姚章浩
402173263e
两处契约错：prebackup 只认"与拟发布快照同内容的那一份"，而恢复作业登记的是 恢复前备份（必然不同），于是刚备份完就显示"尚未创建"；归档里同时有目标基线与 每次预备份，overview 不给登记类型，页面只能把每份都写成"测试封存"。 现在 prebackup 取最近一次已登记的那份，并给出所属作业与 bound_to_target； overview 新增不含 evidence 的轻量版本清单供页面标注每份快照。闸口判定不变。
417 lines
18 KiB
Go
417 lines
18 KiB
Go
package httpapi
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
|
|
"knowledge-governance/internal/governance"
|
|
)
|
|
|
|
// 生产闸口与整库状态契约的针对性测试：不做数据库集成，只验证
|
|
// "证据不齐就不建作业" 与 "三类版本不互相顶替" 这两条硬规则。
|
|
|
|
// 复用既有 fakeJobStore 提供 Store 的其余方法，只覆盖整库作业这几个。
|
|
type fakeLibraryStore struct {
|
|
fakeJobStore
|
|
grant *governance.LibraryReleaseAuthorization
|
|
versions []governance.LibraryVersion
|
|
jobs []governance.LibraryJob
|
|
createN int
|
|
lastJob governance.LibraryJob
|
|
lastState governance.LibraryJobState
|
|
}
|
|
|
|
func (f *fakeLibraryStore) CreateLibraryJob(_ context.Context, job governance.LibraryJob, _ []string, _ time.Time) (governance.LibraryJob, bool, error) {
|
|
f.createN++
|
|
f.lastJob = job
|
|
return job, false, nil
|
|
}
|
|
|
|
func (f *fakeLibraryStore) LibraryJob(_ context.Context, id string) (governance.LibraryJob, error) {
|
|
return governance.LibraryJob{ID: id}, nil
|
|
}
|
|
|
|
func (f *fakeLibraryStore) ListLibraryJobs(_ context.Context, scope string, _ int) ([]governance.LibraryJob, error) {
|
|
result := make([]governance.LibraryJob, 0, len(f.jobs))
|
|
for _, job := range f.jobs {
|
|
if job.Scope == scope {
|
|
result = append(result, job)
|
|
}
|
|
}
|
|
return result, nil
|
|
}
|
|
|
|
func (f *fakeLibraryStore) RecordLibraryVersion(_ context.Context, version governance.LibraryVersion) error {
|
|
f.versions = append(f.versions, version)
|
|
return nil
|
|
}
|
|
|
|
func (f *fakeLibraryStore) LibraryVersions(_ context.Context, scope string, _ int) ([]governance.LibraryVersion, error) {
|
|
result := make([]governance.LibraryVersion, 0, len(f.versions))
|
|
for _, version := range f.versions {
|
|
if version.Scope == scope {
|
|
result = append(result, version)
|
|
}
|
|
}
|
|
return result, nil
|
|
}
|
|
|
|
func (f *fakeLibraryStore) UpdateLibraryStage(_ context.Context, _, _, _ string, _, _, _, _ *int64, _ string, _ time.Time) error {
|
|
return nil
|
|
}
|
|
|
|
func (f *fakeLibraryStore) AdvanceLibraryJob(_ context.Context, _ string, state governance.LibraryJobState, _, _, _, _, _ string, _ time.Time) error {
|
|
f.lastState = state
|
|
return nil
|
|
}
|
|
|
|
func (f *fakeLibraryStore) CreateLibraryAuthorization(_ context.Context, item governance.LibraryReleaseAuthorization) error {
|
|
f.grant = &item
|
|
return nil
|
|
}
|
|
|
|
func (f *fakeLibraryStore) ActiveLibraryAuthorization(_ context.Context, scope, snapshotID, digest string, now time.Time) (governance.LibraryReleaseAuthorization, bool, error) {
|
|
if f.grant == nil || f.grant.Scope != scope || f.grant.SnapshotID != snapshotID || f.grant.ParamsDigest != digest {
|
|
return governance.LibraryReleaseAuthorization{}, false, nil
|
|
}
|
|
if !f.grant.ValidAt(now) {
|
|
