hub v0.15.0: Phase 2 managed updates — per-customer controller-version floor

Operator sets a minimum controller version (FLOOR), per-customer defaulting to a
global floor; the report ACK returns the effective floor + latest_version so the
controller auto-updates to the floor when below it (latest stays the opt-in button).

- store: min_controller_version column + hub_settings global floor + Effective/
  Get/SetGlobal/SetMin resolution + config/env DEFAULT_MIN_CONTROLLER_VERSION
- handler: report ACK {min_controller_version, latest_version}; LatestVersionProvider
- web: global floor editor + per-customer override form + Floor column (English)
- tests: floor resolution + ACK + render; override-precedence red-proof verified

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FSZmmSFVzGwEzhYmxbkgBK

hub/internal/web/configs.go

@@ -19,6 +19,24 @@ import (
 
 var validCustomerID = regexp.MustCompile(`^[a-zA-Z0-9.\-]+$`)
 
+// validSemver matches a bare X.Y.Z controller version (the floor format). Empty is also accepted by
+// the floor handlers (clears the override).
+var validSemver = regexp.MustCompile(`^\d+\.\d+\.\d+$`)
+
+// normalizeFloorInput trims, strips a leading "v", and validates a floor version submitted from the
+// operator UI. Returns (value, true) on a valid bare semver or empty string; (_, false) otherwise.
+func normalizeFloorInput(raw string) (string, bool) {
+	v := strings.TrimSpace(raw)
+	v = strings.TrimPrefix(v, "v")
+	if v == "" {
+		return "", true
+	}
+	if !validSemver.MatchString(v) {
+		return "", false
+	}
+	return v, true
+}
+
 // customerListEntry is a merged view of a customer from both configs and reports.
 type customerListEntry struct {
 	CustomerID        string
@@ -30,6 +48,11 @@ type customerListEntry struct {
 	ControllerVersion string
 	TimeSinceReport   time.Duration
 	ConfigCreatedAt   time.Time
+
+	// Phase 2 managed-update floor
+	FloorOverride  string // per-customer override ("" = none)
+	EffectiveFloor string // override else global ("" = no floor)
+	BelowFloor     bool   // current < effective floor (would auto-update)
 }
 
 // handleConfigList shows all customers (merged from configs + reports).
@@ -59,6 +82,7 @@ func (s *Server) handleConfigList(w http.ResponseWriter, r *http.Request) {
 			HasConfig:       true,
 			IsBlocked:       cfg.Status == "blocked",
 			ConfigCreatedAt: cfg.CreatedAt,
+			FloorOverride:   cfg.MinControllerVersion,
 		}
 	}
 
@@ -94,6 +118,18 @@ func (s *Server) handleConfigList(w http.ResponseWriter, r *http.Request) {
 		}
 	}
 
+	// Phase 2 floor: resolve each customer's effective floor (override else global) + below-floor flag.
+	globalFloor := s.store.GetGlobalMinControllerVersion()
+	for _, e := range merged {
+		e.EffectiveFloor = e.FloorOverride
+		if e.EffectiveFloor == "" {
+			e.EffectiveFloor = globalFloor
+		}
+		if e.EffectiveFloor != "" && e.ControllerVersion != "" {
+			e.BelowFloor = compareVersions(e.EffectiveFloor, e.ControllerVersion) > 0
+		}
+	}
+
 	// Sort by customer_id
 	entries := make([]customerListEntry, 0, len(merged))
 	for _, e := range merged {
@@ -104,15 +140,19 @@ func (s *Server) handleConfigList(w http.ResponseWriter, r *http.Request) {
 	})
 
 	data := struct {
-		Customers []customerListEntry
-		ActiveNav string
-		Flash     string
-		CSRFToken string
+		Customers   []customerListEntry
+		GlobalFloor string
+		ActiveNav   string
+		Flash       string
+		CSRFToken   string
+		CSRFField   template.HTML
 	}{
-		Customers: entries,
-		ActiveNav: "configs",
-		Flash:     r.URL.Query().Get("flash"),
-		CSRFToken: s.csrfToken(r),
+		Customers:   entries,
+		GlobalFloor: globalFloor,
+		ActiveNav:   "configs",
+		Flash:       r.URL.Query().Get("flash"),
+		CSRFToken:   s.csrfToken(r),
+		CSRFField:   s.csrfField(r),
 	}
 	s.templates.ExecuteTemplate(w, "configs.html", data)
 }
@@ -203,6 +243,19 @@ func (s *Server) handleCustomerUnified(w http.ResponseWriter, r *http.Request, c
 		}
 	}
 
