admin/felhom.eu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

R-331 (hub half): the Backup card reads offsite, not the dead backup fields (v0.109.0)

Browse Source 
The customer page's Backup card read `Snapshots 0 / Repo Size 0 MB / Integrity
Unknown` for EVERY customer, indefinitely. Measured on demo-hp 2026-08-30 while
that night's controller log said `[offbox] backup OK: 8 app(s) backed up, 67
snapshot(s), 2m14s` and the box held snapshot_count:67, repo_size_bytes:
140829678, stats_known:true.

A card reading "no backups" over a working backup is worse than no card -- the
R-88 direction of failure (degrade to NO BACKUP rather than to UNKNOWN) on the
one screen that answers "is this customer protected?".

The data was never missing. The card rendered the report's `backup` object,
whose snapshot/size/integrity fields have had no producer since slice 8C. The
live numbers are in the `offsite` object, which THIS PACKAGE already reads for
the Offsite page and which monitor.OffsiteChecker already alarms from. Proof the
bytes were arriving: the Offsite page rendered demo-hp's usage as 0.1 GB from
that very object while the Backup card said 0 MB. So this is a render fix over
an existing feed, not a new pipeline.

Not a one-line swap, because snapshot_count:0 means two opposite things --
"holds nothing" and "never measured". R-225 measured that confusion one layer
down. backup_card.go resolves a three-way ruling in Go (a {{if}} chain over
map[string]interface{} float64s cannot keep the absent/zero distinction the card
is entirely about):
  no offsite object   -> "No off-site data reported", and says explicitly that
                         this is NOT the same as "no backups"
  disabled + state    -> names the blocker (needs_credential)
  stats_known:false   -> em-dash + "never been measured". NEVER 0
  stats_known:true    -> the real numbers, INCLUDING a real 0

A pre-v0.225.0 controller sends no stats_known -> false -> "unknown". That
direction is pinned: upgrading the hub ahead of the fleet must not report every
un-upgraded customer as having zero backups.

The Integrity row is DELETED, not re-sourced: nothing produces it, the
controller runs no integrity check, and NotifyIntegrityOK/Failed are called from
nowhere.

RED-PROOF: restore the pre-fix card markup -> all four tests fail, reporting 67
and 134.3 MB absent from the rendered page and the Integrity row present. The
tests drive handleCustomerUnified and grep the HTML on purpose: the defect was
the template's choice of source object, so a test one layer below it would have
been green against the shipped bug.

