mirror of
https://github.com/taylanbakircioglu/haproxy-openmanager.git
synced 2026-09-25 03:42:06 +00:00
02b1cb2bca
Closes #13, Closes #14. This release squashes the v1.4.0 → v1.5.0 development line. v1.4.0 shipped the ACME stability & enterprise audit (Issues #10/#11/#12). v1.5.0 builds on that foundation with two co-equal headline features plus a 22-round audit campaign hardening the prior configuration surface. License remains MIT for v1.5.0 (relicense to AGPL-3.0 lands in v1.5.2). ------------------------------------------------------------------ HEADLINE FEATURE A — ACME Diagnostic Panel (Issue #13) ------------------------------------------------------------------ A live pre-flight + post-failure diagnostic surface for every ACME order, reachable from the ACME Automation page. The panel exists to make ACME failures legible to operators who do NOT have shell access to the API host. Endpoints (`backend/routers/acme_diagnostics.py`): POST /api/letsencrypt/orders/{order_id}/diagnostics Run the full 5-check suite (DNS / port-80 / routing / account / agents) and humanize the order's `error_detail` (>=11 RFC-8555 problem types, backwards compatible with legacy plain-string failures). POST /api/letsencrypt/orders/{order_id}/diagnostics/ {check_id}/rerun Re-run a single check in place — used by the "Re-run" button on every row of the modal's pre-flight table. GET /api/letsencrypt/orders/{order_id}/events Merged event timeline combining the typed `acme_order_events` rows with correlated `user_activity_logs` entries (resource_type = 'letsencrypt_order' AND resource_id = order_id). The diagnostic modal auto-tails this timeline every 5 seconds while open. Service-level checks (`backend/services/acme_diagnostics.py`): * DNS resolution via stdlib socket.gethostbyname_ex through run_in_executor (intentionally avoiding an aiodns runtime dep for v1.5.0). * Port-80 HEAD probe, target locked to the order's domains, success on HTTP 200 OR 404, warns on egress timeout (corp egress policies routinely blackhole outbound 80 — fail-hard would be too noisy). * SSRF guard: probe refuses non-public IPs and surfaces the skip in the diagnostic result; IPv4-mapped IPv6 normalisation closes the `::ffff:169.254.169.254` cloud-metadata vector. * HAProxy routing presence check: matches the order's cluster_ids to a port-80 HTTP frontend. * ACME account validity check against `letsencrypt_accounts`. * Agent presence check (>=1 active agent in target cluster). * Every sub-check wrapped in a wall-clock timeout to bound impact on the API event loop. RBAC: ssl.read for run, ssl.read for events. Per-user 5/min rate limit on both run and rerun, backed by the (user_id, action, created_at DESC) composite index. Frontend (`frontend/src/components/ACMEAutomation.js`): * "Diagnose" button on every order row + the existing "stuck order" warning row. * Modal with two tabs: - Pre-flight Checks (Antd Table with status pills + Re-run buttons + humanized error banner) - Event Log (Antd Timeline with auto-tail polling, scroll- to-bottom, pause-on-hover) * Correlation IDs surfaced in error banners and individual check fail details for backend-log lookup. ------------------------------------------------------------------ HEADLINE FEATURE B — Site Setup Wizard (Issue #14) ------------------------------------------------------------------ A single guided flow that creates a Backend + Servers + HTTP Frontend (and optional HTTPS Frontend) in one atomic transaction. Endpoints (`backend/routers/site_wizard.py`): POST /api/site-wizard/preview — diff-preview the changeset POST /api/site-wizard/create — atomic execute POST /api/site-wizard/reject — clean rollback (including any wizard_staged ACME orders) GET /api/site-wizard/drafts — draft persistence PUT /api/site-wizard/drafts/{id} — save/update DELETE /api/site-wizard/drafts/{id} Feature surface: * One screen captures both backend (mode + servers) AND frontend (http + optional https + SSL mode) inputs. * SSL modes: ACME (new order, HTTP-01 only for v1.5.0), Upload (existing PEM), Existing (link to a stored cert), or None. * ACME-staged path: wizard_staged_until watermark on the `letsencrypt_orders` row defers finalisation until agent confirmation; per-mode reject cleanly cancels and rolls back the staged order. * Live diff preview against the cluster's current generated config (renderer-evolution noise stripped — track-sc<N> dedup, per-server cookie strip, defaults-cookie inheritance, listen-block flattening). * Draft persistence with PEM stripped at save time (private keys never round-trip through the drafts table). * Per-cluster multi-tenancy: drafts and wizard_staged orders are isolated to the creating user's cluster scope. Frontend (`frontend/src/components/SiteWizard.js`): * 4-step Antd Steps flow: Backend → Frontend → SSL → Review. * Render the live diff preview inline before commit. * Antd Form-level validation mirrors backend Pydantic validators (numeric bounds, HAProxy reserved keywords, ALPN consistency, IPv6 scope-id, domain regex, server name dedup). ------------------------------------------------------------------ AUDIT CAMPAIGN — Rounds 1 → 22 (Bulgu #1 → #82) ------------------------------------------------------------------ v1.5.0 includes 22 adversarial review passes. Each round produced its own commit set in the corporate development line; this squash collapses those into the v1.5.0 release artefact. Highlights: Round 1-4 Site Wizard core: dry-run parity, single-line value injection guard, ACL -f pattern-file block, SSL parity, timeout regex, form-state pin. Round 5-7 defaults-cookie inheritance, server-named-cookie guard, fe/be mode mismatch, duplicate server names, health_check_uri + server_address validators. Round 8-10 cookie_name / cookie_options newline-injection guard, dry-run parity (round 9), TCP-mode HTTP-only feature blockers. Round 11 SSL name path traversal + health-check >= 1. Round 12-13 SSL & ACME deep dive (Bulgu #23-#32). Round 14 single-line value injection (Bulgu #33). Round 15-17 ACME multi-tenant UX, numeric bounds, HAProxy reserved keywords, ALPN/TLS consistency, all-backup, multi-domain & multi-user enterprise edges, drain/HSTS/post-completion (Bulgu #34-#53). Round 18-21 concurrency, agent state, TCP-mode HTTP-only, list size caps, IPv6 scope-id, preview account validation, TCP backend + balance uri reject (Bulgu #54-#61). Round 22 FE error visibility + 3x stale-data lockouts, referential integrity + cascade safety, authentication & authorization, multi-cluster isolation, apply_pending_changes concurrency, script injection + bulk import multi-tenancy, prefix-stripped signature comparison (Bulgu #62-#82). ------------------------------------------------------------------ NO CORPORATE-SPECIFIC ARTIFACTS ------------------------------------------------------------------ This squash deliberately sanitises corporate hostnames, container registry references, and TLS secret names into generic placeholders (`your-registry.example.com/your-org`, `haproxy-openmanager*.example.com`, `wildcard-tls`, `taylanbakircioglu/haproxy-openmanager-*`) so the public artefact contains no internal infrastructure detail. Pilot / development history that retained those values stays in the corporate fork and is NOT part of this commit.
257 lines
8.2 KiB
Python
257 lines
8.2 KiB
Python
"""
|
|
v1.5.0 Feature A — record_event() and prune_acme_events_and_drafts_if_due() unit tests.
|
|
|
|
These tests validate:
|
|
* happy-path INSERT shape against acme_order_events,
|
|
* silent failure when the underlying table is missing (older deployments),
|
|
* conn-reuse path doesn't open/close a pool connection,
|
|
* daily-watermark logic correctly skips reruns within 24h.