+	// Phase 2 managed-update floor: per-customer override, the global default, the effective floor, and
+	// whether the box is currently below it (i.e. would auto-update on its next report).
+	floorOverride := ""
+	if cfg != nil {
+		floorOverride = cfg.MinControllerVersion
+	}
+	globalFloor := s.store.GetGlobalMinControllerVersion()
+	effectiveFloor := s.store.EffectiveMinControllerVersion(customerID)
+	belowFloor := false
+	if effectiveFloor != "" && customer != nil && customer.ControllerVersion != "" {
+		belowFloor = compareVersions(effectiveFloor, customer.ControllerVersion) > 0
+	}
+
 	// History, notifications, events
 	var history []store.CustomerSummary
 	var notifPrefs *store.NotificationPrefs
@@ -241,6 +294,12 @@ func (s *Server) handleCustomerUnified(w http.ResponseWriter, r *http.Request, c
 		UpdateAvailable bool
 		ControllerURL   string
 
+		// Phase 2 managed-update floor controls
+		FloorOverride  string // per-customer override ("" = none)
+		GlobalFloor    string // global default (hub_settings → config/env)
+		EffectiveFloor string // override else global ("" = no floor)
+		BelowFloor     bool   // current < effective floor (would auto-update)
+
 		ConfigSyncStatus string // "in_sync", "mismatch", "unknown"
 		ConfigDiffCount  int
 
@@ -296,6 +355,11 @@ func (s *Server) handleCustomerUnified(w http.ResponseWriter, r *http.Request, c
 		UpdateAvailable: updateAvailable,
 		ControllerURL:   controllerURL,
 
+		FloorOverride:  floorOverride,
+		GlobalFloor:    globalFloor,
+		EffectiveFloor: effectiveFloor,
+		BelowFloor:     belowFloor,
+
 		ConfigSyncStatus: configSyncStatus,
 		ConfigDiffCount:  configDiffCount,
 
@@ -551,6 +615,53 @@ func (s *Server) handleUnblockCustomer(w http.ResponseWriter, r *http.Request, c
 	http.Redirect(w, r, "/customers/"+customerID+"?flash=unblocked", http.StatusSeeOther)
 }
 
+// handleSetGlobalFloor sets (or clears) the global controller-version floor (Phase 2 managed
+// updates). Empty clears the hub_settings override, falling back to the config/env default.
+func (s *Server) handleSetGlobalFloor(w http.ResponseWriter, r *http.Request) {
+	if err := r.ParseForm(); err != nil {
+		http.Error(w, "Bad request", http.StatusBadRequest)
+		return
+	}
+	v, ok := normalizeFloorInput(r.FormValue("min_controller_version"))
+	if !ok {
+		http.Redirect(w, r, "/configs?flash=floor_invalid", http.StatusSeeOther)
+		return
+	}
+	if err := s.store.SetGlobalMinControllerVersion(v); err != nil {
+		s.logger.Printf("[ERROR] Failed to set global floor: %v", err)
+		http.Error(w, "Internal error", http.StatusInternalServerError)
+		return
+	}
+	s.logger.Printf("[INFO] Global controller-version floor set to %q", v)
+	http.Redirect(w, r, "/configs?flash=floor_set", http.StatusSeeOther)
+}
+
+// handleSetCustomerFloor sets (or clears) a customer's per-customer controller-version floor
+// override. Empty clears the override (the customer then uses the global floor).
+func (s *Server) handleSetCustomerFloor(w http.ResponseWriter, r *http.Request, customerID string) {
+	cfg, err := s.store.GetCustomerConfig(customerID)
+	if err != nil || cfg == nil {
+		http.NotFound(w, r)
+		return
+	}
+	if err := r.ParseForm(); err != nil {
+		http.Error(w, "Bad request", http.StatusBadRequest)
+		return
+	}
+	v, ok := normalizeFloorInput(r.FormValue("min_controller_version"))
+	if !ok {
+		http.Redirect(w, r, "/customers/"+customerID+"?flash=floor_invalid", http.StatusSeeOther)
+		return
+	}
+	if err := s.store.SetMinControllerVersion(customerID, v); err != nil {
+		s.logger.Printf("[ERROR] Failed to set floor for %s: %v", customerID, err)
+		http.Error(w, "Internal error", http.StatusInternalServerError)
+		return
+	}
+	s.logger.Printf("[INFO] Customer %s controller-version floor override set to %q", customerID, v)
+	http.Redirect(w, r, "/customers/"+customerID+"?flash=floor_set", http.StatusSeeOther)
+}
+
 // handlePushConfig sends the generated YAML config to the controller.
 func (s *Server) handlePushConfig(w http.ResponseWriter, r *http.Request, customerID string) {
 	cfg, err := s.store.GetCustomerConfig(customerID)

