gitea-admin/proxy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: complete reset recovery safety

Browse Source
This commit is contained in:
proxyctl coordinator
2026-07-17 11:25:09 +08:00
parent 9e2418f45e
commit 4cf9731db4
9 changed files with 339 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/proxyctl/main.go
+19 -3
View File
@@ -197,7 +197,16 @@ func runMaintenanceCommand(args []string, input io.Reader, output io.Writer, sto
if args[0] != "reset" {
return errors.New("invalid maintenance command")
}
fmt.Fprint(output, "Reset every managed Target and restore recorded original state? [y/N] ")
readOnlyState, readOnlyErr := store.ReadOnlyLoad()
if readOnlyErr != nil {
return fmt.Errorf("inspect Profile state before reset confirmation: %w", readOnlyErr)
}
warning := app.NewMaintenance(readOnlyState, targets, nil, nil).ResetConfirmation(context.Background())
fmt.Fprintln(output, "Reset every managed Target and restore recorded original state?")
if warning != "" {
fmt.Fprintln(output, warning)
}
fmt.Fprint(output, "Continue? [y/N] ")
answer, _ := bufio.NewReader(input).ReadString('\n')
answer = strings.ToLower(strings.TrimSpace(answer))
if answer != "y" && answer != "yes" {
@@ -222,8 +231,15 @@ func runMaintenanceCommand(args []string, input io.Reader, output io.Writer, sto
fmt.Fprintf(output, "%s: skipped (%s) — %s\n", item.TargetID, item.Inspection.State, profile.RedactText(item.Inspection.Evidence))
continue
}
if item.Err != nil {
fmt.Fprintf(output, "%s: failed (%s) — %s; fresh inspection: %s\n", item.TargetID, item.Inspection.State, profile.RedactText(item.Err.Error()), profile.RedactText(item.Inspection.Evidence))
if item.OperationErr != nil {
fmt.Fprintf(output, "%s: failed (%s) — %s; fresh inspection: %s\n", item.TargetID, item.Inspection.State, profile.RedactText(item.OperationErr.Error()), profile.RedactText(item.Inspection.Evidence))
if item.LogErr != nil {
fmt.Fprintf(output, "%s: operation logging also failed — %s\n", item.TargetID, profile.RedactText(item.LogErr.Error()))
}
continue
}
if item.LogErr != nil {
fmt.Fprintf(output, "%s: reset (%s) — %s; operation logging failed — %s\n", item.TargetID, item.Inspection.State, profile.RedactText(item.Inspection.Evidence), profile.RedactText(item.LogErr.Error()))
continue
}
fmt.Fprintf(output, "%s: reset (%s) — %s\n", item.TargetID, item.Inspection.State, profile.RedactText(item.Inspection.Evidence))
cmd/proxyctl/maintenance_test.go
+61 -7
View File
@@ -12,6 +12,7 @@ import (
"strings"
"testing"
"proxyctl/internal/app"
"proxyctl/internal/gnome"
"proxyctl/internal/operationlock"
"proxyctl/internal/oplog"
@@ -29,11 +30,16 @@ func (failingIdentityEnvironment) LookupUser(string) (profile.UserIdentity, erro
}
func (failingIdentityEnvironment) LookupEnv(string) (string, bool) { return "", false }
type failingOperationLogger struct{ err error }
func (l failingOperationLogger) Write(app.LogEntry) error { return l.err }
type processFakeTarget struct {
id string
state target.State
err error
calls int
id string
state target.State
err error
calls int
confirmation string
}
func (f *processFakeTarget) ID() string { return f.id }
@@ -41,7 +47,7 @@ func (f *processFakeTarget) Description() target.Description { return target.Des
func (f *processFakeTarget) Availability(context.Context) target.Availability {
return target.Availability{Available: true, Evidence: "fake executable found"}
}
func (f *processFakeTarget) Confirmation(bool) string { return "" }
func (f *processFakeTarget) Confirmation(bool) string { return f.confirmation }
func (f *processFakeTarget) Inspect(context.Context, *profile.Profile) target.Inspection {
return target.Inspection{State: f.state, Evidence: "fake evidence for http://alice:secret@proxy.test"}
}
@@ -217,14 +223,21 @@ func TestCommandsRunAsRealProcessesInsideIsolatedUserState(t *testing.T) {
if !strings.Contains(string(doctorOutput), "Profile validity") || (doctorErr != nil && !strings.Contains(string(doctorOutput), "[FAIL]")) {
t.Fatalf("doctor process err=%v output=%q", doctorErr, doctorOutput)
}
resetMarker := filepath.Join(root, "home", "reset-mutation-marker")
resetOutput, err := invoke("no\n", "reset")
if err != nil || !strings.Contains(string(resetOutput), "Reset cancelled") {
if err != nil || !strings.Contains(string(resetOutput), "Reset cancelled") || !strings.Contains(string(resetOutput), "Docker will restart immediately") {
t.Fatalf("reset cancellation process err=%v output=%q", err, resetOutput)
}
if _, statErr := os.Stat(resetMarker); !errors.Is(statErr, os.ErrNotExist) {
t.Fatalf("cancelled real process mutated reset fixture: %v", statErr)
}
resetOutput, err = invoke("yes\n", "reset")
if err != nil || !strings.Contains(string(resetOutput), "shell: skipped (Disabled)") {
if err != nil || !strings.Contains(string(resetOutput), "shell: skipped (Disabled)") || !strings.Contains(string(resetOutput), "docker-daemon-test: reset (Disabled)") {
t.Fatalf("confirmed reset process err=%v output=%q", err, resetOutput)