return governance.LibraryReleaseAuthorization{}, false, nil
|
|
}
|
|
return *f.grant, true, nil
|
|
}
|
|
|
|
func (f *fakeLibraryStore) LibraryAuthorizations(context.Context, string, int) ([]governance.LibraryReleaseAuthorization, error) {
|
|
if f.grant == nil {
|
|
return nil, nil
|
|
}
|
|
return []governance.LibraryReleaseAuthorization{*f.grant}, nil
|
|
}
|
|
|
|
func (f *fakeLibraryStore) RevokeLibraryAuthorization(context.Context, string, time.Time) error {
|
|
return nil
|
|
}
|
|
|
|
func (f *fakeLibraryStore) AttachLibraryQueueJob(_ context.Context, _, _ string, _ time.Time) error {
|
|
return nil
|
|
}
|
|
|
|
func (f *fakeLibraryStore) CancelLibraryJob(_ context.Context, _, _ string, _ time.Time) error {
|
|
f.lastState = governance.LibraryJobCancelled
|
|
return nil
|
|
}
|
|
|
|
func TestLibrarySyncGateRequiresEveryPieceOfEvidence(t *testing.T) {
|
|
known := libraryKnownView{State: "known", Version: &libraryVersionView{ID: "v1"}}
|
|
cases := []struct {
|
|
name string
|
|
config Config
|
|
production libraryKnownView
|
|
prebackup libraryKnownView
|
|
target string
|
|
allowed bool
|
|
reason string
|
|
}{
|
|
{
|
|
name: "default installation is closed",
|
|
config: Config{},
|
|
production: libraryKnownView{State: "unknown"},
|
|
prebackup: libraryKnownView{State: "unknown"},
|
|
target: "snap-1",
|
|
allowed: false,
|
|
reason: "生产写入闸口关闭",
|
|
},
|
|
{
|
|
name: "flags on but restore evidence missing",
|
|
config: Config{ProductionReleaseRequestsEnabled: true,
|
|
LibraryProductionDatabaseURL: "postgres://prod.invalid/db", LibraryProductionInternalKB: "kb-int"},
|
|
production: known,
|
|
prebackup: known,
|
|
target: "snap-1",
|
|
allowed: false,
|
|
reason: "没有已核验的生产恢复演练证据",
|
|
},
|
|
{
|
|
name: "capacity budget missing blocks even when everything else is present",
|
|
config: Config{ProductionReleaseRequestsEnabled: true, ProductionBackupRestoreVerified: true,
|
|
LibraryProductionDatabaseURL: "postgres://prod.invalid/db", LibraryProductionInternalKB: "kb-int"},
|
|
production: known,
|
|
prebackup: known,
|
|
target: "snap-1",
|
|
allowed: false,
|
|
reason: "容量预算未设置",
|
|
},
|
|
{
|
|
name: "everything present",
|
|
config: Config{ProductionReleaseRequestsEnabled: true, ProductionBackupRestoreVerified: true,
|
|
LibraryProductionDatabaseURL: "postgres://prod.invalid/db", LibraryProductionInternalKB: "kb-int", LibraryCapacityBudgetBytes: 1 << 40},
|
|
production: known,
|
|
prebackup: known,
|
|
target: "snap-1",
|
|
allowed: true,
|
|
},
|
|
}
|
|
for _, testCase := range cases {
|
|
t.Run(testCase.name, func(t *testing.T) {
|
|
gate := librarySyncGateWithGrant(testCase.config, testCase.production, testCase.prebackup, testCase.target, true)
|
|
if gate.SyncAllowed != testCase.allowed {
|
|
t.Fatalf("sync_allowed = %v, want %v (%v)", gate.SyncAllowed, testCase.allowed, gate.Reasons)
|
|
}
|
|
if testCase.reason != "" {
|
|
joined := strings.Join(gate.Reasons, "|")
|
|
if !strings.Contains(joined, testCase.reason) {
|
|
t.Fatalf("reasons %v missing %q", gate.Reasons, testCase.reason)
