175 lines
8.6 KiB
Python
175 lines
8.6 KiB
Python
#!/usr/bin/env python3
|
|
"""immich_repair.py EVDIR — re-prove Immich's after_unclean_boot scripts on v3.3.5 on scratch 9202 (the method of
|
|
felhom.eu audits/immich-repair-2026-10-14 Part C): deploy through the product (9202 pointed at the drill, Immich
|
|
v3.3.5), the admin through the setup gate, a family member, 20 + 10 photos through Immich's own API, then damage
|
|
4 thumbnail files and delete 1 original, run the template's repair and report_lost commands inside immich-server
|
|
exactly as the controller does (node -e <script> <ids…>), and check: 0 empty files after, 0 controls rewritten,
|
|
the deleted original reported by name. Remove through the product at the end. No password is printed."""
|
|
import hashlib, io, json, os, re, sys, tempfile, time
|
|
|
|
sys.path.insert(0, "/mnt/5_hdd/felhom.eu/git/app-catalog-felhom.eu/scripts")
|
|
import box_walk as w # noqa: E402
|
|
import upgrade_fixtures_box28 as fx # noqa: E402
|
|
import yaml # noqa: E402
|
|
from PIL import Image # noqa: E402
|
|
|
|
EV = sys.argv[1]
|
|
os.makedirs(EV, exist_ok=True)
|
|
DRILL = "/mnt/5_hdd/felhom.eu/drill/app-catalog-drill"
|
|
OUT = []
|
|
|
|
|
|
def say(*a):
|
|
w.say(*a)
|
|
OUT.append(w.LOG[-1])
|
|
|
|
|
|
def save():
|
|
open(os.path.join(EV, "repair-v3.3.5.txt"), "w").write("\n".join(OUT) + "\n")
|
|
|
|
|
|
def jpeg(i):
|
|
im = Image.new("RGB", (640, 480), ((i * 37) % 256, (i * 91) % 256, (i * 53) % 256))
|
|
for y in range(0, 480, 16):
|
|
for x in range(0, 640, 16):
|
|
if (x // 16 + y // 16 + i) % 3 == 0:
|
|
im.paste(((x * i) % 256, (y * 7) % 256, (i * 13) % 256), (x, y, x + 16, y + 16))
|
|
b = io.BytesIO()
|
|
im.save(b, "JPEG", quality=85)
|
|
return b.getvalue()
|
|
|
|
|
|
def login(sub, u, pw):
|
|
rc, code, out = w.app_curl(sub, "/api/auth/login", "-H", "Content-Type: application/json",
|
|
data=json.dumps({"email": u, "password": pw}), method="POST")
|
|
return json.loads(out)["accessToken"]
|
|
|
|
|
|
def upload(sub, tok, n, tag, tmp):
|
|
ok = 0
|
|
for i in range(n):
|
|
p = os.path.join(tmp, f"{tag}-{i:03d}.jpg")
|
|
open(p, "wb").write(jpeg(i + (100 if tag == "mem" else 0)))
|
|
ts = "2026-01-%02dT%02d:00:00.000Z" % (1 + i % 28, i % 24)
|
|
rc, code, out = w.app_curl(sub, "/api/assets", "-H", f"Authorization: Bearer {tok}",
|
|
"-F", f"assetData=@{p};type=image/jpeg", "-F", f"deviceAssetId={tag}-{i}",
|
|
"-F", "deviceId=felhom-drill", "-F", f"fileCreatedAt={ts}", "-F", f"fileModifiedAt={ts}",
|
|
method="POST", timeout=90)
|
|
if code in ("200", "201"):
|
|
ok += 1
|
|
else:
|
|
say(f" upload {tag} {i} -> {code} {out[:150]}")
|
|
return ok
|
|
|
|
|
|
def node_cmd(block):
|
|
cmd = block["command"]
|
|
assert cmd[:2] == ["node", "-e"], cmd
|
|
return cmd[2]
|
|
|
|
|
|
def main():
|
|
fy = yaml.safe_load(open(f"{DRILL}/templates/immich/.felhom.yml"))
|
|
aub = fy["after_unclean_boot"]
|
|
comp = open(f"{DRILL}/templates/immich/docker-compose.yml").read()
|
|
img = re.search(r"image:\s*(ghcr.io/immich-app/immich-server:\S+)", comp).group(1)
|
|
say(f"drill head {os.popen(f'git -C {DRILL} rev-parse --short HEAD').read().strip()}: immich-server {img}; "
|
|
f"the block lists {aub['images']}")
|
|
w.login()
|
|
if w.stack("immich").get("deployed"):
|
|
say("immich already deployed on 9202 — STOP (not ours)")
|
|
return 2
|
|
if not w.deploy("immich", "photos"):
|
|
return 1
|
|
pins = (w.stack("immich").get("app_config") or {}).get("pinned_images") or {}
|
|
say(f"deployed: {pins.get('immich-server')}")
|
|
if pins.get("immich-server") != img:
|
|
say("the box did not deploy the drill's v3.3.5 — STOP")
|
|
return 1
|
|
seed = fx.Immich().seed(w, "photos", say)
|
|
if not seed:
|
|
say("admin sign-up failed")
|
|
return 1
|
|
atok = login("photos", seed["u"], seed["pw"])
|
|
mu, mpw = "member" + os.urandom(3).hex() + "@example.invalid", "Drill-" + os.urandom(8).hex()
|
|
rc, code, out = w.app_curl("photos", "/api/admin/users", "-H", f"Authorization: Bearer {atok}",
|
|
"-H", "Content-Type: application/json",
|
|
data=json.dumps({"email": mu, "password": mpw, "name": "Member"}), method="POST")
|
|
say(f"family member: {code}")
|
|
mtok = login("photos", mu, mpw)
|
|
tmp = tempfile.mkdtemp()
|
|
