CyberCoveLLC/Triple-C
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases 35 Wiki Activity

Make a rollback pin outliving its project visible and deletable

Browse Source 
`survey_rollback_pins` walks images, not projects, and deliberately
tolerates an absent project by falling back to the raw id as the display
name. Two things then dropped it on the floor: `destroy` called
`find_project` before the confirmation check, so it refused such a pin
every time, and the per-project table joins destructive items to rows by
project_id, where rows come only from projects in the store. The result
was a multi-GB `pre-migration-*` image that the scan measured, the panel
never rendered, and nothing could remove — in the one screen built to
find exactly that.

`destroy` takes the same early return `OrphanVolume` already takes, and
still validates the tag: `latest` names the project's live snapshot, so
the ownerless path must not be a way around that check.

The UI grows a bucket for destructive items matching no row, rather than
filtering them away. The typed gate already compared against the id via
`project_name`; the dialog now says "project id" instead of asking for a
project name that no longer exists.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GBq2rGum6GX7xXgsas1fDc
This commit is contained in:
shadow-test
2026-08-23 12:18:04 -07:00
co-authored by Claude Opus 5
parent 6b8d43414d
commit 4f6c012071
4 changed files with 244 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/src-tauri/src/docker/disk.rs
+66
View File
@@ -3035,6 +3035,52 @@ async fn reclaim_containers(
/// the typed confirmation is permission to act, not a promise that the world
/// stood still. Both of those re-checks predate the move to the destructive
/// path and are deliberately unchanged.
/// Drop a rollback pin whose project is no longer in `projects.json`.
///
/// The owned case ([`destroy`]'s `RollbackPin` arm) takes the project's claim
/// and clears the ownerless marker. Neither applies here: there is no project
/// to claim, and nothing else can be mid-operation on an id the store does not
/// know. What *does* still apply is the tag validation — this is the one
/// destructive variant carrying a free-form string over IPC, and `latest` would
/// name a live snapshot rather than a pin.
async fn destroy_ownerless_rollback_pin(
project_id: &str,
tag: &str,
) -> Result<ReclaimResult, String> {
if migration::parse_rollback_tag(tag).is_none() {
return Err(format!(
"{:?} is not a rollback pin tag. Nothing was removed.",
tag
));
}
let reference = format!("triple-c-snapshot-{}:{}", project_id, tag);
migration::untag_image(&reference).await?;
// The grace clock is meaningless once the tag is gone, and the marker file
// would otherwise outlive everything that could ever read it.
migration_store::clear_ownerless(project_id, tag);
// Untagging only makes the image dangling; the sweep applies its own
// refusal rules to whatever that turns out to be.
let sweep = container::sweep_orphaned_snapshots().await;
log::info!(
"Dropped ownerless rollback pin {} on explicit confirmation",
reference
);
Ok(ReclaimResult {
target: None,
destroyed: Some(DestructiveTarget::RollbackPin {
project_id: project_id.to_string(),
tag: tag.to_string(),
}),
ok: true,
freed_bytes: sweep.reclaimed_bytes,
projected_bytes: None,
message: format!(
"Dropped rollback pin {} for a project that is no longer in Triple-C.",
tag
),
})
}
async fn destroy_orphan_volume(name: &str, projects: &[Project]) -> Result<ReclaimResult, String> {
let docker = get_docker()?;
@@ -3772,6 +3818,26 @@ pub async fn destroy(
return destroy_orphan_volume(name, projects).await;
}
// **A rollback pin can outlive the project it belongs to.**
// `survey_rollback_pins` walks *images*, not projects, and deliberately
// tolerates an absent project by falling back to the raw id as the display
// name. So a pin left by a project the user has since deleted is measured
// and listed — and `find_project` below would refuse it on every attempt,
// making a multi-GB image permanently undeletable through the panel that
// exists to find exactly that. Take the same early return `OrphanVolume`
// takes, confirming against the subject the UI actually showed: the id.
if let DestructiveTarget::RollbackPin { project_id, tag } = target {
if find_project(projects, target.project_id()).is_err() {
if !confirmation_matches(project_id, confirmation) {
return Err(format!(
"This pin's project is no longer in Triple-C, so there is no name to type. Type the project id ({}) exactly to confirm. Nothing was removed.",
project_id
));
}
return destroy_ownerless_rollback_pin(project_id, tag).await;
}
}
let project = find_project(projects, target.project_id())?;
if !confirmation_matches(&project.name, confirmation) {
return Err(format!(
app/src-tauri/src/docker/disk_tests.rs
+45
View File
@@ -1547,3 +1547,48 @@ async fn compaction_end_to_end_against_a_real_image() {
probe.stdout
);
}
#[tokio::test]
async fn an_ownerless_rollback_pin_is_confirmed_against_its_id_not_a_project_name() {
// `survey_rollback_pins` walks images, not projects, so a pin outlives the
// project that made it. Before the early return, `destroy` called
// `find_project` first and refused such a pin every single time — a
// multi-GB image measured by the panel and deletable by nothing in it.