|
|
}
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
// 闸口关闭时 POST /api/v1/library/syncs 必须直接拒绝，并且**不创建**作业：
|
|
// 不能留下一个永远失败的空作业，也不能让按钮看起来接通了。
|
|
func TestLibrarySyncEnqueueRefusesWithoutCreatingJob(t *testing.T) {
|
|
store := &fakeLibraryStore{}
|
|
config := Config{Store: store}
|
|
request := httptest.NewRequest(http.MethodPost, "/api/v1/library/syncs",
|
|
strings.NewReader(`{"scope":"internal","target_snapshot_id":"snap-1"}`))
|
|
recorder := httptest.NewRecorder()
|
|
librarySyncEnqueue(recorder, request, config)
|
|
if recorder.Code != http.StatusServiceUnavailable {
|
|
t.Fatalf("status = %d, want 503", recorder.Code)
|
|
}
|
|
if store.createN != 0 {
|
|
t.Fatalf("created %d jobs while gate is closed", store.createN)
|
|
}
|
|
var body struct {
|
|
Code string `json:"code"`
|
|
Reasons []string `json:"reasons"`
|
|
}
|
|
if err := json.Unmarshal(recorder.Body.Bytes(), &body); err != nil {
|
|
t.Fatalf("decode body: %v", err)
|
|
}
|
|
if body.Code != "library_sync_blocked" || len(body.Reasons) == 0 {
|
|
t.Fatalf("unexpected refusal body: %s", recorder.Body.String())
|
|
}
|
|
}
|
|
|
|
// 预备份是作业内第一步生成的，不能拿"启动前还没有预备份"当门禁：
|
|
// 否则预备份只能由作业生成、作业又要求预备份，永远启动不了。
|
|
// 但"上一次预备份失败"必须阻断重试。
|
|
func TestLibrarySyncEnqueueDoesNotRequirePrebackupBeforeStart(t *testing.T) {
|
|
store := &fakeLibraryStore{}
|
|
config := Config{Store: store, ProductionReleaseRequestsEnabled: true, ProductionBackupRestoreVerified: true,
|
|
LibraryProductionDatabaseURL: "postgres://prod.invalid/db", LibraryProductionInternalKB: "kb-int",
|
|
LibraryCapacityBudgetBytes: 1 << 40}
|
|
gate := librarySyncGateWithGrant(config, libraryKnownView{State: "known"}, libraryKnownView{State: "unknown"}, "snap-1", true)
|
|
if !gate.SyncAllowed {
|
|
t.Fatalf("missing prebackup must not block the start: %v", gate.Reasons)
|
|
}
|
|
failed := librarySyncGateWithGrant(config, libraryKnownView{State: "known"},
|
|
libraryKnownView{State: "failed"}, "snap-1", true)
|
|
if failed.SyncAllowed || !strings.Contains(strings.Join(failed.Reasons, "|"), "预备份失败") {
|
|
t.Fatalf("failed prebackup must block: %v", failed.Reasons)
|
|
}
|
|
}
|
|
|
|
// 首次发布：生产没有生效版本，但目标为空 = 合法空基线。
|
|
func TestLibrarySyncGateAllowsFirstPublishOnEmptyBaseline(t *testing.T) {
|
|
config := Config{ProductionReleaseRequestsEnabled: true, ProductionBackupRestoreVerified: true,
|
|
LibraryProductionDatabaseURL: "postgres://prod.invalid/db", LibraryProductionInternalKB: "kb-int",
|
|
LibraryCapacityBudgetBytes: 1 << 40}
|
|
empty := libraryKnownView{State: "unknown", EmptyBaseline: true}
|
|
if gate := librarySyncGateWithGrant(config, empty, libraryKnownView{State: "unknown"}, "snap-1", true); !gate.SyncAllowed {
|
|
t.Fatalf("empty production must be a legal first-publish baseline: %v", gate.Reasons)
|
|
}
|
|
// 非空但没有权威版本：仍然阻断。
|
|
if gate := librarySyncGateWithGrant(config, libraryKnownView{State: "unknown"}, libraryKnownView{State: "unknown"}, "snap-1", true); gate.SyncAllowed {
|
|
