Files
projectsend/tests/Feature/Platform/StaleCodeNoticeTest.php
T
Ignacio Nelson ed0d36de25 Reduce a manual update to one command that asks first (#1628)
Updating a server install cost nine artisan invocations plus a PHP-FPM
reload, written out in three places that had already drifted apart. One
of those steps is silently fatal to skip: with opcache.validate_timestamps
off — what production guides recommend and what our own image ships — the
database moves to the new version while every visitor keeps being served
the old code, and artisan reports the new version throughout.

`sudo ./update.sh` is now the whole procedure. It asks whether to check
GitHub, asks whether to download the release and verifies the checksum
published beside it, and asks whether there is a backup — offering to dump
the database when the answer is no. Then it takes the site down, replaces
the files, runs the update, reloads PHP-FPM, restarts the worker and
brings the site back. The application still has no self-updater: nothing
is fetched or applied unless somebody runs this and answers yes.

Underneath it is `php artisan projectsend:update`, which is everything an
update does that needs no root — and now the only definition of it. Both
container entrypoints call it instead of carrying their own copy of the
sequence, so the two paths cannot drift again.

Three findings worth keeping in the record, all from rehearsing rather
than reasoning:

  - queue:restart has to come last. It writes its signal into the cache,
    so clearing the cache afterwards deletes it and the worker runs old
    code forever.
  - optimize:clear is not safe to recommend. It runs cache:clear, which
    on Redis is FLUSHDB — harmless on the default two-database layout,
    but on a single-database Redis it takes the sessions and the queue
    with it. The compiled caches are cleared individually instead.
  - update.sh overwrites itself mid-run, because the zip contains it and
    bash reads its own script lazily by byte offset. It re-execs from a
    temporary copy before touching anything.

And when the reload is skipped anyway, the application now says so:
projectsend:update records the version it applied, and any staff page
compares that with what the running process actually compiled. The same
check catches the mirror image — new files in place, update never run.

Rehearsed end to end against real installs: a container upgrade (69 to 73
migrations, key and data intact, healthy), a scripted update on a real
nginx + php-fpm install with OPcache pinned (web process moved 2.1.0 to
2.1.1), the skipped-reload case (banner appears naming both versions, and
clears on reload), the refusals (downgrade, non-release zip, truncated
zip, URL passed to --zip, non-root), a database taken down mid-update
(site comes back out of maintenance mode by itself), and a real download
of the published 2.0.0 zip with its checksum verified.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-14 20:29:20 -03:00

130 lines
4.3 KiB
PHP

<?php
declare(strict_types=1);
use App\Models\User;
use App\Modules\Identity\Models\Role;
use App\Modules\Identity\Permissions\SystemRole;
use App\Modules\Platform\Capabilities\Edition;
use App\Modules\Platform\Installation\Installation;
use App\Modules\Platform\Installation\InstallationKind;
use App\Modules\Platform\Settings\Setting;
use App\Modules\Platform\Settings\Settings;
/**
* There is no way to be in a container and not in one within a single test
* run, so the detection is answered for — same seam and same reasoning as
* InstallationKindTest's own fake.
*/
class NoticeInstallation extends Installation
{
public function __construct(private readonly bool $container) {}
protected function inContainer(): bool
{
return $this->container;
}
}
function applied(string $version): void
{
app(Settings::class)->set(Setting::AppliedVersion, $version);
app(Settings::class)->set(Setting::AppliedVersionAt, now()->toIso8601String());
}
/**
* The shared prop as the page would receive it. Read out of the root
* view's data rather than through assertInertia's callback, because most
* of these assert the notice's *absence* — and a callback that never runs
* proves nothing.
*
* @return array<string, string>|null
*/
function noticeFor(User $user): ?array
{
$page = test()->actingAs($user)
->get('/dashboard')
->assertSuccessful()
->viewData('page');
return $page['props']['code_notice'] ?? null;
}
beforeEach(function () {
$this->admin = User::factory()->create();
config()->set('projectsend.version', '2.1.0');
});
test('nothing is said when the applied version is the running one', function () {
applied('2.1.0');
expect(noticeFor($this->admin))->toBeNull();
});
test('nothing is said on an installation that has never applied an update', function () {
expect(app(Settings::class)->get(Setting::AppliedVersion))->toBe('')
->and(noticeFor($this->admin))->toBeNull();
});
// The failure this exists for: files replaced, PHP never reloaded, so the
// database is ahead of the code every visitor is being served.
test('an applied version ahead of the running code reports stale code', function () {
applied('2.2.0');
$notice = noticeFor($this->admin);
expect($notice)->not->toBeNull()
->and($notice['reason'])->toBe('stale_code')
->and($notice['applied'])->toBe('2.2.0')
->and($notice['running'])->toBe('2.1.0');
});
// The other half of the same mistake: new files unpacked, the update never
// run, so the schema is behind the code.
test('an applied version behind the running code reports a pending update', function () {
applied('2.0.0');
expect(noticeFor($this->admin)['reason'])->toBe('pending_update');
});
test('it is gated on view_system_info', function () {
applied('2.2.0');
$uploader = User::factory()->create([
'role_id' => Role::query()->where('name', SystemRole::AccountManager->value)->value('id'),
]);
expect(noticeFor($uploader))->toBeNull()
->and(noticeFor($this->admin))->not->toBeNull();
})->skip(fn (): bool => Role::query()->where('name', SystemRole::AccountManager->value)->doesntExist(), 'needs the seeded roles');
// Unlike update_notice, which is edition-gated: what code a server is
// executing is a fact about the machine, not a feature of an edition.
test('it is not gated on the edition', function () {
config()->set('projectsend.edition', Edition::Cloud);
applied('2.2.0');
expect(noticeFor($this->admin))->not->toBeNull();
});
test('it names the command this kind of installation can actually run', function (bool $container, string $expected) {
app()->instance(Installation::class, new NoticeInstallation($container));
applied('2.2.0');
expect(noticeFor($this->admin)['install_kind'])->toBe($expected);
})->with([
'a container' => [true, InstallationKind::Container->value],
'a server somebody administers' => [false, InstallationKind::Manual->value],
]);
// The rollback story, asserted end to end: whatever the marker said, the
// command rewrites it to whatever is actually running.
test('running the update clears the notice', function () {
applied('2.2.0');
expect(noticeFor($this->admin))->not->toBeNull();
$this->artisan('projectsend:update')->assertSuccessful();
expect(noticeFor($this->admin))->toBeNull();
});