Phases 5, 6, 8: OCI pull/push paths and admin REST API

Phase 5 (OCI pull): internal/oci/ package with manifest GET/HEAD by tag/digest, blob GET/HEAD with repo membership check, tag listing with OCI pagination, catalog listing. Multi-segment repo names via parseOCIPath() right-split routing. DB query layer in internal/db/repository.go. Phase 6 (OCI push): blob uploads (monolithic and chunked) with uploadManager tracking in-progress BlobWriters, manifest push implementing full ARCHITECTURE.md §5 flow in a single SQLite transaction (create repo, upsert manifest, populate manifest_blobs, atomic tag move). Digest verification on both blob commit and manifest push-by-digest. Phase 8 (admin REST): /v1 endpoints for auth (login/logout/health), repository management (list/detail/delete), policy CRUD with engine reload, audit log listing with filters, GC trigger/status stubs. RequireAdmin middleware, platform-standard error format. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-19 18:25:18 -07:00
parent f5e67bd4aa
commit dddc66f31b
40 changed files with 6832 additions and 7 deletions
--- a/internal/server/admin_gc_test.go
+++ b/internal/server/admin_gc_test.go
@@ -0,0 +1,94 @@
+package server
+
+import (
+	"encoding/json"
+	"testing"
+)
+
+func TestAdminTriggerGC(t *testing.T) {
+	database := openAdminTestDB(t)
+	router, _ := buildAdminRouter(t, database)
+
+	rr := adminReq(t, router, "POST", "/v1/gc", "")
+	if rr.Code != 202 {
+		t.Fatalf("status: got %d, want 202; body: %s", rr.Code, rr.Body.String())
+	}
+
+	var resp gcTriggerResponse
+	if err := json.NewDecoder(rr.Body).Decode(&resp); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	if resp.ID == "" {
+		t.Fatal("expected non-empty GC ID")
+	}
+}
+
+func TestAdminTriggerGCConflict(t *testing.T) {
+	database := openAdminTestDB(t)
+	router, _ := buildAdminRouter(t, database)
+
+	// First trigger should succeed.
+	rr := adminReq(t, router, "POST", "/v1/gc", "")
+	if rr.Code != 202 {
+		t.Fatalf("first trigger status: got %d, want 202", rr.Code)
+	}
+
+	// Second trigger should conflict because GC is still "running".
+	rr = adminReq(t, router, "POST", "/v1/gc", "")
+	if rr.Code != 409 {
+		t.Fatalf("second trigger status: got %d, want 409; body: %s", rr.Code, rr.Body.String())
+	}
+}
+
+func TestAdminGCStatus(t *testing.T) {
+	database := openAdminTestDB(t)
+	router, _ := buildAdminRouter(t, database)
+
+	// Before triggering GC.
+	rr := adminReq(t, router, "GET", "/v1/gc/status", "")
+	if rr.Code != 200 {
+		t.Fatalf("status: got %d, want 200", rr.Code)
+	}
+
+	var resp gcStatusResponse
+	if err := json.NewDecoder(rr.Body).Decode(&resp); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	if resp.Running {
+		t.Fatal("expected running=false before trigger")
+	}
+
+	// Trigger GC.
+	rr = adminReq(t, router, "POST", "/v1/gc", "")
+	if rr.Code != 202 {
+		t.Fatalf("trigger status: got %d, want 202", rr.Code)
+	}
+
+	// After triggering GC.
+	rr = adminReq(t, router, "GET", "/v1/gc/status", "")
+	if rr.Code != 200 {
+		t.Fatalf("status: got %d, want 200", rr.Code)
+	}
+
+	if err := json.NewDecoder(rr.Body).Decode(&resp); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	if !resp.Running {
+		t.Fatal("expected running=true after trigger")
+	}
+}
+
+func TestAdminGCNonAdmin(t *testing.T) {
+	database := openAdminTestDB(t)
+	router := buildNonAdminRouter(t, database)
+
+	rr := adminReq(t, router, "POST", "/v1/gc", "")
+	if rr.Code != 403 {
+		t.Fatalf("trigger status: got %d, want 403", rr.Code)
+	}
+
+	rr = adminReq(t, router, "GET", "/v1/gc/status", "")
+	if rr.Code != 403 {
+		t.Fatalf("status status: got %d, want 403", rr.Code)
+	}
+}