mirror of
https://github.com/kevinveenbirkenbach/docker-volume-backup.git
synced 2026-08-20 21:22:54 +00:00
Kevin Veen-Birkenbach
2129c5e362
ruff was never wired into this repository: no target, no CI step, no pin. It reported 45 findings across sources and tests, so nothing enforced what the codebase already mostly followed. Adds `make ruff` (check + format --check), `make ruff-fix`, and `make lint` as its alias, and makes `make test` run lint as a fourth parallel spur. The CI workflow calls `make test`, so it is covered there too. The linter is pinned in a `lint` extra: a ruff minor bump changes which rules fire, and with the suite gating on a clean run an unpinned linter would fail it on an unrelated day. The 45 findings are fixed rather than configured away. Three needed a decision instead of the mechanical fix: - The generation timestamp keeps its local wall clock (DTZ005 waived). Generations sort by that name, and UTC would order new ones before the existing ones wherever the offset is positive - "newest generation" is what every restore path selects on. - The per-volume `copy` closure now binds volume_name and vol_dir as default arguments (B023). It only worked because it is called inside the same iteration. - The two CLI top-level handlers keep their blind except (BLE001 waived): turning any failure into exit 1 is what a CLI boundary is for. The two in run.py did not need it and were narrowed to what they actually catch. Also drops the comments that restate the code: the section banners in restore/__main__.py, the filename repeated as line 1 of nine test files, step narration above the statement it narrates, and a block in app.py documenting parameters that had moved to another module. What names a trip-wire stays - the snapshot destination rule, the mysql-binary absence in MariaDB 11 images, the session-scoped FOREIGN_KEY_CHECKS, the spooled temp file for multi-GB dumps, and the negative control that loses its discriminating power if it ever passes. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
73 lines
2.1 KiB
Python
73 lines
2.1 KiB
Python
import tempfile
|
|
import unittest
|
|
from unittest.mock import patch
|
|
|
|
import pandas
|
|
|
|
from baudolo.backup import db as db_mod
|
|
|
|
|
|
def _df(rows):
|
|
return pandas.DataFrame(
|
|
rows, columns=["instance", "database", "username", "password"]
|
|
)
|
|
|
|
|
|
def _capture_commands(*, db_type, rows, container):
|
|
captured = []
|
|
|
|
def _capture(cmd):
|
|
captured.append(cmd)
|
|
return []
|
|
|
|
with (
|
|
tempfile.TemporaryDirectory() as td,
|
|
patch.object(db_mod, "execute_shell_command", side_effect=_capture),
|
|
):
|
|
db_mod.backup_database(
|
|
container=container,
|
|
volume_dir=td,
|
|
db_type=db_type,
|
|
databases_df=_df(rows),
|
|
database_containers=[container],
|
|
)
|
|
return captured
|
|
|
|
|
|
class TestMariaDBDumpUsesTCP(unittest.TestCase):
|
|
# Regression guard for 'Access denied for user <user>@localhost' when only
|
|
# '<user>'@'%' is granted: the in-container mariadb-dump MUST force TCP so
|
|
# the connection is auth-matched against '%' instead of socket->localhost.
|
|
|
|
def test_mariadb_dump_forces_tcp_loopback(self):
|
|
captured = _capture_commands(
|
|
db_type="mariadb",
|
|
rows=[("mariadb", "appdb", "appuser", "s3cret")],
|
|
container="mariadb",
|
|
)
|
|
dump_cmds = [c for c in captured if "mariadb-dump" in c]
|
|
self.assertEqual(
|
|
len(dump_cmds), 1, f"expected one dump command, got: {captured}"
|
|
)
|
|
|
|
cmd = dump_cmds[0]
|
|
self.assertIn("-h 127.0.0.1", cmd)
|
|
self.assertIn("--protocol=tcp", cmd)
|
|
self.assertIn("-u appuser", cmd)
|
|
self.assertIn("-ps3cret", cmd)
|
|
self.assertIn(" appdb", cmd)
|
|
|
|
def test_postgres_dump_unaffected(self):
|
|
captured = _capture_commands(
|
|
db_type="postgres",
|
|
rows=[("pg", "appdb", "appuser", "s3cret")],
|
|
container="pg",
|
|
)
|
|
dump_cmds = [c for c in captured if "pg_dump" in c and "pg_dumpall" not in c]
|
|
self.assertEqual(len(dump_cmds), 1)
|
|
self.assertNotIn("--protocol=tcp", dump_cmds[0])
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main(verbosity=2)
|