flyemoji
f2fc57cad9
Add POST /api/v1/internal/servers/{name}/backup so the on-node break-glass
console can snapshot a stopped world while felis-api is alive. It goes through
the API (not direct-to-CRD like halt) because rendering the backup Job needs
deployment coordinates (FELIS_IMAGE, FELIS_BACKUP_PVC) only felis-api holds.
Service-token auth (no Principal); the middleware IS the authorization, since
the operator already has root on the node. Refactor the RWO stopped-gate,
optional-Backuper 503, async hand-off and audit+202 into a shared enqueueBackup
tail so the external (owner/admin) and internal (break-glass) faces cannot
diverge on the security-critical stopped-gate. The internal audit is attributed
to break-glass/internal so a console-initiated backup is distinguishable from an
owner self-service one.
257 lines
9.7 KiB
Go
257 lines
9.7 KiB
Go
package api
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"errors"
|
|
"net/http"
|
|
"testing"
|
|
|
|
"felis.lolicon.best/internal/apis/felis/v1alpha1"
|
|
)
|
|
|
|
// fakeBackuper records the on-demand backup kick-off the handler makes. It mirrors
|
|
// fakeRestorer: the handler only STARTS the work, so the fake just captures the
|
|
// arguments and returns a canned error.
|
|
type fakeBackuper struct {
|
|
err error
|
|
calls int
|
|
gotName string
|
|
gotFormerOwn string
|
|
}
|
|
|
|
func (f *fakeBackuper) Backup(_ context.Context, name, formerOwner string) error {
|
|
f.calls++
|
|
f.gotName, f.gotFormerOwn = name, formerOwner
|
|
return f.err
|
|
}
|
|
|
|
// TestBackupNow exercises POST /api/v1/servers/{name}/backup (spec §18/§19 WorldArchiver,
|
|
// on demand). The default server is stopped and owned by owner1 with a wired
|
|
// fakeBackuper. The focus is the owner-or-admin gate, the stopped gate (the RWO world
|
|
// PVC must be free), the 404/503 surface, that the recorded former owner is the
|
|
// server's CURRENT owner, and that backup is an async 202 kick-off.
|
|
func TestBackupNow(t *testing.T) {
|
|
owner := &Principal{UserID: "owner1", Email: "[email protected]", Role: "user"}
|
|
|
|
mk := func() (*API, *fakeRepo, *fakeCluster, *fakeBackuper) {
|
|
repo := newFakeRepo()
|
|
repo.byName["survival"] = &ServerRecord{Name: "survival", OwnerID: "owner1"}
|
|
cl := newFakeCluster()
|
|
cl.byName["survival"] = &ServerInfo{Name: "survival", Phase: "Stopped",
|
|
Ready: false, DesiredState: string(v1alpha1.DesiredStopped)}
|
|
backuper := &fakeBackuper{}
|
|
api := newTestAPI(repo, cl)
|
|
api.Backuper = backuper
|
|
return api, repo, cl, backuper
|
|
}
|
|
|
|
const path = "/api/v1/servers/survival/backup"
|
|
|
|
t.Run("owner backs up -> 202 + backuper(currentOwner) + audit", func(t *testing.T) {
|
|
api, repo, _, backuper := mk()
|
|
api.External = staticExternal{p: owner}
|
|
w := do(api.ExternalHandler(), "POST", path, "", nil)
|
|
if w.Code != http.StatusAccepted {
|
|
t.Fatalf("code = %d, want 202 (%s)", w.Code, w.Body.String())
|
|
}
|
|
var resp struct {
|
|
Name string `json:"name"`
|
|
Status string `json:"status"`
|
|
}
|
|
if err := json.Unmarshal(w.Body.Bytes(), &resp); err != nil {
|
|
t.Fatalf("body not JSON: %v (%s)", err, w.Body.String())
|
|
}
|
|
if resp.Name != "survival" || resp.Status != "backing_up" {
|
|
t.Fatalf("unexpected response %+v", resp)
|
|
}
|
|
if backuper.calls != 1 || backuper.gotName != "survival" || backuper.gotFormerOwn != "owner1" {
|
|
t.Fatalf("backuper saw (calls=%d,%q,%q), want (1,survival,owner1)",
|
|
backuper.calls, backuper.gotName, backuper.gotFormerOwn)
|
|
}
|
|
if len(repo.audits) != 1 || repo.audits[0].Action != "backup.create" || repo.audits[0].Actor != "[email protected]" {
|
|
t.Fatalf("audit not written as expected: %+v", repo.audits)
|
|
}
|
|
})
|
|
|
|
t.Run("admin backs up an unowned server -> 202, empty former owner recorded", func(t *testing.T) {
|
|
api, repo, _, backuper := mk()
|
|
repo.byName["survival"].OwnerID = "" // released world
|
|
api.External = staticExternal{p: &Principal{UserID: "admin1", Email: "[email protected]",
|
|
Role: "admin", ViaAdminAccess: true}}
|
|
w := do(api.ExternalHandler(), "POST", path, "", nil)
|
|
