Deploy main eacf1e7 to prod

Replaces #559, which conflicted. Model: opus-5-5
2026-10-25 01:55:36 +00:00
parent 1647b43aa6
commit 537374e4cc
311 changed files with 35614 additions and 14120 deletions
@@ -3,16 +3,21 @@ package handlers_test
 import (
 	"context"
 	"errors"
+	"fmt"
 	"html/template"
+	"log/slog"
 	"net/http"
 	"net/http/httptest"
+	"strconv"
 	"sync"
 	"testing"
+	"time"

 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"go.uber.org/fx"
 	"go.uber.org/fx/fxtest"
+	"sneak.berlin/go/webhooker/internal/archive"
 	"sneak.berlin/go/webhooker/internal/config"
 	"sneak.berlin/go/webhooker/internal/database"
 	"sneak.berlin/go/webhooker/internal/delivery"
@@ -20,54 +25,114 @@ import (
 	"sneak.berlin/go/webhooker/internal/handlers"
 	"sneak.berlin/go/webhooker/internal/healthcheck"
 	"sneak.berlin/go/webhooker/internal/logger"
+	"sneak.berlin/go/webhooker/internal/metrics"
 	"sneak.berlin/go/webhooker/internal/middleware"
 	"sneak.berlin/go/webhooker/internal/session"
 )

-// recordingNotifier is a delivery.Notifier that records the tasks it
-// was handed, so a test can prove a handler queued the delivery it
-// claims to have queued — and, on the refusal paths, that it queued
-// nothing.
-type recordingNotifier struct {
-	mu    sync.Mutex
-	tasks []delivery.Task
+// recordingArchives is an archive.Archives that records what it
+// was asked to do, so a test can prove that a deletion or rename
+// path reached the archive writers. After FailRenames, every
+// rename of that target fails with the given error. After
+// BlockNextRename, the next rename is recorded and then waits.
+// RenameLock returns a plain mutex, as in archive.Writers.
+type recordingArchives struct {
+	renameMu       sync.Mutex
+	mu             sync.Mutex
+	evicted        []string
+	evictedTargets []string
+	renames        []archiveRename
+	renameErrs     map[string]error
+	entered        chan struct{}
+	release        chan struct{}
 }

-func (n *recordingNotifier) Notify(tasks []delivery.Task) {
-	n.mu.Lock()
-	defer n.mu.Unlock()
+// errInjectedRename is the failure a test hands FailRenames.
+var errInjectedRename = errors.New("injected rename failure")

-	n.tasks = append(n.tasks, tasks...)
+// errNameTaken is what the archive writers return when a file
+// already has an archive's new name, here archive-taken.db.
+var errNameTaken = fmt.Errorf(
+	"%w: archive-taken.db", archive.ErrNameTaken,
+)
+
+// archiveRename is one recorded Rename call.
+type archiveRename struct {
+	TargetID    string
+	WebhookName string
+	TargetName  string
 }

-// Tasks returns a copy of the recorded tasks.
-func (n *recordingNotifier) Tasks() []delivery.Task {
-	n.mu.Lock()
-	defer n.mu.Unlock()
-
-	out := make([]delivery.Task, len(n.tasks))
-	copy(out, n.tasks)
-
-	return out
+func (r *recordingArchives) RenameLock() *sync.Mutex {
+	return &r.renameMu
 }

-// recordingEvictor is a delivery.WebhookEvictor that records
-// the webhook ids it was asked to evict, so a test can prove
-// that a deletion path reached the delivery engine.
-type recordingEvictor struct {
-	mu      sync.Mutex
-	evicted []string
-}
-
-func (r *recordingEvictor) EvictWebhook(webhookID string) {
+func (r *recordingArchives) EvictWebhook(webhookID string) {
 	r.mu.Lock()
 	defer r.mu.Unlock()