hub/internal/web/render_test.go

@@ -0,0 +1,47 @@
+package web
+
+import (
+	"bytes"
+	"io"
+	"log"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"gitea.dooplex.hu/admin/felhom-hub/internal/store"
+)
+
+// Catches template SYNTAX errors (template.Must in New panics) and that the floor fields render on the
+// two edited pages. Field-level execution errors surface as a non-nil ExecuteTemplate error.
+func TestTemplates_FloorRender(t *testing.T) {
+	st, err := store.New(filepath.Join(t.TempDir(), "t.db"), log.New(io.Discard, "", 0))
+	if err != nil {
+		t.Fatalf("store.New: %v", err)
+	}
+	t.Cleanup(func() { st.Close() })
+	s := New(st, "", "", "test", time.Hour, log.New(io.Discard, "", 0)) // template.Must runs here
+
+	// configs.html — the list page data shape used by handleConfigList.
+	cfgData := struct {
+		Customers []customerListEntry
+		GlobalFloor string
+		ActiveNav   string
+		Flash       string
+		CSRFToken   string
+		CSRFField   string
+	}{
+		Customers: []customerListEntry{{
+			CustomerID: "c", EffectiveFloor: "0.87.0", FloorOverride: "0.87.0", BelowFloor: true,
+			ControllerVersion: "0.86.0", HasConfig: true,
+		}},
+		GlobalFloor: "0.86.0",
+		ActiveNav:   "configs",
+	}
+	var buf bytes.Buffer
+	if err := s.templates.ExecuteTemplate(&buf, "configs.html", cfgData); err != nil {
+		t.Fatalf("render configs.html: %v", err)
+	}
+	if !bytes.Contains(buf.Bytes(), []byte("0.87.0")) || !bytes.Contains(buf.Bytes(), []byte("global floor")) {
+		t.Errorf("configs.html missing floor content")
+	}
+}

hub/internal/web/server.go

@@ -230,6 +230,14 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		} else {
 			http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
 		}
+	case strings.HasPrefix(path, "/customers/") && strings.HasSuffix(path, "/floor"):
+		customerID := strings.TrimPrefix(path, "/customers/")
+		customerID = strings.TrimSuffix(customerID, "/floor")
+		if r.Method == http.MethodPost {
+			s.handleSetCustomerFloor(w, r, customerID)
+		} else {
+			http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		}
 	case strings.HasPrefix(path, "/customers/") && strings.HasSuffix(path, "/create-config"):
 		customerID := strings.TrimPrefix(path, "/customers/")
 		customerID = strings.TrimSuffix(customerID, "/create-config")
@@ -254,6 +262,12 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		} else {
 			s.handleConfigNewForm(w, r)
 		}
+	case path == "/configs/global-floor":
+		if r.Method == http.MethodPost {
+			s.handleSetGlobalFloor(w, r)
+		} else {
+			http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		}
 	case strings.HasPrefix(path, "/configs/") && strings.HasSuffix(path, "/delete"):
 		customerID := strings.TrimPrefix(path, "/configs/")
 		customerID = strings.TrimSuffix(customerID, "/delete")

hub/internal/web/templates/configs.html

@@ -20,10 +20,28 @@
 
         {{if .Flash}}
         <div class="flash flash-success">
-            {{if eq .Flash "deleted"}}Customer configuration deleted.{{end}}
+            {{if eq .Flash "deleted"}}Customer configuration deleted.
+            {{else if eq .Flash "floor_set"}}Controller-version floor saved.
+            {{else if eq .Flash "floor_invalid"}}Invalid version — use X.Y.Z (or blank to clear).
+            {{end}}
         </div>
         {{end}}
 