t.Fatal("unknown non-empty production must block")
|
|
}
|
|
}
|
|
|
|
// 上一次预备份失败时必须阻断重试（预备份本身是作业内生成的，不能当启动前门禁）。
|
|
func TestLibrarySyncEnqueueRequiresPrebackupForTarget(t *testing.T) {
|
|
store := &fakeLibraryStore{versions: []governance.LibraryVersion{{
|
|
ID: "ver-prod-1", Scope: "internal", Kind: governance.LibraryVersionProductionEffective,
|
|
SnapshotID: "prod-snap", VersionLabel: "prod-2026.10", CreatedAt: time.Now().UTC(),
|
|
}, {
|
|
ID: "ver-backup-1", Scope: "internal", Kind: governance.LibraryVersionProductionPrebackup,
|
|
SnapshotID: "snap-1", CreatedAt: time.Now().UTC(),
|
|
}}}
|
|
config := Config{Store: store, ProductionReleaseRequestsEnabled: true, ProductionBackupRestoreVerified: true,
|
|
LibraryProductionDatabaseURL: "postgres://prod.invalid/db", LibraryProductionInternalKB: "kb-int",
|
|
LibraryCapacityBudgetBytes: 1 << 40}
|
|
request := httptest.NewRequest(http.MethodPost, "/api/v1/library/syncs",
|
|
strings.NewReader(`{"scope":"internal","target_snapshot_id":"snap-1"}`))
|
|
recorder := httptest.NewRecorder()
|
|
librarySyncEnqueue(recorder, request, config)
|
|
// 没有授权仍然 503，但原因里不能再出现"还没有生产预备份"这种死循环门禁。
|
|
if recorder.Code != http.StatusServiceUnavailable {
|
|
t.Fatalf("status = %d, want 503", recorder.Code)
|
|
}
|
|
if strings.Contains(recorder.Body.String(), "还没有生产预备份") {
|
|
t.Fatalf("start gate must not require a prebackup that only the job can create: %s", recorder.Body.String())
|
|
}
|
|
}
|
|
|
|
// 证据齐全 + 有效授权时才会真正建作业并入队；缺授权一律拒绝且不建作业。
|
|
func TestLibrarySyncEnqueueCreatesJobOnlyWithGrant(t *testing.T) {
|
|
target := "snap-1"
|
|
digest, err := librarySyncParamsDigest("internal", target)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
store := &fakeLibraryStore{versions: []governance.LibraryVersion{
|
|
{ID: "ver-prod", Scope: "internal", Kind: governance.LibraryVersionProductionEffective,
|
|
SnapshotID: "prod-snap", VersionLabel: "prod-2026.10", CreatedAt: time.Now().UTC()},
|
|
{ID: "ver-backup", Scope: "internal", Kind: governance.LibraryVersionProductionPrebackup,
|
|
SnapshotID: target, CreatedAt: time.Now().UTC()},
|
|
}}
|
|
store.enqueueEchoRequestedID = true
|
|
config := Config{Store: store, ProductionReleaseRequestsEnabled: true, ProductionBackupRestoreVerified: true,
|
|
LibraryProductionDatabaseURL: "postgres://prod.invalid/db", LibraryProductionInternalKB: "kb-int", LibraryCapacityBudgetBytes: 1 << 40}
|
|
body := `{"scope":"internal","target_snapshot_id":"` + target + `"}`
|
|
|
|
// 先没有授权
|
|
recorder := httptest.NewRecorder()
|
|
librarySyncEnqueue(recorder, httptest.NewRequest(http.MethodPost, "/api/v1/library/syncs", strings.NewReader(body)), config)
|
|
if recorder.Code != http.StatusServiceUnavailable {
|
|
t.Fatalf("without grant status=%d body=%s", recorder.Code, recorder.Body.String())
|
|
}
|
|
if store.createN != 0 {
|
|
t.Fatal("must not create a job without a grant")
|
|
}
|
|
|
|
// 补上绑定同一目标与快照的授权
|
|
now := time.Now().UTC()
|
|
store.grant = &governance.LibraryReleaseAuthorization{ID: "auth-1", Scope: "internal", SnapshotID: target,
