hetzner-api-dyndns-records-webinterface/internal/appupdate/manager_test.go

package appupdate

import (
	"context"
	"encoding/base64"
	"errors"
	"fmt"
	"log/slog"
	"net/http"
	"net/http/httptest"
	"os"
	"path/filepath"
	"strconv"
	"strings"
	"sync"
	"sync/atomic"
	"testing"
	"time"

	"github.com/root-kdw12/hetzner-api-dyndns-records-webinterface/internal/buildinfo"
	"github.com/root-kdw12/hetzner-api-dyndns-records-webinterface/internal/secure"
	"github.com/root-kdw12/hetzner-api-dyndns-records-webinterface/internal/store"
	"github.com/root-kdw12/hetzner-api-dyndns-records-webinterface/internal/updateprotocol"
)

type fakeUpdateAgent struct {
	mu          sync.Mutex
	status      updateprotocol.Status
	statusErr   error
	startErr    error
	statusCalls int
	startCalls  int
	requests    []updateprotocol.Request
}

func (a *fakeUpdateAgent) Status(context.Context) (updateprotocol.Status, error) {
	a.mu.Lock()
	defer a.mu.Unlock()
	a.statusCalls++
	return a.status, a.statusErr
}

func (a *fakeUpdateAgent) Start(_ context.Context, request updateprotocol.Request) error {
	a.mu.Lock()
	defer a.mu.Unlock()
	a.startCalls++
	a.requests = append(a.requests, request)
	if a.startErr == nil {
		a.status.Phase = updateprotocol.PhaseQueued
		a.status.TargetVersion = request.Version
	}
	return a.startErr
}

func (a *fakeUpdateAgent) setStatus(status updateprotocol.Status, err error) {
	a.mu.Lock()
	a.status = status
	a.statusErr = err
	a.mu.Unlock()
}

func (a *fakeUpdateAgent) counts() (status, start int) {
	a.mu.Lock()
	defer a.mu.Unlock()
	return a.statusCalls, a.startCalls
}

func TestManagerKeepsUpdateReminderWhenGiteaBecomesUnavailable(t *testing.T) {
	t.Parallel()
	nextVersion := nextReleaseVersion(t)
	const credential = " test-password-or-token-that-must-stay-secret "
	var unavailable atomic.Bool
	api := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		username, password, ok := r.BasicAuth()
		if !ok || username != "registry-user" || password != credential {
			http.Error(w, "unauthorized", http.StatusUnauthorized)
			return
		}
		if unavailable.Load() {
			http.Error(w, "temporarily unavailable", http.StatusServiceUnavailable)
			return
		}
		w.Header().Set("Content-Type", "application/json")
		_, _ = fmt.Fprintf(w, `{"tag_name":%q,"html_url":%q,"draft":false,"prerelease":false}`, nextVersion, "https://example.invalid/releases/"+nextVersion)
	}))
	defer api.Close()

	ctx := context.Background()
	database, err := store.Open(ctx, filepath.Join(t.TempDir(), "app.db"))
	if err != nil {
		t.Fatal(err)
	}
	t.Cleanup(func() { _ = database.Close() })
	keyFile := filepath.Join(t.TempDir(), "master-key")
	key := make([]byte, 32)
	for index := range key {
		key[index] = byte(index + 1)
	}
	if err := os.WriteFile(keyFile, []byte(base64.RawStdEncoding.EncodeToString(key)), 0o600); err != nil {
		t.Fatal(err)
	}
	cipher, err := secure.LoadCipher(keyFile)
	if err != nil {
		t.Fatal(err)
	}
	manager, err := New(database, cipher, api.URL, filepath.Join(t.TempDir(), "missing-agent.sock"), time.Hour, slog.New(slog.NewTextHandler(os.Stderr, nil)))
	if err != nil {
		t.Fatal(err)
	}
	if err := manager.SaveCredential(ctx, "registry-user", credential); err != nil {
		t.Fatal(err)
	}
	if err := manager.CheckNow(ctx); err != nil {
		t.Fatal(err)
	}
	state := manager.State()
	if !state.UpdateAvailable || state.LatestVersion != nextVersion || state.LastError != "" || state.CredentialUsername != "registry-user" {
		t.Fatalf("new release was not detected: %#v", state)
	}
	settings, err := database.GetSoftwareUpdateSettings(ctx)
	if err != nil {
		t.Fatal(err)
	}
	if strings.Contains(string(settings.TokenCiphertext), credential) {
		t.Fatal("registry credential was stored as plaintext")
	}