if w.Code != http.StatusAccepted {
|
|
t.Fatalf("code = %d, want 202 (%s)", w.Code, w.Body.String())
|
|
}
|
|
if backuper.calls != 1 || backuper.gotFormerOwn != "" {
|
|
t.Fatalf("backuper saw (calls=%d, former=%q), want (1, empty)", backuper.calls, backuper.gotFormerOwn)
|
|
}
|
|
})
|
|
|
|
t.Run("non-owner -> 403, no backup", func(t *testing.T) {
|
|
api, _, _, backuper := mk()
|
|
api.External = staticExternal{p: &Principal{UserID: "stranger", Role: "user"}}
|
|
w := do(api.ExternalHandler(), "POST", path, "", nil)
|
|
if w.Code != http.StatusForbidden {
|
|
t.Fatalf("code = %d, want 403", w.Code)
|
|
}
|
|
if backuper.calls != 0 {
|
|
t.Fatal("a forbidden caller must not start a backup")
|
|
}
|
|
})
|
|
|
|
t.Run("unknown server -> 404", func(t *testing.T) {
|
|
api, _, _, _ := mk()
|
|
api.External = staticExternal{p: owner}
|
|
w := do(api.ExternalHandler(), "POST", "/api/v1/servers/missing/backup", "", nil)
|
|
if w.Code != http.StatusNotFound {
|
|
t.Fatalf("code = %d, want 404", w.Code)
|
|
}
|
|
})
|
|
|
|
t.Run("running server -> 409 not_stopped, no backup", func(t *testing.T) {
|
|
api, _, cl, backuper := mk()
|
|
cl.byName["survival"].Ready = true
|
|
cl.byName["survival"].DesiredState = string(v1alpha1.DesiredRunning)
|
|
api.External = staticExternal{p: owner}
|
|
w := do(api.ExternalHandler(), "POST", path, "", nil)
|
|
if w.Code != http.StatusConflict || decodeErr(t, w) != "not_stopped" {
|
|
t.Fatalf("code = %d body %s", w.Code, w.Body.String())
|
|
}
|
|
if backuper.calls != 0 {
|
|
t.Fatal("a running server holds the RWO world PVC — backup must be refused")
|
|
}
|
|
})
|
|
|
|
t.Run("starting server -> 409 not_stopped", func(t *testing.T) {
|
|
api, _, cl, _ := mk()
|
|
cl.byName["survival"].Ready = false
|
|
cl.byName["survival"].DesiredState = string(v1alpha1.DesiredRunning)
|
|
api.External = staticExternal{p: owner}
|
|
w := do(api.ExternalHandler(), "POST", path, "", nil)
|
|
if w.Code != http.StatusConflict || decodeErr(t, w) != "not_stopped" {
|
|
t.Fatalf("code = %d body %s", w.Code, w.Body.String())
|
|
}
|
|
})
|
|
|
|
t.Run("nil Backuper -> 503 backup_unavailable", func(t *testing.T) {
|
|
api, _, _, _ := mk()
|
|
api.Backuper = nil
|
|
api.External = staticExternal{p: owner}
|
|
w := do(api.ExternalHandler(), "POST", path, "", nil)
|
|
if w.Code != http.StatusServiceUnavailable || decodeErr(t, w) != "backup_unavailable" {
|
|
t.Fatalf("code = %d body %s", w.Code, w.Body.String())
|
|
}
|
|
})
|
|
|
|
t.Run("backuper failure -> 500, not audited", func(t *testing.T) {
|
|
api, repo, _, backuper := mk()
|
|
backuper.err = errors.New("kick-off failed")
|
|
api.External = staticExternal{p: owner}
|
|
w := do(api.ExternalHandler(), "POST", path, "", nil)
|
|
if w.Code != http.StatusInternalServerError {
|
|
t.Fatalf("code = %d, want 500 (%s)", w.Code, w.Body.String())
|
|
}
|
|
if len(repo.audits) != 0 {
|
|
t.Fatalf("a failed backup must not be audited: %+v", repo.audits)
|
|
}
|
|
})
|
|
|
|
t.Run("backuper reports unknown server -> 404", func(t *testing.T) {
|
|
api, _, _, backuper := mk()
|
|
backuper.err = ErrNotFound
|
|
api.External = staticExternal{p: owner}
|
|
w := do(api.ExternalHandler(), "POST", path, "", nil)
|
|
if w.Code != http.StatusNotFound {
|
|
t.Fatalf("code = %d, want 404", w.Code)
|
|
}
|
|
})
|
|
|
|
t.Run("invalid server name -> 400", func(t *testing.T) {
|
|
api, _, _, _ := mk()
|
|
api.External = staticExternal{p: owner}
|
|
w := do(api.ExternalHandler(), "POST", "/api/v1/servers/X/backup", "", nil)
|
|
if w.Code != http.StatusBadRequest {
|
|
t.Fatalf("code = %d, want 400", w.Code)
|
|
}
|
|
})
|
|
}
|
|
|
|
// TestInternalBackup exercises POST /api/v1/internal/servers/{name}/backup, the
|
|
// break-glass console's face. It shares enqueueBackup with the external handler, so
|
|
// the stopped-gate / 503 / async-202 behaviour is proven there; here the focus is the
|
|
// internal-face difference: no Principal (service-token auth), no owner gate — even a
|
|
// server owned by someone else backs up (the on-node operator is trusted) — and the
|
|
// audit is attributed to "break-glass"/"internal", not an email/"external".