|
|
ParamsDigest: digest, AuthorizedBy: "admin", ExpiresAt: now.Add(30 * time.Minute), CreatedAt: now}
|
|
recorder = httptest.NewRecorder()
|
|
librarySyncEnqueue(recorder, httptest.NewRequest(http.MethodPost, "/api/v1/library/syncs", strings.NewReader(body)), config)
|
|
if recorder.Code != http.StatusAccepted {
|
|
t.Fatalf("with grant status=%d body=%s", recorder.Code, recorder.Body.String())
|
|
}
|
|
if store.createN != 1 {
|
|
t.Fatalf("created=%d, want 1", store.createN)
|
|
}
|
|
if store.enqueued.Type != "library.sync" {
|
|
t.Fatalf("enqueued type=%q, want library.sync", store.enqueued.Type)
|
|
}
|
|
if !strings.Contains(string(store.enqueued.Payload), store.lastJob.ID) {
|
|
t.Fatalf("queue payload must carry the library job id: %s", store.enqueued.Payload)
|
|
}
|
|
}
|
|
|
|
// 真实现场（2026-10-29 16:59 的按版本恢复）：恢复作业登记了"恢复前备份"，
|
|
// 但那份备份的内容就是**恢复前**的生产状态，永远不可能等于测试封存快照。
|
|
// 旧逻辑只认"与测试封存同快照的预备份"，于是刚备份完就显示"尚未创建/无记录"。
|
|
func TestLibraryOverviewShowsLatestPrebackupWhenTargetDiffers(t *testing.T) {
|
|
root := libraryFixtureRoot(t)
|
|
sealed := sealSharedVersions(t, root, 1, 4)[0]
|
|
now := time.Now().UTC()
|
|
store := &fakeLibraryStore{versions: []governance.LibraryVersion{
|
|
{ID: "ver-effective", Scope: "internal", Kind: governance.LibraryVersionProductionEffective,
|
|
SnapshotID: "prod-restored-snapshot", CreatedAt: now},
|
|
{ID: "ver-prebackup", Scope: "internal", Kind: governance.LibraryVersionProductionPrebackup,
|
|
SnapshotID: "snap-before-restore", SourceJobID: "librestore-internal-1", CreatedAt: now.Add(-time.Second)},
|
|
{ID: "ver-sealed", Scope: "internal", Kind: governance.LibraryVersionTestSealed,
|
|
SnapshotID: sealed, CreatedAt: now.Add(-2 * time.Hour)},
|
|
}}
|
|
config := Config{Store: store, LibraryArchiveRoot: root, LibraryCapacityBudgetBytes: 1 << 30}
|
|
request := httptest.NewRequest(http.MethodGet, "/api/v1/library/overview?scope=internal", nil)
|
|
recorder := httptest.NewRecorder()
|
|
libraryOverviewHandler(recorder, request, config)
|
|
if recorder.Code != http.StatusOK {
|
|
t.Fatalf("status = %d: %s", recorder.Code, recorder.Body.String())
|
|
}
|
|
var body struct {
|
|
Production libraryKnownView `json:"production"`
|
|
Prebackup libraryKnownView `json:"prebackup"`
|
|
Versions []libraryVersionRef `json:"versions"`
|
|
TestSealed *librarySnapshotView `json:"test_sealed"`
|
|
Gate struct {
|
|
SyncAllowed bool `json:"sync_allowed"`
|
|
Reasons []string `json:"reasons"`
|
|
} `json:"gate"`
|
|
}
|
|
if err := json.Unmarshal(recorder.Body.Bytes(), &body); err != nil {
|
|
t.Fatalf("decode overview: %v", err)
|
|
}
|
|
if body.TestSealed == nil || body.TestSealed.SnapshotID != sealed {
|
|
t.Fatalf("test sealed candidate must be the registered one: %+v", body.TestSealed)
|
|
}
|
|
if body.Prebackup.State != "known" || body.Prebackup.Version == nil ||
|
|
body.Prebackup.Version.ID != "ver-prebackup" || body.Prebackup.Version.SourceJobID != "librestore-internal-1" {
|
|
