drive (non-destructive). If a migrate target is picked in the inline select →
// migrate-then-decommission; otherwise decommission-anyway with type-to-confirm.
@@ -594,9 +594,9 @@ function doStorageDecommission(body) {
headers: Object.assign({'Content-Type': 'application/json'}, csrfHeaders()),
body: JSON.stringify(body)
}).then(function(r) { return r.json(); }).then(function(data) {
if (data.ok) { alert('Leszerelés elindítva.'); location.reload(); }
else { alert('Hiba: ' + (data.error || 'ismeretlen')); }
}).catch(function(e) { alert('Hiba: ' + e); });
if (data.ok) { showAlert('Leszerelés elindítva.'); location.reload(); }
else { showAlert('Hiba: ' + (data.error || 'ismeretlen')); }
}).catch(function(e) { showAlert('Hiba: ' + e); });
}
// H3: one-click re-enroll a decommissioned/ejected drive — clears the marker, re-attaches under the
// parent, restarts the gate-stopped apps (data is intact).
@@ -612,8 +612,8 @@ function doStorageReEnroll(path) {
body: JSON.stringify({where: path})
}).then(function(r) { return r.json(); }).then(function(data) {
if (data.ok) { location.reload(); }
else { alert('Hiba: ' + (data.error || 'ismeretlen')); }
}).catch(function(e) { alert('Hiba: ' + e); });
else { showAlert('Hiba: ' + (data.error || 'ismeretlen')); }
}).catch(function(e) { showAlert('Hiba: ' + e); });
}
function cancelEditLabel(path, label) {
var wrap = document.getElementById('label-wrap-' + path);
controller/internal/web/templates/storage_network.html
+2 -2
View File
@@ -218,8 +218,8 @@ function netStorageRemove(name,label){
onConfirm:function(){
fetch('/api/storage/netstorage/remove',{method:'POST',headers:Object.assign({'Content-Type':'application/json'},csrfHeaders()),body:JSON.stringify({name:name})})
.then(function(r){return r.json();}).then(function(d){
if(d.ok){ location.reload(); } else { alert('Hiba: '+(d.error||'ismeretlen')); }
}).catch(function(e){ alert('Hiba: '+e); });
if(d.ok){ location.reload(); } else { showAlert('Hiba: '+(d.error||'ismeretlen')); }
}).catch(function(e){ showAlert('Hiba: '+e); });
}});
}
if(document.getElementById('ns-add-form')){ nsToggleSmb(); nsUpdateHostID(); } // form absent on the capability banner
controller/scripts/native_confirm_gate.py
+13 -9
View File
@@ -1,10 +1,13 @@
# -*- coding: utf-8 -*-
"""Native-confirm gate (drill F-11) — native confirm()/prompt() dialogs are OS-modals that block
browser automation (CDP freezes) and are banned from the UI; consequential actions use the inline
felhomConfirm helper (layout.html) or the .confirm-overlay dialog.
"""Native-confirm gate (drill F-11; alert added v0.126.4) — native confirm()/prompt()/alert()
dialogs are OS-modals that block browser automation (CDP freezes) and are banned from the UI;
consequential actions use the inline felhomConfirm helper (layout.html) or the .confirm-overlay
dialog; error/info surfaces use showAlert (layout.html modal). alert() joined the ban after the
0.87.0 wizard leg: a decommission error path alert() froze the automation exactly like F-11
predicted (the operator had to click the OS-modal away).
Run from controller/: python scripts/native_confirm_gate.py
Exit 1 if any native confirm(/prompt( call remains in the templates.
Exit 1 if any native confirm(/prompt(/alert( call remains in the templates.
"""
import io, os, re, sys
@@ -13,9 +16,10 @@ ROOTS = [
os.path.join("internal", "setup", "templates"),
]
# A bare confirm(/prompt( CALL with an argument: not preceded by an identifier character, so felhomConfirm( and
# onRestoreConfirmChange( never match. window.confirm( still matches ('.' is not identifier).
NATIVE = re.compile(r"(?<![A-Za-z0-9_$])(?:confirm|prompt)\(\s*[^)\s]")
# A bare confirm(/prompt(/alert( CALL with an argument: not preceded by an identifier character,
# so felhomConfirm(, showAlert( and onRestoreConfirmChange( never match. window.confirm( /
# window.alert( still match ('.' is not an identifier character).
NATIVE = re.compile(r"(?<![A-Za-z0-9_$])(?:confirm|prompt|alert)\(\s*[^)\s]")
def main():
@@ -30,9 +34,9 @@ def main():
total += 1
print("%s:%d %s" % (fn, lineno, line.strip()[:120].encode('ascii', 'backslashreplace').decode()))
if total:
print("NATIVE CONFIRM GATE FAILED: %d native confirm()/prompt() call(s) remain" % total)
print("NATIVE CONFIRM GATE FAILED: %d native confirm()/prompt()/alert() call(s) remain" % total)
sys.exit(1)
print("native-confirm gate OK — no native confirm()/prompt() in templates")
print("native-confirm gate OK — no native confirm()/prompt()/alert() in templates")
if __name__ == "__main__":