admin/felhom.eu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(hub): v0.69.0 — customer DELETE is the guided full-teardown cascade (R-25b)

Browse Source 
POST /configs/{id}/delete now runs hosts -> RESET -> purge behind three
acknowledgements, a typed customer-id, a stale-preview check and the
ONLINE-host refusal (every gate before any write, so a refusal has zero
side effects). The shallow handleConfigDelete is gone.

Two invariants are asserted, not just commented: ruling 3 is preserved by
construction (leg 2 never sees a host row) and retained escrow custody is
purged exactly once, in leg 3 (leg 2 runs with purgeEscrow=false).

handleCustomerReset's committed half was extracted as commitCustomerReset;
the standalone RESET path is byte-identical to v0.68.1 and its suite is
untouched. Five red-proofs run.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J55BQE1gE2V4ffud5jweGS
This commit is contained in:
authentik Default Admin
2026-07-21 19:31:48 +02:00
parent f59aa97d0c
commit 61dbd870c3
13 changed files with 1087 additions and 208 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hub/internal/web/customer_reset.go
+109 -72
View File
@@ -7,6 +7,7 @@ import (
"time"
"gitea.dooplex.hu/admin/felhom-hub/internal/offsite"
"gitea.dooplex.hu/admin/felhom-hub/internal/store"
)
// Customer RESET (v0.61.0) — the middle lifecycle tier (host delete < RESET < customer DELETE). One
@@ -135,80 +136,11 @@ func (s *Server) handleCustomerReset(w http.ResponseWriter, r *http.Request, cus
}
s.logger.Printf("[INFO] customer RESET started for %s (journal #%d, escrow_ack=%t)", customerID, resetID, escrowAck)
// Leg: Hetzner offsite (repo DATA destroyed). Only when the customer chose an offsite tier.
offsiteEnabled, offsiteType := offsiteChoice(cfg.ConfigJSON)
if offsiteEnabled && s.offsite != nil {
if derr := s.offsite.Deprovision(ctx, customerID, offsiteType); derr != nil {
_ = s.store.UpdateResetLeg(resetID, "hetzner", "failed")
s.logger.Printf("[ERROR] reset %s: hetzner deprovision FAILED (journal #%d retained; re-run to resume): %v", customerID, resetID, derr)
http.Error(w, "Reset incomplete: the offsite (Hetzner) teardown failed — nothing was purged; re-run to resume. ("+derr.Error()+")", http.StatusBadGateway)
return
}
_ = s.store.UpdateResetLeg(resetID, "hetzner", "ok")
s.logger.Printf("[INFO] reset %s: offsite deprovisioned (repo data destroyed)", customerID)
} else {
_ = s.store.UpdateResetLeg(resetID, "hetzner", "skipped")
}
// Leg: PBS DR tenancy (namespace + backups + token destroyed). The namespace is customer-id-keyed
// and survives host deletion, so it is torn down here by id; idempotent when absent.
if s.tenantsync != nil {
if _, derr := s.tenantsync.Deprovision(ctx, customerID); derr != nil {
_ = s.store.UpdateResetLeg(resetID, "pbs", "failed")
s.logger.Printf("[ERROR] reset %s: PBS deprovision FAILED (journal #%d retained; re-run to resume): %v", customerID, resetID, derr)
http.Error(w, "Reset incomplete: the PBS namespace teardown failed — nothing was purged; re-run to resume. ("+derr.Error()+")", http.StatusBadGateway)
return
}
_ = s.store.UpdateResetLeg(resetID, "pbs", "ok")
s.logger.Printf("[INFO] reset %s: PBS tenancy deprovisioned", customerID)
} else {
_ = s.store.UpdateResetLeg(resetID, "pbs", "skipped")
}
// All external legs are ok — now the DB side (publish-last, one leg at a time so the journal
// records where a mid-purge crash stopped). Claim → unclaimed (fresh code next onboarding).
if s.claimEngine != nil {
if cerr := s.claimEngine.ResetToUnclaimed(cfg); cerr != nil {
_ = s.store.UpdateResetLeg(resetID, "claim", "failed")
s.logger.Printf("[ERROR] reset %s: claim reset failed: %v", customerID, cerr)
http.Error(w, "Reset incomplete: the claim reset failed — re-run to resume. ("+cerr.Error()+")", http.StatusInternalServerError)
return
}
} else if derr := s.store.DeleteClaim(customerID); derr != nil { // no engine wired: use the store primitive directly
_ = s.store.UpdateResetLeg(resetID, "claim", "failed")
s.logger.Printf("[ERROR] reset %s: claim delete failed: %v", customerID, derr)
http.Error(w, "Internal error", http.StatusInternalServerError)
// Standalone RESET purges the retained custody itself, gated by the ack it just checked.