	unavailable.Store(true)
	if err := manager.CheckNow(ctx); err == nil {
		t.Fatal("unavailable Gitea endpoint was reported as successful")
	}
	state = manager.State()
	if !state.UpdateAvailable || state.LatestVersion != nextVersion || state.LastError == "" {
		t.Fatalf("temporary outage removed the last known update reminder: %#v", state)
	}
}

func TestManagerFallsBackToTokenAuthentication(t *testing.T) {
	t.Parallel()
	const credential = "fallback-api-token"
	var requests atomic.Int32
	api := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		requests.Add(1)
		if r.Header.Get("Authorization") != "token "+credential {
			http.Error(w, "unauthorized", http.StatusUnauthorized)
			return
		}
		w.Header().Set("Content-Type", "application/json")
		_, _ = w.Write([]byte(`{"tag_name":"v2.0.0","html_url":"https://example.invalid/releases/v2.0.0","draft":false,"prerelease":false}`))
	}))
	defer api.Close()

	manager := &Manager{apiURL: api.URL, httpClient: api.Client()}
	release, err := manager.fetchLatest(context.Background(), "registry-user", credential)
	if err != nil {
		t.Fatal(err)
	}
	if release.TagName != "v2.0.0" || requests.Load() != 2 {
		t.Fatalf("token fallback was not used: release=%#v requests=%d", release, requests.Load())
	}
}

func TestAgentCompatibilityStartsAtStableV14Protocol(t *testing.T) {
	t.Parallel()
	tests := []struct {
		name   string
		status updateprotocol.Status
		want   bool
	}{
		{name: "v1.4 baseline", status: updateprotocol.Status{AgentVersion: "v1.4.0", Protocol: 2}, want: true},
		{name: "newer compatible agent version", status: updateprotocol.Status{AgentVersion: "v2.0.0", Protocol: buildinfo.UpdateProtocolVersion}, want: true},
		{name: "legacy protocol", status: updateprotocol.Status{Protocol: 0}},
		{name: "old agent version", status: updateprotocol.Status{AgentVersion: "v1.3.0", Protocol: 2}},
		{name: "future unknown protocol", status: updateprotocol.Status{AgentVersion: "v2.0.0", Protocol: buildinfo.UpdateProtocolVersion + 1}},
		{name: "missing version", status: updateprotocol.Status{Protocol: 2}},
	}
	for _, test := range tests {
		test := test
		t.Run(test.name, func(t *testing.T) {
			t.Parallel()
			if got := agentCompatible(test.status); got != test.want {
				t.Fatalf("agentCompatible(%#v) = %v; want %v", test.status, got, test.want)
			}
		})
	}
}

func TestRequestUpdateRefreshesStaleAgentStateBeforeStarting(t *testing.T) {
	t.Parallel()
	nextVersion := nextReleaseVersion(t)
	agent := &fakeUpdateAgent{status: compatibleAgentStatus(updateprotocol.PhaseIdle)}
	manager, database := updateReadyManager(t, agent)
	if manager.State().AgentAvailable {
		t.Fatal("test precondition failed: cached agent state is already available")
	}
	if err := manager.RequestUpdate(context.Background(), nextVersion); err != nil {
		t.Fatalf("live agent was rejected because of stale cached state: %v", err)
	}
	statusCalls, startCalls := agent.counts()
	if statusCalls != 1 || startCalls != 1 {
		t.Fatalf("agent was not checked immediately before start: status=%d start=%d", statusCalls, startCalls)
	}
	settings, err := database.GetSoftwareUpdateSettings(context.Background())
	if err != nil {
		t.Fatal(err)
	}
	if settings.DesiredVersion != nextVersion {
		t.Fatalf("target version was not persisted: %#v", settings)
	}
}