Green gate clean: 18 packages, rc 0.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LB8FmJaGd2cyjvy6dbEjpM
This commit is contained in:
authentik Default Admin
2026-08-30 18:39:15 +02:00
parent c2c1fb48dc
commit f5c9411e5e
8 changed files with 514 additions and 176 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hub/internal/web/backup_card.go
+148
View File
@@ -0,0 +1,148 @@
package web
import (
"encoding/json"
"fmt"
"time"
)
// ── R-331 — the operator Backup card told every customer they had no backups ─────────────────────
//
// THE DEFECT. `customer_unified.html`'s Backup card rendered `snapshot_count`, `repo_size_mb` and
// `integrity_ok` out of the report's `backup` object. Those three fields have had NO PRODUCER since
// disk-tier restic moved to the host agent (slice 8C): the controller's `buildBackupReport` says so
// in a comment and leaves them zero, so the card read `Snapshots 0 · Repo Size 0 MB · Integrity
// Unknown` for every customer, forever. Measured on `demo-hp` 2026-08-30, while the box's own log for
// that night said `[offbox] backup OK: 8 app(s) backed up, 67 snapshot(s), 2m14s`.
//
// **A card that reads "0 snapshots" over a working backup is worse than no card.** It is the R-88
// direction of failure — degrading to "no backup" rather than to "unknown" — on the one screen an
// operator would consult to answer "is this customer protected?".
//
// THE DATA WAS NEVER MISSING. The live numbers ride in the report's `offsite` object, which this
// package already reads for the Offsite page (`offsiteUsageBytes`) and which `monitor.OffsiteChecker`
// already drives fill and staleness alarms from. The card was simply pointed at the wrong object.
// So this is a RENDER fix over an existing feed, not a new pipeline — and `integrity_ok` is dropped
// rather than re-sourced, because nothing in the controller has produced it since 8C either:
// `NotifyIntegrityOK` / `NotifyIntegrityFailed` exist and are called from nowhere.
//
// WHAT MADE IT MORE THAN A ONE-LINE TEMPLATE SWAP. `snapshot_count: 0` means two opposite things —
// "this repository holds nothing" and "nobody has ever measured this repository" — and the report
// could not tell them apart until controller v0.225.0 started forwarding `stats_known`. R-225
// measured that exact confusion one layer down: a rebuilt box rendered „Tároló méret · 0 pillanatkép"
// over a store that really held snapshot `f3d9cd67`. Rendering the count without consulting
// `stats_known` would have moved R-225 from the controller UI to the hub UI instead of fixing it.
// backupCardView is what the Backup card renders. Every field is resolved in Go rather than in the
// template, so the three-way "no data / unknown / known" ruling is unit-testable and lives in one
// place — a template `{{if}}` chain over a `map[string]interface{}` of float64s is neither.
type backupCardView struct {
// --- local app-data leg (the report's `backup` object) ---
// These two are the ONLY fields of that object with a live producer, which is why nothing else
// from it appears on the card any more.
LocalEnabled bool
LastDBDump string // humanised; "—" when the box has never dumped
// --- off-site leg (the report's `offsite` object) ---
// OffsiteReported is false when the report carried no `offsite` object at all: a pre-v0.109.0
// controller, or a box that has never had the tier. The card then says so and shows NO numbers —
// the same rule `offsiteBoxTile` already follows ("absent, not a zeroed tile").
OffsiteReported bool
OffsiteEnabled bool
// OffsiteState carries a DECLARED state (`needs_credential`, `awaiting_recovery_key`) for a box
// that reports an object while disabled. Rendering it is the difference between "no off-site
// backup" and "off-site backup is blocked waiting for a key" — an operator action item.
OffsiteState string
// StatsKnown is false both when the repository was never measured AND when the controller is too
// old to say. Both are ignorance, and the card must show ignorance, never zero.
StatsKnown bool
Snapshots int
RepoSize string // humanised; only meaningful when StatsKnown
LastSuccess string // humanised age of the last run that actually SUCCEEDED; "—" when never
LastStatus string // "ok" | "incomplete" | "error" | "running"
QuotaStr string // "" when the target has no soft quota (dedicated boxes)
}
// reportBackupCard parses one customer's stored report into the card view. A report that will not
// parse yields a zero view, which renders as "nothing reported" — never as zeroed numbers.
//
// It takes the raw JSON rather than the already-parsed `map[string]interface{}` the page also holds,
// for the reason the sibling readers in this file's package do: typed decoding keeps the int/float64