+        <!-- Phase 2 managed updates: global controller-version floor -->
+        <div class="card" style="margin-bottom: 1rem; padding: 1rem; border: 1px solid #334155; border-radius: 8px;">
+            <h2 style="margin: 0 0 0.5rem;">Managed updates — global floor</h2>
+            <p style="font-size: 0.85em; color: #94a3b8; margin: 0 0 0.5rem;">
+                The minimum controller version every box auto-updates to (unless a per-customer override is set).
+                Boxes below the floor update on their next report — no customer action. Blank = no global floor.
+            </p>
+            <form method="POST" action="/configs/global-floor" style="display: flex; gap: 0.5rem; align-items: center; flex-wrap: wrap;">
+                {{.CSRFField}}
+                <input type="text" name="min_controller_version" value="{{.GlobalFloor}}" placeholder="e.g. 0.86.0 (blank = none)" style="padding: 0.3em 0.5em; width: 14em;">
+                <button class="btn btn-sm" type="submit">Save global floor</button>
+                <span style="font-size: 0.85em; color: #cbd5e1;">Current: {{if .GlobalFloor}}<code>v{{.GlobalFloor}}</code>{{else}}<span class="text-muted">unset</span>{{end}}</span>
+            </form>
+        </div>
+
         <div style="display: flex; justify-content: space-between; align-items: center; margin-bottom: 1rem;">
             <h2 style="margin: 0;">Customers</h2>
             <a href="/configs/new" class="btn">+ Add Customer</a>
@@ -43,6 +61,7 @@
                     <th>Domain</th>
                     <th>Status</th>
                     <th>Version</th>
+                    <th>Floor</th>
                     <th>Config</th>
                 </tr>
             </thead>
@@ -64,6 +83,10 @@
                         {{end}}
                     </td>
                     <td>{{if .ControllerVersion}}<code>{{.ControllerVersion}}</code>{{else}}<span class="text-muted">—</span>{{end}}</td>
+                    <td>
+                        {{if .EffectiveFloor}}<code>v{{.EffectiveFloor}}</code>{{if .FloorOverride}}<span class="text-muted" style="font-size:0.8em;"> (override)</span>{{end}}{{if .BelowFloor}}<span style="color:#f59e0b;" title="below floor — will auto-update"> ●</span>{{end}}
+                        {{else}}<span class="text-muted">—</span>{{end}}
+                    </td>
                     <td>
                         {{if .HasConfig}}
                         <span class="config-badge config-badge-managed">MANAGED</span>

hub/internal/web/templates/customer_unified.html

@@ -433,6 +433,30 @@
                 </div>
                 {{end}}
             </div>
+            <!-- Phase 2 managed-update floor (operator-enforced minimum) -->
+            <div class="info-grid" style="margin-top: 0.75rem; border-top: 1px solid #334155; padding-top: 0.75rem;">
+                <div class="info-item">
+                    <span class="label">Effective floor (min. version)</span>
+                    <span class="value">
+                        {{if .EffectiveFloor}}v{{.EffectiveFloor}}
+                            {{if .BelowFloor}}<span style="color: #f59e0b; margin-left: 0.3em;">● below floor — will auto-update</span>
+                            {{else}}<span style="color: #94a3b8; margin-left: 0.3em;">— at/above floor</span>{{end}}
+                        {{else}}<span style="color: #94a3b8;">none (Phase 2 inert)</span>{{end}}
+                    </span>
+                </div>
+                <div class="info-item">
+                    <span class="label">Global floor</span>
+                    <span class="value">{{if .GlobalFloor}}v{{.GlobalFloor}}{{else}}<span style="color: #94a3b8;">unset</span>{{end}}</span>
+                </div>
+            </div>
+            <form method="POST" action="/customers/{{.CustomerID}}/floor" style="margin-top: 0.5rem; display: flex; gap: 0.5rem; align-items: center; flex-wrap: wrap;">
+                {{.CSRFField}}
+                <label style="font-size: 0.85em; color: #cbd5e1;">Per-customer override</label>
+                <input type="text" name="min_controller_version" value="{{.FloorOverride}}" placeholder="e.g. 0.87.0 (blank = use global)" style="padding: 0.3em 0.5em; font-size: 0.85em; width: 14em;">
+                <button class="btn btn-outline btn-sm" type="submit">Save floor</button>
+                <span style="font-size: 0.8em; color: #94a3b8;">Boxes below the effective floor auto-update on their next report. Blank clears the override.</span>
+            </form>
+
             {{if and .HasConfig .ConfigSyncStatus}}
             <div class="info-item" style="margin-top: 0.5rem;">
                 <span class="label">Config Sync</span>