P2R-01: REST + WS rewire against the slim shape

Schedules CRUD now takes {cron, enabled, source_group_ids[]} with cron parsed via robfig/cron/v3 and group membership scoped to the host. New source-groups CRUD lives at /api/hosts/{id}/source-groups; delete refuses with 409 if any schedule still references the group, returning the schedule list so the UI can prompt 'remove from these schedules first.' Repo-maintenance GET/PUT manages forget/prune/check cadences on host_repo_maintenance — no version bump, the server-side ticker (P2R-06) drives execution. Per-source-group Run-now (POST /hosts/{id}/source-groups/{gid}/run) resolves the group's includes/excludes/retention/tag and dispatches a backup command.run with the new structured CommandRunPayload fields (Includes/Excludes/Tag). Old per-host /hosts/{id}/run-backup and /hosts/{id}/init-repo return 410 Gone with a redirect message. schedule_push.go is rebuilt: buildScheduleSetPayload assembles the slim wire shape, pushScheduleSetOnConn ships it during the on-hello window, pushScheduleSetAsync fires after every CRUD mutation, and dispatchScheduledJob handles agent schedule.fire by iterating the schedule's source groups and dispatching one backup per group with actor_kind=schedule and scheduled_id pointing at the schedule. Auto-init at first WS connect: when the host has repo creds bound and no init job in its history, server dispatches restic init. Restic's 'config file already exists' soft-success means re-runs against an existing repo no-op; we don't auto-retry on failure (operator triggers re-init manually via the danger zone in P2R-09). api.Schedule drops Kind/Paths/Excludes/Tags/RetentionPolicy/Manual etc. in favour of {id, cron, enabled, source_groups: [...]}. The agent scheduler stops checking sch.Manual; cmd/agent's backup dispatch reads Includes/Excludes/Tag instead of Args. Tests cover the new HTTP surface end-to-end: source-groups CRUD with in-use refusal, schedule validation (bad cron / missing groups / foreign group), repo-maintenance auto-seed and validation, the 410 route, and buildScheduleSetPayload's wire-shape correctness. Full suite passes; smoke env exercises auto-init dispatch on hello, async push after schedule create, and per-source-group Run-now landing the right paths/excludes/tag at the agent.
2026-05-03 10:56:40 +01:00
parent 0735038ea8
commit ec0bf0f6c3
18 changed files with 1564 additions and 101 deletions
@@ -0,0 +1,145 @@
+// repo_maintenance.go — REST API for /api/hosts/{id}/repo-maintenance.
+//
+// Cadence rows for the three repo-wide verbs (forget / prune / check).
+// Edits do NOT bump host_schedule_version: the server-side maintenance
+// ticker drives execution (P2R-06), not the agent's local cron.
+package http
+
+import (
+	"encoding/json"
+	"errors"
+	stdhttp "net/http"
+
+	"github.com/go-chi/chi/v5"
+
+	"gitea.dcglab.co.uk/steve/restic-manager/internal/store"
+)
+
+type repoMaintenanceView struct {
+	HostID         string `json:"host_id"`
+	ForgetCron     string `json:"forget_cron"`
+	ForgetEnabled  bool   `json:"forget_enabled"`
+	PruneCron      string `json:"prune_cron"`
+	PruneEnabled   bool   `json:"prune_enabled"`
+	CheckCron      string `json:"check_cron"`
+	CheckEnabled   bool   `json:"check_enabled"`
+	CheckSubsetPct int    `json:"check_subset_pct"`
+}
+
+func toRepoMaintenanceView(m store.HostRepoMaintenance) repoMaintenanceView {
+	return repoMaintenanceView{
+		HostID:         m.HostID,
+		ForgetCron:     m.ForgetCron,
+		ForgetEnabled:  m.ForgetEnabled,
+		PruneCron:      m.PruneCron,
+		PruneEnabled:   m.PruneEnabled,
+		CheckCron:      m.CheckCron,
+		CheckEnabled:   m.CheckEnabled,
+		CheckSubsetPct: m.CheckSubsetPct,
+	}
+}
+
+func (s *Server) handleGetRepoMaintenance(w stdhttp.ResponseWriter, r *stdhttp.Request) {
+	if !s.authedUser(r) {
+		writeJSONError(w, stdhttp.StatusUnauthorized, "unauthorized", "")
+		return
+	}
+	hostID := chi.URLParam(r, "id")
+	if _, err := s.deps.Store.GetHost(r.Context(), hostID); err != nil {
+		writeJSONError(w, stdhttp.StatusNotFound, "host_not_found", "")
+		return
+	}
+	m, err := s.deps.Store.GetRepoMaintenance(r.Context(), hostID)
+	if err != nil {
+		if errors.Is(err, store.ErrNotFound) {
+			// Self-heal: seed and return the defaults so the UI never
+			// has to handle a 404 here. Hosts enrolled before the
+			// migration may legitimately be missing the row.