if lerr := s.commitCustomerReset(ctx, cfg, resetID, escrowAck); lerr != nil {
http.Error(w, lerr.Msg, lerr.Status)
return
}
_ = s.store.UpdateResetLeg(resetID, "claim", "ok")
// Clear the provisioned offsite descriptor (keep the tier CHOICE, drop provisioned host/user/repo/
// fingerprint) and re-save → ConfigVersion bump. Identity + basic config survive intact.
newConfigJSON, cerr := offsite.ClearProvisionedDescriptor(cfg.ConfigJSON)
if cerr != nil {
_ = s.store.UpdateResetLeg(resetID, "descriptor", "failed")
s.logger.Printf("[ERROR] reset %s: clear offsite descriptor: %v", customerID, cerr)
http.Error(w, "Internal error", http.StatusInternalServerError)
return
}
cfg.ConfigJSON = newConfigJSON
if serr := s.store.SaveCustomerConfig(cfg); serr != nil {
_ = s.store.UpdateResetLeg(resetID, "descriptor", "failed")
s.logger.Printf("[ERROR] reset %s: save cleared config: %v", customerID, serr)
http.Error(w, "Internal error", http.StatusInternalServerError)
return
}
_ = s.store.UpdateResetLeg(resetID, "descriptor", "ok")
// DB purge LAST: retained escrow (ack-gated), one-time secret, DR recipe, log bundles.
if perr := s.store.PurgeCustomerResetDBState(customerID, escrowAck); perr != nil {
_ = s.store.UpdateResetLeg(resetID, "db_purge", "failed")
s.logger.Printf("[ERROR] reset %s: DB purge failed: %v", customerID, perr)
http.Error(w, "Reset incomplete: the DB purge failed — re-run to resume. ("+perr.Error()+")", http.StatusInternalServerError)
return
}
_ = s.store.UpdateResetLeg(resetID, "db_purge", "ok")
if ferr := s.store.FinishCustomerReset(resetID); ferr != nil {
s.logger.Printf("[WARN] reset %s: journal finish stamp failed (state is complete): %v", customerID, ferr)
}
@@ -231,3 +163,108 @@ func (s *Server) handleCustomerReset(w http.ResponseWriter, r *http.Request, cus
s.bumpIntent(customerID) // wake any holding wait so a lingering box sees the cleared state promptly
http.Redirect(w, r, "/customers/"+customerID+"?flash=reset_done", http.StatusSeeOther)
}
// resetLegError names the leg of the committed RESET sequence that failed, carrying the exact
// operator-facing message + HTTP status the standalone RESET handler has always returned. The DELETE
// cascade (v0.69.0, R-25b) reuses the same values so a mid-cascade failure names its leg too.
type resetLegError struct {
Leg string // journal leg name: hetzner | pbs | claim | descriptor | db_purge
Status int
Msg string
Err error
}
func (e *resetLegError) Error() string {
if e.Err != nil {
return e.Leg + ": " + e.Err.Error()
}
return e.Leg
}
// commitCustomerReset runs the COMMITTED reset sequence against an already-gated customer: external
// teardown FIRST (Hetzner, PBS), then the DB side (claim → descriptor → purge), each leg stamped into
// the journal so a failed run is resumable. It deliberately owns no gate, no audit event, no journal
// open/close and no redirect — those belong to the caller, because the two callers differ there:
//
// - standalone RESET (v0.61.0): purgeEscrow = the operator's escrow_ack; the customer survives.
// - DELETE cascade (v0.69.0, R-25b): purgeEscrow = FALSE — retained custody is purged exactly ONCE,
// in the cascade's final leg (DeleteCustomerConfig, the one true purge point). Purging here too
// would split the single custody-destruction point across two legs.
//
// Behaviour for the standalone caller is byte-identical to v0.68.1 (same order, same leg names, same
// messages, same status codes).
func (s *Server) commitCustomerReset(ctx context.Context, cfg *store.CustomerConfig, resetID int64, purgeEscrow bool) *resetLegError {
customerID := cfg.CustomerID
// Leg: Hetzner offsite (repo DATA destroyed). Only when the customer chose an offsite tier.