|
|
"""
|
|
import json
|
|
from datetime import datetime, timedelta
|
|
from unittest.mock import AsyncMock, patch, MagicMock
|
|
|
|
import pytest
|
|
|
|
from utils.activity_log import (
|
|
record_event,
|
|
prune_acme_events_and_drafts_if_due,
|
|
)
|
|
|
|
|
|
# ----------------------------------------------------------------------------
|
|
# record_event happy path
|
|
# ----------------------------------------------------------------------------
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_record_event_happy_path_with_provided_conn():
|
|
conn = AsyncMock()
|
|
conn.fetchval.return_value = 42
|
|
|
|
row_id = await record_event(
|
|
order_id=100,
|
|
event_type="acme.order.created",
|
|
severity="info",
|
|
message="Test event",
|
|
details={"foo": "bar"},
|
|
correlation_id="corr-123",
|
|
conn=conn,
|
|
)
|
|
|
|
assert row_id == 42
|
|
conn.fetchval.assert_awaited_once()
|
|
args = conn.fetchval.call_args.args
|
|
sql = args[0]
|
|
assert "INSERT INTO acme_order_events" in sql
|
|
# Positional args after the SQL template
|
|
assert args[1] == 100 # order_id
|
|
assert args[2] == "acme.order.created" # event_type
|
|
assert args[3] == "INFO" # severity normalized upper
|
|
assert args[4] == "Test event" # message
|
|
parsed_details = json.loads(args[5])
|
|
assert parsed_details == {"foo": "bar"}
|
|
assert args[6] == "corr-123"
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_record_event_severity_uppercased_default_info():
|
|
conn = AsyncMock()
|
|
conn.fetchval.return_value = 1
|
|
|
|
await record_event(order_id=1, event_type="x", conn=conn)
|
|
args = conn.fetchval.call_args.args
|
|
assert args[3] == "INFO"
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_record_event_dict_details_serialized_to_json():
|
|
conn = AsyncMock()
|
|
conn.fetchval.return_value = 7
|
|
|
|
await record_event(
|
|
order_id=1,
|
|
event_type="x",
|
|
details={"k": [1, 2, 3], "nested": {"a": True}},
|
|
conn=conn,
|
|
)
|
|
args = conn.fetchval.call_args.args
|
|
parsed = json.loads(args[5])
|
|
assert parsed == {"k": [1, 2, 3], "nested": {"a": True}}
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_record_event_none_details_serialized_to_empty_object():
|
|
conn = AsyncMock()
|
|
conn.fetchval.return_value = 1
|
|
|
|
await record_event(order_id=1, event_type="x", details=None, conn=conn)
|
|
args = conn.fetchval.call_args.args
|
|
parsed = json.loads(args[5])
|
|
assert parsed == {}
|
|
|
|
|
|
# ----------------------------------------------------------------------------
|
|
# record_event resilience
|
|
# ----------------------------------------------------------------------------
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_record_event_swallows_db_error_returns_none():
|
|
"""If the table doesn't exist or the DB rejects the insert, NEVER raise."""
|
|
conn = AsyncMock()
|
|
conn.fetchval.side_effect = Exception(
|
|
'relation "acme_order_events" does not exist'
|
|
)
|
|
|
|
row_id = await record_event(order_id=1, event_type="x", conn=conn)
|
|
assert row_id is None
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_record_event_swallows_outer_failure_when_pool_unavailable():
|
|
"""If get_database_connection itself raises (pool exhausted), still return None."""
|
|
with patch(
|
|
"utils.activity_log.get_database_connection",
|
|
side_effect=Exception("pool exhausted"),
|
|
):
|
|
row_id = await record_event(order_id=1, event_type="x")
|
|
assert row_id is None
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_record_event_acquires_and_releases_own_conn():
|
|
"""When no conn is supplied we must open one and release it."""
|
|
fake_conn = AsyncMock()
|
|
fake_conn.fetchval.return_value = 99
|
|
|
|
with patch(
|
|
"utils.activity_log.get_database_connection",
|
|
AsyncMock(return_value=fake_conn),
|
|
) as mocked_get, patch(
|
|
"utils.activity_log.close_database_connection",
|
|
AsyncMock(),
|
|
) as mocked_close:
|
|
row_id = await record_event(order_id=1, event_type="x")
|
|
|
|
assert row_id == 99
|
|
mocked_get.assert_awaited_once()
|
|
mocked_close.assert_awaited_once_with(fake_conn)
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_record_event_does_not_close_caller_provided_conn():
|
|
"""When conn is passed in, we must NOT close it."""
|
|
conn = AsyncMock()
|
|
conn.fetchval.return_value = 1
|
|
|
|
with patch(
|
|
"utils.activity_log.close_database_connection",
|
|
AsyncMock(),
|
|
) as mocked_close:
|
|
await record_event(order_id=1, event_type="x", conn=conn)
|
|
|
|
mocked_close.assert_not_awaited()
|
|
|
|
|
|
# ----------------------------------------------------------------------------
|
|
# prune_acme_events_and_drafts_if_due — daily watermark
|
|
# ----------------------------------------------------------------------------
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_prune_skips_when_last_run_is_recent():
|
|
"""If acme.events_last_pruned_at is < 24h old, skip the DELETE."""