t.Fatalf("latest registered prebackup must be visible with its job: %+v", body.Prebackup)
|
|
}
|
|
if body.Prebackup.BoundToTarget {
|
|
t.Fatal("a restore prebackup is not the publish target snapshot")
|
|
}
|
|
// 三类版本都要出现在轻量清单里，页面才能给每份归档写对类型。
|
|
if len(body.Versions) != 3 {
|
|
t.Fatalf("versions = %+v", body.Versions)
|
|
}
|
|
for _, reason := range body.Gate.Reasons {
|
|
if strings.Contains(reason, "预备份") {
|
|
t.Fatalf("a registered prebackup must not be reported as missing: %q", reason)
|
|
}
|
|
}
|
|
}
|
|
|
|
// 三类版本必须分开读：production_effective 才是生产当前，测试封存不能顶替。
|
|
func TestLibraryOverviewKeepsVersionKindsSeparate(t *testing.T) {
|
|
now := time.Now().UTC()
|
|
store := &fakeLibraryStore{versions: []governance.LibraryVersion{
|
|
{ID: "ver-test", Scope: "internal", Kind: governance.LibraryVersionTestSealed, SnapshotID: "snap-1", CreatedAt: now},
|
|
{ID: "ver-prod", Scope: "internal", Kind: governance.LibraryVersionProductionEffective,
|
|
SnapshotID: "prod-snap", VersionLabel: "prod-2026.10", CreatedAt: now},
|
|
{ID: "ver-backup-other", Scope: "internal", Kind: governance.LibraryVersionProductionPrebackup,
|
|
SnapshotID: "other-snap", CreatedAt: now},
|
|
}}
|
|
config := Config{Store: store, LibraryArchiveRoot: t.TempDir()}
|
|
request := httptest.NewRequest(http.MethodGet, "/api/v1/library/overview?scope=internal", nil)
|
|
recorder := httptest.NewRecorder()
|
|
libraryOverviewHandler(recorder, request, config)
|
|
if recorder.Code != http.StatusOK {
|
|
t.Fatalf("status = %d: %s", recorder.Code, recorder.Body.String())
|
|
}
|
|
var body struct {
|
|
Production libraryKnownView `json:"production"`
|
|
Prebackup libraryKnownView `json:"prebackup"`
|
|
Versions []libraryVersionRef `json:"versions"`
|
|
Diff struct {
|
|
State string `json:"state"`
|
|
} `json:"diff"`
|
|
Gate struct {
|
|
SyncAllowed bool `json:"sync_allowed"`
|
|
} `json:"gate"`
|
|
}
|
|
if err := json.Unmarshal(recorder.Body.Bytes(), &body); err != nil {
|
|
t.Fatalf("decode overview: %v", err)
|
|
}
|
|
if body.Production.State != "known" || body.Production.Version == nil || body.Production.Version.ID != "ver-prod" {
|
|
t.Fatalf("production must be the effective version, got %+v", body.Production)
|
|
}
|
|
// 预备份按"最近一次生产写入前的备份"显示：归档不可用时没有可匹配的目标，
|
|
// 但登记过的预备份必须仍然可见（否则真备份了却显示"尚未创建"），
|
|
// 并且明确标出它并不是本次拟发布快照。
|
|
if body.Prebackup.State != "known" || body.Prebackup.Version == nil || body.Prebackup.Version.ID != "ver-backup-other" {
|
|
t.Fatalf("registered prebackup must stay visible: %+v", body.Prebackup)
|
|
}
|
|
if body.Prebackup.BoundToTarget {
|
|
t.Fatalf("prebackup must not claim to be the publish target without one: %+v", body.Prebackup)
|
|
}
|
|
if len(body.Versions) != 3 {
|
|
t.Fatalf("overview must expose every registered version kind, got %+v", body.Versions)
|
|
}
|
|
if body.Diff.State != "unknown" {
|
|
t.Fatalf("diff must be unknown until the comparison is wired, got %q", body.Diff.State)
|
|
}
|
|
if body.Gate.SyncAllowed {
|
|
t.Fatal("gate must stay closed")
|
|
}
|
|
}
|