2 Commits

Author	SHA1	Message	Date
shankar0123	a3d8b9c607	fix(deploy,db,handler): close fresh-clone postgres init failure + 4 ride-along audit findings (U-3 master) ... GitHub #10 reopened: operator mikeakasully cloned v2.0.50 fresh and ran the canonical quickstart (docker compose -f deploy/docker-compose.yml up -d --build); postgres reported unhealthy indefinitely, dependent containers never started. Root cause: deploy/docker-compose.yml mounted a hand-curated subset of migrations/*.up.sql + seed.sql into postgres /docker-entrypoint-initdb.d/. Postgres applied them at initdb time. Once seed.sql referenced columns added by migrations *after* the mounted cutoff (e.g., policy_rules.severity from migration 000013), initdb crashed mid-seed and the container loop wedged. Two sources of truth (compose mount list vs in-tree migration ladder) diverged the moment a seed-touching migration shipped, and the only thing that fixed it was hand-editing the compose file every release. Fix: remove the dual source. Postgres boots empty; the server applies migrations + seed at startup via RunMigrations + RunSeed. Helm has used this pattern since day one (postgres-init emptyDir); compose now matches. Bundled with four ride-along audit findings whose fixes share the same schema/db code surface, so operators take the schema-change pain only once: cat-u-seed_initdb_schema_drift [P1, primary] — initdb-mount fix cat-o-retry_interval_unit_mismatch [P1] — column rename minutes→seconds cat-o-notification_created_at_dead_field [P2] — add column + populate cat-o-health_check_column_orphans [P1] — drop unwired columns cat-u-no_version_endpoint [P2] — add /api/v1/version Single migration (000017_db_coupling_cleanup) bundles the three schema changes under a DO \$\$ guard so re-application is safe; reduces operator-visible 'schema-change releases' from four to one. Backend - internal/repository/postgres/db.go: add RunSeed (baseline) + RunDemoSeed (gated by CERTCTL_DEMO_SEED). Both idempotent (ON CONFLICT DO NOTHING in every shipped INSERT) so repeated boots are safe; missing-file is no-op so custom packaging that strips seeds still boots cleanly. - cmd/server/main.go: invoke RunSeed (always) + RunDemoSeed (when flag set) immediately after RunMigrations. - internal/repository/postgres/notification.go: NotificationRepository.Create now sets created_at (with time.Now() fallback when caller leaves it zero); scanNotification reads it back; List + ListRetryEligible SELECT extended. - internal/repository/postgres/renewal_policy.go: column references updated to retry_interval_seconds across SELECT/INSERT/UPDATE sites. - internal/api/handler/version.go: new VersionHandler exposes {version, commit, modified, build_time, go_version} from runtime/debug.ReadBuildInfo() with ldflags-supplied Version override. - internal/api/router/router.go: register GET /api/v1/version through the no-auth chain (CORS + ContentType) alongside /health, /ready, /api/v1/auth/info. - cmd/server/main.go: add /api/v1/version to no-auth dispatch + audit ExcludePaths so rollout polling doesn't dominate the audit trail. - internal/config/config.go: add DatabaseConfig.DemoSeed + CERTCTL_DEMO_SEED env var. Migration - migrations/000017_db_coupling_cleanup.up.sql + .down.sql: (1) renewal_policies.retry_interval_minutes → retry_interval_seconds (DO \$\$ guard, idempotent re-application) (2) notification_events ADD COLUMN created_at TIMESTAMPTZ NOT NULL DEFAULT NOW() (3) network_scan_targets DROP orphan health_check_enabled + health_check_interval_seconds - migrations/seed.sql: column reference updated to retry_interval_seconds. - migrations/seed_demo.sql: same column rename + applied at runtime now via RunDemoSeed (no longer initdb-mounted). Compose - deploy/docker-compose.yml: drop ALL initdb mounts (10 migration files + seed.sql); add start_period: 30s to postgres + certctl-server healthchecks to absorb the runtime migration + seed application window on first boot. - deploy/docker-compose.test.yml: same drop (+ ghost seed_test.sql mount removed; that file never existed); same healthcheck start_period. - deploy/docker-compose.demo.yml: replace seed_demo.sql initdb mount with CERTCTL_DEMO_SEED=true env var on certctl-server. Tests - internal/api/handler/version_handler_test.go: TestVersion_ReturnsBuildInfo, TestVersion_RejectsNonGet, TestVersion_LdflagsOverride. - internal/repository/postgres/seed_test.go: TestRunSeed_AppliesIdempotently, TestRunSeed_MissingFileIsNoOp, TestRunDemoSeed_AppliesIdempotently, TestMigration000017_RetryIntervalRename, TestMigration000017_NotificationCreatedAt, TestMigration000017_HealthCheckOrphansDropped (testcontainers, -short skips). - internal/repository/postgres/notification_test.go: TestNotificationRepository_CreatedAt_IsPersisted + TestNotificationRepository_CreatedAt_DefaultsToNow. CI