func TestRequestUpdateRejectsUnavailableIncompatibleAndBusyAgents(t *testing.T) {
	t.Parallel()
	nextVersion := nextReleaseVersion(t)
	tests := []struct {
		name      string
		status    updateprotocol.Status
		statusErr error
	}{
		{name: "unavailable", statusErr: errors.New("offline")},
		{name: "incompatible", status: updateprotocol.Status{Phase: updateprotocol.PhaseIdle, AgentVersion: "v1.3.0", Protocol: 1}},
		{name: "busy", status: compatibleAgentStatus(updateprotocol.PhasePulling)},
	}
	for _, test := range tests {
		test := test
		t.Run(test.name, func(t *testing.T) {
			t.Parallel()
			agent := &fakeUpdateAgent{status: test.status, statusErr: test.statusErr}
			manager, database := updateReadyManager(t, agent)
			if err := manager.RequestUpdate(context.Background(), nextVersion); err == nil {
				t.Fatal("unsafe update request was accepted")
			}
			_, startCalls := agent.counts()
			if startCalls != 0 {
				t.Fatalf("agent start was called %d times", startCalls)
			}
			settings, err := database.GetSoftwareUpdateSettings(context.Background())
			if err != nil {
				t.Fatal(err)
			}
			if settings.DesiredVersion != "" {
				t.Fatalf("rejected update changed desired version: %#v", settings)
			}
		})
	}
}

func TestRequestUpdateSerializesParallelClicks(t *testing.T) {
	t.Parallel()
	nextVersion := nextReleaseVersion(t)
	agent := &fakeUpdateAgent{status: compatibleAgentStatus(updateprotocol.PhaseIdle)}
	manager, _ := updateReadyManager(t, agent)
	results := make(chan error, 2)
	start := make(chan struct{})
	for index := 0; index < 2; index++ {
		go func() {
			<-start
			results <- manager.RequestUpdate(context.Background(), nextVersion)
		}()
	}
	close(start)
	var successes int
	for index := 0; index < 2; index++ {
		if err := <-results; err == nil {
			successes++
		}
	}
	_, startCalls := agent.counts()
	if successes != 1 || startCalls != 1 {
		t.Fatalf("parallel clicks started an unexpected number of updates: successes=%d starts=%d", successes, startCalls)
	}
}

func TestAgentMonitorRecoversAfterDelayedAgentStartup(t *testing.T) {
	t.Parallel()
	agent := &fakeUpdateAgent{statusErr: errors.New("not listening yet")}
	manager := &Manager{agent: agent}
	ctx, cancel := context.WithCancel(context.Background())
	done := make(chan struct{})
	go func() {
		manager.monitorAgent(ctx, 2*time.Millisecond, 20*time.Millisecond)
		close(done)
	}()
	waitForCondition(t, time.Second, func() bool {
		statusCalls, _ := agent.counts()
		return statusCalls > 0
	})
	agent.setStatus(compatibleAgentStatus(updateprotocol.PhaseIdle), nil)
	waitForCondition(t, time.Second, func() bool {
		state := manager.State()
		return state.AgentAvailable && state.AgentCompatible
	})
	cancel()
	select {
	case <-done:
	case <-time.After(time.Second):
		t.Fatal("agent monitor did not stop after context cancellation")
	}
}