 	r.evicted = append(r.evicted, webhookID)
 }

+func (r *recordingArchives) EvictTarget(targetID string) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	r.evictedTargets = append(r.evictedTargets, targetID)
+}
+
+func (r *recordingArchives) Rename(
+	targetID, webhookName, targetName string,
+) error {
+	r.mu.Lock()
+
+	r.renames = append(r.renames, archiveRename{
+		TargetID:    targetID,
+		WebhookName: webhookName,
+		TargetName:  targetName,
+	})
+	err := r.renameErrs[targetID]
+	entered, release := r.entered, r.release
+	r.entered, r.release = nil, nil
+
+	r.mu.Unlock()
+
+	if entered != nil {
+		close(entered)
+		<-release
+	}
+
+	return err
+}
+
+// BlockNextRename makes the next rename, once recorded, wait until
+// the returned release is called. The returned channel is closed
+// when that rename starts waiting.
+func (r *recordingArchives) BlockNextRename() (<-chan struct{}, func()) {
+	entered := make(chan struct{})
+	release := make(chan struct{})
+
+	r.mu.Lock()
+	r.entered, r.release = entered, release
+	r.mu.Unlock()
+
+	return entered, func() { close(release) }
+}
+
+// FailRenames makes every later rename of targetID fail with err.
+func (r *recordingArchives) FailRenames(targetID string, err error) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	if r.renameErrs == nil {
+		r.renameErrs = map[string]error{}
+	}
+
+	r.renameErrs[targetID] = err
+}
+
 // Evicted returns a copy of the recorded webhook ids.
-func (r *recordingEvictor) Evicted() []string {
+func (r *recordingArchives) Evicted() []string {
 	r.mu.Lock()
 	defer r.mu.Unlock()

@@ -77,38 +142,122 @@ func (r *recordingEvictor) Evicted() []string {
 	return out
 }

+// EvictedTargets returns a copy of the recorded target ids.
+func (r *recordingArchives) EvictedTargets() []string {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	out := make([]string, len(r.evictedTargets))
+	copy(out, r.evictedTargets)
+
+	return out
+}
+
+// Renames returns a copy of the recorded renames.
+func (r *recordingArchives) Renames() []archiveRename {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	out := make([]archiveRename, len(r.renames))
+	copy(out, r.renames)
+
+	return out
+}
+
+// testCircuitBreakers is a delivery.CircuitBreakers that reports, for
+// each target, the circuit state and cooldown a test gave it with Set,
+// and a closed breaker for any other target.
+type testCircuitBreakers struct {
+	mu        sync.Mutex
+	states    map[string]delivery.CircuitState
+	cooldowns map[string]time.Duration
+}
+
+// Set makes the target's breaker read as state, with cooldown left.
+func (b *testCircuitBreakers) Set(
+	targetID string, state delivery.CircuitState, cooldown time.Duration,
+) {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+
+	if b.states == nil {
+		b.states = map[string]delivery.CircuitState{}
+		b.cooldowns = map[string]time.Duration{}
+	}
+
+	b.states[targetID] = state
+	b.cooldowns[targetID] = cooldown
+}
+
+func (b *testCircuitBreakers) StateAndCooldown(
+	targetID string,
+) (delivery.CircuitState, time.Duration) {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+
+	return b.states[targetID], b.cooldowns[targetID]
+}
+
+// newTestApp returns an app whose RequireStart fails the test when
+// starting takes longer than fx's default start timeout of 15s. That
+// limit catches a start that hangs, not a busy host: measured with make
+// test on 2026-10-02 at host load 58-69 on 48 cores, the slowest of this
+// package's starts took 0.49s.
 func newTestApp(
 	t *testing.T,
 	targets ...any,
 ) *fxtest.App {
 	t.Helper()

+	return newTestAppWithConfig(
+		t, &config.Config{DataDir: t.TempDir()}, targets...,
+	)
+}
+
+// newTestAppWithConfig is newTestApp over a caller-supplied Config.
+func newTestAppWithConfig(
+	t *testing.T,
+	cfg *config.Config,
+	targets ...any,
+) *fxtest.App {
+	t.Helper()
+
 	return fxtest.New(
 		t,
+		// fx's own log is discarded, not sent to t.Logf: a hook still
+		// running after a start or stop timeout would write there after
+		// the test has returned.
+		fx.NopLogger,
 		fx.Provide(
 			globals.New,
 			logger.New,
-			func() *config.Config {
-				return &config.Config{
-					DataDir: t.TempDir(),
-				}
-			},
+			func(l *logger.Logger) *slog.Logger { return l.Get() },
+			func() *config.Config { return cfg },
 			database.New,
 			database.NewWebhookDBManager,
 			healthcheck.New,
 			session.New,
-			func() *recordingNotifier {
-				return &recordingNotifier{}
+			archive.NewWriters,
+			// The engine is built on a lifecycle that is never started,
+			// so no worker runs: every delivery the engine creates for a
+			// handler stays pending, where the test can read it.
+			func(p delivery.EngineParams) *delivery.Engine {
+				return delivery.New(fxtest.NewLifecycle(t), p)
 			},
-			func(n *recordingNotifier) delivery.Notifier {
-				return n
+			func() *recordingArchives {
+				return &recordingArchives{}
 			},
-			func() *recordingEvictor {
-				return &recordingEvictor{}
-			},
-			func(r *recordingEvictor) delivery.WebhookEvictor {
+			func(r *recordingArchives) archive.Archives {
 				return r
 			},
+			func() *testCircuitBreakers {
+				return &testCircuitBreakers{}
+			},
+			func(b *testCircuitBreakers) delivery.CircuitBreakers {
+				return b
+			},
+			metrics.NewRegistry,
+			metrics.New,
 			middleware.New,
 			delivery.NewGuard,
 			handlers.New,
@@ -176,11 +325,11 @@ func TestHandleIndex_Authenticated(t *testing.T) {