|
|
fake_conn = AsyncMock()
|
|
recent = (datetime.utcnow() - timedelta(hours=1)).isoformat() + "Z"
|
|
fake_conn.fetchrow.return_value = {"value": json.dumps(recent)}
|
|
|
|
with patch(
|
|
"utils.activity_log.get_database_connection",
|
|
AsyncMock(return_value=fake_conn),
|
|
), patch(
|
|
"utils.activity_log.close_database_connection",
|
|
AsyncMock(),
|
|
):
|
|
out = await prune_acme_events_and_drafts_if_due()
|
|
|
|
assert out == {"acme_events": 0, "wizard_drafts": 0}
|
|
# Assert NO DELETE was issued: every conn.execute call was for INSERT or never called.
|
|
delete_calls = [
|
|
c for c in fake_conn.execute.call_args_list
|
|
if c.args and "DELETE" in c.args[0]
|
|
]
|
|
assert delete_calls == []
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_prune_runs_when_last_run_is_stale():
|
|
"""If watermark is > 24h old, prune executes and watermark updates."""
|
|
fake_conn = AsyncMock()
|
|
|
|
stale = (datetime.utcnow() - timedelta(hours=48)).isoformat() + "Z"
|
|
# First fetchrow is for acme key, second for wizard key.
|
|
fake_conn.fetchrow.side_effect = [
|
|
{"value": json.dumps(stale)},
|
|
{"value": json.dumps(stale)},
|
|
]
|
|
|
|
# asyncpg returns "DELETE <n>" string for DELETE statements.
|
|
fake_conn.execute.side_effect = [
|
|
"DELETE 5", # acme_order_events delete
|
|
"INSERT 0 1", # watermark upsert for acme
|
|
"DELETE 2", # wizard_drafts delete
|
|
"INSERT 0 1", # watermark upsert for wizard
|
|
]
|
|
|
|
with patch(
|
|
"utils.activity_log.get_database_connection",
|
|
AsyncMock(return_value=fake_conn),
|
|
), patch(
|
|
"utils.activity_log.close_database_connection",
|
|
AsyncMock(),
|
|
):
|
|
out = await prune_acme_events_and_drafts_if_due()
|
|
|
|
assert out == {"acme_events": 5, "wizard_drafts": 2}
|
|
# Verify both DELETE queries were issued.
|
|
delete_sqls = [
|
|
c.args[0] for c in fake_conn.execute.call_args_list
|
|
if c.args and "DELETE" in c.args[0]
|
|
]
|
|
assert any("acme_order_events" in s for s in delete_sqls)
|
|
assert any("wizard_drafts" in s for s in delete_sqls)
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_prune_runs_on_first_run_when_watermark_missing():
|
|
"""Missing watermark row should NOT block first-run prune."""
|
|
fake_conn = AsyncMock()
|
|
fake_conn.fetchrow.return_value = None
|
|
fake_conn.execute.side_effect = [
|
|
"DELETE 0", "INSERT 0 1",
|
|
"DELETE 0", "INSERT 0 1",
|
|
]
|
|
|
|
with patch(
|
|
"utils.activity_log.get_database_connection",
|
|
AsyncMock(return_value=fake_conn),
|
|
), patch(
|
|
"utils.activity_log.close_database_connection",
|
|
AsyncMock(),
|
|
):
|
|
out = await prune_acme_events_and_drafts_if_due()
|
|
|
|
assert out == {"acme_events": 0, "wizard_drafts": 0}
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_prune_swallows_top_level_db_failure():
|
|
"""If the connection itself fails, return zeros, never raise."""
|
|
with patch(
|
|
"utils.activity_log.get_database_connection",
|
|
side_effect=Exception("db down"),
|
|
):
|
|
out = await prune_acme_events_and_drafts_if_due()
|
|
assert out == {"acme_events": 0, "wizard_drafts": 0}
|