// and absent/zero distinctions that a generic map destroys, and those distinctions are the whole
// subject of this card.
func reportBackupCard(reportJSON string) backupCardView {
var r struct {
Backup *struct {
Enabled bool `json:"enabled"`
LastDBDump *time.Time `json:"last_db_dump"`
} `json:"backup"`
Offsite *struct {
Enabled bool `json:"enabled"`
State string `json:"state"`
LastStatus string `json:"last_status"`
LastSuccess string `json:"last_success"`
SnapshotCount int `json:"snapshot_count"`
RepoSizeBytes int64 `json:"repo_size_bytes"`
QuotaGB int `json:"quota_gb"`
// StatsKnown is ABSENT on a controller below v0.225.0, and absent unmarshals to false —
// which is the correct fail-safe direction: a box that cannot answer is unknown, never
// empty. See OffboxReportStatus.StatsKnown in the controller.
StatsKnown bool `json:"stats_known"`
} `json:"offsite"`
}
var v backupCardView
if json.Unmarshal([]byte(reportJSON), &r) != nil {
return v
}
if r.Backup != nil {
v.LocalEnabled = r.Backup.Enabled
v.LastDBDump = "—"
if r.Backup.LastDBDump != nil && !r.Backup.LastDBDump.IsZero() {
v.LastDBDump = timeAgo(*r.Backup.LastDBDump)
}
}
if r.Offsite == nil {
return v
}
v.OffsiteReported = true
v.OffsiteEnabled = r.Offsite.Enabled
v.OffsiteState = r.Offsite.State
v.LastStatus = r.Offsite.LastStatus
v.StatsKnown = r.Offsite.StatsKnown
if v.StatsKnown {
v.Snapshots = r.Offsite.SnapshotCount
v.RepoSize = fmtBytesAuto(r.Offsite.RepoSizeBytes)
}
v.LastSuccess = "—"
if t, err := time.Parse(time.RFC3339, r.Offsite.LastSuccess); err == nil {
v.LastSuccess = timeAgo(t)
}
if r.Offsite.QuotaGB > 0 {
v.QuotaStr = fmt.Sprintf("%d GB", r.Offsite.QuotaGB)
}
return v
}
// fmtBytesAuto scales to the unit that keeps a repository size readable. The Offsite page's
// fmtBytesGB is deliberately NOT reused here: it is fixed at GB because it renders against GB quotas
// where a common unit is the point, and it turns demo-hp's real 140 829 678 bytes into "0.1 GB" —
// which on a card whose entire defect was under-reporting a real backup reads as "nearly nothing".
func fmtBytesAuto(b int64) string {
switch {
case b >= 1<<40:
return fmt.Sprintf("%.2f TB", float64(b)/float64(int64(1)<<40))
case b >= 1<<30:
return fmt.Sprintf("%.1f GB", float64(b)/float64(int64(1)<<30))
case b >= 1<<20:
return fmt.Sprintf("%.1f MB", float64(b)/float64(int64(1)<<20))
case b >= 1<<10:
return fmt.Sprintf("%.1f KB", float64(b)/float64(int64(1)<<10))
default:
return fmt.Sprintf("%d B", b)
}
}
hub/internal/web/configs.go
+14
View File
@@ -294,6 +294,10 @@ func (s *Server) handleCustomerUnified(w http.ResponseWriter, r *http.Request, c
HasReports bool
Customer *store.CustomerSummary
Report map[string]interface{}
// BackupCard (R-331) is resolved in Go, not in the template: the card must distinguish
// "no data reported" from "measured empty" from "never measured", and a {{if}} chain over
// Report's float64s cannot. See backup_card.go.
BackupCard backupCardView
OverallStatus string
HostCause string // v0.53.0 roll-up: "" or "host down|stale|pending: <id>"
@@ -428,6 +432,15 @@ func (s *Server) handleCustomerUnified(w http.ResponseWriter, r *http.Request, c
}
offsiteUnprovisioned := offsiteView.Offsite.Enabled && offsiteView.Offsite.Type == ""
// R-331: the Backup card reads the report's `offsite` object, not the long-dead `backup`
// snapshot/size/integrity fields. Built here so the page holds one resolved view rather than
// re-deriving it in template conditionals. A nil customer (never reported) yields the zero view,
// which renders as "nothing reported".
var backupCard backupCardView
if customer != nil {
backupCard = reportBackupCard(customer.ReportJSON)
}
data := pageData{
CustomerID: customerID,
CustomerName: name,
@@ -443,6 +456,7 @@ func (s *Server) handleCustomerUnified(w http.ResponseWriter, r *http.Request, c
HasReports: customer != nil,
Customer: customer,
Report: report,
BackupCard: backupCard,
OverallStatus: overallStatus,
HostCause: hostCause,
hub/internal/web/r331_backup_card_test.go
+162
View File
@@ -0,0 +1,162 @@
package web
import (
"strings"
"testing"
"gitea.dooplex.hu/admin/felhom-hub/internal/store"
)
// ── R-331 — the Backup card said "Snapshots 0" over a working backup ─────────────────────────────
//
// Measured on `demo-hp` 2026-08-30: the card read `Snapshots 0 · Repo Size 0 MB · Integrity Unknown`
// while the box's own settings held `snapshot_count: 67, repo_size_bytes: 140829678, stats_known:
// true` and that night's log said `[offbox] backup OK: 8 app(s) backed up, 67 snapshot(s), 2m14s`.
// The card rendered the report's `backup` object, whose snapshot/size/integrity fields have had no
// producer since disk-tier restic moved to the host agent; the live numbers were in the `offsite`
// object all along.