 	assert.Equal(t, http.StatusSeeOther, w2.Code)
 	assert.Equal(
-		t, "/sources", w2.Header().Get("Location"),
+		t, "/hooks", w2.Header().Get("Location"),
 	)
 }

-func TestBuildSlackTargetConfig_AcceptsPublicURL(t *testing.T) {
+func TestSetSlackTargetSettings_AcceptsPublicURL(t *testing.T) {
 	t.Parallel()

 	var h *handlers.Handlers
@@ -190,20 +339,17 @@ func TestBuildSlackTargetConfig_AcceptsPublicURL(t *testing.T) {

 	t.Cleanup(app.RequireStop)

-	req := httptest.NewRequestWithContext(
-		context.Background(), http.MethodPost, "/", nil)
-	w := httptest.NewRecorder()
+	const hookURL = "http://93.184.216.34/services/T00/B00/xxx"

-	cfg, err := h.BuildSlackTargetConfigForTest(
-		w, req, "http://93.184.216.34/services/T00/B00/xxx",
-	)
+	var target database.Target

-	require.NoError(t, err)
-	assert.Equal(t, http.StatusOK, w.Code)
-	assert.Contains(t, cfg, "webhookUrl")
+	errMsg := h.SetSlackTargetSettingsForTest(t.Context(), &target, hookURL)
+
+	assert.Empty(t, errMsg)
+	assert.Equal(t, hookURL, target.URL)
 }

-func TestBuildSlackTargetConfig_RejectsReservedURL(t *testing.T) {
+func TestSetSlackTargetSettings_RejectsReservedURL(t *testing.T) {
 	t.Parallel()

 	var h *handlers.Handlers
@@ -213,17 +359,14 @@ func TestBuildSlackTargetConfig_RejectsReservedURL(t *testing.T) {

 	t.Cleanup(app.RequireStop)

-	req := httptest.NewRequestWithContext(
-		context.Background(), http.MethodPost, "/", nil)
-	w := httptest.NewRecorder()
+	var target database.Target

-	cfg, err := h.BuildSlackTargetConfigForTest(
-		w, req, "http://169.254.169.254/latest/meta-data/",
+	errMsg := h.SetSlackTargetSettingsForTest(
+		t.Context(), &target, "http://169.254.169.254/latest/meta-data/",
 	)

-	require.Error(t, err)
-	assert.Empty(t, cfg)
-	assert.Equal(t, http.StatusBadRequest, w.Code)
+	assert.Contains(t, errMsg, "Invalid target URL")
+	assert.Empty(t, target.URL)
 }

 func TestRenderTemplate(t *testing.T) {
@@ -307,62 +450,110 @@ func TestRenderTemplateMidRenderErrorSendsNoPartialBody(t *testing.T) {
 		t, http.StatusInternalServerError, w.Code,
 		"a failed render must report a 500",
 	)
-	assert.Equal(
-		t, "Internal server error\n", w.Body.String(),
+	assert.NotContains(
+		t, w.Body.String(), partialPageMarker,
 		"the response must carry no part of the aborted page",
 	)
+	assert.Contains(
+		t, w.Body.String(), "500 Internal Server Error",
+		"a failed render must answer with the error page",
+	)
 }

-func TestBuildDatabaseTargetConfig_Valid(t *testing.T) {
+func TestSetDatabaseTargetSettings_Valid(t *testing.T) {
 	t.Parallel()

-	var h *handlers.Handlers
+	cases := []struct {
+		expiry, rotation string
+		wantExpiry       time.Duration
+		wantRotation     string
+	}{
+		// Empty expiry and rotation: the keep-forever, one-file
+		// default.
+		{"", "", 0, rotationNone},
+		{expiryNever, "", 0, rotationNone},
+		{" 36h ", "", 36 * time.Hour, rotationNone},
+		{"", rotationDaily, 0, rotationDaily},
+		{"90m", rotationHourly, 90 * time.Minute, rotationHourly},
+	}

