steve
f0dfa689fe
Three small follow-ups from review:
1. Restore target is now operator-editable. Default value is the
literal '\$HOME/rm-restore/<job-id>/' (agent expands \$HOME at
run time using os.UserHomeDir(); also handles \${HOME} and ~/
prefixes). Operator can replace with any absolute path.
- ui_restore.go validates the input is either absolute or starts
with one of the recognised prefixes; other env-var refs (\$PATH
etc.) are deliberately rejected so operator paths can't pick up
arbitrary agent env values.
- host_restore.html replaces the read-only mono-text display with
a real <input>; help text spells out that \$HOME resolves
agent-side and <job-id> is substituted on dispatch.
- install.sh + the systemd unit prep /root/rm-restore so the
default works under the sandbox: ReadWritePaths gains a soft
'-/root/rm-restore' entry (the '-' makes the bind-mount soft-fail
if missing, but install.sh pre-creates it root-owned 0700).
2. --no-ownership flag now gated on restic version. The flag was
added in restic 0.17 and 0.16 rejects it. Previously dropped it
wholesale — that meant new-dir restores silently preserved
ownership against design intent on 0.17+. Now the agent threads
its detected restic version (sysinfo already collects it) through
runner.Config -> restic.Env, and RunRestore appends --no-ownership
only when AtLeastVersion(0, 17) returns true. 0.16 hosts still
restore with original uid/gid; help text in the wizard explicitly
notes this. The previous 'Original ownership is preserved' copy
was wrong for new-dir mode and is corrected.
3. golangci-lint misspell locale switched US -> UK and the codebase
swept (73 corrections, mostly behaviour/serialise/recognise/honour).
Wire-format ErrorCode 'unauthorized' -> 'unauthorised' is a tiny
contract change but the agent doesn't parse those codes today and
no external API consumers exist yet. Tests passed before + after.
Tests:
- internal/restic/version_test.go covers Env.AtLeastVersion across
edge cases (empty, exact match, patch above, minor below, non-
numeric) and expandHome on \$HOME / \${HOME} / ~/, plus
pass-through for absolute paths and refusal of other env vars.
- ui_restore_test updated: TargetDir now starts '\$HOME/rm-restore/'
with the job_id substituted into the placeholder.
Live verified on the smoke env: default target restored to
/root/rm-restore/<job-id>/ as the agent's expanded \$HOME (2 files,
14 bytes); custom override '/tmp/custom-restore/<job-id>/' restored
into the agent's PrivateTmp namespace (1 file, 6 bytes); both jobs
'succeeded', exit 0.
87 lines
2.4 KiB
Go
87 lines
2.4 KiB
Go
package http
|
|
|
|
import (
|
|
stdhttp "net/http"
|
|
"time"
|
|
|
|
"github.com/go-chi/chi/v5"
|
|
"github.com/oklog/ulid/v2"
|
|
|
|
"gitea.dcglab.co.uk/steve/restic-manager/internal/api"
|
|
"gitea.dcglab.co.uk/steve/restic-manager/internal/store"
|
|
)
|
|
|
|
// handleCancelJob is POST /api/jobs/{id}/cancel. Sends a command.cancel
|
|
// envelope to the host that owns the job; the agent kills the running
|
|
// restic subprocess, and the resulting job.finished envelope (status =
|
|
// canceled) is what actually transitions the job row — this handler
|
|
// does not touch the jobs table directly. Returning 202 makes that
|
|
// asynchronicity explicit.
|
|
//
|
|
// 4xx cases:
|
|
// - job not found (404)
|
|
// - job already in a terminal state (409 — nothing to cancel)
|
|
// - host offline (503 — same code path the run-now endpoint uses)
|
|
//
|
|
// Audit-logged as job.cancel with the job ID as target.
|
|
func (s *Server) handleCancelJob(w stdhttp.ResponseWriter, r *stdhttp.Request) {
|
|
user, ok := s.requireUser(r)
|
|
if !ok {
|
|
writeJSONError(w, stdhttp.StatusUnauthorized, "unauthorised", "")
|
|
return
|
|
}
|
|
jobID := chi.URLParam(r, "id")
|
|
if jobID == "" {
|
|
writeJSONError(w, stdhttp.StatusBadRequest, "missing_job_id", "")
|
|
return
|
|
}
|
|
|
|
job, err := s.deps.Store.GetJob(r.Context(), jobID)
|
|
if err != nil {
|
|
writeJSONError(w, stdhttp.StatusNotFound, "job_not_found", "")
|
|
return
|
|
}
|
|
switch api.JobStatus(job.Status) {
|
|
case api.JobSucceeded, api.JobFailed, api.JobCancelled:
|
|
writeJSONError(w, stdhttp.StatusConflict, "job_terminal",
|
|
"job is already in a terminal state ("+job.Status+")")
|
|
return
|
|
}
|
|
|
|
if !s.deps.Hub.Connected(job.HostID) {
|
|
writeJSONError(w, stdhttp.StatusServiceUnavailable, "host_offline",
|
|
"agent is not connected; can't deliver cancel signal")
|
|
return
|
|
}
|
|
|
|
env, err := api.Marshal(api.MsgCommandCancel, jobID, api.CommandCancelPayload{
|
|
JobID: jobID,
|
|
})
|
|
if err != nil {
|
|
writeJSONError(w, stdhttp.StatusInternalServerError, "internal", "")
|
|
return
|
|
}
|
|
if err := s.deps.Hub.Send(r.Context(), job.HostID, env); err != nil {
|
|
writeJSONError(w, stdhttp.StatusServiceUnavailable, "host_offline", err.Error())
|
|
return
|
|
}
|
|
|
|
var actorID *string
|
|
actor := "system"
|
|
if user != nil {
|
|
actor = "user"
|
|
actorID = &user.ID
|
|
}
|
|
_ = s.deps.Store.AppendAudit(r.Context(), store.AuditEntry{
|
|
ID: ulid.Make().String(),
|
|
UserID: actorID,
|
|
Actor: actor,
|
|
Action: "job.cancel",
|
|
TargetKind: ptr("job"),
|
|
TargetID: &jobID,
|
|
TS: time.Now().UTC(),
|
|
})
|
|
|
|
w.WriteHeader(stdhttp.StatusAccepted)
|
|
}
|