//
// These tests use demo-hp's REAL reported values, so a regression fails against the same numbers the
// defect was measured against rather than against invented ones.
// demoHPReportJSON is the shape demo-hp actually sends (controller 0.225.0), trimmed to the objects
// the Backup card reads.
const demoHPReportJSON = `{
"backup": {"enabled": true, "last_db_dump": "2026-08-30T02:15:01Z"},
"offsite": {"enabled": true, "escrow_state": "escrowed", "last_status": "ok",
"last_success": "2026-08-30T02:17:19Z", "snapshot_count": 67,
"repo_size_bytes": 140829678, "quota_gb": 50, "stats_known": true}
}`
func renderWithReport(t *testing.T, reportJSON string) string {
t.Helper()
s, st := newTestServer(t)
if err := st.SaveCustomerConfig(&store.CustomerConfig{
CustomerID: "demo-hp", CustomerName: "Demo HP", Domain: "enkisfelhom.hu",
RetrievalPassword: "pw", APIKey: "k", Status: "active",
}); err != nil {
t.Fatal(err)
}
if err := st.SaveReport("demo-hp", []byte(reportJSON)); err != nil {
t.Fatal(err)
}
return renderCustomerPage(t, s, "demo-hp")
}
// THE CONSEQUENCE TEST. Not "does reportBackupCard return 67" — does the page an operator actually
// looks at contain 67. The defect lived in the template's choice of source object, so a test one
// layer below it would have been green against the shipped bug.
//
// RED-PROOF (run 2026-08-30, recorded in REPORT.md): point the card back at `.Report.backup` →
// this fails with the rendered page carrying `Snapshots 0` and no `67`.
func TestBackupCard_RendersTheRealSnapshotCount(t *testing.T) {
html := renderWithReport(t, demoHPReportJSON)
if !strings.Contains(html, ">67<") {
t.Error("the rendered Backup card does not contain demo-hp's real snapshot count (67) — " +
"this is the defect: an operator reading this page concludes the customer has no backups")
}
if !strings.Contains(html, "134.3 MB") {
t.Error("the card does not carry the real repository size (134.3 MB from 140829678 bytes)")
}
if strings.Contains(html, "Repo Size 0 MB") || strings.Contains(html, ">0 MB<") {
t.Error("the card still renders the dead `repo_size_mb` field as 0 MB")
}
// `integrity_ok` has no producer anywhere in the controller — NotifyIntegrityOK and
// NotifyIntegrityFailed exist and are called from nowhere. A row that always reads "Unknown" is
// not information, and one that could read "OK" from an unwritten field would be a lie.
if strings.Contains(html, "Integrity") {
t.Error("the card still shows an Integrity row — nothing in the controller produces it")
}
}
// The three-way ruling, which is the reason this card needed Go and not a template {{if}}.
func TestBackupCard_ThreeWayRuling(t *testing.T) {
t.Run("never measured shows a dash, never 0", func(t *testing.T) {
// A box with an off-site tier that has never read its repository. Reporting 0 here would
// claim the repository is EMPTY, which is not what is known — R-225's exact defect, which
// was measured live over a store that really held snapshot f3d9cd67.
html := renderWithReport(t, `{"backup":{"enabled":true},
"offsite":{"enabled":true,"last_status":"ok","snapshot_count":0,"repo_size_bytes":0}}`)
if !strings.Contains(html, "never been") {
t.Error("an unmeasured repository is not called out as unmeasured — the operator reads " +
"the dash as a formatting quirk rather than as missing knowledge")
}
if strings.Contains(html, ">0<") {
t.Error("an unmeasured repository rendered a literal 0 snapshot count — zero is a claim " +
"about the repository's contents and nothing here justifies making it")
}
})
t.Run("measured empty is stated, not hidden", func(t *testing.T) {
// The opposite news, and it must be sayable: the repository was read and really holds
// nothing. If this rendered a dash too, the field would be pointless.
html := renderWithReport(t, `{"backup":{"enabled":true},
"offsite":{"enabled":true,"last_status":"ok","snapshot_count":0,"repo_size_bytes":0,
"stats_known":true}}`)
if strings.Contains(html, "never been") {
t.Error("a MEASURED empty repository was reported as unmeasured — the operator never " +
"learns that a customer genuinely has zero off-site snapshots, which is an alarm")
}
if !strings.Contains(html, ">0<") {
t.Error("a measured-empty repository did not render its 0 — measured zero is knowledge " +
"and must be shown")
}
})
t.Run("no offsite object says so instead of showing numbers", func(t *testing.T) {
html := renderWithReport(t, `{"backup":{"enabled":true}}`)
if !strings.Contains(html, "No off-site data reported") {
t.Error("a report with no `offsite` object did not say so — the same rule offsiteBoxTile " +
"already follows: absent, never a zeroed tile")
}
if strings.Contains(html, "Off-site snapshots") {
t.Error("numbers were rendered for a customer whose controller has never reported any")
