steve
8aa635f0c1
Two fixes that close the loop on dashboard run-now and harden the
agent's restic invocation.
Default paths (interim until P2-01 schedules):
- 0003 migration adds default_paths TEXT NOT NULL DEFAULT '[]'
to hosts and to enrollment_tokens.
- Operator types paths in the Add-host form (textarea, one per
line). They ride on the enrol_token row alongside the
encrypted creds (paths aren't secret — plain JSON column).
- On consume, ConsumeEnrollmentToken still just burns the token;
the new GetEnrollmentTokenAttachments returns both the
re-bindable creds and the path list in one round trip, the
handler transfers them onto the new host row inside CreateHost.
- The dashboard's Run-now and host-detail's "Run backup now"
button now read Host.DefaultPaths and pass them to dispatchJob.
A host with no default paths returns 400 with a friendly
"no paths set" message instead of dispatching a doomed
`restic backup` with no positional args.
- Doc comments explicitly call this out as a Phase 1 interim —
schedules supersede.
Restic env hygiene:
- envSlice() previously omitted HOME / XDG_CACHE_HOME, which
bit the smoke runs whenever the agent was launched outside
systemd (restic refused to start: "neither $XDG_CACHE_HOME
nor $HOME are defined"). Now both are set explicitly: prefer
Env.ExtraEnv overrides, fall back to the agent process's own
HOME, and finally to /var/lib/restic-manager.
- Comment makes the env policy explicit: parent's RESTIC_* /
AWS_* / B2_* env is filtered out by design — control-plane
is the unambiguous source of truth.
JS bug fix in the live log page:
- {{$job.ID | printf "%q"}} produced a literal-quoted JS string,
which then went into the WS URL as ".../jobs/"<ID>"/stream"
→ 404. Switched to '{{$job.ID}}' inside the literal so
html/template's auto-escape does the right thing. Verified
end-to-end: dashboard "Run now" → live progress + log lines
arrive over the WS → succeeded pill renders.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
107 lines
3.4 KiB
Go
107 lines
3.4 KiB
Go
package http
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"testing"
|
|
)
|
|
|
|
// TestEnrollmentTransfersRepoCreds verifies the round-trip:
|
|
// - operator mints a token with repo_url/username/password
|
|
// - encrypted blob lands on the token row, bound to token_hash
|
|
// - on consume, the blob is re-encrypted bound to host_id and
|
|
// written to host_credentials in the same tx.
|
|
func TestEnrollmentTransfersRepoCreds(t *testing.T) {
|
|
t.Parallel()
|
|
srv, _, st := newTestServerWithHub(t)
|
|
|
|
ctx := context.Background()
|
|
want := repoCredsBlob{
|
|
RepoURL: "rest:https://repo.example/host42",
|
|
RepoUsername: "host42",
|
|
RepoPassword: "hunter2",
|
|
}
|
|
|
|
// Encrypt + create token like the operator endpoint would.
|
|
const tokHash = "tok-hash-fixture"
|
|
enc, err := srv.encryptRepoCreds(want, []byte("token:"+tokHash))
|
|
if err != nil {
|
|
t.Fatalf("encrypt: %v", err)
|
|
}
|
|
if err := st.CreateEnrollmentToken(ctx, tokHash, 1<<20, enc, ""); err != nil {
|
|
t.Fatalf("create token: %v", err)
|
|
}
|
|
|
|
// Rebind under host_id, then consume (this is what the agent
|
|
// enroll handler does inline).
|
|
const hostID = "h-fixture"
|
|
_, encForHost, err := srv.rebindTokenAttachments(ctx, tokHash, hostID)
|
|
if err != nil {
|
|
t.Fatalf("rebind: %v", err)
|
|
}
|
|
if encForHost == "" {
|
|
t.Fatal("rebind returned empty blob; expected re-encrypted ciphertext")
|
|
}
|
|
if encForHost == enc {
|
|
t.Errorf("rebind should change ciphertext (additional-data differs); got identical")
|
|
}
|
|
|
|
// Burn the token, then create the host row, then promote — same
|
|
// order the HTTP handler runs.
|
|
if err := st.ConsumeEnrollmentToken(ctx, tokHash, hostID); err != nil {
|
|
t.Fatalf("consume: %v", err)
|
|
}
|
|
if _, err := st.DB().Exec(
|
|
`INSERT INTO hosts (id, name, os, arch, enrolled_at) VALUES (?,?,?,?,?)`,
|
|
hostID, "host42", "linux", "amd64", "2026-01-01T00:00:00Z"); err != nil {
|
|
t.Fatalf("insert host: %v", err)
|
|
}
|
|
if err := st.SetHostCredentials(ctx, hostID, encForHost); err != nil {
|
|
t.Fatalf("set host credentials: %v", err)
|
|
}
|
|
|
|
// host_credentials row should now hold the host-bound ciphertext.
|
|
got, err := st.GetHostCredentials(ctx, hostID)
|
|
if err != nil {
|
|
t.Fatalf("get host creds: %v", err)
|
|
}
|
|
plain, err := srv.deps.AEAD.Decrypt(got, []byte("host:"+hostID))
|
|
if err != nil {
|
|
t.Fatalf("decrypt: %v", err)
|
|
}
|
|
var blob repoCredsBlob
|
|
if err := json.Unmarshal(plain, &blob); err != nil {
|
|
t.Fatalf("unmarshal: %v", err)
|
|
}
|
|
if blob != want {
|
|
t.Errorf("blob mismatch:\n got %+v\nwant %+v", blob, want)
|
|
}
|
|
|
|
// Cross-check: decrypting with a wrong AD must fail (swap
|
|
// detection — proves the AAD binding is doing real work).
|
|
if _, err := srv.deps.AEAD.Decrypt(got, []byte("host:other-host")); err == nil {
|
|
t.Error("decrypt with wrong AD must fail; AAD binding is broken")
|
|
}
|
|
}
|
|
|
|
// TestEnrollmentTokenWithoutCreds is the regression that ensures the
|
|
// existing ttl/single-use semantics still work when no creds are
|
|
// attached (used by the enrollment_test.go fixture path).
|
|
func TestEnrollmentTokenWithoutCreds(t *testing.T) {
|
|
t.Parallel()
|
|
_, _, st := newTestServerWithHub(t)
|
|
ctx := context.Background()
|
|
|
|
const tokHash = "no-creds-token"
|
|
if err := st.CreateEnrollmentToken(ctx, tokHash, 1<<20, "", ""); err != nil {
|
|
t.Fatalf("create: %v", err)
|
|
}
|
|
att, err := st.GetEnrollmentTokenAttachments(ctx, tokHash)
|
|
if err != nil {
|
|
t.Fatalf("get token attachments: %v", err)
|
|
}
|
|
if att.EncRepoCreds != "" {
|
|
t.Errorf("token without creds should return empty blob; got %q", att.EncRepoCreds)
|
|
}
|
|
}
|