guardrail - .github/workflows/ci.yml: new 'Forbidden migration mount in compose initdb (U-3)' step grep-fails the build if any migrations/*.sql or seed*.sql re-appears in /docker-entrypoint-initdb.d in any compose file. Catches future drift before a fresh-clone operator hits it. Spec / Docs - api/openapi.yaml: add /api/v1/version operation under Health tag. - docs/architecture.md: replace the 'initdb may run the same SQL' paragraph with a post-U-3 single-source-of-truth explanation. - CHANGELOG.md: full unreleased-section entry covering all 5 closures, breaking changes, and the new env var. Audit doc - coverage-gap-audit-2026-04-24-v5/unified-audit.md: add new P1 #14 cat-u-seed_initdb_schema_drift; flip the 4 ride-along findings to ✅ RESOLVED with closure prose pointing at this commit. Verification: build/vet/test -short -race all clean across all touched packages locally; govulncheck reports 0 vulnerabilities affecting our code; OpenAPI YAML parses; CI U-3 grep guardrail clears against the post-fix tree.	2026-04-25 13:29:23 +00:00
shankar0123	97b23e98d9	test(repository): close L-1 integration-coverage gap for HealthCheck + RenewalPolicy ... The coverage-gap audit flagged L-1 (P2): `HealthCheckRepository` (453 LOC, 11 methods) and `RenewalPolicyRepository` (289 LOC, 5 methods post-G-1 — the audit's "92 lines, 2 methods" figure was stale) ship to production with zero live-DB integration coverage. The existing `repo_test.go` header self-documents the gap: "15 of 17 PostgreSQL repository files". Operationally load-bearing piece: M48's scheduler calls `HealthCheckRepository.ListDueForCheck` every tick to drive continuous TLS health monitoring. A silent SQL regression there — wrong INTERVAL math, NULL-handling slip, lost ORDER BY — would fail open: operator adds endpoint → scheduler never picks it up → endpoint degrades in production → no alert. The loop continues ticking and logs "processed 0 endpoints" normally, so the failure mode is operationally invisible. Closure shape (test-only; no production code touched): - internal/repository/postgres/health_check_test.go (new file, 7 tests) · TestHealthCheckRepository_CRUD · TestHealthCheckRepository_GetByEndpoint · TestHealthCheckRepository_List_Filters · TestHealthCheckRepository_ListDueForCheck (the load-bearing one — seeds four rows with differing last_checked_at+interval relationships to NOW() plus one NULL-last_checked_at row, asserts the correct subset returns and ORDER BY last_checked_at ASC NULLS FIRST holds) · TestHealthCheckRepository_RecordHistory_GetHistory · TestHealthCheckRepository_PurgeHistory · TestHealthCheckRepository_GetSummary - internal/repository/postgres/renewal_policy_test.go (new file, 3 tests) · TestRenewalPolicyRepository_CRUD (exercises auto-generated rp-<slug(name)> PK, JSONB round-trip of [30,14,7,0] thresholds, UpdatedAt monotonic advance, ORDER BY name for List) · TestRenewalPolicyRepository_DuplicateName (asserts errors.Is(err, repository.ErrRenewalPolicyDuplicateName) on both Create-name-unique and Update-name-unique collision paths, the pg 23505 sentinel mapping) · TestRenewalPolicyRepository_DeleteInUse (raw-INSERTs a managed_certificates row FK'ing the policy, asserts errors.Is(err, repository.ErrRenewalPolicyInUse) from pg 23503 ON DELETE RESTRICT, cleans up, then asserts not-found surfaces distinctly) - internal/repository/postgres/repo_test.go (one-line header flip) "covering 15 of 17 ... repository files" → "17 of 17"; added cross-reference pointing readers at the two sibling files. Both new files use the existing getTestDB(t) + schema-per-test-isolation convention and skip via testing.Short() in CI, matching M26 TICKET-003 scaffolding byte-for-byte. Repository/postgres is not in the CI coverage-gate path (grep -nE "internal/repository/postgres" .github/workflows/ci.yml → no hits), so adding test-only files cannot regress gated coverage elsewhere. Verification gates run locally (sandbox without Docker, so the -short skip gate itself is what's exercised; operator runs the testcontainer path locally): 1. go vet ./... — clean 2. go build ./... — clean 3. go test -short -count=1 ./... — clean 4. go test -race -short ./internal/repository/postgres/... — clean 5. staticcheck — absent; CI checkset holds 6. govulncheck — skipped; test-only, no deps 7. per-layer coverage no-regression — N/A; repo/pg not gated 8. tsc --noEmit — N/A; no frontend change 9. vitest run — N/A; no frontend change 10. vite build — N/A; no frontend change 11. OpenAPI lint — N/A; no spec change No migration, no interface change, no production code diff. The RenewalPolicyRepository drift between audit ("92 lines, 2 methods") and HEAD (289 lines, 5 methods post-G-1) is documented honestly in the audit report's Resolution Log, not papered over. Closes: coverage-gap-audit L-1 (P2)	2026-04-20 20:39:06 +00:00