}
})
t.Run("a disabled tier with a declared state names the blocker", func(t *testing.T) {
html := renderWithReport(t, `{"backup":{"enabled":true},
"offsite":{"enabled":false,"state":"needs_credential"}}`)
if !strings.Contains(html, "needs_credential") {
t.Error("the declared state was dropped — 'off-site not enabled' and 'off-site blocked " +
"waiting for a credential' are different operator actions and must read differently")
}
})
}
// A pre-v0.225.0 controller sends no `stats_known` key. Absence must degrade to UNKNOWN, never to
// "empty" — otherwise upgrading the hub before the fleet would tell the operator that every
// un-upgraded customer has zero backups.
func TestBackupCard_OldControllerDegradesToUnknownNotEmpty(t *testing.T) {
html := renderWithReport(t, `{"backup":{"enabled":true},
"offsite":{"enabled":true,"last_status":"ok","last_success":"2026-08-30T02:17:19Z",
"snapshot_count":67,"repo_size_bytes":140829678,"quota_gb":50}}`)
if !strings.Contains(html, "never been") {
t.Error("a report without stats_known was treated as authoritative — the hub cannot know " +
"whether an old controller's counts were ever read, and must say so")
}
// The rest of the card must still work: last successful run is independent of stats_known.
if !strings.Contains(html, "Last successful run") {
t.Error("the whole off-site section vanished for an old controller")
}
}
func TestFmtBytesAuto_ScalesInsteadOfCollapsingToZero(t *testing.T) {
// The Offsite page's fmtBytesGB renders demo-hp's real size as "0.1 GB". On a card whose entire
// defect was under-reporting a real backup, that reads as "nearly nothing" — which is why this
// formatter exists rather than reusing that one.
for _, tc := range []struct{ in int64; want string }{
{140829678, "134.3 MB"}, // demo-hp, measured
{0, "0 B"},
{1 << 10, "1.0 KB"},
{1 << 20, "1.0 MB"},
{1 << 30, "1.0 GB"},
{1 << 40, "1.00 TB"},
} {
if got := fmtBytesAuto(tc.in); got != tc.want {
t.Errorf("fmtBytesAuto(%d) = %q, want %q", tc.in, got, tc.want)
}
}
}
hub/internal/web/templates/customer_unified.html
+44 -14
View File
@@ -271,28 +271,58 @@
{{end}}
</section>
<!-- Backup -->
<!-- Backup (R-331: reads the report's `offsite` object; the `backup` object's
snapshot/size/integrity fields have had no producer since slice 8C) -->
<section class="card">
<h2>Backup</h2>
{{with .Report.backup}}
{{with .BackupCard}}
<div class="info-grid">
<div class="info-item">
<span class="label">Enabled</span>
<span class="value">{{if index . "enabled"}}Yes{{else}}No{{end}}</span>
<span class="label">App data (local)</span>
<span class="value">{{if .LocalEnabled}}Enabled{{else}}Disabled{{end}}</span>
</div>
<div class="info-item">
<span class="label">Snapshots</span>
<span class="value">{{index . "snapshot_count"}}</span>
</div>
<div class="info-item">
<span class="label">Repo Size</span>
<span class="value">{{index . "repo_size_mb"}} MB</span>
</div>
<div class="info-item">
<span class="label">Integrity</span>
<span class="value">{{if index . "integrity_ok"}}OK{{else}}Unknown{{end}}</span>
<span class="label">Last DB dump</span>
<span class="value">{{if .LastDBDump}}{{.LastDBDump}}{{else}}&mdash;{{end}}</span>
</div>
</div>
{{if not .OffsiteReported}}
<p class="text-muted">No off-site data reported &mdash; the controller has never sent an
<code>offsite</code> object (no off-site tier, or a controller older than v0.109.0).
<strong>This is not the same as "no backups"</strong>; it means this page cannot say.</p>
{{else if not .OffsiteEnabled}}
<p class="text-muted">Off-site backup is not enabled for this customer.{{if .OffsiteState}}
Declared state: <code>{{.OffsiteState}}</code> &mdash; the box is waiting on a credential
or recovery key and cannot back up off-site until it has one.{{end}}</p>
{{else}}
<div class="info-grid">
<div class="info-item">
<span class="label">Off-site snapshots</span>
<span class="value">{{if .StatsKnown}}{{.Snapshots}}{{else}}&mdash;{{end}}</span>
</div>
<div class="info-item">
<span class="label">Repo size</span>
<span class="value">{{if .StatsKnown}}{{.RepoSize}}{{else}}&mdash;{{end}}</span>
</div>
<div class="info-item">
<span class="label">Last successful run</span>
<span class="value">{{.LastSuccess}}</span>
</div>
{{if .QuotaStr}}
<div class="info-item">
<span class="label">Soft quota</span>
<span class="value">{{.QuotaStr}}</span>
</div>
{{end}}
</div>
{{if not .StatsKnown}}
<p class="text-muted">Snapshot count and repository size have <strong>never been
measured</strong> on this box &mdash; shown as &mdash; rather than 0, because zero would
claim the repository is empty and that is not what is known. They fill in after the next
off-site run reads the repository.</p>
{{end}}
{{end}}
{{end}}
</section>
{{end}}