Add Deactivate Jail button for inactive jails with local override
- Add has_local_override field to InactiveJail model
- Update _build_inactive_jail and list_inactive_jails to compute the field
- Add delete_jail_local_override() service function
- Add DELETE /api/config/jails/{name}/local router endpoint
- Surface has_local_override in frontend InactiveJail type
- Show Deactivate Jail button in JailsTab when has_local_override is true
- Add tests: TestBuildInactiveJail, TestListInactiveJails, TestDeleteJailLocalOverride
This commit is contained in:
@@ -290,6 +290,28 @@ class TestBuildInactiveJail:
|
||||
jail = _build_inactive_jail("active-jail", settings, "/etc/fail2ban/jail.conf")
|
||||
assert jail.enabled is True
|
||||
|
||||
def test_has_local_override_absent(self, tmp_path: Path) -> None:
|
||||
"""has_local_override is False when no .local file exists."""
|
||||
jail = _build_inactive_jail(
|
||||
"sshd", {}, "/etc/fail2ban/jail.d/sshd.conf", config_dir=tmp_path
|
||||
)
|
||||
assert jail.has_local_override is False
|
||||
|
||||
def test_has_local_override_present(self, tmp_path: Path) -> None:
|
||||
"""has_local_override is True when jail.d/{name}.local exists."""
|
||||
local = tmp_path / "jail.d" / "sshd.local"
|
||||
local.parent.mkdir(parents=True, exist_ok=True)
|
||||
local.write_text("[sshd]\nenabled = false\n")
|
||||
jail = _build_inactive_jail(
|
||||
"sshd", {}, "/etc/fail2ban/jail.d/sshd.conf", config_dir=tmp_path
|
||||
)
|
||||
assert jail.has_local_override is True
|
||||
|
||||
def test_has_local_override_no_config_dir(self) -> None:
|
||||
"""has_local_override is False when config_dir is not provided."""
|
||||
jail = _build_inactive_jail("sshd", {}, "/etc/fail2ban/jail.conf")
|
||||
assert jail.has_local_override is False
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# _write_local_override_sync
|
||||
@@ -425,6 +447,121 @@ class TestListInactiveJails:
|
||||
assert "sshd" in names
|
||||
assert "apache-auth" in names
|
||||
|
||||
async def test_has_local_override_true_when_local_file_exists(
|
||||
self, tmp_path: Path
|
||||
) -> None:
|
||||
"""has_local_override is True for a jail whose jail.d .local file exists."""
|
||||
_write(tmp_path / "jail.conf", JAIL_CONF)
|
||||
local = tmp_path / "jail.d" / "apache-auth.local"
|
||||
local.parent.mkdir(parents=True, exist_ok=True)
|
||||
local.write_text("[apache-auth]\nenabled = false\n")
|
||||
with patch(
|
||||
"app.services.config_file_service._get_active_jail_names",
|
||||
new=AsyncMock(return_value=set()),
|
||||
):
|
||||
result = await list_inactive_jails(str(tmp_path), "/fake.sock")
|
||||
jail = next(j for j in result.jails if j.name == "apache-auth")
|
||||
assert jail.has_local_override is True
|
||||
|
||||
async def test_has_local_override_false_when_no_local_file(
|
||||
self, tmp_path: Path
|
||||
) -> None:
|
||||
"""has_local_override is False when no jail.d .local file exists."""
|
||||
_write(tmp_path / "jail.conf", JAIL_CONF)
|
||||
with patch(
|
||||
"app.services.config_file_service._get_active_jail_names",
|
||||
new=AsyncMock(return_value=set()),
|
||||
):
|
||||
result = await list_inactive_jails(str(tmp_path), "/fake.sock")
|
||||
jail = next(j for j in result.jails if j.name == "apache-auth")
|
||||
assert jail.has_local_override is False
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# delete_jail_local_override
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
|
||||
@pytest.mark.asyncio
|
||||
class TestDeleteJailLocalOverride:
|
||||
"""Tests for :func:`~app.services.config_file_service.delete_jail_local_override`."""
|
||||
|
||||
async def test_deletes_local_file(self, tmp_path: Path) -> None:
|
||||
"""delete_jail_local_override removes the jail.d/.local file."""
|
||||
from app.services.config_file_service import delete_jail_local_override
|
||||
|
||||
_write(tmp_path / "jail.conf", JAIL_CONF)
|
||||
local = tmp_path / "jail.d" / "apache-auth.local"
|
||||
local.parent.mkdir(parents=True, exist_ok=True)
|
||||
local.write_text("[apache-auth]\nenabled = false\n")
|
||||
|
||||
with patch(
|
||||
"app.services.config_file_service._get_active_jail_names",
|
||||
new=AsyncMock(return_value=set()),
|
||||
):
|
||||
await delete_jail_local_override(str(tmp_path), "/fake.sock", "apache-auth")
|
||||
|
||||
assert not local.exists()
|
||||
|
||||
async def test_no_error_when_local_file_missing(self, tmp_path: Path) -> None:
|
||||
"""delete_jail_local_override succeeds silently when no .local file exists."""
