Repository navigation
fix: harden the CrowdSec import and restore, and finish the page translations - #1562
Merged
Merged
Conversation
…r layout in the import spec The CrowdSec import and diagnostics specs now build archives with the real config/ folder layout instead of a top-level config.yaml, and the baseline carries acquis, profiles and simulation files. The export assertions expect config/config.yaml exactly. New pending specs cover refusing a top-level archive and keeping the current files (including notification files) an archive omits; they stay skipped until the matching behavior lands.
The CrowdSec import UI creates a real ~40MB application backup per import, which filled the 256M /app/data tmpfs across repeated runs. The two UI specs now delete the backups they create in afterAll (best effort), and the local tmpfs is raised to 512M as a backstop. Refs #1558.
…r CrowdSec reads Importing an archive that keeps config.yaml at the top level into an installation that reads its configuration from the config folder is now refused with a clear message, and nothing is changed. Export a configuration from the CrowdSec page, or put the files in a config/ folder inside the archive. A fresh installation without a config folder still accepts both layouts. An archive whose config.yaml sits in some other folder (for example parsers/config.yaml) is now reported as missing config.yaml right away.
…tain An imported configuration archive that leaves out acquis.yaml, profiles.yaml, simulation.yaml or the patterns folder no longer leaves CrowdSec unable to start: the current copies are kept and listed in the import response (kept_files). A file or folder the archive does provide always wins, and a linked file or folder is never replaced. When the kept profiles.yaml names a notification, the notification file that defines it is brought back too. If it cannot be brought back without replacing a file from the archive, the import is refused with a clear message and nothing is changed. The end-to-end specs for kept files are enabled, and the diagnostics specs now expect the current acquis.yaml to be kept after a config-only import.
After an import, an inline note in the import card lists the current files that were kept because the archive did not contain them. Names are shown as plain text with control characters removed and length capped. This inline note is new user-facing behaviour under a fix: subject on purpose: it belongs to the #1554 fix (the user must be told what was kept). Also adds a test that a failed hub item restore with a partial response body shows the generic error and stays retryable.
…rt an unreadable install list A restore now reports a hub item as not found only when cscli says it cannot find that exact item, instead of matching any output containing 'not found'. If the list of installed items cannot be read again part-way through a restore, the restore answers with an error that still lists what was installed, and CrowdSec is reloaded so those installs take effect.
…st is cancelled An import, export, file save, preset apply or hub restore that is queued behind another CrowdSec configuration change now gives up as soon as the browser request is cancelled, instead of waiting its turn and running anyway.
CrowdSec's live database, download cache, hub files and process file are now recognised however their names are capitalised, so an imported or restored archive can no longer replace or duplicate them by using different letter case.
Toasts, preset status lines, console enrollment errors and the loading overlay messages on the CrowdSec configuration page now follow the selected language. A test now fails if a new hard-coded message is added to the page.
Frontend tests now get a 15 second limit per test and hook, and two typing-heavy test files no longer simulate per-keystroke delays, so they stop failing on a busy machine.
…aviour Explain the refused top-level archive, the kept companion and notification files, their known limits, and the clearer hub restore errors.
Contributor
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
Contributor
✅ Supply Chain Verification Results✅ PASSED 📦 SBOM Summary
🔍 Vulnerability Scan
📎 Artifacts
Generated by Supply Chain Verification workflow • View Details |
Codecov Report❌ Patch coverage is 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-ups from the CrowdSec export/import work (#1561): safer imports, clearer restore errors, translations and test stability. 13 ordered commits; each builds and passes its own gate.
config/folder CrowdSec reads is refused with a clear message, before anything is changed. Archive entry names are normalised the same way in the validator, the inspector and the extractor.profiles.yaml,simulation.yaml,acquis.yamlorpatterns/, the current ones are kept (CrowdSec cannot start without them; checked withcrowdsec -tin a throwaway container). The notification files a kept profile names are restored too. The import card lists what was kept (new inline note, five languages).cscliwording; an unreadable install list returns an error with the partial result; configuration changes stop waiting once the request is cancelled (context-aware lock at all 7 sites, no new "busy" response).userEventwithout delay in the two flaky files (the suite already runs one worker).Not in this PR: #1551 (redacting notification values in exports) gets its own PR.
Verification
golangci-lintclean;go build,npm run buildand type-check pass;go test -race -count=3on the handlers package.--project=security-tests): import and diagnostics specs 72 passed, 0 skipped.docs/reports/qa_report.md.Issues
Closing keywords only take effect on merge to
main, so these stay open until the promotion.Closes #1559, #1554, #1556, #1552, #1550, #1558, #1560
Claude Code helped produce this change.