Phase A-E: stability, security, observability, and test coverage

Phase A - Stability: - Engine.Start(): recovers orphaned jobs (running/queued/waking_up) after crash - Engine.Stop(): graceful shutdown - cancels all in-flight jobs and waits - Queue keyed by jobID (not syncPairID): cancel now targets exact job - Local rsync uses jobCtx (context.Background() replaced) - Migrations wrapped in transactions; checksums stored Phase B - Security: - admin/admin default removed: SYNCSERVER_ADMIN_PASSWORD required on first run - Path validation: rejects .., leading -, null bytes in sync pair paths - Rsync flags allowlist: dangerous flags blocked (--rsync-path, -e, --files-from) - Shell concat in RunRemote replaced with proper sh -c escaping - knownhosts: replaced custom parser with golang.org/x/crypto/ssh/knownhosts - RequireAdmin wired: machine CRUD, SSH key ops, settings require admin role - deploy-keys: uses authorized_keys only (no private key upload) - Hardcoded /var/lib/syncserver/ssh paths replaced with cfg.SSHDir() Phase C - Operational: - /readyz health check: DB query + SSH dir accessibility - /metrics endpoint: Prometheus text format (jobs, queue, machines) - Event struct JSON tags: job_id, machine_id, type (snake_case) - EventBus broadcast: fanned out to all subscribers - SQLite VACUUM INTO backup: scheduled before cleanup if BackupDir set - Filesystem job log cleanup: removes .log files for purged jobs - Backup retention: old backups auto-purged Phase D - Frontend: - Schedules page: REST API + full CRUD UI for cron schedules - Dashboard: cancel button for running/queued jobs - JobDetail: server-side log download via API - Settings: displays data_dir from server - 404 page: proper NotFound component Phase E - Tests: - auth_test.go: JWT, bcrypt, middleware, seed (18 tests) - models_test.go: Job, Machine, SyncPair, Schedule repos (18 tests) - go test -race: no data races found
2026-07-19 22:14:30 -04:00
parent 300555d35f
commit 84b185be39
33 changed files with 2398 additions and 199 deletions
@@ -0,0 +1,243 @@
+package api
+
+import (
+	"database/sql"
+	"encoding/json"
+	"log/slog"
+	"net/http"
+	"strconv"
+	"time"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/syncserver/internal/models"
+	"github.com/syncserver/internal/scheduler"
+)
+
+type ScheduleHandler struct {
+	db *sql.DB
+}
+
+func NewScheduleHandler(db *sql.DB) *ScheduleHandler {
+	return &ScheduleHandler{db: db}
+}
+
+func (h *ScheduleHandler) List(w http.ResponseWriter, r *http.Request) {
+	repo := models.NewScheduleRepository(h.db)
+	schedules, err := repo.GetAll()
+	if err != nil {
+		slog.Error("failed to fetch schedules", "error", err)
+		writeError(w, http.StatusInternalServerError, "failed to fetch schedules")
+		return
+	}
+
+	pairRepo := models.NewSyncPairRepository(h.db)
+	pairs, err := pairRepo.GetAll()
+	if err != nil {
+		slog.Error("failed to fetch sync pairs", "error", err)
+		writeError(w, http.StatusInternalServerError, "failed to fetch sync pairs")
+		return
+	}
+	pairMap := make(map[int64]string)
+	for _, p := range pairs {
+		pairMap[p.ID] = p.Name
+	}
+
+	out := make([]ScheduleResponse, len(schedules))
+	for i, s := range schedules {
+		out[i] = scheduleToResp(s, pairMap)
+	}
+	writeJSON(w, out)
+}
+
+func (h *ScheduleHandler) Get(w http.ResponseWriter, r *http.Request) {
+	id, err := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
+	if err != nil {
+		writeError(w, http.StatusBadRequest, "invalid id")
+		return
+	}
+	repo := models.NewScheduleRepository(h.db)
+	s, err := repo.GetByID(id)
+	if err == sql.ErrNoRows {
+		writeError(w, http.StatusNotFound, "schedule not found")
+		return
+	}
+	if err != nil {
+		slog.Error("failed to fetch schedule", "id", id, "error", err)
+		writeError(w, http.StatusInternalServerError, "failed to fetch schedule")
+		return
+	}
+
+	pairRepo := models.NewSyncPairRepository(h.db)
+	pairs, err := pairRepo.GetAll()
+	if err != nil {
+		slog.Error("failed to fetch sync pairs", "error", err)
+		writeError(w, http.StatusInternalServerError, "failed to fetch sync pairs")
+		return
+	}
+	pairMap := make(map[int64]string)
+	for _, p := range pairs {
+		pairMap[p.ID] = p.Name
+	}
+
+	writeJSON(w, scheduleToResp(*s, pairMap))
+}
+
+func (h *ScheduleHandler) Create(w http.ResponseWriter, r *http.Request) {
