hub v0.61.0 + felhom-tenantsync v1.1.0: Customer RESET (middle lifecycle tier)
One operator action returns a customer to pre-first-install: all operational state dies (offsite repo, PBS namespace+backups, DR recipe, one-time secret, claim state, retained escrow custody); identity + basic config + provenance + events survive. Sits between host delete and customer Delete. - store/customer_reset.go: customer_resets journal, live inventory, ack-gated purge (never touches identity/provenance/events), DeleteClaim. - claim.ResetToUnclaimed: delete claim row -> fresh code next onboarding. - offsite.Deprovision (idempotent) + OffsiteIdentifier + ClearProvisionedDescriptor. - tenantsync.Deprovision + felhom-tenantsync.sh deprovision op (destroys ns + backup groups + token; shared user untouched; idempotent). - web/customer_reset.go: GET reset -> inventory JSON; POST -> orchestration (external teardown FIRST, DB purge LAST; refuse-while-hosts; typed-id + separate escrow ack). Amber RESET card distinct from red Danger-zone Delete. - Red-proofs: ack-gate + partial-failure resumability (both proven red); store ack-gating + journal round-trip; offsite idempotency + descriptor clear; RESET-card render. Green: build + vet + test.
This commit is contained in:
@@ -0,0 +1,228 @@
|
||||
package web
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"net/http"
|
||||
"time"
|
||||
|
||||
"gitea.dooplex.hu/admin/felhom-hub/internal/offsite"
|
||||
)
|
||||
|
||||
// Customer RESET (v0.61.0) — the middle lifecycle tier (host delete < RESET < customer DELETE). One
|
||||
// operator action returns a customer to pre-first-install: every OPERATIONAL trace dies (offsite repo
|
||||
// + PBS namespace + credentials + DR recipe + claim state + retained escrow custody), while IDENTITY
|
||||
// and the BASIC CONFIG survive (customer_configs row, provenance rows, the audit event stream).
|
||||
//
|
||||
// Orchestration discipline (spec §3): external teardown runs FIRST, the DB purge runs LAST
|
||||
// (publish-last). Every leg is idempotent, so a partial run is simply re-run from the top — a failed
|
||||
// external leg is a clean journal entry, and the DB purge (which erases the descriptors that say what
|
||||
// still needs tearing down) is withheld until every external leg is ok. Provenance/events are NEVER
|
||||
// wiped — the audit trail outlives every lifecycle tier.
|
||||
|
||||
// offsiteChoice reads the customer's offsite tier selection out of config_json (the same shape the
|
||||
// re-issue/freeze handlers read). enabled=false means no offsite leg to run.
|
||||
func offsiteChoice(configJSON string) (enabled bool, typ string) {
|
||||
var o struct {
|
||||
Offsite struct {
|
||||
Enabled bool `json:"enabled"`
|
||||
Type string `json:"type"`
|
||||
} `json:"offsite"`
|
||||
}
|
||||
_ = json.Unmarshal([]byte(configJSON), &o)
|
||||
return o.Offsite.Enabled, o.Offsite.Type
|
||||
}
|
||||
|
||||
// handleCustomerResetPreview — GET /configs/{id}/reset. Returns the live inventory the confirm surface
|
||||
// renders (ruling 4): what a RESET would destroy right now. Read-only — no writes, no external calls
|
||||
// beyond the label lookups needed to name the offsite resource. `refused` is true when a host row still
|
||||
// exists (ruling 3: RESET refuses until the operator deletes the hosts first).
|
||||
func (s *Server) handleCustomerResetPreview(w http.ResponseWriter, r *http.Request, customerID string) {
|
||||
cfg, err := s.store.GetCustomerConfig(customerID)
|
||||
if err != nil {
|
||||
s.logger.Printf("[ERROR] reset preview %s: %v", customerID, err)
|
||||
http.Error(w, "Internal error", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
if cfg == nil {
|
||||
http.NotFound(w, r)
|
||||
return
|
||||
}
|
||||
inv, err := s.store.CustomerResetInventory(customerID)
|
||||
if err != nil {
|
||||
s.logger.Printf("[ERROR] reset preview %s: inventory: %v", customerID, err)
|
||||
http.Error(w, "Internal error", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
offsiteEnabled, offsiteType := offsiteChoice(cfg.ConfigJSON)
|
||||
offsiteName := ""
|
||||
if offsiteEnabled && s.offsite != nil {
|
||||
ctx, cancel := context.WithTimeout(r.Context(), 20*time.Second)
|
||||
defer cancel()
|
||||
if n, oerr := s.offsite.OffsiteIdentifier(ctx, customerID, offsiteType); oerr != nil {
|
||||
s.logger.Printf("[WARN] reset preview %s: offsite identifier lookup: %v", customerID, oerr)
|
||||
} else {
|
||||
offsiteName = n
|
||||
}
|
||||
}
|
||||
w.Header().Set("Content-Type", "application/json")
|
||||
_ = json.NewEncoder(w).Encode(map[string]any{
|
||||
"customer_id": customerID,
|
||||
"host_count": inv.HostCount,
|
||||
"refused": inv.HostCount > 0, // ruling 3
|
||||
"superseded_blobs": inv.SupersededBlobs,
|
||||
"escrow_ack_required": inv.SupersededBlobs > 0, // ruling 1: separate custody-destruction ack
|
||||
"dr_recipe_present": inv.DRRecipePresent,
|
||||
"one_time_secret": inv.OneTimeSecretPresent,
|
||||
"claim_present": inv.ClaimPresent,
|
||||
"offsite_enabled": offsiteEnabled,
|
||||
"offsite_type": offsiteType,
|
||||
"offsite_identifier": offsiteName,
|
||||
"pbs_tenancy_configured": s.tenantsync != nil,
|
||||
})
|
||||
}
|
||||
|
||||
// handleCustomerReset — POST /configs/{id}/reset. Executes the reset. Preconditions (Scenario A + the
|
||||
// confirm gates) are checked BEFORE any write or external call: a refused reset leaves zero side effects.
