hetzner-api-dyndns-records-webinterface/internal/appupdate/manager_test.go

package appupdate

import (
	"context"
	"encoding/base64"
	"log/slog"
	"net/http"
	"net/http/httptest"
	"os"
	"path/filepath"
	"strings"
	"sync/atomic"
	"testing"
	"time"

	"github.com/root-kdw12/hetzner-api-dyndns-records-webinterface/internal/buildinfo"
	"github.com/root-kdw12/hetzner-api-dyndns-records-webinterface/internal/secure"
	"github.com/root-kdw12/hetzner-api-dyndns-records-webinterface/internal/store"
	"github.com/root-kdw12/hetzner-api-dyndns-records-webinterface/internal/updateprotocol"
)

func TestManagerKeepsUpdateReminderWhenGiteaBecomesUnavailable(t *testing.T) {
	t.Parallel()
	const credential = " test-password-or-token-that-must-stay-secret "
	var unavailable atomic.Bool
	api := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		username, password, ok := r.BasicAuth()
		if !ok || username != "registry-user" || password != credential {
			http.Error(w, "unauthorized", http.StatusUnauthorized)
			return
		}
		if unavailable.Load() {
			http.Error(w, "temporarily unavailable", http.StatusServiceUnavailable)
			return
		}
		w.Header().Set("Content-Type", "application/json")
		_, _ = w.Write([]byte(`{"tag_name":"v1.4.3","html_url":"https://example.invalid/releases/v1.4.3","draft":false,"prerelease":false}`))
	}))
	defer api.Close()

	ctx := context.Background()
	database, err := store.Open(ctx, filepath.Join(t.TempDir(), "app.db"))
	if err != nil {
		t.Fatal(err)
	}
	t.Cleanup(func() { _ = database.Close() })
	keyFile := filepath.Join(t.TempDir(), "master-key")
	key := make([]byte, 32)
	for index := range key {
		key[index] = byte(index + 1)
	}
	if err := os.WriteFile(keyFile, []byte(base64.RawStdEncoding.EncodeToString(key)), 0o600); err != nil {
		t.Fatal(err)
	}
	cipher, err := secure.LoadCipher(keyFile)
	if err != nil {
		t.Fatal(err)
	}
	manager, err := New(database, cipher, api.URL, filepath.Join(t.TempDir(), "missing-agent.sock"), time.Hour, slog.New(slog.NewTextHandler(os.Stderr, nil)))
	if err != nil {
		t.Fatal(err)
	}
	if err := manager.SaveCredential(ctx, "registry-user", credential); err != nil {
		t.Fatal(err)
	}
	if err := manager.CheckNow(ctx); err != nil {
		t.Fatal(err)
	}
	state := manager.State()
	if !state.UpdateAvailable || state.LatestVersion != "v1.4.3" || state.LastError != "" || state.CredentialUsername != "registry-user" {
		t.Fatalf("new release was not detected: %#v", state)
	}
	settings, err := database.GetSoftwareUpdateSettings(ctx)
	if err != nil {
		t.Fatal(err)
	}
	if strings.Contains(string(settings.TokenCiphertext), credential) {
		t.Fatal("registry credential was stored as plaintext")
	}

	unavailable.Store(true)
	if err := manager.CheckNow(ctx); err == nil {
		t.Fatal("unavailable Gitea endpoint was reported as successful")
	}
	state = manager.State()
	if !state.UpdateAvailable || state.LatestVersion != "v1.4.3" || state.LastError == "" {
		t.Fatalf("temporary outage removed the last known update reminder: %#v", state)
	}
}

func TestManagerFallsBackToTokenAuthentication(t *testing.T) {
	t.Parallel()
	const credential = "fallback-api-token"
	var requests atomic.Int32
	api := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		requests.Add(1)
		if r.Header.Get("Authorization") != "token "+credential {
			http.Error(w, "unauthorized", http.StatusUnauthorized)
			return
		}
		w.Header().Set("Content-Type", "application/json")
		_, _ = w.Write([]byte(`{"tag_name":"v2.0.0","html_url":"https://example.invalid/releases/v2.0.0","draft":false,"prerelease":false}`))
	}))
	defer api.Close()

	manager := &Manager{apiURL: api.URL, httpClient: api.Client()}
	release, err := manager.fetchLatest(context.Background(), "registry-user", credential)
	if err != nil {
		t.Fatal(err)
	}
	if release.TagName != "v2.0.0" || requests.Load() != 2 {
		t.Fatalf("token fallback was not used: release=%#v requests=%d", release, requests.Load())
	}
}

func TestAgentCompatibilityStartsAtStableV14Protocol(t *testing.T) {
	t.Parallel()
	tests := []struct {
		name   string
		status updateprotocol.Status
		want   bool
	}{
		{name: "v1.4 baseline", status: updateprotocol.Status{AgentVersion: "v1.4.0", Protocol: 2}, want: true},
		{name: "newer compatible agent version", status: updateprotocol.Status{AgentVersion: "v2.0.0", Protocol: buildinfo.UpdateProtocolVersion}, want: true},
		{name: "legacy protocol", status: updateprotocol.Status{Protocol: 0}},
		{name: "old agent version", status: updateprotocol.Status{AgentVersion: "v1.3.0", Protocol: 2}},
		{name: "future unknown protocol", status: updateprotocol.Status{AgentVersion: "v2.0.0", Protocol: buildinfo.UpdateProtocolVersion + 1}},
		{name: "missing version", status: updateprotocol.Status{Protocol: 2}},
	}
	for _, test := range tests {
		test := test
		t.Run(test.name, func(t *testing.T) {
			t.Parallel()
			if got := agentCompatible(test.status); got != test.want {
				t.Fatalf("agentCompatible(%#v) = %v; want %v", test.status, got, test.want)
			}
		})
	}
}

func TestManagerClearsCompletedDesiredVersionOnStartup(t *testing.T) {
	t.Parallel()
	ctx := context.Background()
	database, err := store.Open(ctx, filepath.Join(t.TempDir(), "app.db"))
	if err != nil {
		t.Fatal(err)
	}
	t.Cleanup(func() { _ = database.Close() })
	if err := database.SetDesiredSoftwareVersion(ctx, buildinfo.Version); err != nil {
		t.Fatal(err)
	}
	keyFile := filepath.Join(t.TempDir(), "master-key")
	key := make([]byte, 32)
	for index := range key {
		key[index] = byte(index + 1)
	}
	if err := os.WriteFile(keyFile, []byte(base64.RawStdEncoding.EncodeToString(key)), 0o600); err != nil {
		t.Fatal(err)
	}
	cipher, err := secure.LoadCipher(keyFile)
	if err != nil {
		t.Fatal(err)
	}
	manager, err := New(database, cipher, "https://git.example/api/releases/latest", filepath.Join(t.TempDir(), "agent.sock"), time.Hour, slog.New(slog.NewTextHandler(os.Stderr, nil)))
	if err != nil {
		t.Fatal(err)
	}
	if manager.State().DesiredVersion != "" {
		t.Fatalf("installed version remained pending: %#v", manager.State())
	}
	settings, err := database.GetSoftwareUpdateSettings(ctx)
	if err != nil {
		t.Fatal(err)
	}
	if settings.DesiredVersion != "" {
		t.Fatalf("completed desired version remained persisted: %#v", settings)
	}
}