offsiteEnabled, offsiteType := offsiteChoice(cfg.ConfigJSON)
if offsiteEnabled && s.offsite != nil {
if derr := s.offsite.Deprovision(ctx, customerID, offsiteType); derr != nil {
_ = s.store.UpdateResetLeg(resetID, "hetzner", "failed")
s.logger.Printf("[ERROR] reset %s: hetzner deprovision FAILED (journal #%d retained; re-run to resume): %v", customerID, resetID, derr)
return &resetLegError{Leg: "hetzner", Status: http.StatusBadGateway, Err: derr,
Msg: "Reset incomplete: the offsite (Hetzner) teardown failed — nothing was purged; re-run to resume. (" + derr.Error() + ")"}
}
_ = s.store.UpdateResetLeg(resetID, "hetzner", "ok")
s.logger.Printf("[INFO] reset %s: offsite deprovisioned (repo data destroyed)", customerID)
} else {
_ = s.store.UpdateResetLeg(resetID, "hetzner", "skipped")
}
// Leg: PBS DR tenancy (namespace + backups + token destroyed). The namespace is customer-id-keyed
// and survives host deletion, so it is torn down here by id; idempotent when absent.
if s.tenantsync != nil {
if _, derr := s.tenantsync.Deprovision(ctx, customerID); derr != nil {
_ = s.store.UpdateResetLeg(resetID, "pbs", "failed")
s.logger.Printf("[ERROR] reset %s: PBS deprovision FAILED (journal #%d retained; re-run to resume): %v", customerID, resetID, derr)
return &resetLegError{Leg: "pbs", Status: http.StatusBadGateway, Err: derr,
Msg: "Reset incomplete: the PBS namespace teardown failed — nothing was purged; re-run to resume. (" + derr.Error() + ")"}
}
_ = s.store.UpdateResetLeg(resetID, "pbs", "ok")
s.logger.Printf("[INFO] reset %s: PBS tenancy deprovisioned", customerID)
} else {
_ = s.store.UpdateResetLeg(resetID, "pbs", "skipped")
}
// All external legs are ok — now the DB side (publish-last, one leg at a time so the journal
// records where a mid-purge crash stopped). Claim → unclaimed (fresh code next onboarding).
if s.claimEngine != nil {
if cerr := s.claimEngine.ResetToUnclaimed(cfg); cerr != nil {
_ = s.store.UpdateResetLeg(resetID, "claim", "failed")
s.logger.Printf("[ERROR] reset %s: claim reset failed: %v", customerID, cerr)
return &resetLegError{Leg: "claim", Status: http.StatusInternalServerError, Err: cerr,
Msg: "Reset incomplete: the claim reset failed — re-run to resume. (" + cerr.Error() + ")"}
}
} else if derr := s.store.DeleteClaim(customerID); derr != nil { // no engine wired: use the store primitive directly
_ = s.store.UpdateResetLeg(resetID, "claim", "failed")
s.logger.Printf("[ERROR] reset %s: claim delete failed: %v", customerID, derr)
return &resetLegError{Leg: "claim", Status: http.StatusInternalServerError, Err: derr, Msg: "Internal error"}
}
_ = s.store.UpdateResetLeg(resetID, "claim", "ok")
// Clear the provisioned offsite descriptor (keep the tier CHOICE, drop provisioned host/user/repo/
// fingerprint) and re-save → ConfigVersion bump. Identity + basic config survive intact.
newConfigJSON, cerr := offsite.ClearProvisionedDescriptor(cfg.ConfigJSON)
if cerr != nil {
_ = s.store.UpdateResetLeg(resetID, "descriptor", "failed")
s.logger.Printf("[ERROR] reset %s: clear offsite descriptor: %v", customerID, cerr)
return &resetLegError{Leg: "descriptor", Status: http.StatusInternalServerError, Err: cerr, Msg: "Internal error"}
}
cfg.ConfigJSON = newConfigJSON
if serr := s.store.SaveCustomerConfig(cfg); serr != nil {
_ = s.store.UpdateResetLeg(resetID, "descriptor", "failed")
s.logger.Printf("[ERROR] reset %s: save cleared config: %v", customerID, serr)
return &resetLegError{Leg: "descriptor", Status: http.StatusInternalServerError, Err: serr, Msg: "Internal error"}
}
_ = s.store.UpdateResetLeg(resetID, "descriptor", "ok")
// DB purge LAST: retained escrow (ack-gated), one-time secret, DR recipe, log bundles.
if perr := s.store.PurgeCustomerResetDBState(customerID, purgeEscrow); perr != nil {
_ = s.store.UpdateResetLeg(resetID, "db_purge", "failed")
s.logger.Printf("[ERROR] reset %s: DB purge failed: %v", customerID, perr)
return &resetLegError{Leg: "db_purge", Status: http.StatusInternalServerError, Err: perr,
Msg: "Reset incomplete: the DB purge failed — re-run to resume. (" + perr.Error() + ")"}
}
_ = s.store.UpdateResetLeg(resetID, "db_purge", "ok")
return nil
}