let projects: Vec<Project> = Vec::new();
let target = DestructiveTarget::RollbackPin {
project_id: "dead0000-0000-0000-0000-000000000000".to_string(),
tag: "pre-migration-20260101-101500".to_string(),
};
// The wrong subject is refused, and the message says what to type instead
// of the "project not found" the old path produced.
let err = destroy(&target, "some-project-name", &projects)
.await
.expect_err("a mismatched confirmation must refuse");
assert!(
err.contains("dead0000-0000-0000-0000-000000000000"),
"the refusal should name the id to type, got: {}",
err
);
assert!(err.contains("Nothing was removed"));
}
#[tokio::test]
async fn an_ownerless_rollback_pin_still_refuses_a_tag_that_is_not_a_pin() {
// The tag is the one free-form string a destructive target carries, and
// `latest` names the project's live snapshot. The owned arm validates it;
// the ownerless arm must not be the way around that check.
let projects: Vec<Project> = Vec::new();
let target = DestructiveTarget::RollbackPin {
project_id: "dead0000-0000-0000-0000-000000000000".to_string(),
tag: "latest".to_string(),
};
let err = destroy(&target, "dead0000-0000-0000-0000-000000000000", &projects)
.await
.expect_err("`latest` is not a rollback pin tag");
assert!(
err.contains("not a rollback pin tag"),
"got: {}",
err
);
}
app/src/components/settings/DiskSettings.test.tsx
+62
View File
@@ -492,6 +492,68 @@ describe("DiskSettings", () => {
expect(await screen.findByTestId("disk-orphan-bucket")).toBeInTheDocument();
});
it("shows a rollback pin whose project is gone, instead of dropping it", async () => {
// `survey_rollback_pins` walks images, not projects, and falls back to the
// raw id when the project is absent. The per-project table joins
// destructive items to rows by `project_id`, and rows come only from
// projects in the store — so before the unmatched bucket, such a pin was
// measured by the scan and rendered nowhere at all. A multi-GB image the
// panel knew about and offered no way to remove.
const ownerlessPin: DestructiveItem = {
target: {
kind: "rollback_pin",
project_id: "dead0000-0000-0000-0000-000000000000",
tag: "pre-migration-20260101-101500",
},
project_id: "dead0000-0000-0000-0000-000000000000",
// The Rust falls back to the id, and it is what `destroy` compares
// against — so this is the string the user has to type.
project_name: "dead0000-0000-0000-0000-000000000000",
label: "Rollback pin pre-migration-20260101-101500",
loses: "The only copy of that migration's rollback target.",
bytes: 5_400_000_000,
blocked: null,
};
listReclaimable.mockResolvedValue(plan({ destructive: [ownerlessPin] }));
await renderAndScan();
const bucket = await screen.findByTestId("disk-unmatched-bucket");
expect(within(bucket).getByText(/Rollback pin pre-migration-20260101-101500/)).toBeInTheDocument();
// And it is not silently folded into the project table.
const table = screen.queryByTestId("disk-project-table");
if (table) {
expect(table.textContent).not.toMatch(/pre-migration-20260101-101500/);
}
});
it("asks for the project id, not a project name, when there is no project", async () => {
// The gate compares against `project_name`, which is the raw id here. That
// works — but a dialog captioned "type the project name" for a project that
// no longer exists asks for something the user cannot supply.
const ownerlessPin: DestructiveItem = {
target: {
kind: "rollback_pin",
project_id: "dead0000-0000-0000-0000-000000000000",
tag: "pre-migration-20260101-101500",
},
project_id: "dead0000-0000-0000-0000-000000000000",
project_name: "dead0000-0000-0000-0000-000000000000",
label: "Rollback pin pre-migration-20260101-101500",
loses: "The only copy of that migration's rollback target.",
bytes: 5_400_000_000,
blocked: null,
};
listReclaimable.mockResolvedValue(plan({ destructive: [ownerlessPin] }));
await renderAndScan();
const bucket = await screen.findByTestId("disk-unmatched-bucket");
fireEvent.click(within(bucket).getByRole("button", { name: /Delete/ }));
const dialog = await screen.findByRole("dialog");
expect(dialog.textContent).toMatch(/project id/i);
expect(dialog.textContent).not.toMatch(/type the project name/i);
});
it("keeps orphaned volumes out of the per-project table", async () => {
// The table keys off `project_id`, and an orphan's id matches no row by
// definition. Passing them in anyway is how one would leak into the wrong
app/src/components/settings/DiskSettings.tsx
+71 -2
View File
@@ -105,7 +105,18 @@ export default function DiskSettings() {
// moved from the tick list to the destructive list can vanish from the UI
// entirely rather than reappear behind a confirmation.