func TestManagerClearsCompletedDesiredVersionOnStartup(t *testing.T) {
	t.Parallel()
	ctx := context.Background()
	database, err := store.Open(ctx, filepath.Join(t.TempDir(), "app.db"))
	if err != nil {
		t.Fatal(err)
	}
	t.Cleanup(func() { _ = database.Close() })
	if err := database.SetDesiredSoftwareVersion(ctx, buildinfo.Version); err != nil {
		t.Fatal(err)
	}
	keyFile := filepath.Join(t.TempDir(), "master-key")
	key := make([]byte, 32)
	for index := range key {
		key[index] = byte(index + 1)
	}
	if err := os.WriteFile(keyFile, []byte(base64.RawStdEncoding.EncodeToString(key)), 0o600); err != nil {
		t.Fatal(err)
	}
	cipher, err := secure.LoadCipher(keyFile)
	if err != nil {
		t.Fatal(err)
	}
	manager, err := New(database, cipher, "https://git.example/api/releases/latest", filepath.Join(t.TempDir(), "agent.sock"), time.Hour, slog.New(slog.NewTextHandler(os.Stderr, nil)))
	if err != nil {
		t.Fatal(err)
	}
	if manager.State().DesiredVersion != "" {
		t.Fatalf("installed version remained pending: %#v", manager.State())
	}
	settings, err := database.GetSoftwareUpdateSettings(ctx)
	if err != nil {
		t.Fatal(err)
	}
	if settings.DesiredVersion != "" {
		t.Fatalf("completed desired version remained persisted: %#v", settings)
	}
}

func compatibleAgentStatus(phase string) updateprotocol.Status {
	return updateprotocol.Status{Phase: phase, AgentVersion: buildinfo.MinimumAgentVersion, Protocol: buildinfo.MinimumAgentProtocol}
}

func updateReadyManager(t *testing.T, agent updateAgent) (*Manager, *store.Store) {
	t.Helper()
	nextVersion := nextReleaseVersion(t)
	ctx := context.Background()
	database, err := store.Open(ctx, filepath.Join(t.TempDir(), "app.db"))
	if err != nil {
		t.Fatal(err)
	}
	t.Cleanup(func() { _ = database.Close() })
	keyFile := filepath.Join(t.TempDir(), "master-key")
	key := make([]byte, 32)
	for index := range key {
		key[index] = byte(index + 1)
	}
	if err := os.WriteFile(keyFile, []byte(base64.RawStdEncoding.EncodeToString(key)), 0o600); err != nil {
		t.Fatal(err)
	}
	cipher, err := secure.LoadCipher(keyFile)
	if err != nil {
		t.Fatal(err)
	}
	manager, err := New(database, cipher, "https://git.example/api/releases/latest", filepath.Join(t.TempDir(), "agent.sock"), time.Hour, slog.New(slog.NewTextHandler(os.Stderr, nil)))
	if err != nil {
		t.Fatal(err)
	}
	manager.agent = agent
	if err := manager.SaveCredential(ctx, "registry-user", "registry-password"); err != nil {
		t.Fatal(err)
	}
	if err := database.RecordSoftwareUpdateSuccess(ctx, nextVersion, "https://git.example/releases/"+nextVersion, time.Now()); err != nil {
		t.Fatal(err)
	}
	settings, err := database.GetSoftwareUpdateSettings(ctx)
	if err != nil {
		t.Fatal(err)
	}
	manager.setStoredState(settings)
	return manager, database
}

func waitForCondition(t *testing.T, timeout time.Duration, condition func() bool) {
	t.Helper()
	deadline := time.Now().Add(timeout)
	for time.Now().Before(deadline) {
		if condition() {
			return
		}
		time.Sleep(time.Millisecond)
	}
	t.Fatal("condition did not become true in time")
}