|
||||
func (s *Server) handleCustomerReset(w http.ResponseWriter, r *http.Request, customerID string) {
|
||||
cfg, err := s.store.GetCustomerConfig(customerID)
|
||||
if err != nil {
|
||||
s.logger.Printf("[ERROR] reset %s: %v", customerID, err)
|
||||
http.Error(w, "Internal error", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
if cfg == nil {
|
||||
http.NotFound(w, r)
|
||||
return
|
||||
}
|
||||
inv, err := s.store.CustomerResetInventory(customerID)
|
||||
if err != nil {
|
||||
s.logger.Printf("[ERROR] reset %s: inventory: %v", customerID, err)
|
||||
http.Error(w, "Internal error", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
|
||||
// Ruling 3 (Scenario A): RESET REFUSES while any host row exists. RESET never deletes hosts — the
|
||||
// operator deletes them first. 409 with ZERO writes and ZERO external calls.
|
||||
if inv.HostCount > 0 {
|
||||
s.logger.Printf("[WARN] reset %s REFUSED: %d host row(s) still present — delete the hosts first", customerID, inv.HostCount)
|
||||
http.Error(w, "Reset refused: this customer still has host(s). Delete every host first — reset never deletes hosts.", http.StatusConflict)
|
||||
return
|
||||
}
|
||||
|
||||
// Typed-confirmation gate: the operator must type the exact customer-id.
|
||||
if r.FormValue("confirm_id") != customerID {
|
||||
http.Error(w, "Reset refused: the typed customer-id does not match.", http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
// Ruling 1: destroying retained escrow custody (M>0) needs its OWN separate acknowledgment.
|
||||
escrowAck := r.FormValue("escrow_ack") == "1"
|
||||
if inv.SupersededBlobs > 0 && !escrowAck {
|
||||
http.Error(w, "Reset refused: destroying the retained recovery-key custody requires the separate acknowledgment.", http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
|
||||
// From here the reset is committed. Detached ctx (spec: once teardown starts it must run to a clean
|
||||
// journal state regardless of the operator's browser). External legs FIRST.
|
||||
ctx, cancel := context.WithTimeout(context.WithoutCancel(r.Context()), 5*time.Minute)
|
||||
defer cancel()
|
||||
|
||||
resetID, err := s.store.StartCustomerReset(customerID, escrowAck)
|
||||
if err != nil {
|
||||
s.logger.Printf("[ERROR] reset %s: open journal: %v", customerID, err)
|
||||
http.Error(w, "Internal error", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
s.logger.Printf("[INFO] customer RESET started for %s (journal #%d, escrow_ack=%t)", customerID, resetID, escrowAck)
|
||||
|
||||
// Leg: Hetzner offsite (repo DATA destroyed). Only when the customer chose an offsite tier.
|
||||
offsiteEnabled, offsiteType := offsiteChoice(cfg.ConfigJSON)
|
||||
if offsiteEnabled && s.offsite != nil {
|
||||
if derr := s.offsite.Deprovision(ctx, customerID, offsiteType); derr != nil {
|
||||
_ = s.store.UpdateResetLeg(resetID, "hetzner", "failed")
|
||||
s.logger.Printf("[ERROR] reset %s: hetzner deprovision FAILED (journal #%d retained; re-run to resume): %v", customerID, resetID, derr)
|
||||
http.Error(w, "Reset incomplete: the offsite (Hetzner) teardown failed — nothing was purged; re-run to resume. ("+derr.Error()+")", http.StatusBadGateway)
|
||||
return
|
||||
}
|
||||
_ = s.store.UpdateResetLeg(resetID, "hetzner", "ok")
|
||||
s.logger.Printf("[INFO] reset %s: offsite deprovisioned (repo data destroyed)", customerID)
|
||||
} else {
|
||||
_ = s.store.UpdateResetLeg(resetID, "hetzner", "skipped")
|
||||
}
|
||||
|
||||
// Leg: PBS DR tenancy (namespace + backups + token destroyed). The namespace is customer-id-keyed
|
||||
// and survives host deletion, so it is torn down here by id; idempotent when absent.