}
if data, readErr := os.ReadFile(resetMarker); readErr != nil || string(data) != "reset\n" {
t.Fatalf("confirmed real process marker err=%v data=%q", readErr, data)
}
installOutput, err := invoke("", "shell", "install")
if err != nil || !strings.Contains(string(installOutput), "installed") {
t.Fatalf("shell install process err=%v output=%q", err, installOutput)
@@ -359,6 +372,47 @@ func TestResetSuppressesSavedGNOMEPasswordFromOperationCLIAndLogsWithoutActivePr
}
}
func TestResetPromptIncludesEveryManagedTargetWarningAndCancellationDoesNotMutate(t *testing.T) {
root := t.TempDir()
config := filepath.Join(root, "profiles.json")
writeConfig(t, config, `{"profiles":[]}`)
store := profile.NewFileStore(config)
daemon := &processFakeTarget{id: "docker-daemon", state: target.Drifted, confirmation: "Docker will restart immediately and may disrupt running containers and other work."}
other := &processFakeTarget{id: "other", state: target.Enabled, confirmation: "Other managed warning."}
external := &processFakeTarget{id: "external", state: target.External, confirmation: "must not appear"}
var output bytes.Buffer
err := runMaintenanceCommand([]string{"reset"}, strings.NewReader("no\n"), &output, store, []target.Target{daemon, other, external}, operationlock.New(filepath.Join(root, "operation.lock")), nil, nil)
if err != nil {
t.Fatal(err)
}
text := output.String()
for _, want := range []string{"docker-daemon: Docker will restart immediately", "other: Other managed warning", "Reset cancelled"} {
if !strings.Contains(text, want) {
t.Errorf("reset output missing %q: %q", want, text)
}
}
if strings.Contains(text, "must not appear") || daemon.calls+other.calls+external.calls != 0 {
t.Fatalf("cancel output=%q calls=%d/%d/%d", text, daemon.calls, other.calls, external.calls)
}
}
func TestResetCommandReportsCompletedTargetTruthWhenOperationLoggingFails(t *testing.T) {
root := t.TempDir()
config := filepath.Join(root, "profiles.json")
writeConfig(t, config, `{"profiles":[]}`)
managed := &processFakeTarget{id: "managed", state: target.Enabled}
var output bytes.Buffer
err := runMaintenanceCommand([]string{"reset"}, strings.NewReader("yes\n"), &output, profile.NewFileStore(config), []target.Target{managed}, operationlock.New(filepath.Join(root, "operation.lock")), failingOperationLogger{err: errors.New("log device full")}, nil)
if err == nil || !strings.Contains(err.Error(), "log device full") {
t.Fatalf("logger failure err=%v output=%q", err, output.String())
}
if managed.calls != 1 || managed.state != target.Disabled || !strings.Contains(output.String(), "managed: reset (Disabled)") || !strings.Contains(output.String(), "operation logging failed") {
t.Fatalf("logger failure truth output=%q calls=%d state=%s", output.String(), managed.calls, managed.state)
}
}
func TestResetCommandCancellationAndTruthfulPartialFailureWithFakeTargets(t *testing.T) {
root := t.TempDir()
config := filepath.Join(root, "xdg-config", "proxyctl", "profiles.json")
cmd/proxyctl/process_testenv.go
+27 -1
View File
@@ -3,21 +3,47 @@
package main
import (
"context"
"errors"
"os"
"os/user"
"path/filepath"
"strconv"
"proxyctl/internal/profile"
"proxyctl/internal/target"
)
type processResetTarget struct{ marker string }
func (t processResetTarget) ID() string { return "docker-daemon-test" }
func (t processResetTarget) Description() target.Description {
return target.Description{Name: "Docker daemon"}
}
func (t processResetTarget) Availability(context.Context) target.Availability {
return target.Availability{Available: true, Evidence: "isolated process fixture"}
}
func (t processResetTarget) Inspect(context.Context, *profile.Profile) target.Inspection {
if _, err := os.Stat(t.marker); err == nil {
return target.Inspection{State: target.Disabled, Evidence: "isolated managed configuration removed"}
}
return target.Inspection{State: target.Drifted, Evidence: "isolated recovery metadata exists"}
}
func (t processResetTarget) Confirmation(bool) string {
return "Docker will restart immediately. This may disrupt running containers and other work."
}
func (t processResetTarget) SetDesired(context.Context, bool, *profile.Profile) target.OperationResult {
err := os.WriteFile(t.marker, []byte("reset\n"), 0o600)
return target.OperationResult{Inspection: t.Inspect(context.Background(), nil), Err: err}
}
// This file is compiled only into the process-smoke binary. It gives that real
// executable an identity whose home is inside the test sandbox and omits
// production system Targets, so no command can reach developer or host state.
func init() {
processProductionTargets = func(profile.IdentityEnvironment) ([]target.Target, error) {
return []target.Target{}, nil
home := os.Getenv("PROXYCTL_PROCESS_TEST_HOME")
return []target.Target{processResetTarget{marker: filepath.Join(home, "reset-mutation-marker")}}, nil
}
processCurrentUser = func() (profile.UserIdentity, error) {
home := os.Getenv("PROXYCTL_PROCESS_TEST_HOME")