|
|
func TestInternalBackup(t *testing.T) {
|
|
mk := func() (*API, *fakeRepo, *fakeCluster, *fakeBackuper) {
|
|
repo := newFakeRepo()
|
|
repo.byName["survival"] = &ServerRecord{Name: "survival", OwnerID: "someone-else"}
|
|
cl := newFakeCluster()
|
|
cl.byName["survival"] = &ServerInfo{Name: "survival", Phase: "Stopped",
|
|
Ready: false, DesiredState: string(v1alpha1.DesiredStopped)}
|
|
backuper := &fakeBackuper{}
|
|
api := newTestAPI(repo, cl)
|
|
api.Backuper = backuper
|
|
return api, repo, cl, backuper
|
|
}
|
|
|
|
const path = "/api/v1/internal/servers/survival/backup"
|
|
|
|
t.Run("stopped server -> 202 + backuper(currentOwner) + break-glass audit", func(t *testing.T) {
|
|
api, repo, _, backuper := mk()
|
|
w := do(api.InternalHandler(), "POST", path, "", jsonHeader)
|
|
if w.Code != http.StatusAccepted {
|
|
t.Fatalf("code = %d, want 202 (%s)", w.Code, w.Body.String())
|
|
}
|
|
// No owner gate on the internal face: a server owned by someone else still backs
|
|
// up, and the recorded former owner is the server's CURRENT owner.
|
|
if backuper.calls != 1 || backuper.gotName != "survival" || backuper.gotFormerOwn != "someone-else" {
|
|
t.Fatalf("backuper saw (calls=%d,%q,%q), want (1,survival,someone-else)",
|
|
backuper.calls, backuper.gotName, backuper.gotFormerOwn)
|
|
}
|
|
if len(repo.audits) != 1 || repo.audits[0].Action != "backup.create" ||
|
|
repo.audits[0].Actor != "break-glass" || repo.audits[0].Source != "internal" {
|
|
t.Fatalf("audit not attributed to break-glass/internal: %+v", repo.audits)
|
|
}
|
|
})
|
|
|
|
t.Run("running server -> 409 not_stopped, no backup", func(t *testing.T) {
|
|
api, _, cl, backuper := mk()
|
|
cl.byName["survival"].Ready = true
|
|
cl.byName["survival"].DesiredState = string(v1alpha1.DesiredRunning)
|
|
w := do(api.InternalHandler(), "POST", path, "", jsonHeader)
|
|
if w.Code != http.StatusConflict || decodeErr(t, w) != "not_stopped" {
|
|
t.Fatalf("code = %d body %s", w.Code, w.Body.String())
|
|
}
|
|
if backuper.calls != 0 {
|
|
t.Fatal("a running server holds the RWO world PVC — backup must be refused")
|
|
}
|
|
})
|
|
|
|
t.Run("nil Backuper -> 503 backup_unavailable", func(t *testing.T) {
|
|
api, _, _, _ := mk()
|
|
api.Backuper = nil
|
|
w := do(api.InternalHandler(), "POST", path, "", jsonHeader)
|
|
if w.Code != http.StatusServiceUnavailable || decodeErr(t, w) != "backup_unavailable" {
|
|
t.Fatalf("code = %d body %s", w.Code, w.Body.String())
|
|
}
|
|
})
|
|
|
|
t.Run("unknown server -> 404", func(t *testing.T) {
|
|
api, _, _, _ := mk()
|
|
w := do(api.InternalHandler(), "POST", "/api/v1/internal/servers/missing/backup", "", jsonHeader)
|
|
if w.Code != http.StatusNotFound {
|
|
t.Fatalf("code = %d, want 404", w.Code)
|
|
}
|
|
})
|
|
|
|
t.Run("invalid server name -> 400 bad_name", func(t *testing.T) {
|
|
api, _, _, _ := mk()
|
|
w := do(api.InternalHandler(), "POST", "/api/v1/internal/servers/X/backup", "", jsonHeader)
|
|
if w.Code != http.StatusBadRequest || decodeErr(t, w) != "bad_name" {
|
|
t.Fatalf("code = %d body %s", w.Code, w.Body.String())
|
|
}
|
|
})
|
|
}
|