|
||||
from app.services.config_file_service import delete_jail_local_override
|
||||
|
||||
_write(tmp_path / "jail.conf", JAIL_CONF)
|
||||
with patch(
|
||||
"app.services.config_file_service._get_active_jail_names",
|
||||
new=AsyncMock(return_value=set()),
|
||||
):
|
||||
# Must not raise even though there is no .local file.
|
||||
await delete_jail_local_override(str(tmp_path), "/fake.sock", "apache-auth")
|
||||
|
||||
async def test_raises_jail_not_found(self, tmp_path: Path) -> None:
|
||||
"""delete_jail_local_override raises JailNotFoundInConfigError for unknown jail."""
|
||||
from app.services.config_file_service import (
|
||||
JailNotFoundInConfigError,
|
||||
delete_jail_local_override,
|
||||
)
|
||||
|
||||
_write(tmp_path / "jail.conf", JAIL_CONF)
|
||||
with (
|
||||
patch(
|
||||
"app.services.config_file_service._get_active_jail_names",
|
||||
new=AsyncMock(return_value=set()),
|
||||
),
|
||||
pytest.raises(JailNotFoundInConfigError),
|
||||
):
|
||||
await delete_jail_local_override(str(tmp_path), "/fake.sock", "nonexistent")
|
||||
|
||||
async def test_raises_jail_already_active(self, tmp_path: Path) -> None:
|
||||
"""delete_jail_local_override raises JailAlreadyActiveError when jail is running."""
|
||||
from app.services.config_file_service import (
|
||||
JailAlreadyActiveError,
|
||||
delete_jail_local_override,
|
||||
)
|
||||
|
||||
_write(tmp_path / "jail.conf", JAIL_CONF)
|
||||
local = tmp_path / "jail.d" / "sshd.local"
|
||||
local.parent.mkdir(parents=True, exist_ok=True)
|
||||
local.write_text("[sshd]\nenabled = false\n")
|
||||
with (
|
||||
patch(
|
||||
"app.services.config_file_service._get_active_jail_names",
|
||||
new=AsyncMock(return_value={"sshd"}),
|
||||
),
|
||||
pytest.raises(JailAlreadyActiveError),
|
||||
):
|
||||
await delete_jail_local_override(str(tmp_path), "/fake.sock", "sshd")
|
||||
|
||||
async def test_raises_jail_name_error(self, tmp_path: Path) -> None:
|
||||
"""delete_jail_local_override raises JailNameError for invalid jail names."""
|
||||
from app.services.config_file_service import (
|
||||
JailNameError,
|
||||
delete_jail_local_override,
|
||||
)
|
||||
|
||||
with pytest.raises(JailNameError):
|
||||
await delete_jail_local_override(str(tmp_path), "/fake.sock", "../evil")
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# activate_jail
|
||||
@@ -3174,6 +3311,64 @@ class TestActivateJailRollback:
|
||||
# Verify the error message mentions logpath issues.
|
||||
assert "logpath" in result.message.lower() or "check that all logpath" in result.message.lower()
|
||||
|
||||
async def test_activate_jail_rollback_deletes_file_when_no_prior_local(
|
||||
self, tmp_path: Path
|
||||
) -> None:
|
||||
"""Rollback deletes the .local file when none existed before activation.
|
||||
|
||||
When a jail had no .local override before activation, activate_jail
|
||||
creates one with enabled = true. If reload then crashes, rollback must
|
||||
delete that file (leaving the jail in the same state as before the
|
||||
activation attempt).
|
||||
|
||||
Expects:
|
||||
- The .local file is absent after rollback.
|
||||
- The response indicates recovered=True.
|
||||
"""
|
||||
from app.models.config import ActivateJailRequest, JailValidationResult
|
||||
|
||||
_write(tmp_path / "jail.conf", JAIL_CONF)
|
||||
(tmp_path / "jail.d").mkdir(parents=True, exist_ok=True)
|
||||
local_path = tmp_path / "jail.d" / "apache-auth.local"
|
||||
# No .local file exists before activation.
|
||||
assert not local_path.exists()
|
||||
|
||||
req = ActivateJailRequest()
|
||||
reload_call_count = 0
|
||||
|
||||
async def reload_side_effect(socket_path: str, **kwargs: object) -> None:
|
||||
nonlocal reload_call_count
|
||||
reload_call_count += 1
|
||||
if reload_call_count == 1:
|
||||
raise RuntimeError("fail2ban crashed")
|
||||
# Recovery reload succeeds.
|
||||
|
||||
with (
|
||||
patch(
|
||||
"app.services.config_file_service._get_active_jail_names",
|
||||
new=AsyncMock(return_value=set()),
|
||||
),
|
||||
patch("app.services.config_file_service.jail_service") as mock_js,
|
||||
patch(
|
||||
"app.services.config_file_service._probe_fail2ban_running",
|
||||
new=AsyncMock(return_value=True),
|
||||
),
|
||||
patch(
|
||||
"app.services.config_file_service._validate_jail_config_sync",
|
||||
return_value=JailValidationResult(
|
||||
jail_name="apache-auth", valid=True
|
||||
),
|
||||
),
|
||||
):
|
||||
mock_js.reload_all = AsyncMock(side_effect=reload_side_effect)
|
||||
result = await activate_jail(
|
||||
str(tmp_path), "/fake.sock", "apache-auth", req
|
||||
)
|
||||
|
||||
assert result.active is False
|
||||
assert result.recovered is True
|
||||
assert not local_path.exists()
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# rollback_jail
|
||||
|
||||
Reference in New Issue
Block a user