func TestRepositoryCanSwitchPublicPrivateAndBack(t *testing.T) {
	t.Parallel()
	nextVersion := nextReleaseVersion(t)
	var private atomic.Bool
	var authenticated atomic.Int32
	api := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		if !private.Load() {
			if r.Header.Get("Authorization") != "" {
				t.Error("credentials sent to public repository")
			}
		} else {
			user, password, ok := r.BasicAuth()
			if !ok || user != "registry-user" || password != "registry-password" {
				http.NotFound(w, r)
				return
			}
			authenticated.Add(1)
		}
		_, _ = fmt.Fprintf(w, `{"tag_name":%q,"draft":false,"prerelease":false}`, nextVersion)
	}))
	defer api.Close()
	manager, database := updateReadyManager(t, &fakeUpdateAgent{status: compatibleAgentStatus(updateprotocol.PhaseIdle)})
	manager.apiURL = api.URL
	manager.httpClient = api.Client()
	ctx := context.Background()
	if err := database.SaveSoftwareUpdateCredential(ctx, "", []byte{}, []byte{}); err != nil {
		t.Fatal(err)
	}
	if err := manager.CheckNow(ctx); err != nil {
		t.Fatalf("public release requires login: %v", err)
	}
	private.Store(true)
	if err := manager.CheckNow(ctx); !errors.Is(err, ErrCredentialMissing) {
		t.Fatalf("missing private access not explained: %v", err)
	}
	if !manager.State().UpdateAvailable {
		t.Fatal("visibility change removed last known release")
	}
	if err := manager.SaveCredential(ctx, "registry-user", "registry-password"); err != nil {
		t.Fatal(err)
	}
	if err := manager.CheckNow(ctx); err != nil {
		t.Fatalf("private 404 did not retry credentials: %v", err)
	}
	private.Store(false)
	if err := database.SaveSoftwareUpdateCredential(ctx, "registry-user", []byte("corrupt"), []byte("corrupt")); err != nil {
		t.Fatal(err)
	}
	if err := manager.CheckNow(ctx); err != nil {
		t.Fatalf("public check depends on old secret: %v", err)
	}
	if authenticated.Load() != 1 {
		t.Fatalf("unexpected authenticated requests: %d", authenticated.Load())
	}
}

func TestAnonymousUpdateRequiresCapableAgent(t *testing.T) {
	t.Parallel()
	nextVersion := nextReleaseVersion(t)
	for _, capable := range []bool{false, true} {
		t.Run(strconv.FormatBool(capable), func(t *testing.T) {
			status := compatibleAgentStatus(updateprotocol.PhaseIdle)
			status.AnonymousPull = capable
			agent := &fakeUpdateAgent{status: status}
			manager, database := updateReadyManager(t, agent)
			if err := database.SaveSoftwareUpdateCredential(context.Background(), "", []byte{}, []byte{}); err != nil {
				t.Fatal(err)
			}
			settings, err := database.GetSoftwareUpdateSettings(context.Background())
			if err != nil {
				t.Fatal(err)
			}
			manager.setStoredState(settings)
			err = manager.RequestUpdate(context.Background(), nextVersion)
			if !capable {
				if err == nil || !strings.Contains(err.Error(), "Compose") || !manager.State().ComposeSyncRequired {
					t.Fatalf("legacy agent not handled: %v", err)
				}
				if len(agent.requests) != 0 {
					t.Fatal("legacy agent received incompatible anonymous request")
				}
			} else {
				if err != nil {
					t.Fatal(err)
				}
				if len(agent.requests) != 1 || agent.requests[0].RegistryUsername != "" || agent.requests[0].RegistryToken != "" {
					t.Fatal("anonymous request not forwarded")
				}
			}
		})
	}
}

// Keep update scenarios newer than the source fallback after every release bump.
func nextReleaseVersion(t *testing.T) string {
	t.Helper()
	parts := strings.Split(strings.TrimPrefix(buildinfo.Version, "v"), ".")
	if len(parts) != 3 {
		t.Fatalf("unexpected build version %q", buildinfo.Version)
	}
	patch, err := strconv.Atoi(parts[2])
	if err != nil {
		t.Fatal(err)
	}
	return fmt.Sprintf("v%s.%s.%d", parts[0], parts[1], patch+1)
}