|
||||
if s.tenantsync != nil {
|
||||
if _, derr := s.tenantsync.Deprovision(ctx, customerID); derr != nil {
|
||||
_ = s.store.UpdateResetLeg(resetID, "pbs", "failed")
|
||||
s.logger.Printf("[ERROR] reset %s: PBS deprovision FAILED (journal #%d retained; re-run to resume): %v", customerID, resetID, derr)
|
||||
http.Error(w, "Reset incomplete: the PBS namespace teardown failed — nothing was purged; re-run to resume. ("+derr.Error()+")", http.StatusBadGateway)
|
||||
return
|
||||
}
|
||||
_ = s.store.UpdateResetLeg(resetID, "pbs", "ok")
|
||||
s.logger.Printf("[INFO] reset %s: PBS tenancy deprovisioned", customerID)
|
||||
} else {
|
||||
_ = s.store.UpdateResetLeg(resetID, "pbs", "skipped")
|
||||
}
|
||||
|
||||
// All external legs are ok — now the DB side (publish-last, one leg at a time so the journal
|
||||
// records where a mid-purge crash stopped). Claim → unclaimed (fresh code next onboarding).
|
||||
if s.claimEngine != nil {
|
||||
if cerr := s.claimEngine.ResetToUnclaimed(cfg); cerr != nil {
|
||||
_ = s.store.UpdateResetLeg(resetID, "claim", "failed")
|
||||
s.logger.Printf("[ERROR] reset %s: claim reset failed: %v", customerID, cerr)
|
||||
http.Error(w, "Reset incomplete: the claim reset failed — re-run to resume. ("+cerr.Error()+")", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
} else if derr := s.store.DeleteClaim(customerID); derr != nil { // no engine wired: use the store primitive directly
|
||||
_ = s.store.UpdateResetLeg(resetID, "claim", "failed")
|
||||
s.logger.Printf("[ERROR] reset %s: claim delete failed: %v", customerID, derr)
|
||||
http.Error(w, "Internal error", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
_ = s.store.UpdateResetLeg(resetID, "claim", "ok")
|
||||
|
||||
// Clear the provisioned offsite descriptor (keep the tier CHOICE, drop provisioned host/user/repo/
|
||||
// fingerprint) and re-save → ConfigVersion bump. Identity + basic config survive intact.
|
||||
newConfigJSON, cerr := offsite.ClearProvisionedDescriptor(cfg.ConfigJSON)
|
||||
if cerr != nil {
|
||||
_ = s.store.UpdateResetLeg(resetID, "descriptor", "failed")
|
||||
s.logger.Printf("[ERROR] reset %s: clear offsite descriptor: %v", customerID, cerr)
|
||||
http.Error(w, "Internal error", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
cfg.ConfigJSON = newConfigJSON
|
||||
if serr := s.store.SaveCustomerConfig(cfg); serr != nil {
|
||||
_ = s.store.UpdateResetLeg(resetID, "descriptor", "failed")
|
||||
s.logger.Printf("[ERROR] reset %s: save cleared config: %v", customerID, serr)
|
||||
http.Error(w, "Internal error", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
_ = s.store.UpdateResetLeg(resetID, "descriptor", "ok")
|
||||
|
||||
// DB purge LAST: retained escrow (ack-gated), one-time secret, DR recipe, log bundles.
|
||||
if perr := s.store.PurgeCustomerResetDBState(customerID, escrowAck); perr != nil {
|
||||
_ = s.store.UpdateResetLeg(resetID, "db_purge", "failed")
|
||||
s.logger.Printf("[ERROR] reset %s: DB purge failed: %v", customerID, perr)
|
||||
http.Error(w, "Reset incomplete: the DB purge failed — re-run to resume. ("+perr.Error()+")", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
_ = s.store.UpdateResetLeg(resetID, "db_purge", "ok")
|
||||
|
||||
if ferr := s.store.FinishCustomerReset(resetID); ferr != nil {
|
||||
s.logger.Printf("[WARN] reset %s: journal finish stamp failed (state is complete): %v", customerID, ferr)
|
||||
}
|
||||
|
||||
// Audit event (SURVIVES — the reset is part of the customer's permanent history).
|
||||
msg := "Ügyfél-visszaállítás (RESET): minden működési állapot törölve (offsite tároló, PBS névtér, DR-recept, azonosítási állapot). Az azonosság és az alapkonfiguráció megmaradt."
|
||||
if escrowAck {
|
||||
msg += " A megőrzött helyreállítási-kulcs letét is megsemmisült (megerősítve)."
|
||||
}
|
||||
if _, eerr := s.store.SaveEvent(customerID, "customer_reset", "warning", msg, "", "hub"); eerr != nil {
|
||||
s.logger.Printf("[WARN] reset %s: save audit event: %v", customerID, eerr)
|
||||
}
|
||||
|
||||
s.logger.Printf("[INFO] customer RESET complete for %s (journal #%d) — identity + basic config retained", customerID, resetID)
|
||||
s.bumpIntent(customerID) // wake any holding wait so a lingering box sees the cleared state promptly
|
||||
http.Redirect(w, r, "/customers/"+customerID+"?flash=reset_done", http.StatusSeeOther)
|
||||
}
|
||||
Reference in New Issue
Block a user