testing: bootstrap UI, agent reliability, NS-01..04 + alert username

Smoothes the rough edges that came up exercising a live deployment. First-run bootstrap UI: /bootstrap renders a username + password form that uses the in-memory token directly (operator no longer copies it out of the log); /login redirects there while bootstrap is available. Agent reliability: failJob synthetic envelopes so command.run early returns no longer hang the server-side job; runtime probe of restic restore --help drives --no-ownership instead of version sniffing (0.18.x had it removed). Server unit re-shaped: ProtectSystem=full plus ReadWritePaths=/etc/restic-manager, no ProtectHome — restore can now write anywhere a user might want. Restore wizard: default target is /root/rm-restore/<job-id>/ with clearer help text. Re-init confirm input uses .field (was .input, which doesn't exist — text was invisible). NS-01 host delete: store DeleteHost, admin-band /hosts/{id}/delete with hostname-confirm danger zone, audit, FK cascade, live WS close. NS-02 enrollment-token recovery: outstanding-tokens panel on /hosts/new, regenerate (preserves attachments) and revoke handlers + audit, store-level ListOutstandingEnrollmentTokens and DeleteEnrollmentToken. NS-03 repo init / probe surface: migration 0020 adds hosts.repo_status + repo_status_error; WS handler projects every init job's outcome onto the host row (idempotent already-initialised collapses to ready); creds-save resets status and dispatches a fresh probe; /hosts/{id}/repo/probe retry endpoint with banner. NS-04 dashboard live + sort + filter: query-string filter (q/status/repo_status/tag/sort/dir), 5s htmx live poll mirroring the alerts pattern with a localStorage live toggle, sortable column headers, filter row + clear. Alerts page: ack'd-by line resolves user_id ULID to username. Compose.yaml ignored — host-specific.
2026-05-05 22:03:15 +01:00
parent ddb46e16b6
commit 02e4ef7544
40 changed files with 2135 additions and 109 deletions
@@ -0,0 +1,98 @@
+package store
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+)
+
+// TestDeleteHostCascades verifies that DeleteHost removes the host
+// row and that every dependent table (schedules, jobs, source groups,
+// host_credentials) is wiped via the FK cascade declared in the
+// migrations. We also verify the agent bearer is no longer resolvable
+// — a re-installed agent must come back through pending-host accept.
+func TestDeleteHostCascades(t *testing.T) {
+	t.Parallel()
+	s := openTestStore(t)
+	ctx := context.Background()
+
+	hostID := makeSchedHost(t, s)
+	gid := makeGroup(t, s, hostID, "default", "01HDELGRP000000000000001")
+
+	// One job, one schedule, one credential row — enough to prove the
+	// cascade reaches every dependent table we care about.
+	if err := s.CreateJob(ctx, Job{
+		ID: "j-del-1", HostID: hostID, Kind: "backup",
+		ActorKind: "system", CreatedAt: time.Now().UTC(),
+	}); err != nil {
+		t.Fatalf("create job: %v", err)
+	}
+
+	sched := &Schedule{
+		ID:             "01HDELSCHED00000000000001",
+		HostID:         hostID,
+		CronExpr:       "0 3 * * *",
+		Enabled:        true,
+		SourceGroupIDs: []string{gid},
+	}
+	if err := s.CreateSchedule(ctx, sched); err != nil {
+		t.Fatalf("create schedule: %v", err)
+	}
+
+	if err := s.SetHostCredentials(ctx, hostID, CredKindRepo, "ciphertext"); err != nil {
+		t.Fatalf("set creds: %v", err)
+	}
+
+	// Sanity: agent bearer resolves before deletion.
+	if _, err := s.LookupHostByAgentToken(ctx, "tokenhash"); err != nil {
+		t.Fatalf("pre-delete bearer lookup: %v", err)
+	}
+
+	if err := s.DeleteHost(ctx, hostID); err != nil {
+		t.Fatalf("DeleteHost: %v", err)
+	}
+
+	if _, err := s.GetHost(ctx, hostID); !errors.Is(err, ErrNotFound) {
+		t.Errorf("GetHost after delete: want ErrNotFound, got %v", err)
+	}
+	if _, err := s.LookupHostByAgentToken(ctx, "tokenhash"); !errors.Is(err, ErrNotFound) {
+		t.Errorf("bearer lookup after delete: want ErrNotFound, got %v", err)
+	}
+
+	// Cascade smoke-tests via raw counts. We don't own a public
+	// "list jobs by host" path that filters by host, so go to the DB
+	// directly with the same connection used by the store helpers.
+	for _, q := range []struct {
+		label string
+		sql   string
+	}{
+		{"schedules", "SELECT count(*) FROM schedules WHERE host_id = ?"},
+		{"jobs", "SELECT count(*) FROM jobs WHERE host_id = ?"},
+		{"source_groups", "SELECT count(*) FROM source_groups WHERE host_id = ?"},
+		{"host_credentials", "SELECT count(*) FROM host_credentials WHERE host_id = ?"},
+		{"schedule_source_groups", "SELECT count(*) FROM schedule_source_groups WHERE schedule_id = ?"},
+	} {
+		var n int
+		key := hostID
+		if q.label == "schedule_source_groups" {
+			key = "01HDELSCHED00000000000001"
+		}
+		if err := s.db.QueryRowContext(ctx, q.sql, key).Scan(&n); err != nil {
+			t.Fatalf("count %s: %v", q.label, err)
+		}
+		if n != 0 {
+			t.Errorf("cascade left %d rows in %s", n, q.label)
+		}
+	}
+}
+
+// TestDeleteHostNotFound: a delete against a missing id surfaces
+// ErrNotFound so the HTTP layer can 404 instead of 200-ing a no-op.
+func TestDeleteHostNotFound(t *testing.T) {
+	t.Parallel()
+	s := openTestStore(t)
+	if err := s.DeleteHost(context.Background(), "01HNOTAHOST00000000000000"); !errors.Is(err, ErrNotFound) {
+		t.Errorf("missing id: want ErrNotFound, got %v", err)
+	}
+}