feat: add resilient updates and access controls

internal/appupdate/manager_test.go

@@ -0,0 +1,86 @@
+package appupdate
+
+import (
+	"context"
+	"encoding/base64"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/root-kdw12/hetzner-api-dyndns-records-webinterface/internal/secure"
+	"github.com/root-kdw12/hetzner-api-dyndns-records-webinterface/internal/store"
+)
+
+func TestManagerKeepsUpdateReminderWhenGiteaBecomesUnavailable(t *testing.T) {
+	t.Parallel()
+	const token = "test-token-that-must-stay-secret"
+	var unavailable atomic.Bool
+	api := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Header.Get("Authorization") != "token "+token {
+			http.Error(w, "unauthorized", http.StatusUnauthorized)
+			return
+		}
+		if unavailable.Load() {
+			http.Error(w, "temporarily unavailable", http.StatusServiceUnavailable)
+			return
+		}
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{"tag_name":"v1.3.1","html_url":"https://example.invalid/releases/v1.3.1","draft":false,"prerelease":false}`))
+	}))
+	defer api.Close()
+
+	ctx := context.Background()
+	database, err := store.Open(ctx, filepath.Join(t.TempDir(), "app.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	keyFile := filepath.Join(t.TempDir(), "master-key")
+	key := make([]byte, 32)
+	for index := range key {
+		key[index] = byte(index + 1)
+	}
+	if err := os.WriteFile(keyFile, []byte(base64.RawStdEncoding.EncodeToString(key)), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	cipher, err := secure.LoadCipher(keyFile)
+	if err != nil {
+		t.Fatal(err)
+	}
+	manager, err := New(database, cipher, api.URL, filepath.Join(t.TempDir(), "missing-agent.sock"), time.Hour, slog.New(slog.NewTextHandler(os.Stderr, nil)))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := manager.SaveCredential(ctx, "registry-user", token); err != nil {
+		t.Fatal(err)
+	}
+	if err := manager.CheckNow(ctx); err != nil {
+		t.Fatal(err)
+	}
+	state := manager.State()
+	if !state.UpdateAvailable || state.LatestVersion != "v1.3.1" || state.LastError != "" {
+		t.Fatalf("new release was not detected: %#v", state)
+	}
+	settings, err := database.GetSoftwareUpdateSettings(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if strings.Contains(string(settings.TokenCiphertext), token) {
+		t.Fatal("registry token was stored as plaintext")
+	}
+
+	unavailable.Store(true)
+	if err := manager.CheckNow(ctx); err == nil {
+		t.Fatal("unavailable Gitea endpoint was reported as successful")
+	}
+	state = manager.State()
+	if !state.UpdateAvailable || state.LatestVersion != "v1.3.1" || state.LastError == "" {
+		t.Fatalf("temporary outage removed the last known update reminder: %#v", state)
+	}
+}