say(f"admin uploaded: {upload('photos', atok, 20, 'adm', tmp)}")
|
|
say(f"member uploaded: {upload('photos', mtok, 10, 'mem', tmp)}")
|
|
hdd = w.app_env("immich", "HDD_PATH")
|
|
under = aub["empty_files"]["under"].replace("${HDD_PATH}", hdd)
|
|
up = under.rsplit("/thumbs", 1)[0]
|
|
for _ in range(60):
|
|
n = w.guest(f"find {under} -type f -name '*_thumbnail.webp' -size +0 | wc -l; "
|
|
f"find {under} -type f -name '*_preview.jpeg' -size +0 | wc -l").split()
|
|
if n == ["30", "30"]:
|
|
break
|
|
time.sleep(5)
|
|
say(f"thumbnails/previews settled: {n}")
|
|
srv = w.guest("docker ps --filter label=com.docker.compose.service=immich-server --format '{{.Names}}'").strip()
|
|
# controls: every thumbs file before the damage (size + mtime)
|
|
ctl0 = w.guest(f"find {under} -type f -printf '%p %s %T@\\n' | sort")
|
|
files = [l.split()[0] for l in ctl0.splitlines() if l.endswith(tuple("0123456789")) and "_thumbnail.webp" in l]
|
|
by_user = {}
|
|
for f in files:
|
|
by_user.setdefault(f.split("/thumbs/")[1].split("/")[0], []).append(f)
|
|
users = sorted(by_user)
|
|
victims = by_user[users[0]][:2] + by_user[users[1]][:2]
|
|
rx = re.compile(aub["empty_files"]["id_from_name"])
|
|
ids = [rx.search(os.path.basename(v)).group(1) for v in victims]
|
|
# one original deleted (not a victim's), as the power cut can lose a file that was being written
|
|
orig = w.guest(f"find {up}/upload {up}/library -type f -name '*.jpg' 2>/dev/null | head -1").strip()
|
|
w.guest("\n".join(f": > {v}" for v in victims) + f"\nrm -f {orig}\n")
|
|
empty0 = w.guest(f"find {under} -type f -size 0 | wc -l").strip()
|
|
say(f"damage: {empty0} empty files ({len(users)} users), 1 original deleted")
|
|
# the repair, exactly as the controller runs it: node -e <script> <ids…> inside the service's container
|
|
t = f"/tmp/felhom-aub-{os.getpid()}.js"
|
|
rep = node_cmd(aub["repair"])
|
|
out = w.guest(f"cat > {t} <<'FELHOMJS'\n{rep}\nFELHOMJS\nt0=$(date +%s%N)\n"
|
|
f"docker exec {srv} node -e \"$(cat {t})\" {' '.join(ids)}; echo \"rc=$? in $(( ($(date +%s%N) - t0) / 1000000 )) ms\"\n"
|
|
f"rm -f {t}", timeout=900)
|
|
say("== repair with %d ids\n%s" % (len(ids), out.strip()))
|
|
empty1 = w.guest(f"find {under} -type f -size 0 | wc -l").strip()
|
|
ctl1 = w.guest(f"find {under} -type f -printf '%p %s %T@\\n' | sort")
|
|
a = {l.split()[0]: l for l in ctl0.splitlines() if l.strip()}
|
|
b = {l.split()[0]: l for l in ctl1.splitlines() if l.strip()}
|
|
# a CONTROL is a file of an asset that was NOT damaged; the job rebuilds a damaged asset's thumbnail AND preview,
|
|
# so its sibling files are expected to change (the 2026-10-14 method counted the same way)
|
|
controls = [p for p in a if not any(os.path.basename(p).startswith(i) for i in ids) and not p.endswith("/.immich")]
|
|
rewritten = [p for p in controls if b.get(p) != a[p]]
|
|
sib = [os.path.basename(p) for p in a if p not in victims and any(os.path.basename(p).startswith(i) for i in ids)]
|
|
say(f"damaged assets' other files (rebuilt by the job, expected): {len(sib)}; changed: "
|
|
f"{sum(1 for p in a if os.path.basename(p) in sib and b.get(p) != a[p])}")
|
|
if rewritten:
|
|
say("controls rewritten: " + ", ".join(os.path.basename(p) for p in rewritten))
|
|
fixed = [v for v in victims if v in b and b[v].split()[1] != "0"]
|
|
say(f"after: empty now {empty1}; victims repaired {len(fixed)} of {len(victims)}; "
|
|
f"controls rewritten {len(rewritten)} of {len(controls)}")
|
|
lost = node_cmd(aub["report_lost"])
|
|
out = w.guest(f"cat > {t} <<'FELHOMJS'\n{lost}\nFELHOMJS\n"
|
|
f"docker exec {srv} node -e \"$(cat {t})\"; echo \"rc=$?\"\nrm -f {t}", timeout=900)
|
|
say("== report_lost (the deleted original: %s)\n%s" % (os.path.basename(orig), out.strip()))
|
|
verdict = (empty1 == "0" and len(fixed) == len(victims) and not rewritten and "FELHOM_REPAIR_OK" in "\n".join(OUT)
|
|
and "FELHOM_LOST_OK lost=1" in out)
|
|
say(f"VERDICT {'proven' if verdict else 'NOT proven'} on {img}")
|
|
save()
|
|
return 0 if verdict else 1
|
|
|
|
|
|
if __name__ == "__main__":
|
|
rc = 1
|
|
try:
|
|
rc = main()
|
|
finally:
|
|
try:
|
|
if w.stack("immich").get("deployed"):
|
|
w.remove("immich")
|
|
OUT.extend(w.LOG[-3:])
|
|
finally:
|
|
save()
|
|
sys.exit(rc)
|