const orphanVolumes = plan?.destructive.filter(isOrphanVolume) ?? [];
const projectDestructive = plan?.destructive.filter((d) => !isOrphanVolume(d)) ?? [];
// A destructive item is rendered inside its project's row, so one whose
// project id matches no row would be measured and shown nowhere. That is not
// hypothetical: `survey_rollback_pins` walks *images*, not projects, and
// deliberately tolerates an absent project by falling back to the raw id as
// the display name — so a pin left behind by a deleted project is exactly
// this case, and it is the multi-GB kind. Anything unmatched gets its own
// section rather than being silently dropped.
const rowIds = new Set((report?.projects ?? []).map((r) => r.project_id));
const projectDestructive =
plan?.destructive.filter((d) => !isOrphanVolume(d) && rowIds.has(d.project_id)) ?? [];
const unmatchedDestructive =
plan?.destructive.filter((d) => !isOrphanVolume(d) && !rowIds.has(d.project_id)) ?? [];
const safeItems = plan?.items.filter((i) => i.safety === "safe") ?? [];
const semiItems = plan?.items.filter((i) => i.safety === "semi_safe") ?? [];
@@ -495,6 +506,58 @@ export default function DiskSettings() {
</section>
)}
{/* --- Destructive leftovers with no project row ------------------- */}
{unmatchedDestructive.length > 0 && (
<section className="space-y-2" data-testid="disk-unmatched-bucket">
<h3 className="text-[13px] font-medium text-[var(--text-primary)]">
Leftovers from projects no longer in Triple-C
</h3>
<p className="text-xs text-[var(--text-secondary)] leading-relaxed">
These belong to a project id that is not in your project list, so there
is no row above to show them under. The same caveat as the volumes below
applies: &ldquo;not in your project list&rdquo; is the only thing this
means, and an idle live project is indistinguishable from a deleted one
from Docker&rsquo;s side. Because there is no project name to type, each
one is confirmed against its project <em>id</em>.
</p>
<ul className="space-y-1.5">
{unmatchedDestructive.map((item) => (
<li
key={destructiveKey(item)}
className="flex items-start justify-between gap-3"
data-testid={`disk-unmatched-${destructiveKey(item)}`}
>
<span className="flex-1 min-w-0">
<span className="block text-[var(--text-primary)] font-mono break-all">
{item.label}
</span>
<span className="block text-xs text-[var(--text-secondary)] leading-snug">
{item.loses}
</span>
{item.blocked && (
<span className="block text-xs text-[var(--text-secondary)]">
{item.blocked}
</span>
)}
</span>
<span className="flex items-center gap-2 whitespace-nowrap">
<span className="text-xs text-[var(--text-secondary)] tabular-nums">
{formatBytes(item.bytes)}
</span>
<Button
size="sm"
disabled={item.blocked !== null || working}
onClick={() => openDestroying(item)}
>
Delete&hellip;
</Button>
</span>
</li>
))}
</ul>
</section>
)}
{/* --- Orphaned volumes: destructive, one at a time ---------------- */}
{orphanVolumes.length > 0 && (
<section className="space-y-2" data-testid="disk-orphan-bucket">
@@ -704,6 +767,12 @@ export default function DiskSettings() {
// case-sensitive and a mangled name in the heading is a name the user
// cannot type.
const orphan = isOrphanVolume(destroying);
// A leftover whose project is gone has no name either. `project_name`
// is the raw id in that case — which is deliberate on the Rust side and
// is exactly what `destroy` compares against — so the gate works, but
// the label has to say "id" or it asks for something that does not
// exist.
const ownerless = !orphan && !rowIds.has(destroying.project_id);
return (
<TypedConfirmModal
title={
@@ -712,7 +781,7 @@ export default function DiskSettings() {
: `Delete ${destroying.label.toLowerCase()}`
}
expected={destroying.project_name}
subject={orphan ? "volume name" : "project name"}
subject={orphan ? "volume name" : ownerless ? "project id" : "project name"}
confirmLabel={orphan ? "Delete volume" : `Delete ${destroying.label.toLowerCase()}`}
busy={working}
// A failure here has to land inside the dialog. The panel's own