+			if seedErr := s.deps.Store.CreateDefaultRepoMaintenance(r.Context(), hostID); seedErr != nil {
+				writeJSONError(w, stdhttp.StatusInternalServerError, "internal", "")
+				return
+			}
+			m, err = s.deps.Store.GetRepoMaintenance(r.Context(), hostID)
+			if err != nil {
+				writeJSONError(w, stdhttp.StatusInternalServerError, "internal", "")
+				return
+			}
+		} else {
+			writeJSONError(w, stdhttp.StatusInternalServerError, "internal", "")
+			return
+		}
+	}
+	writeJSON(w, stdhttp.StatusOK, toRepoMaintenanceView(*m))
+}
+
+type repoMaintenanceWriteRequest struct {
+	ForgetCron     string `json:"forget_cron"`
+	ForgetEnabled  bool   `json:"forget_enabled"`
+	PruneCron      string `json:"prune_cron"`
+	PruneEnabled   bool   `json:"prune_enabled"`
+	CheckCron      string `json:"check_cron"`
+	CheckEnabled   bool   `json:"check_enabled"`
+	CheckSubsetPct int    `json:"check_subset_pct"`
+}
+
+func (s *Server) handleUpdateRepoMaintenance(w stdhttp.ResponseWriter, r *stdhttp.Request) {
+	if !s.authedUser(r) {
+		writeJSONError(w, stdhttp.StatusUnauthorized, "unauthorized", "")
+		return
+	}
+	hostID := chi.URLParam(r, "id")
+	if _, err := s.deps.Store.GetHost(r.Context(), hostID); err != nil {
+		writeJSONError(w, stdhttp.StatusNotFound, "host_not_found", "")
+		return
+	}
+	var req repoMaintenanceWriteRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		writeJSONError(w, stdhttp.StatusBadRequest, "invalid_json", err.Error())
+		return
+	}
+	for label, expr := range map[string]string{
+		"forget_cron": req.ForgetCron,
+		"prune_cron":  req.PruneCron,
+		"check_cron":  req.CheckCron,
+	} {
+		if expr == "" {
+			writeJSONError(w, stdhttp.StatusBadRequest, "missing_field", label+" required")
+			return
+		}
+		if _, err := cronParser.Parse(expr); err != nil {
+			writeJSONError(w, stdhttp.StatusBadRequest, "invalid_cron", label+": "+err.Error())
+			return
+		}
+	}
+	if req.CheckSubsetPct < 0 || req.CheckSubsetPct > 100 {
+		writeJSONError(w, stdhttp.StatusBadRequest, "invalid_value",
+			"check_subset_pct must be 0..100")
+		return
+	}
+	// Ensure the row exists (older hosts may pre-date the auto-seed).
+	if err := s.deps.Store.CreateDefaultRepoMaintenance(r.Context(), hostID); err != nil {
+		writeJSONError(w, stdhttp.StatusInternalServerError, "internal", "")
+		return
+	}
+	m := store.HostRepoMaintenance{
+		HostID:         hostID,
+		ForgetCron:     req.ForgetCron,
+		ForgetEnabled:  req.ForgetEnabled,
+		PruneCron:      req.PruneCron,
+		PruneEnabled:   req.PruneEnabled,
+		CheckCron:      req.CheckCron,
+		CheckEnabled:   req.CheckEnabled,
+		CheckSubsetPct: req.CheckSubsetPct,
+	}
+	if err := s.deps.Store.UpdateRepoMaintenance(r.Context(), &m); err != nil {
+		writeJSONError(w, stdhttp.StatusInternalServerError, "internal", err.Error())
+		return
+	}
+	out, _ := s.deps.Store.GetRepoMaintenance(r.Context(), hostID)
+	if out != nil {
+		writeJSON(w, stdhttp.StatusOK, toRepoMaintenanceView(*out))
+		return
+	}
+	writeJSON(w, stdhttp.StatusOK, toRepoMaintenanceView(m))
+}
+