-	app := newTestApp(t, &h)
-	app.RequireStart()
+	for _, tc := range cases {
+		var target database.Target

-	t.Cleanup(app.RequireStop)
+		errMsg := handlers.SetDatabaseTargetSettingsForTest(
+			&target, tc.expiry, tc.rotation,
+		)

-	// Empty expiry: the keep-forever default, empty config.
-	w := httptest.NewRecorder()
-	cfg, err := h.BuildDatabaseTargetConfigForTest(w, "")
-	require.NoError(t, err)
-	assert.Empty(t, cfg)
-
-	// Explicit never is stored as config.
-	w = httptest.NewRecorder()
-	cfg, err = h.BuildDatabaseTargetConfigForTest(w, "never")
-	require.NoError(t, err)
-	assert.JSONEq(t, `{"expiry":"never"}`, cfg)
-
-	// A positive duration is stored as config.
-	w = httptest.NewRecorder()
-	cfg, err = h.BuildDatabaseTargetConfigForTest(w, "720h")
-	require.NoError(t, err)
-	assert.JSONEq(t, `{"expiry":"720h"}`, cfg)
+		assert.Empty(t, errMsg, tc)
+		assert.Equal(t, tc.wantExpiry, target.ArchiveExpiry, tc)
+		assert.Equal(t, tc.wantRotation, target.ArchiveRotation, tc)
+	}
 }

-func TestBuildDatabaseTargetConfig_RejectsBadExpiry(
+// TestSetDatabaseTargetSettings_RejectsBadExpiry pins each refusal's
+// whole message, as the form shows it.
+func TestSetDatabaseTargetSettings_RejectsBadExpiry(
 	t *testing.T,
 ) {
 	t.Parallel()

-	var h *handlers.Handlers
+	cases := map[string]string{
+		"nonsense": `Invalid archive expiry: expiry must be "never" or ` +
+			`a Go duration such as "720h": time: invalid duration ` +
+			`"nonsense"`,
+		"7d": `Invalid archive expiry: expiry must be "never" or a Go ` +
+			`duration such as "720h": time: unknown unit "d" in ` +
+			`duration "7d"`,
+		"-5h": `Invalid archive expiry: expiry must be a positive ` +
+			`duration or "never": "-5h"`,
+	}

-	app := newTestApp(t, &h)
-	app.RequireStart()
+	for bad, want := range cases {
+		var target database.Target

-	t.Cleanup(app.RequireStop)
+		errMsg := handlers.SetDatabaseTargetSettingsForTest(
+			&target, bad, "",
+		)

-	for _, bad := range []string{"nonsense", "7d", "-5h"} {
-		w := httptest.NewRecorder()
-		cfg, err := h.BuildDatabaseTargetConfigForTest(w, bad)
+		assert.Equal(t, want, errMsg, "expiry %q", bad)
+	}
+}
+
+func TestSetDatabaseTargetSettings_RejectsBadRotation(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	for _, bad := range []string{"weekly", "Daily", " none"} {
+		var target database.Target
+
+		errMsg := handlers.SetDatabaseTargetSettingsForTest(
+			&target, "", bad,
+		)

-		require.Error(t, err, "expiry %q", bad)
-		assert.Empty(t, cfg)
 		assert.Equal(
-			t, http.StatusBadRequest, w.Code,
-			"expiry %q should be rejected with 400", bad,
+			t,
+			"Invalid archive rotation: rotation must be none, "+
+				"monthly, daily or hourly: "+strconv.Quote(bad),
+			errMsg,
 		)
 	}
 }
+
+// TestFormatArchiveExpiry covers the expiries the expiry choices do
+// not: TestArchiveExpiryChoices shows the edit form starting on each
+// choice. An expiry in whole hours is written in hours, and any other
+// as Go writes it, which the form accepts back unchanged.
+func TestFormatArchiveExpiry(t *testing.T) {
+	t.Parallel()
+
+	cases := map[time.Duration]string{
+		0:                expiryNever,
+		36 * time.Hour:   "36h",
+		90 * time.Minute: "1h30m0s",
+	}
+
+	for expiry, want := range cases {
+		assert.Equal(t, want, handlers.FormatArchiveExpiryForTest(expiry))
+	}
+}