+	var req CreateScheduleRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		writeError(w, http.StatusBadRequest, "invalid request body")
+		return
+	}
+
+	if req.SyncPairID <= 0 {
+		writeError(w, http.StatusBadRequest, "sync_pair_id is required")
+		return
+	}
+	if req.CronExpr == "" {
+		writeError(w, http.StatusBadRequest, "cron_expr is required")
+		return
+	}
+
+	_, err := scheduler.ParseCron(req.CronExpr)
+	if err != nil {
+		writeError(w, http.StatusBadRequest, "invalid cron expression: "+err.Error())
+		return
+	}
+
+	pairRepo := models.NewSyncPairRepository(h.db)
+	_, err = pairRepo.GetByID(req.SyncPairID)
+	if err == sql.ErrNoRows {
+		writeError(w, http.StatusBadRequest, "sync_pair not found")
+		return
+	}
+	if err != nil {
+		slog.Error("failed to fetch sync pair", "id", req.SyncPairID, "error", err)
+		writeError(w, http.StatusInternalServerError, "failed to validate sync pair")
+		return
+	}
+
+	expr, _ := scheduler.ParseCron(req.CronExpr)
+	var nextRun *time.Time
+	if expr != nil {
+		t := scheduler.NextRun(expr, time.Now().UTC())
+		nextRun = &t
+	}
+
+	s := &models.Schedule{
+		SyncPairID: req.SyncPairID,
+		CronExpr:   req.CronExpr,
+		NextRunAt:  nextRun,
+		Enabled:    req.Enabled,
+	}
+
+	repo := models.NewScheduleRepository(h.db)
+	id, err := repo.Create(s)
+	if err != nil {
+		slog.Error("failed to create schedule", "error", err)
+		writeError(w, http.StatusInternalServerError, "failed to create schedule")
+		return
+	}
+	s.ID = id
+
+	pairs, _ := pairRepo.GetAll()
+	pairMap := make(map[int64]string)
+	for _, p := range pairs {
+		pairMap[p.ID] = p.Name
+	}
+
+	w.Header().Set("Location", "/api/schedules/"+strconv.FormatInt(id, 10))
+	writeJSON(w, scheduleToResp(*s, pairMap), http.StatusCreated)
+}
+
+func (h *ScheduleHandler) Update(w http.ResponseWriter, r *http.Request) {
+	id, err := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
+	if err != nil {
+		writeError(w, http.StatusBadRequest, "invalid id")
+		return
+	}
+
+	var req UpdateScheduleRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		writeError(w, http.StatusBadRequest, "invalid request body")
+		return
+	}
+
+	repo := models.NewScheduleRepository(h.db)
+	existing, err := repo.GetByID(id)
+	if err == sql.ErrNoRows {
+		writeError(w, http.StatusNotFound, "schedule not found")
+		return
+	}
+	if err != nil {
+		slog.Error("failed to fetch schedule", "id", id, "error", err)
+		writeError(w, http.StatusInternalServerError, "failed to fetch schedule")
+		return
+	}
+
+	if req.CronExpr != "" {
+		_, err := scheduler.ParseCron(req.CronExpr)
+		if err != nil {
+			writeError(w, http.StatusBadRequest, "invalid cron expression: "+err.Error())
+			return
+		}
+		existing.CronExpr = req.CronExpr
+		expr, _ := scheduler.ParseCron(req.CronExpr)
+		if expr != nil {
+			t := scheduler.NextRun(expr, time.Now().UTC())
+			existing.NextRunAt = &t
+		}
+	}
+
+	if req.Enabled {
+		existing.Enabled = true
+	} else if req.Enabled == false {
+		existing.Enabled = false
+	}
+
+	if err := repo.Update(existing); err != nil {
+		slog.Error("failed to update schedule", "id", id, "error", err)
+		writeError(w, http.StatusInternalServerError, "failed to update schedule")
+		return
+	}
+
+	pairRepo := models.NewSyncPairRepository(h.db)
+	pairs, _ := pairRepo.GetAll()
+	pairMap := make(map[int64]string)
+	for _, p := range pairs {
+		pairMap[p.ID] = p.Name
+	}
+
+	writeJSON(w, scheduleToResp(*existing, pairMap))
+}
+
+func (h *ScheduleHandler) Delete(w http.ResponseWriter, r *http.Request) {
+	id, err := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
+	if err != nil {
+		writeError(w, http.StatusBadRequest, "invalid id")
+		return
+	}
+
+	repo := models.NewScheduleRepository(h.db)
+	if err := repo.Delete(id); err != nil {
+		slog.Error("failed to delete schedule", "id", id, "error", err)
+		writeError(w, http.StatusInternalServerError, "failed to delete schedule")
+		return
+	}
+	w.WriteHeader(http.StatusNoContent)
+}
+
+func scheduleToResp(s models.Schedule, pairMap map[int64]string) ScheduleResponse {
+	resp := ScheduleResponse{
+		ID:          s.ID,
+		SyncPairID:  s.SyncPairID,
+		SyncPairName: pairMap[s.SyncPairID],
+		CronExpr:    s.CronExpr,
+		Enabled:     s.Enabled,
+		CreatedAt:  s.CreatedAt.Format(time.RFC3339),
+	}
+	if s.NextRunAt != nil {
+		t := s.NextRunAt.Format(time.RFC3339)
+		resp.NextRun = &t
+	}
+	return resp
+}